[bokelley]

Second DX slice for #3504 (T2 in the approved DX plan, section 2.2): revocation per adcp#8607. It stacks on #3542, which stacks on #3534 and the rest of the #3504 stack. Review only feat(reporting): wind down with windDownGrant instead of revoking. It targets main because CI runs only for PRs into main.

What changes

• windDownGrant(current?) and REPORTING_WIND_DOWN_TASKS in @adcp/sdk/server, both @experimental.
  • The grant is { allowed_tasks: ['get_reporting_status', 'sync_reporting_receipts', 'sync_reporting_status'], read_only: false }. read_only is false because receipts and statuses are writes.
  • REPORTING_WIND_DOWN_TASKS is a frozen tuple of those three tasks.
  • Use: account.authorization = windDownGrant(account.authorization). Coverage continues because the grant lists get_reporting_status (feat(reporting): owner-scoped subscription receipts and statuses; coverage follows the grant #3528's reportingSubscriptionCoverageGrantedV1).
• acceptsReceipt is gone. No doc, guide, example or TSDoc mentions it. feat(reporting): owner-scoped subscription receipts and statuses; coverage follows the grant #3528 deleted it, and its test still asserts the property is absent. The only remaining old text is in the generated 3.3.0-beta.1 types: the sync_reporting_receipts/sync_reporting_status request descriptions ("remain acceptable for status_retention_days"). Regenerating for beta.3 (T1) replaces it.
• Docs. The REPORTING-LEDGER.md subscription section now leads with "To end a relationship, wind down; don't revoke". The TSDoc on Account.authorization points to windDownGrant.
• Vectors. test/fixtures/reporting-subscriptions/grant-cases.json is new, written as data so the Python SDK can mirror it.
  • grant_cases: nine cases of the coverage grant rule. They cover no authorization object, the wind-down grant, get_reporting_status alone, four reduced grants without get_reporting_status, an empty list, and exact task-name matching.
  • transition_cases: five grant timelines run through the real engine. Each asserts isAuthorized, coverage, accounts_unauthorized and every owed period:
    • wind-down keeps every period, with no accounts_unauthorized entry;
    • a reduced grant without get_reporting_status ends coverage at the floor of its instant;
    • that owes exactly what a full revocation owes;
    • dropping get_reporting_status from a wind-down grant ends coverage then;
    • restoring it inside retention is a re-grant with a gap.
  • test/lib/reporting-subscription-wind-down.test.js runs them and tests the helper.

Deviations from the plan

• windDownGrant takes an optional argument. The plan shows windDownGrant(), and that call still works. Passing the current authorization keeps its authorized_at, because a reduced grant continues the chain and sellers advertising subscriptions MUST populate authorized_at. Without the argument, account.authorization = windDownGrant() would silently drop it from list_accounts. The old grant's field_scopes and scope_name describe the old task set, so they are dropped. The Python SDK needs the same argument: wind_down_grant(current=None).
• The vectors live in this repo's fixtures. The spec-repo vectors (X1, adcp#8616) have no grant or allowed_tasks cases, so they couldn't host these. They can move there with the coverage cases.

Checks

npm run typecheck, lint:boundaries, check:package-size (no new published files), Prettier, and the reporting-subscription, principal and reliable-reporting suites (336 tests).

Refs #3504

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Comment (human reviewer recommended)

Comment — 4 medium findings, no blocking issues; a human should review.

This PR adds AdCP 3.3 principal-level reporting subscriptions (87 files, ~31.5k lines) across producer, coverage engine, calendar math, ledger, service planning, consumer runtime, principal validation, Postgres store, and managed delivery. The reviewer found the implementation consistently fail-closed: principal/caller isolation enforced at listConfigurations filtering + SQL predicates + handler defense-in-depth, receipts/status admission threaded and refused at wiring time, bounded paginated walks and correction loops, wire fields emitted only when the served schema bundle defines them, and correct minor/experimental changesets plus the new @adcp/sdk/reporting/advanced subpath export. No critical/high findings, no witness-not-translator violations, no changeset gaps.

Decision path: No critical/high findings (row 1 skipped). gated_paths is false (row 2 n/a). high_risk is false (rows 3,5 n/a). No medium finding is in data-loss/schema/infra category — all four are correctness issues in subscription scheduling/ledger logic (row 4 n/a). No prior decision (row 6 n/a). No no-auto-approve team match (row 7 n/a). Three or more medium findings present → row 8 fires → comment.

Medium findings

• src/lib/server/principal/reporting-subscriptions.ts:357 — replace_account_configs retry dropped when one-shot flag omitted on a later sync
• src/lib/reporting/subscriptions/engine.ts:763 — action_required pending_action goes stale: settleExclusions never refreshes an open entry
• src/lib/reporting/subscriptions/engine.ts:1476 — last_owed_period_end fallback reads .at(-1) of an unsorted frozen.periods array
• src/lib/reporting/subscriptions/calendar.ts:236 — Sub-daily billing_cycle calendar silently drops period_anchor (midnight-aligned boundaries)

These four correctness concerns — particularly the stale pending_action and the dropped period_anchor — merit a human look before merge, though none rises to a blocking severity.

Medium findings

• src/lib/server/principal/reporting-subscriptions.ts:357 — replace_account_configs retry dropped when one-shot flag is omitted on a later sync
• src/lib/reporting/subscriptions/engine.ts:763 — action_required pending_action goes stale: settleExclusions never refreshes an open entry
• src/lib/reporting/subscriptions/engine.ts:1476 — last_owed_period_end fallback reads .at(-1) of an unsorted frozen.periods array
• src/lib/reporting/subscriptions/calendar.ts:236 — Sub-daily billing_cycle calendar silently drops period_anchor (midnight-aligned boundaries)

[aao-secretariat]

Ladon verdict: Approve

Approve — subsequent review, all four prior Medium findings resolved with tests; no current findings.

This push is a targeted 6-file / 229-line delta responding to the prior comment decision. Each prior Medium finding was addressed:

• calendar.ts:236 — sub-daily billing_cycle now refused per adcp#8622 before the sub-daily branch (period_anchor no longer silently dropped).
• engine.ts:1476 — .at(-1) on unsorted periods replaced with a max-scan latestPeriodEnd, confined to the withheld.length branch.
• engine.ts:763 — settleExclusions now refreshes an open action_required entry's pending_action via a real canonicalize (utils/jcs) compare, mutates the stored reference, and marks changed to notify.
• reporting-subscriptions.ts:357 — !== true flipped to === false so an omitted one-shot flag no longer drops a pending replace_account_configs retry.

Decision table: no critical/high (row 1 n/a); gated_paths false (row 2 n/a); high_risk false (rows 3/5 n/a); no medium findings (rows 4/8 n/a); prior decision was comment, not escalate, and there are zero new findings (row 6 n/a); no no-auto-approve team match (row 7 n/a). Falls through to row 9 → approve. Note: review_decision is REVIEW_REQUIRED, but that only gates approval when gated_paths is true (it is false here), so it does not block.

The merge-base changed after approval.