[bokelley]

Forward-merge the published v3.2.4 maintenance release (origin/3.2.x @ 5e6c4b01113237234b440b6c95adb8c6e0a07ca9, the #8144 Version Packages merge) into main, as a true merge commit that preserves the 3.2.x ancestry. This is the manual recipe in .agents/playbook.md § Release lines: the automatic forward-merge cannot run because the earlier 3.2.2/3.2.3 forward merges (#7918, #7997) were squash-merged, so the new merge re-conflicts on 69 paths.

What lands on main

Net diff vs main: 2,213 added files and 7 modified.

• Added, immutable release records: dist/schemas/3.2.4/ (1,625 files), dist/compliance/3.2.4/ (584), and the signed tuple dist/protocol/3.2.4.tgz{,.sha256,.sig,.crt}.
• Modified release records: CHANGELOG.md (3.2.4 block), docs/reference/release-notes.mdx (3.2.4 section), dist/schemas/index.json and dist/schemas/latest.json (3.2/3.x aliases and latest_stable now 3.2.4; main's newer 3.1.27/3.0.27 aliases kept), static/compliance/published-versions.json (+3.2.4).
• static/compliance/source/test-vectors/request-signing/negative/026-non-ascii-host.json: comment now says the correction shipped in 3.2.4 and is carried on 3.3 (bytes of the signed vector are unchanged).
• server/tests/unit/storyboards.test.ts: the hosted 3.2 alias now resolves to 3.2.4; exact 3.2.3 and 3.2.4 pins load their own bundles through the hosted SDK.

Main keeps its package/lock/schema-index version (3.2.1 pre-release state), pending 3.3 changesets and pre-mode, docs navigation, .dockerignore, Addie's DOCS_SCHEMA_RELEASES and all 3.3 source. The 3.2.4 docs snapshot is the separate bot PR #8150 and is not in this diff. No protocol changeset (forward-merge branch prefix skips the check).

Immutable-byte evidence (no resigning, no regeneration)

• All 2,213 added blobs are identical to the blobs at tag v3.2.4 (git ls-tree -r vs the merge index); tag v3.2.4^{} = 5e6c4b01… = the merged 3.2.x tip.
• The four tuple assets match, byte for byte, the GitHub Release assets and the official CDN (https://adcontextprotocol.org/protocol/3.2.4.tgz*, fetched with a curl UA; the default urllib UA gets a 403):
  3.2.4.tgz 23,463,422 B d5a0b167b323e5ee05ac2c8da9ca01c46a5cb5a7b988570f40f746bb8b15ae76; .sha256 76 B 0e038fc515a117426c22ba1245cffe823bedc209e36a9f81746c902ede529764; .sig 96 B 0cf40f20d768172cd98e54464624b7684846d3dcc6849df31f0ffcae08b56ac3; .crt 2,476 B 34d8d052bc50b8a821d8cf1e4d8ec51d5df2cc256bb13b4a649e9ee119d90aad.
• sha256sum -c passes and cosign verify-blob passes against identity https://github.com/adcontextprotocol/adcp/.github/workflows/release.yml@refs/heads/3.2.x, issuer https://token.actions.githubusercontent.com.
• The tarball's schemas/ and compliance/ trees match the committed dist trees except the generated_at timestamps in schemas/manifest.json and compliance/index.json, which are as published.

Conflict resolution (all 69 reviewed)

• 49 conflicted source/docs/vector files are unchanged between v3.2.3 and v3.2.4 (their 3.2.x side is the 3.2.3 content that chore(release): forward-merge 3.2.3 release records #7997 already reconciled), so main's reviewed blob stays. This is not a blanket --ours: each was checked against git diff v3.2.3 origin/3.2.x.
• 8 files in the 3.2.3→3.2.4 delta were reviewed hunk by hunk. Main already carries every 3.2.4 addition, verbatim or as an evolved superset (REVISION_UNREADABLE text with main's compaction rules, the channels row, the principal walkthrough link). The only text taken from 3.2.x is the 026 vector note above.
• package.json, package-lock.json and static/schemas/source/index.json were restored to main's values after the textual merge took the 3.2.4 version. docs.json, .dockerignore, schema-tools.ts stay main's.

Validation

• Independent read-only audit by a Sonnet protocol-expert agent: net diff, no 3.2.4 content missing from main, metadata consistency, byte identity of all 2,213 artifacts, and no 3.2-only wording over 3.3 semantics all passed.
• Local pre-commit hook passed on the merge commit and on the test follow-up, each run alone (1,106 root unit tests, guards, full server unit suite, typecheck). Pre-push docs validation passed (49/49 navigation checks). The local storyboard matrix was stopped after ~55 minutes in the /sales tenant on this loaded sandbox and the documented ADCP_SKIP_STORYBOARD_MATRIX=1 option was used; the matrix is advisory and CI training-agent-storyboards is authoritative and must be green on the final head.
• Hosted-target storyboards test: 60/60.

Review and maintainer instruction

On 2026-10-13 the maintainer requested: “8153 is blocked can we get it clean & out”. That instruction authorizes fixing the blockers and landing this published release. It is not a GitHub APPROVED review; the exact final head still needs fresh review and green checks before merge. The content-conflict audit above remains available for that review.

Follow-ups, not in this PR: the frozen docs snapshot #8150 needs this PR and the snapshot-extraction fix (separate PR) before it can be regenerated.

🤖 Generated with Claude Code

---

Open workspace in Conductor

Runtime image blocker repair (2026-10-13)

The original Production docs index smoke failed because /app was 7,491 MiB against the existing 7,424 MiB disk guard. Image assembly now hard-links byte-identical immutable schema, compliance, and configured docs snapshot files before copying them into the runtime image. This retains every published path and byte, excludes mutable latest output and symlinks, preserves permissions/ownership, verifies bytes before linking, and fails the build on an unsuccessful replacement. The disk guard is unchanged. Generated .addie-repos is excluded from the build context; the authoritative repos stage still populates the runtime cache.

Current main was merged into this PR without conflicts so the release is tested with the latest platform changes while preserving the original 3.2.x merge ancestry.

Fresh verification: all 2,213 added release files match v3.2.4 by Git blob; all four protocol tuple files match the GitHub Release downloads; checksum and official release-workflow cosign verification pass. Seven storage controls pass (path/byte preservation, idempotence, mutable-output isolation, permissions and symlink handling, failed-replacement path preservation, and byte/symlink substitution rejection); all 60 hosted-bundle tests pass with the pinned SDK; the published-compliance manifest check passes. A Docker multi-stage control confirms COPY preserves the hard links. Normal repository hooks passed: 12,562 server unit tests (31 intentional skips), 1,113 root unit tests on the final working tree, boundary guards, and TypeScript checks. Full production-image smoke and final-head CI remain authoritative.

Release decision provenance and measured production image

The stable cut was human-approved on Version Packages #8144 (bokelley, APPROVED at head 60800c7dec3283d1da067eaef35347f6bb6bead7), merged on 2026-10-12, and published as signed tag v3.2.4 (5e6c4b01113237234b440b6c95adb8c6e0a07ca9) at 09:29:41 UTC. This PR imports the exact published records; it does not make a new release cut or republish them.

Historical head 3682e6c74c164159dc70d3f99c9ee19e55b73f51 Production Docker build, including external repo clones, passed: 7,163 MiB against the unchanged 7,424 MiB guard. Image assembly saves 293,302,721 content bytes. No release bytes or paths are removed.

CodeQL filesystem-race fix

Fix commit 3682e6c74c164159dc70d3f99c9ee19e55b73f51 fixes the inline CodeQL finding at the original helper line 58. All content reads use an opened descriptor with O_NOFOLLOW; fstat and byte reads refer to that same inode. After creating a temporary hard link, the helper opens that actual link, verifies its complete bytes, permissions, and ownership, and only then atomically replaces the destination. Cleanup no longer checks a pathname before unlinking it. New controlled races substitute different bytes or a symlink during link creation and prove the published destination remains unchanged and the temporary link is removed. All seven storage controls, 1,113 root tests, guards, and type checks pass. Server source and the previously passing 12,562 server tests are unchanged. Fresh final-head CI and review are required.

The governance reassessment attempt failed before running the reviewer because GitHub pulls.listFiles closed its connection. It produced no new verdict. The upstream human-approved stable-cut evidence above remains available for the fresh review.

Latest main integration

Current head is 64643608a151c93a69ce84ab627d447ed014d09e, incorporating main d89129e884c4ea3acbd01d79747603f76ac6cd8f (#7496). The merge preserves both image-size repairs: builder hard-link deduplication, followed by main's disposable runtime-schema closure. Git release records stay immutable and all 2,213 imported release blobs still match v3.2.4. The runtime closure retains all 49 published compliance/schema pairs, including 3.2.4, all four configured docs snapshots, current aliases, and the retained training anchors. Main's unused schema history is omitted only from the Fly runtime copy; public Git/R2 release records remain intact. The original deduplication statement above describes the builder stage, not a guarantee that every historical schema stays in the final Fly image after #7496.

Fresh local checks on this head: eight pruning/closure controls and all seven descriptor/link controls pass. Both complete image/smoke checks and the full CI matrix restarted for this new head. Earlier image sizes and passing CI are historical evidence, not transferred final-head qualification. The resolved CodeQL fix is unchanged. The independent human GitHub approval requirement remains unsatisfied; no review or branch-protection bypass has been performed.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — forward-merge of published 3.2.4 release requires human/CODEOWNERS ratification.

This PR forward-merges the published 3.2.4 maintenance release into main: 2,213 added files under dist/schemas/3.2.4/, dist/compliance/3.2.4/, and dist/protocol/3.2.4.*, verified byte-identical to tag v3.2.4 (tree hashes c02d4567/5a82d524 and the four tuple blob hashes match 5e6c4b0). No existing semver artifact is modified or deleted, preserving release-artifact immutability. The 7 modified files (index.json/latest.json alias bumps keeping main's 3.1.27/3.0.27, CHANGELOG/release-notes 3.2.4 blocks, published-versions +3.2.4, a comment-only 026 vector with signed bytes unchanged, storyboards.test.ts) are internally consistent.

The reviewer surfaced no Critical/High/Medium code-correctness findings. However, the repo's governance bar treats a forward-merge of a published release as a human act requiring ratification, and review_decision is REVIEW_REQUIRED (not APPROVED). Under the prose-based hard gate, this release-governance decision cannot be auto-approved absent human/CODEOWNERS approval. No destructive change is present and high_risk is driven entirely by (added) files, which is normal release scaffolding — so the escalation is governance-driven, not defect-driven.

Escalation reasons

• Forward-merge of the published 3.2.4 release into main is a release-governance decision requiring explicit human/CODEOWNERS ratification; review_decision is REVIEW_REQUIRED, not APPROVED.

Why human review

• Forward-merge of published release v3.2.4 into main is a release-governance decision that requires explicit human/CODEOWNERS ratification; review_decision is REVIEW_REQUIRED, not APPROVED. Diff is mechanically clean (artifacts byte-identical to tag v3.2.4, no existing semver artifact modified/deleted) but ratification is a human act.

[bokelley]

Addressing the release-governance review: the maintainer now explicitly requested in the current session, “8153 is blocked can we get it clean & out”. That authorizes cleanup and landing; this comment does not represent a GitHub APPROVED review. Please assess the final head 411818236c659f773ef50c97d43cd51500e3205d with that instruction and the conflict-resolution audit retained in the PR description.

The new merge includes current main without content conflicts. All 2,213 release records still match v3.2.4; downloaded release tuple bytes, checksum, and official release-workflow cosign verification all pass. No existing semver artifact is changed or deleted. The additional repair is image assembly only: hard-link identical immutable files before Docker COPY, leaving mutable output independent and keeping the 7,424 MiB guard. Five focused controls and a real multi-stage Docker COPY control pass. All 60 pinned-SDK hosted-bundle tests, 12,562 server unit tests, 1,111 root tests, guards, and type checks pass.

The failed original image smoke is repaired in code; final-head CI must verify the full image. The five failure annotations in the passing canonical release-fixture suite are deliberate assert.throws negative cases (four ancestry violations and one untracked publication file). Deprecated App-input and preview-banner notices are existing maintenance items. Full-diff truncation warnings are covered by the complete local Git blob audit of every added release record, rather than reliance on the truncated API patch. The trusted-base, read-only Ladon invocation warning is the configured workflow posture. There are no inline comments or unresolved review threads.

Merge method must be merge, preserving 3.2.x ancestry; do not squash this forward merge.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — release-governance ratification required.

PR #8153 forward-merges the immutable 3.2.4 release records into main. The reviewer confirms a clean pass: no Critical/High/Medium findings. The authored delta since the prior clean review (a Docker runtime-image dedup script scoped to immutable semver dirs, with content-equality verification, symlink skipping, idempotency, and fail-closed link/rename semantics) was reviewed closely and preserves the immutability invariant — adopters pinning dist/<semver>/ still get byte-identical content. No existing semver artifact is modified or deleted.

Why escalate rather than approve: this PR embodies a release-governance / breaking-class publication decision (forward-merge of a published release line into main). The repo's constitution treats ratification of a release as a human act, never auto-approved unless review_decision is APPROVED. Here review_decision is REVIEW_REQUIRED, so the prose hard gate's escalation instruction stands. The prior decision was also escalate for exactly this reason. Although the reviewer surfaced no fresh critical/high/medium findings (so row 6's sticky condition is not independently met), the standing prose governance gate for breaking/release-class changes applies on its own and requires human/CODEOWNERS ratification before merge.

All dist/** entries are (added) — new immutable artifacts, not modifications or deletions — so the high-risk flag alone is not the trigger; the release-ratification gate is.

Escalation reason: forward-merge of published release v3.2.4 into main is a release-governance decision requiring explicit human/CODEOWNERS ratification; review_decision is REVIEW_REQUIRED, not APPROVED.

Why human review

• Forward-merge of published release v3.2.4 into main is a release-governance / breaking-class publication decision that requires explicit human/CODEOWNERS ratification; review_decision is REVIEW_REQUIRED, not APPROVED. Diff is mechanically clean (artifacts byte-identical to tag v3.2.4, no existing semver artifact modified or deleted; the sole authored change is a fail-closed Docker dedup script that preserves immutability), but ratification is a human act per the constitution's hard gate on breaking/release-class changes.

[bokelley]

The final-head review found no code defects, but classifies this forward merge as a new breaking-class publication decision. There is a concrete distinction to reassess:

• The stable-cut decision has already been human-approved: Version Packages #8144 has bokelley's APPROVED review on 60800c7dec3283d1da067eaef35347f6bb6bead7, was merged on 2026-10-12, and produced release commit/tag 5e6c4b01113237234b440b6c95adb8c6e0a07ca9 / v3.2.4. The signed release was published at 2026-10-12 09:29:41 UTC. This PR imports those exact already-published records; it neither cuts nor republishes a release.
• The net source diff against current main introduces no removed/renamed identifier, requiredness change, new wire field, or changed wire semantics. The only compliance-source change is a comment about the 026 vector, with signed bytes unchanged. Package versions and prerelease state stay main's. Aliases advance to the verified published patch as documented by the publication manifest's hosted advancement policy; exact pins remain available.
• .agents/wg/constitution.md defines metadata-only changes as Editorial and names release go/no-go for RC and stable cuts as the release escalation. LADON.md's prose approval hard gate specifically concerns Breaking-class protocol changes. Please distinguish this integration from the already-ratified stable cut and identify any actual new Breaking-class decision if that classification still applies. No review policy, workflow, or branch protection is being changed or bypassed. The maintainer's instruction to clean and land this integration is recorded above; no GitHub approval is falsely claimed.

Fresh CI evidence: the production image including external repository clones builds at 7,163 MiB, below the unchanged 7,424 MiB guard. The image deduplication saved 293,302,721 content bytes; every published path remains present. Remaining checks are still running. Requesting a fresh assessment of this classification on the same head 411818236c659f773ef50c97d43cd51500e3205d.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — forward-merge of published release v3.2.4 into main requires human/CODEOWNERS ratification.

This PR publishes release artifacts for v3.2.4 under dist/compliance/3.2.4/** (plus a fail-closed Docker dedup script and two new rejection tests). The reviewer reports the diff is mechanically clean: added artifacts are byte-identical to tag v3.2.4, no existing semver artifact is modified or deleted, symlinks are excluded, and the dedup script fails closed with byte/mode/uid/gid verification before an atomic rename. No Critical/High/Medium findings.

However, a forward-merge of a published release is a Breaking/release-class publication decision. The constitution's hard gate ("Breaking-class changes are never auto-approved") requires explicit human ratification: escalate unless review_decision is APPROVED. Here review_decision is unknown/none, so the gate is NOT satisfied. The prior run also escalated on this same release-governance basis.

Escalation reasons

• Forward-merge publishing release v3.2.4 (dist/compliance/3.2.4/**) is a release-class / breaking-class publication decision that requires explicit human/CODEOWNERS ratification per the constitution's hard gate.
• review_decision is not APPROVED (unknown/none); the human-ratification gate is unsatisfied.

The sticky escalation (prior = escalate) persists here because the governance gate condition still holds; the diff remains clean with no new actionable findings, and the sole blocker is the human-ratification act.

Why human review

• Forward-merge publishing release v3.2.4 (dist/compliance/3.2.4/**) is a release-class/breaking-class publication decision requiring explicit human/CODEOWNERS ratification per the constitution's hard gate on breaking-class changes.
• review_decision is not APPROVED (unknown/none), so the human-ratification gate is not satisfied — human/CODEOWNERS review required before merge.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — release-class publication requires human/CODEOWNERS ratification.

This PR publishes stable release v3.2.4 by forward-merging into the release branch, adding the immutable versioned artifact tree under dist/compliance/3.2.4/** (2000+ added files). Per the repo constitution's hard gate, a release-class / breaking-class publication is never auto-approved — ratification is a human act — and must escalate unless review_decision is APPROVED.

Escalation reasons

• Forward-merge publishing release v3.2.4 (dist/compliance/3.2.4/**) is a release-class publication decision requiring explicit human/CODEOWNERS ratification per the constitution's hard gate on breaking/release-class changes.
• review_decision is REVIEW_REQUIRED (not APPROVED), so the human-ratification prose gate is not satisfied.
• Prior decision was escalate; the current run still presents the same release-publication evidence (the v3.2.4 artifact tree), so the escalation persists.

Findings: Reviewer reports a clean delta — the change since the prior head is #7496's runtime-artifact pruning already merged to main and pulled in via a clean merge; scripts/prune-runtime-artifacts.cjs is fail-closed (verify-before-prune ordering, verifyPrunedTree) and acts only on the Docker builder copy, leaving git/R2 release records immutable. No schema/source or changeset-surface changes, no critical/high/medium findings. Nonetheless the release remains a human-ratification gate.

Human/CODEOWNERS review required before merge.

Why human review

• Forward-merge publishing stable release v3.2.4 (dist/compliance/3.2.4/**) is a release-class publication requiring explicit human/CODEOWNERS ratification per the constitution's hard gate on breaking/release-class changes.
• review_decision is REVIEW_REQUIRED (not APPROVED) — the human-ratification prose gate is not satisfied.
• Prior decision was escalate and the same release-publication evidence (the v3.2.4 artifact tree) still exists in this run, so the escalation persists.