[bokelley]

Summary

AdCP 3.3.0-beta.3, X3 from the DX plan, owner-approved: a comply_test_controller scenario, reporting_subscription_probe (experimental, media_buy.reporting_subscriptions). Storyboards can use it to test reporting-subscription coverage across grants and cutovers against a remote seller. Today the reporting_subscriptions storyboard can't reach owed periods, grants or timezone changes, because a buyer can't drive them.

Operation	Params	Effect
revoke_grant	account_id	Ends the caller's authority at simulated_now. The account reads as unknown elsewhere and appears in accounts_unauthorized[].
regrant	account_id	Restores the grant. The chain continues if inside status_retention_days, otherwise a new chain starts. Returns chain and authorized_at/regranted_at.
reduce_grant	account_id, allowed_tasks (new param)	Models a wind-down or partial grant. Dropped tasks fail with SCOPE_INSUFFICIENT, and the account stays covered while get_reporting_status remains.
set_account_timezone	account_id, timezone (new param)	An applied account change. Returns previous_timezone and the per-offering effective_at cutovers.
advance_time	target_time (existing param)	Moves the one virtual clock forward and processes every crossed boundary as in production.

seed_media_buy already exists for buys. The probe acts only on the authenticated caller's own grant on sandbox accounts. The controller keeps accepting regrant and advance_time for an account the caller lost, while every other task treats that account as unknown. Responses are SimulationSuccess with simulated_now.

Files

• compliance/comply-test-controller-request.json: scenario description, operation enum values, a per-operation allOf block, and the new allowed_tasks and timezone params (experimental, x-added-in: 3.3.0)
• compliance/comply-test-controller-response.json: list-scenarios and simulation descriptions
• docs/building/by-layer/L3/comply-test-controller.mdx: new scenario section
• tests/reporting-subscription-probe.test.cjs (added to test:schemas) and the x-added-in sweep entries

Left for later

• The storyboard steps that use the probe (DX plan T17) and moving the SDKs' shared coverage vectors into static/compliance/source/test-vectors/.
• The regrant and reduce_grant results rely on regranted_at (feat(reporting): put flight history, re-grants, and offering availability on the wire #8618) and partial-grant behavior (feat(reporting): deterministic admission and resolution, overrides, paging, in-place membership #8619), both now merged. This PR is rebased on them.

Test plan

• npm run build:schemas && npm run build:compliance (no symbol-link changes)
• test:schemas, test:json-schema, test:compliance-snippets, test:owned-links, the MCP projection and analysis tests, and the bounds tests
• Additive-minor lint has no new non-additive changes
• test:docs-nav live-source checks pass. The snapshot checks need dist/docs, which the sparse worktree omits.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated-path change requires human/CODEOWNERS approval.

This PR modifies two files under the hard approval gate (static/schemas/source/**):

• static/schemas/source/compliance/comply-test-controller-request.json
• static/schemas/source/compliance/comply-test-controller-response.json

gated_paths: true and review_decision: REVIEW_REQUIRED (not APPROVED), so row 2 of the decision table fires: the gate is not satisfied and the outcome must be escalate.

The change itself looks clean and additive: a new reporting_subscription_probe comply_test_controller scenario with five operations, two new optional experimental params (allowed_tasks, timezone, both x-status: experimental, x-added-in: 3.3.0), matching docs, and 8 negative + 5 positive test vectors. Reviewer confirmed schema↔docs coherence, correct per-operation allOf validation (minItems:1 rejects empty allowed_tasks), a correct minor changeset for additive non-breaking experimental surface, no oneOf regression, and no dist/** edits. No Critical/High/Medium findings.

No blocking findings exist, but the deterministic gated-paths gate still requires human/CODEOWNERS review before merge. Once review_decision becomes APPROVED, this clean diff can fall through to approve.

Escalation reasons:

• Protocol schema source files under the hard approval gate are modified while review is still REVIEW_REQUIRED — human/CODEOWNERS approval required.

Why human review

• Gated path: static/schemas/source/compliance/comply-test-controller-request.json modified with review_decision=REVIEW_REQUIRED — human/CODEOWNERS approval required
• Gated path: static/schemas/source/compliance/comply-test-controller-response.json modified with review_decision=REVIEW_REQUIRED — human/CODEOWNERS approval required
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated-path approval required (schema source change, review not yet APPROVED).

This PR adds the experimental reporting_subscription_probe compliance scenario (media_buy.reporting_subscriptions) with five operations. The reviewer reports a clean pass: the request-schema conditional mirrors the existing restate_after_received if/then/else pattern, operation enum is restricted to the 5 ops, account_id required for all but advance_time, allowed_tasks/timezone each required-and-only-for their op with else: not required guards, and target_time required for advance_time. Additive enum/field additions correctly take a minor changeset; no new oneOf, no dist/** edits, docs table and response SimulationSuccess description match the schema one-for-one, and new params carry x-status experimental / x-added-in 3.3.0 (registered in the sweep test). No critical/high/medium findings in the delta.

Despite the clean diff, this PR modifies files under static/schemas/source/**, which is under a hard, non-overridable approval gate (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED. Per decision-table row 2, the outcome MUST be escalate until a human/CODEOWNERS approval is recorded. This also matches the prior escalate (sticky governance matter for an experimental Normative-class protocol change). The gate lifts automatically once review_decision becomes APPROVED.

Escalation reasons

• Modifies static/schemas/source/compliance/comply-test-controller-request.json — gated protocol-source path; human/CODEOWNERS approval required (review_decision=REVIEW_REQUIRED).
• Modifies static/schemas/source/compliance/comply-test-controller-response.json — gated protocol-source path; human/CODEOWNERS approval required.

Why human review

• Gated path: static/schemas/source/compliance/comply-test-controller-request.json modified with review_decision=REVIEW_REQUIRED — human/CODEOWNERS approval required
• Gated path: static/schemas/source/compliance/comply-test-controller-response.json modified with review_decision=REVIEW_REQUIRED — human/CODEOWNERS approval required
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/compliance/comply-test-controller-request.json (modified) matches static/schemas/source/**; static/schemas/source/compliance/comply-test-controller-response.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[bokelley]

Ladon found nothing; it escalated only because the controller schema is under the gated paths. The advisory SDK generation failures are the known regranted_at exhaustiveness check (TypeScript) and the targeting_overlay double-patch (Python, see #8636), neither from this PR. The owner approved the beta.3 set, so this is being merged by admin.