[bokelley]

The schema-bundle workflow used the Python SDK's default main branch, which remains the SDK 9 / AdCP 3.2 line and lacks the composed-envelope generation fixes. Main-branch protocol bundles are 3.3 candidates, so the Python generation job now checks out the SDK's next branch, the SDK 10 / AdCP 3.3 line.

Candidate provenance/checksum verification, historical schema caches, regeneration, generated-code validation and schema-pin tests retain their existing checks. Move the checkout back to the default branch when the SDK promotes 3.3 there.

Validation at fbcdcc945eda66c22ebcc58a8eafe36c321637c2:

• All CI checks pass, including Generate Python SDK and Generate TypeScript SDK.
• Build/static checks and the TypeScript aggregate pass after incorporating main's dependency security fix.
• The change is operational CI configuration and needs no protocol changeset.

Automatic review found no blocking code findings but requires human approval for the gated .github/workflows/** path.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS approval.

This PR modifies .github/workflows/validate-schema-bundle.yml, which matches the .github/workflows/** gated-paths glob (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so the hard approval gate (decision row 2) is not satisfied and the PR cannot be auto-approved.

The change itself is clean: a one-line CI fix setting ref: next on the adcp-client-python checkout so main-PR schema bundles (AdCP 3.3 candidates) generate against the SDK 3.3/next line instead of the 9.x/3.2 default branch. Operational-only — no protocol surface touched, no changeset required, no Critical/High/Medium findings. The workflow self-validates on this PR.

Despite the clean diff, the gated workflow path requires explicit human/CODEOWNERS review before merge.

Escalation reasons:

• .github/workflows/validate-schema-bundle.yml is under a hard approval gate (.github/workflows/**); review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required.

Why human review

• Modifies .github/workflows/validate-schema-bundle.yml, a gated path (.github/workflows/**), and review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required before merge.
• This PR touches a path under a hard, non-overridable approval gate (.github/workflows/validate-schema-bundle.yml (modified) matches .github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated path requires human/CODEOWNERS approval.

This PR modifies .github/workflows/validate-schema-bundle.yml, which matches the hard, path-based approval gate .github/workflows/** (gated_paths: true), and the current review_decision is REVIEW_REQUIRED, not APPROVED. Per decision rule row 2, the outcome must be escalate until a real human/CODEOWNERS approval is recorded — regardless of how clean the diff is.

The reviewer returned a clean pass with no Critical/High/Medium findings: the single CI-config change points the Python SDK generation job at the SDK's next branch (SDK 10 / AdCP 3.3) to fix the 3.3 bundle-key mismatch, with no protocol surface touched and provenance/checksum verification untouched. This is consistent with the prior escalate, which was purely gate-driven with no actionable findings.

Escalation reasons

• .github/workflows/validate-schema-bundle.yml (modified) matches gated path .github/workflows/** and review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required before merge.

Why human review

• Modifies .github/workflows/validate-schema-bundle.yml, a gated path (.github/workflows/**), and review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required before merge.
• This PR touches a path under a hard, non-overridable approval gate (.github/workflows/validate-schema-bundle.yml (modified) matches .github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[bokelley]

"Generate Python SDK" now checks out next and gets through packaging and generation; the first run on this branch passed end to end. Since the beta.3 schema PRs merged (#8617 to #8620), it fails at SDK import: _patch_targeting_overlay in src/adcp/types/_forward_compat.py finds PackageRequest.targeting_overlay already wrapped (Annotated[TargetingOverlayInput | SkipJsonSchema[TargetingOverlay] | None, ...]) and raises. That means the patch is applied twice: an SDK-side forward-compat issue for the Python maintainers to triage, not a branch-selection problem. Ladon found nothing; it escalated only because .github/workflows/** is gated. Merging by admin as instructed.