feat(schema): model programmed channels and FAST carriage

[bokelley]

Summary

• model continuously programmed audio/video streams as first-class channel collections, including FAST, virtual linear, and syndicated audio
• keep the host app as the property, the programmed stream as the collection, and the avail as the placement
• identify carriage through host property IDs plus publisher-scoped channel/EPG identifiers
• support owner-sold carriage through domain-qualified collection constraints in host adagents.json
• preserve carriage data through registry projection and expose external collection constraints in the builder

Authorization semantics

• multiple rights-holders or sales paths use separate collection-narrowed authorized_agents[] entries; no concurrency primitive is needed
• a technology provider is not inherently a rights-holder: software behind the owner endpoint may remain direct, while an operator running the sales endpoint on the owner’s behalf is named as delegated
• revenue shares, buybacks, and backfill priority remain commercial inputs to product construction and pricing, not discovery fields
• the direct publisher verifier matches collection scope by publisher domain and collection ID and fails closed for absent, malformed, or wrong-domain selectors
• the registry product lookup is explicitly documented as publisher-property coverage only; collection, placement, country, and time qualifiers require authoritative publisher validation

Verification

• npm run typecheck
• focused validator and registry-sync unit tests: 81 passed
• npm run test:fast-channel-collections: 4 passed
• npm run test:json-schema: 278 schema-bearing examples passed
• npm run test:openapi
• node scripts/check-changeset-protocol-scope.cjs origin/main
• branch merged with current origin/main

Review status

The automated review finding that publisher_channel_id was missing from the video/CTV identifier reference is addressed. This PR changes gated protocol schema paths and still requires human/CODEOWNERS approval before merge.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema paths modified without required review approval.

This PR models FAST/virtual-linear streams as first-class channel collections: a new enum value, a new publisher_channel_id identifier type, and an optional property_ids carriage field on collection-distribution. Schema, docs, server projection, admin UI, tests, and a correct minor changeset are in sync. The required→optional loosening is non-breaking and the new anyOf is properly discriminated (not an undiscriminated oneOf). No critical or high findings surfaced.

However, this PR modifies files under static/schemas/source/**, which are under a hard, deterministic approval gate (gated_paths: true). The required review status is REVIEW_REQUIRED, not APPROVED (decision table row 2). The protocol source of truth is being changed, so human/CODEOWNERS review is required before this can merge.

Medium findings

• docs/media-buy/product-discovery/collections-and-installments.mdx:880 — publisher_channel_id missing from the "Available video/CTV types" reference list (schema↔docs coherence gap; worth fixing but non-blocking on its own).

Escalation reasons

• Gated paths modified (static/schemas/source/core/collection-distribution.json, .../core/collection.json, .../enums/collection-kind.json, .../enums/distribution-identifier-type.json) and review_decision is REVIEW_REQUIRED, not APPROVED. Human/CODEOWNERS review of the protocol schema change is required.

Medium findings

• docs/media-buy/product-discovery/collections-and-installments.mdx:880 — publisher_channel_id missing from the "Available video/CTV types" reference list

Why human review

• Gated paths modified under static/schemas/source/** (collection-distribution.json, collection.json, collection-kind.json, distribution-identifier-type.json) while review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required before merge.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/collection-distribution.json (modified) matches static/schemas/source/**; static/schemas/source/core/collection.json (modified) matches static/schemas/source/**; static/schemas/source/enums/collection-kind.json (modified) matches static/schemas/source/**; static/schemas/source/enums/distribution-identifier-type.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema paths modified without required review approval.

Gate status
This PR modifies four files under static/schemas/source/** (collection-distribution.json, collection.json, collection-kind.json, distribution-identifier-type.json), which sit under a hard, deterministic approval gate (gated_paths: true). The current review_decision is REVIEW_REQUIRED, not APPROVED, so the gate is not satisfied. Row 2 of the decision table forces escalate (no critical/high findings exist to force request-changes).

Iteration credit
The delta since the prior escalate is small and clean: two $schema example URLs in collections-and-installments.mdx were moved from latest to v3, matching the repo-wide /schemas/v3/ convention. No new findings introduced. The prior escalation persists solely because the gated-path approval gate remains unmet — not because of unresolved code issues.

Medium findings (non-blocking)

• docs/media-buy/product-discovery/collections-and-installments.mdx:880 — publisher_channel_id (added to the distribution-identifier-type enum in this PR) is missing from the "Available video/CTV types" reference list. Minor schema↔docs coherence gap; line is outside all diff hunks so it cannot be pinned inline.

Escalation reasons

• Gated files under static/schemas/source/** modified while review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required before merge.

Medium findings

• docs/media-buy/product-discovery/collections-and-installments.mdx:880 — publisher_channel_id missing from the "Available video/CTV types" reference list

Why human review

• Modifies gated schema files under static/schemas/source/** (collection-distribution.json, collection.json, collection-kind.json, distribution-identifier-type.json) while review_decision is REVIEW_REQUIRED, not APPROVED — human/CODEOWNERS approval required before merge.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/collection-distribution.json (modified) matches static/schemas/source/**; static/schemas/source/core/collection.json (modified) matches static/schemas/source/**; static/schemas/source/enums/collection-kind.json (modified) matches static/schemas/source/**; static/schemas/source/enums/distribution-identifier-type.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[ariloudev]

@bokelley Hi Brian,

Thanks for coming up with this promptly following our conversation on Slack.

The proposal itself looks good, but if I am reading this correctly, without hosts (Roku, Samsung, etc) starting to publish the adagents.json files, it won’t be possible to transact because the AdCP seller relationship authorization validation will fail, right?

I am afraid this is where the AdCP adoption will stall because this will make the hosts complete gatekeepers to agentic selling. Given their scale, how long will it actually take until they embrace AdCP becomes a question yet to be answered.

What are your thoughts on this?

[bokelley]

@ariloudev That is a fair concern. Full AdCP verification of owner-sold carriage does require host participation. Until a host publishes an authoritative declaration, the channel owner's carriage claim can be discovered, but it cannot be promoted to host-verified authorization.

This is why the community registry exists. It gives the ecosystem a place to publish catalog and carriage metadata for properties that have not yet adopted AdCP, with provenance explicit. It cannot manufacture host authorization - an empty authorized_agents array means exactly that - but it prevents the discovery ecosystem from being empty while adoption builds.

The bootstrap question is the important one: how do we accumulate enough useful evidence and participation for verification to have value? A practical next step is to determine whether major CTV and FAST hosts already publish machine-readable channel guides, EPG feeds, or partner APIs that can corroborate carriage. Where those signals exist, the community registry can surface them as evidence; where they do not, we should encourage hosts to expose a lightweight, machine-readable channel guide or attestation endpoint.

So I agree with the underlying point: verification is only valuable when participants contribute verifiable data. The path should be progressive - community discovery and clearly labeled provenance first, host attestation as adoption grows - without representing unverified claims as verified.

---

Generated by Claude Code

[bokelley]

Addressed the review and expert feedback in 9ea5653736, then merged current main in 439c2ec8c0:

• added publisher_channel_id to the documented video/CTV identifier list
• reframed FAST as a carriage/monetization model over the generic channel collection primitive
• documented that concurrent sales paths are separate collection-scoped authorized_agents[] entries, with no new concurrency field
• clarified direct vs delegated technology-provider paths and kept revenue shares/buybacks/backfill out of discovery
• made external collection authorization domain-qualified end to end in the direct verifier and registry-sync index, with wrong-domain, missing-scope, and malformed-input tests
• clarified that the registry product endpoint reports publisher-property coverage only, not full qualifier validation

Local verification after merging main: typecheck; 81 focused runtime tests; 4 channel schema/integration tests; 278 schema-bearing documentation examples; generated OpenAPI; changeset protocol-scope check. There are no unresolved inline review threads. Human/CODEOWNERS approval is still required for the gated schema files.

[bokelley]

Fresh CI is green on 439c2ec8c0: 58 checks passed, including all canonical, server unit/integration, docs, security, Docker, and storyboard jobs. GitGuardian is the sole skipped check. The PR is mergeable with no unresolved review threads; the remaining block is the required human/CODEOWNERS approval for gated schema paths.