fix(schemas): accept envelope-level replayed on 15 response schemas (#2839) (#2862)

Property-list, collection-list, and governance response schemas sealed
their envelope root with additionalProperties: false, rejecting the
replayed boolean that security.mdx requires sellers to inject on
mutating responses. Flip root additionalProperties to true on all 15;
declare replayed explicitly on the 8 mutating ones so AJV still
type-checks it. Nested-body strictness preserved.

Regression coverage in composed-schema-validation: per-schema
acceptance, a negative test, a branch-aware structural lint, and a
drift guard against core/protocol-envelope.json.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bokelley

.changeset/response-envelope-replayed-acceptance.md

@@ -0,0 +1,15 @@
+---
+"adcontextprotocol": patch
+---
+
+Response schemas across property-list, collection-list, and governance families now accept the envelope-level `replayed` field that the seller's idempotency layer injects at response time.
+
+Fifteen `*-response.json` schemas previously declared `additionalProperties: false` at the root, so AJV validators compiled from them rejected `replayed: true` / `replayed: false` — even though `docs/building/implementation/security.mdx` (the idempotency storyboard) requires sellers to emit it on mutating responses. This produced a two-faced contract where `create_media_buy` accepted the same envelope field (via branch-level `additionalProperties: true` on its `oneOf`) while `create_property_list`, `sync_plans`, and others did not. Media-buy, signals, creative, content-standards, and sponsored-intelligence responses already accept envelope-level fields through their `oneOf` branches and did not need changing — only schemas with a root-level seal were affected.
+
+Affected schemas: property-list family (`create`, `update`, `delete`, `get`, `list`, `validate_property_delivery`), collection-list family (`create`, `update`, `delete`, `get`, `list`), and governance (`check_governance`, `get_plan_audit_logs`, `report_plan_outcome`, `sync_plans`).
+
+Fix: root-level `additionalProperties` flipped to `true` on all 15 so envelope-level fields pass through. The eight mutating responses (`create_*`, `update_*`, `delete_*` × 2 families, `report_plan_outcome`, `sync_plans`) also declare `replayed: { type: boolean }` explicitly — consistent with how `context` and `ext` are declared today — so AJV still type-checks it. Nested body `additionalProperties: false` is left intact; envelope extensibility is a root-level concession, not a license for drift inside list bodies.
+
+Regression coverage added in `tests/composed-schema-validation.test.cjs`: per-schema acceptance tests, a negative test (`replayed: "true"` as string must fail), a structural lint that walks every task-family `*-response.json` (including `oneOf`/`anyOf`/`allOf` branches) and fails on any sealed envelope without `replayed` declared, and a drift guard that asserts every inlined `replayed` description matches the canonical definition in `core/protocol-envelope.json`.
+
+Resolves #2839.

static/schemas/source/collection/create-collection-list-response.json

@@ -13,6 +13,11 @@
       "type": "string",
       "description": "Token that authorizes sellers to fetch this list via get_collection_list. Only returned at creation time — buyers MUST store it in a secret manager. Scoped to this one list_id; MUST NOT be reused across lists. Governance agents MUST issue a distinct token per seller so per-relationship revocation is possible. Tokens MUST NOT be logged, appear in cache keys, or echo in error responses. delete_collection_list MUST revoke the token immediately; compromise-driven revocation MUST also signal cache invalidation to sellers (reduced cache_valid_until or a list-changed webhook). See Security considerations in docs/governance/collection/tasks/collection_lists."
     },
+    "replayed": {
+      "type": "boolean",
+      "description": "Set to true when this response is a cached replay returned for an idempotency_key that was already processed. Set to false (or omitted) when the request was executed fresh. Buyers use this to distinguish cached replays from new executions — matters for billing reconciliation, audit logs, and any downstream system that assumes exactly-once event semantics. Only present on responses to mutating requests that carry idempotency_key.",
+      "default": false
+    },
     "context": {
       "$ref": "/schemas/core/context.json"
     },
@@ -24,5 +29,5 @@
     "list",
     "auth_token"
   ],
-  "additionalProperties": false
+  "additionalProperties": true
 }

static/schemas/source/collection/delete-collection-list-response.json

@@ -14,6 +14,11 @@
       "description": "ID of the deleted list",
       "x-entity": "collection_list"
     },
+    "replayed": {
+      "type": "boolean",
+      "description": "Set to true when this response is a cached replay returned for an idempotency_key that was already processed. Set to false (or omitted) when the request was executed fresh. Buyers use this to distinguish cached replays from new executions — matters for billing reconciliation, audit logs, and any downstream system that assumes exactly-once event semantics. Only present on responses to mutating requests that carry idempotency_key.",
+      "default": false
+    },
     "context": {
       "$ref": "/schemas/core/context.json"
     },
@@ -25,5 +30,5 @@
     "deleted",
     "list_id"
   ],
-  "additionalProperties": false
+  "additionalProperties": true
 }

static/schemas/source/collection/get-collection-list-response.json

@@ -125,5 +125,5 @@
   "required": [
     "list"
   ],
-  "additionalProperties": false
+  "additionalProperties": true
 }

static/schemas/source/collection/list-collection-lists-response.json

@@ -25,5 +25,5 @@
   "required": [
     "lists"
   ],
-  "additionalProperties": false
+  "additionalProperties": true
 }

static/schemas/source/collection/update-collection-list-response.json

@@ -9,6 +9,11 @@
       "$ref": "/schemas/collection/collection-list.json",
       "description": "The updated collection list"
     },
+    "replayed": {
+      "type": "boolean",
+      "description": "Set to true when this response is a cached replay returned for an idempotency_key that was already processed. Set to false (or omitted) when the request was executed fresh. Buyers use this to distinguish cached replays from new executions — matters for billing reconciliation, audit logs, and any downstream system that assumes exactly-once event semantics. Only present on responses to mutating requests that carry idempotency_key.",
+      "default": false
+    },
     "context": {
       "$ref": "/schemas/core/context.json"
     },
@@ -19,5 +24,5 @@
   "required": [
     "list"
   ],
-  "additionalProperties": false
+  "additionalProperties": true
 }

static/schemas/source/governance/check-governance-response.json

@@ -149,7 +149,7 @@
     "plan_id",
     "explanation"
   ],
-  "additionalProperties": false,
+  "additionalProperties": true,
   "allOf": [
     {
       "if": {

static/schemas/source/governance/get-plan-audit-logs-response.json

@@ -420,5 +420,5 @@
   "required": [
     "plans"
   ],
-  "additionalProperties": false
+  "additionalProperties": true
 }

static/schemas/source/governance/report-plan-outcome-response.json

@@ -69,6 +69,11 @@
       },
       "additionalProperties": false
     },
+    "replayed": {
+      "type": "boolean",
+      "description": "Set to true when this response is a cached replay returned for an idempotency_key that was already processed. Set to false (or omitted) when the request was executed fresh. Buyers use this to distinguish cached replays from new executions — matters for billing reconciliation, audit logs, and any downstream system that assumes exactly-once event semantics. Only present on responses to mutating requests that carry idempotency_key.",
+      "default": false
+    },
     "context": {
       "$ref": "/schemas/core/context.json"
     },
@@ -80,5 +85,5 @@
     "outcome_id",
     "status"
   ],
-  "additionalProperties": false
+  "additionalProperties": true
 }

static/schemas/source/governance/sync-plans-response.json

@@ -100,6 +100,11 @@
         "additionalProperties": false
       }
     },
+    "replayed": {
+      "type": "boolean",
+      "description": "Set to true when this response is a cached replay returned for an idempotency_key that was already processed. Set to false (or omitted) when the request was executed fresh. Buyers use this to distinguish cached replays from new executions — matters for billing reconciliation, audit logs, and any downstream system that assumes exactly-once event semantics. Only present on responses to mutating requests that carry idempotency_key.",
+      "default": false
+    },
     "context": {
       "$ref": "/schemas/core/context.json"
     },
@@ -110,5 +115,5 @@
   "required": [
     "plans"
   ],
-  "additionalProperties": false
+  "additionalProperties": true
 }