Require portable dotted BrandRef domains

[bokelley]

Summary

• require dotted domains in BrandRef and BrandKey wire schemas
• document production registrability and DNS/SSRF responsibilities
• define narrow, explicit development namespaces

Tests

• npm run test:schemas
• node tests/schema-validation.test.cjs
• pre-push docs and changeset validation

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Request changes

Request changes — 1 blocking finding.

Blocking findings

• static/schemas/source/core/brand-key.json / brand-ref.json — domain pattern narrowed from (\.…)* to (\.…)+, removing explicitly-permitted single-label wire values across two core schemas. This is a Breaking-class narrowing shipped as a minor changeset; it must ship as major. DR-0012's non-breaking rationale does not apply because the prior single-label behavior was specified. Reviewer marked this High/MUST-FIX.

The changeset type must be corrected to major and the change re-evaluated as Breaking-class. Schema↔docs coherence, regex correctness, and test coverage were verified clean.

Note: this PR also touches gated paths (static/schemas/source/**) with review_decision: REVIEW_REQUIRED, and represents a Breaking-class protocol change — both require human/CODEOWNERS ratification regardless of the changeset fix.

Blocking findings

• static/schemas/source/core/brand-ref.json — domain pattern narrowed to require a dot (breaking wire-shape narrowing) shipped as a minor changeset; must be major and re-evaluated as Breaking-class

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema paths require human/CODEOWNERS approval (and this is a breaking-class protocol change).

This PR modifies static/schemas/source/core/brand-key.json and static/schemas/source/core/brand-ref.json, which fall under the deterministic hard approval gate (gated_paths: true). Because review_decision is CHANGES_REQUESTED (not APPROVED), decision-table row 2 forces escalation regardless of the clean reviewer pass.

Separately, the constitution's Breaking-class hard gate independently applies: tightening BrandRef/BrandKey to require dotted domains (pattern *→+, maxLength 253) is a breaking wire change carrying a major changeset. Even a clean breaking change is never auto-approved — ratification is a human act — and review_decision is not APPROVED.

The reviewer found no Critical/High/Medium findings; schema↔docs coherence, changeset scope/type (major), and fail-closed registrability validation were all verified. No blocking findings, but two independent hard gates require explicit human review before merge.

Why human review

• Gated paths: modifies static/schemas/source/core/brand-key.json and static/schemas/source/core/brand-ref.json (static/schemas/source/** hard gate) while review_decision is CHANGES_REQUESTED — human/CODEOWNERS approval required.
• Breaking-class protocol change (BrandRef/BrandKey tightened to require dotted domains, maxLength 253) carrying a major changeset — ratification is a human act; never auto-approved without review_decision APPROVED.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/brand-key.json (modified) matches static/schemas/source/**; static/schemas/source/core/brand-ref.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'CHANGES_REQUESTED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — hard approval gate not satisfied.

This PR modifies files under the static/schemas/source/** hard approval gate (gated_paths: true) while the current GitHub review_decision is CHANGES_REQUESTED, not APPROVED. Per decision-table row 2, the outcome must be escalate until a human/CODEOWNERS approval is recorded — regardless of how clean the diff is.

The reviewer's current-run delta pass is genuinely clean: no critical/high/medium findings. The brand-domain validation split (syntactic assertValidBrandDomain vs. registrable assertRegistrableBrandDomain) is correctly scoped with matching tests, and pinSchemaTreeVersion only rewrites staged bundle output, not released dist/** artifacts. This is a net improvement over the prior review.

However, two independent hard gates still stand:

• Gated paths (row 2): static/schemas/source/core/brand-key.json and static/schemas/source/core/brand-ref.json are under static/schemas/source/**; review_decision is CHANGES_REQUESTED. Human/CODEOWNERS approval required.
• Breaking-class governance gate: BrandRef/BrandKey are tightened to require dotted domains (maxLength 253) — a breaking-class protocol change carrying a major changeset. Ratification is a human act and is never auto-approved without review_decision: APPROVED.

Escalation reasons

• Modifies static/schemas/source/core/brand-key.json and static/schemas/source/core/brand-ref.json under the static/schemas/source/** hard gate while review_decision is CHANGES_REQUESTED — human/CODEOWNERS approval required.
• Breaking-class change (BrandRef/BrandKey require dotted registrable domains, maxLength 253) — human ratification required regardless of a correct major changeset.

To clear this: obtain a GitHub review approval (flips review_decision to APPROVED), after which a clean re-run would fall through to approve.

Why human review

• Modifies static/schemas/source/core/brand-key.json and static/schemas/source/core/brand-ref.json under the static/schemas/source/** hard approval gate while review_decision is CHANGES_REQUESTED — human/CODEOWNERS approval required (decision-table row 2).
• Breaking-class protocol change: BrandRef/BrandKey tightened to require dotted registrable domains (maxLength 253) carrying a major changeset — ratification is a human act and is never auto-approved without review_decision APPROVED.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/brand-key.json (modified) matches static/schemas/source/**; static/schemas/source/core/brand-ref.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'CHANGES_REQUESTED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.