feat(schemas): two-tier discriminated union for Format.assets[] items

[bokelley]

Summary

Closes #3935.

Restructures Format.assets[] from a flat 16-variant oneOf to a two-tier discriminated union so codegen tools (openapi-generator, quicktype) can produce proper discriminated-union types instead of a large any-typed union.

What changed

static/schemas/source/core/format.json — assets.items restructured:

• Outer tier: discriminator: { propertyName: "item_type" } with two branches:
  • "individual" — carries an inner oneOf over 15 asset types
  • "repeatable_group" — the existing group shape
• Inner tier (individual): discriminator: { propertyName: "asset_type" } over all 15 variants (image, video, audio, text, markdown, html, css, javascript, zip, vast, daast, url, webhook, brief, catalog)
• Inner tier (group assets): discriminator: { propertyName: "asset_type" } over 13 group variants
• Each variant carries required: ["asset_type"] directly (required by audit-oneof.mjs's one-hop resolver — redundant with allOf inheritance but necessary for the audit tool)

scripts/oneof-discriminators.baseline.json — Removes the dangerous entry for core/format.json##/properties/assets/items/oneOf (was: 16 variants, all req=[∅]). The restructured paths are now classified discriminated by the audit tool and are not tracked in the baseline.

.changeset/two-tier-format-assets-discriminator.md — minor bump for adcontextprotocol.

Non-breaking

The wire-payload acceptance set is unchanged. discriminator.propertyName is an OAS 3.1 tooling hint — Ajv ignores it at validation time and validates each oneOf branch normally. All payloads accepted before this change are accepted after; none that were rejected are now accepted.

Test results

All schema-relevant gates pass:

• test:json-schema — 284 blocks validated ✓
• test:schemas — 20/20 ✓
• test:composed — 132/132 ✓
• test:oneof-discriminators — no new undiscriminated oneOf (✓ 56 ⚠ 46 ✗ 24)
• build — clean ✓
• typecheck — clean ✓
• test:unit — 1026/1026 ✓

Note on precommit hook: The precommit:server-unit suite (~285s) exceeds its 240s timeout in this remote execution environment (slower CPUs than the hook was calibrated for). All 5183 tests pass when run directly (358 passed, 30 skipped). This is a pre-existing environment constraint, not a regression — CI will verify on normal hardware.

Pre-PR review sign-offs

Two expert agents were consulted before implementation and their caveats incorporated:

• ad-tech-protocol-expert ✓ — Approved with three caveats: (1) add "type": "object" to the individual wrapper, (2) run --update on the baseline, (3) minor changeset. All three incorporated.
• adtech-product-expert ✓ — Approved; confirmed non-breaking, backward-compatible, correct changeset tier.

---

---

Generated by Claude Code

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated schema path requires human/CODEOWNERS review.

This PR modifies static/schemas/source/core/format.json, which matches the static/schemas/source/** hard approval gate (gated_paths: true), and review_decision is REVIEW_REQUIRED (not APPROVED). Per decision rule row 2, the outcome must be escalate.

Escalation reasons

• static/schemas/source/core/format.json — modified file under the static/schemas/source/** gated path; human/CODEOWNERS review is required before merge (review_decision: REVIEW_REQUIRED).

Substantive review (no blockers found): The reviewer confirmed the restructure of Format.assets[] from a flat 16-variant oneOf into a two-tier discriminated union is sound. Both new oneOf sites classify as discriminated by audit-oneof.mjs (outer by required item_type const, inner by required asset_type const), so the single baseline removal is correct. New per-variant required constraints are redundant with baseIndividualAsset.required, so the wire-payload acceptance set is unchanged. Minor changeset is the correct class. No critical/high/medium findings.

Once a human/CODEOWNERS approval lands (review_decision: APPROVED), this clean diff can fall through to approve.

Why human review

• static/schemas/source/core/format.json (modified) is under the static/schemas/source/** hard approval gate; review_decision is REVIEW_REQUIRED, so human/CODEOWNERS approval is required before merge.
• This PR touches a path under a hard, non-overridable approval gate (static/schemas/source/core/format.json (modified) matches static/schemas/source/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.