feat(compliance): scoping lint exempts ID-scoped tasks (#2577 Option C)

[bokelley]

Summary

Implements the lint-classification half of #2577 Option C. Seven tasks whose request schema requires a globally-unique scope-ID move from TENANT_SCOPED_TASKS to EXEMPT_FROM_LINT.

Task	Required scope-ID
check_governance	plan_id
report_plan_outcome	plan_id
acquire_rights	rights_id + buyer + campaign
log_event	event_source_id
calibrate_content	standards_id
validate_content_delivery	standards_id
validate_property_delivery	list_id (schema also has optional account)

At the spec level, the seller resolves the ID → tenant via its own lookup. Envelope account is redundant.

What this PR does not do

• No schema changes. The three tasks that stayed in TENANT_SCOPED_TASKS (preview_creative, build_creative, get_plan_audit_logs) don't have a required scope-ID. Whether they should grow an optional account is a spec decision; tracked in Spec gap: tenant-scoped request schemas missing account/brand fields #2577 as a follow-up.
• No runtime changes. sessionKeyFromArgs today still routes by envelope identity. Storyboards should keep carrying identity on exempt tasks — the lint just stops enforcing it on tasks where the spec doesn't require it. When the runtime learns to resolve by ID, storyboards can drop the identity. Also tracked in Spec gap: tenant-scoped request schemas missing account/brand fields #2577.
• No storyboard edits. The 7 newly-exempt tasks all already carry envelope identity from earlier work (refactor(compliance): normalize storyboard brand/account consistency (#2528, #2530, #2533) #2562, feat(compliance): storyboard scoping lint + sessionKeyFromArgs plans fallback (#2527, #2529, #2531) #2563). Relaxing the lint doesn't regress any storyboard.

Why the split matters for future authors

Before this PR the rule was "tenant-scoped at the handler level ⇒ require envelope identity." After: "required globally-unique scope-ID in schema ⇒ seller resolves by ID, lint doesn't require envelope identity."

The second rule maps cleanly to how a production seller works: auth context identifies the principal, plan_id/rights_id/standards_id identifies the scoped resource, envelope account is either absent or optional. The first rule was a sandbox artifact.

The authoring guide (docs/contributing/storyboard-authoring.md) documents the rule-of-thumb, the three exempt sub-buckets, and explicitly warns authors not to drop envelope identity on exempt tasks until the runtime side of #2577 lands.

Test plan

• npm run build:compliance (scoping lint + build)
• npm run test:storyboard-scoping (parity test — 3/3)
• npm run test:schemas (7/7)
• SEO metadata check (253/253, exit 0)

Related

• Closes first deliverable of Spec gap: tenant-scoped request schemas missing account/brand fields #2577 (lint classification).
• Leaves Spec gap: tenant-scoped request schemas missing account/brand fields #2577 open for the two remaining deliverables (runtime ID routing, schema additions).

🤖 Generated with Claude Code

[github-actions]

Schema Link Check Results

Commit: fbd58c1 - feat(compliance): scoping lint exempts ID-scoped tasks (#2577 Option C)

⚠️ Warnings (schema not yet released)

These schemas exist in source but haven't been released yet. The links will be broken until the next version is published:

• https://adcontextprotocol.org/schemas/v3/enums/specialism.json
  • Schema exists in latest (source) but not yet released in v3
  • Action: This link will work after next 3.x release is published

---

To fix: Either:

1. Wait for the next release and merge this PR after the release is published
2. Use latest instead of a version alias if you need the link to work immediately (note: latest is the development version and may change)
3. Coordinate with maintainers to cut a new release before merging