fix(registry): enforce identity-not-authorization on property-save (#5749 gap #2)

[bokelley]

Closes gap #2 of RFC #5749.

Problem

POST /api/properties/save (saveProperty) is the community-registry property write surface. It required a caller-supplied authorized_agents array (400 if absent) and stored it verbatim into the persisted community-mirror adagents.json document. That let any authenticated registry caller assert sales authorization (which agent may sell a domain's inventory) for a domain they may not own.

AdCP's invariant: the owner's origin /.well-known/adagents.json is the sole authorization source. Community-registry rows never assert authorization and must carry authorized_agents: [] — docs/governance/property/adagents.mdx:296: a community/catalog mirror "Sets authorized_agents: [] … the mirror MUST NOT fabricate one." The sibling community-mirror write path (server/src/routes/community-mirrors.ts:190-200) already drops caller authorization and forces []. This brings saveProperty in line.

Why it matters

The registry's authorization view is normally re-derived from a live origin crawl — but for an un-crawled brand-new domain (exactly the population this endpoint creates rows for) there is nothing to overwrite a phantom write, and the SDK's lookupDomain returns authorized_agents to consumers. Combined with the documented TS/Python resolver divergence (adcontextprotocol/adcp-client#2301, where the TS resolver doesn't honor revocation), an un-scrubbed write is a latent sales-authorization spoof. The scrub is now unconditional and structurally guaranteed — the persisted object hard-codes authorized_agents: [] and never spreads the request body.

Change

• Drop caller-supplied authorized_agents; always persist []. The single adagentsJson object flows into both the create and edit paths, so a previously-stored non-empty array is overwritten to [] on the next save (heals a prior spoof).
• Stop requiring authorized_agents; mark it optional + documented-as-ignored in the OpenAPI spec; regenerate static/openapi/registry.yaml.
• Update the registry save-property docs (request body + cURL/JS/Python samples no longer carry authorization).
• New integration test (registry-property-save-identity.test.ts): caller-supplied authorization is dropped → stored []; omitting the field no longer 400s; the edit path heals a prior non-empty array.

Scope

Scoped to the public REST write surface the RFC names. Both a code review and a security review ran on the diff and came back clean.

The security review surfaced that other caller-supplied writers of hosted_properties.adagents_json carry the same gap — notably the Addie save_property MCP tool (server/src/addie/mcp/property-tools.ts), which auto-publishes (is_public:true, review_status:'approved') and syncs caller-supplied agents into the federated authorization index — plus admin save endpoints in http.ts and mcp-tools.ts. These need per-path review to distinguish caller-supplied from origin-crawl-derived authorization (the latter must not be scrubbed), so they're deliberately not bundled here. Follow-up: #5751.

Gap #1 of the RFC (an authority model / domain-control challenge on the write — already specced at docs/registry/index.mdx:267 but unimplemented) is a separate issue.

Test plan

• tsc -p server/tsconfig.json --noEmit — clean
• vitest run server/tests/integration/registry-property-save-identity.test.ts — 3/3 pass
• npm run build:openapi — static/openapi/registry.yaml regenerated and committed
• pre-commit (unit + typecheck) and pre-push (broken-links) hooks pass

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
adcp	🟢 Ready	View Preview	Jun 28, 2026, 10:18 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[aao-release-bot]

Clean, contained security fix. Right principle: identity is not authorization — a community-registry row never asserts who may sell a domain's inventory, and the owner's origin adagents.json stays the sole authorization source.

Things I checked

• Scrub is structural, not conditional. Single adagentsJson object at registry-api.ts:4476 hard-codes authorized_agents: [] and never spreads the request body. authorized_agents is no longer destructured at :4458, so there's no dangling reference and no path to re-merge caller input. security-reviewer: no High/Medium.
• Edit path heals a prior spoof. editCommunityProperty (property-db.ts:685-699) does a whole-column adagents_json = $N replacement, not a JSON merge — a pre-fix row holding a non-empty array is overwritten wholesale to [] on the next save. Test 3 proves it via revision_number (edit-branch-only) plus the [] assertion.
• Matches the sibling write path. Same invariant as community-mirrors.ts:194-198, which already drops caller authorization and forces [].
• Spec-sound. docs/governance/property/adagents.mdx:296 — a community mirror "Sets authorized_agents: [] … the mirror MUST NOT fabricate one." Empty array plus non-empty properties is a schema-valid catalog-only document (static/schemas/source/adagents.json:712-728). ad-tech-protocol-expert: sound.
• No drift, no fork. static/openapi/registry.yaml was regenerated from the Zod source, not hand-edited — .optional(), the "Ignored." description, example: [], and the required removal all line up across schema, OpenAPI, and docs/registry/index.mdx.
• Required→optional flip is non-breaking. Relaxing a request-body field from required to optional is backward-compatible contract widening — every previously-valid body still validates. Patch-level, no major warranted.
• No changeset required. check-changeset-protocol-scope.cjs scopes the gate to static/schemas/source/, static/registry/, docs/reference/ — none of this PR's paths (static/openapi/, docs/registry/, server/) match. Absence is not a block.

Follow-ups (non-blocking — file as issues)

• Other un-scrubbed writers. #5751 already tracks the Addie save_property MCP tool (auto-publishes is_public:true, review_status:'approved' and syncs caller agents into the federated index) plus the admin endpoints in http.ts/mcp-tools.ts. Correct to scope those out here — they mix caller-supplied and origin-crawl-derived authorization, and a blanket [] there would wrongly scrub legitimate crawled authorization.
• Consider a changeset anyway. Not gate-required, but static/openapi/registry.yaml and docs/registry/index.mdx are adopter-visible. A patch changeset would keep the published-surface change tracked. Wording-only — doesn't block.

Minor nits (non-blocking)

1. Silent drop vs. explicit reject. A caller still sending non-empty authorized_agents gets a 200 and no signal that it was ignored. Defensible — and the OpenAPI description documents it as "Ignored" — but a 400 on non-empty input would be the louder, more spoof-hostile contract. Confirm silent-drop is the intended posture.

The third drift-cleanup-by-regeneration in recent registry work; the source-and-generated-YAML staying in lockstep is the part that makes that boring, which is the goal.

LGTM. Follow-ups noted below.