fix(training-agent): acquire_rights end_date is inclusive (repo-wide CI time-bomb)

[bokelley]

Repo-wide CI blocker — fast-track

As of 2026-06-30, tests/addie/brand-sandbox-tools.test.ts > rights_constraint uses date-time format fails on main, which red-lights the precommit hook and the test:unit CI job for every branch/PR today.

Root cause — calendar time-bomb

acquire_rights (brand-handlers.ts) rejected a campaign when:

new Date(campaign.end_date).getTime() < Date.now()

new Date('2026-06-30') parses to 2026-06-30T00:00:00Z, so the instant midnight UTC passes on the end date, a campaign ending today is wrongly judged "in the past" and rejected — even though the success path sets valid_until to that day's 23:59:59Z. end_date is meant to be inclusive; the guard was off by up to a day.

Fix

• Reject only once the whole end day is past — compare against the start of today (UTC). A campaign ending today stays licensable, matching the inclusive valid_until semantics.
• Make the test use a next-calendar-year window instead of a hardcoded date, so it exercises the success path durably instead of rotting into the same time-bomb tomorrow.

All 38 tests in the file pass; typecheck clean.

Note (follow-up, not fixed here)

The hardcoded default campaign.end_date || '2026-06-30' in brand-handlers.ts is stale (a no-end_date acquisition gets a past expiry), but it's applied after the guard so it can't cause a rejection or break a test. Replacing it needs a product call on the default window.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
adcp	🟢 Ready	View Preview	Jun 30, 2026, 5:07 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[aao-release-bot]

Clean fix. The expiry guard now matches the inclusive end_date semantics the success path already emits.

Things I checked

• Boundary math. new Date('YYYY-MM-DD') parses to 00:00:00Z per spec, so a campaign ending today gives endMs == startOfTodayMs and endMs < startOfTodayMs is false — not rejected. Ending yesterday → rejected. Future → fine. (brand-handlers.ts:947-949)
• No UTC/local footgun. Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()) keeps both sides UTC-anchored. The classic mix of local new Date(y,m,d) against a UTC-parsed endMs is avoided, so the guard flips at UTC midnight in any server timezone.
• Internal consistency. Inclusive-through-end-of-day now lines up with the success path's valid_until: ${endDate}T23:59:59Z. The guard was off by up to a day; it isn't anymore.
• Test durability. Window is computed from getUTCFullYear() + 1, expectations derived from the same startDate/endDate strings. Exercises the success path regardless of run date — no more hardcoded-2026-06-30 time-bomb.
• code-reviewer: clean, no findings.

Follow-ups (non-blocking — file as issues)

• The campaign.end_date || '2026-06-30' and start_date || '2026-04-01' fallbacks at brand-handlers.ts:1041-1042 are still stale. They sit below the guard, but the guard only runs if (campaign.end_date) — a no-end_date acquisition skips the guard and flows the stale 2026-06-30 straight into valid_until. Out of scope here (needs a product call on the default window, as the PR notes), but it's the next time-bomb in the same file.

Diff is two files, 18/-5, no wire surface, no changeset needed. LGTM.