docs(specs): four-layer property-alignment framing + catalog-graduation RFC

[bokelley]

Two WG design docs that turn this work's thinking into something the working group can act on, and frame #5750/#5752 as two points on one authority spine.

Stacked on #5760 (the repo-wide CI time-bomb fix). The first commit here is that fix; it drops out of this PR's diff automatically once #5760 merges to main.

Docs

• specs/property-definition-alignment.md — the reframe (alignment = convergence on evidence with a domain-rooted spine + reversible mistakes, not consensus on a value), the four layers and their distinct trust roots (ontology / referential identity / authority / boundary), the two invariants (origin wins + alias-not-delete; unilateral disavow, never unilateral claim), where fix(registry): enforce identity-not-authorization on property-save (#5749 gap #2) #5750/feat(registry): domain claim + bind-on-verify ownership (#5749 gap #1) #5752 sit, what AAO is NOT (registrar-of-last-resort, not a registrar), and detect-not-prevent.
• specs/property-catalog-graduation.md — RFC to graduate the catalog from Draft to normative-but-non-authoritative: property_rid as a non-authoritative surrogate, the two-axis evidence/confidence model, owner-declared boundary (declare-don't-derive; ESPN as a tree), ontology-evolution governance (the one genuine layer-1 gap), signed cross-attestation as the already-deferred cross-publisher path, and resolutions for catalog open questions Improve documentation framework and remove premature certification references #3/Add foundational publisher formats and extension mechanism #4.

Review

Reviewed by the protocol expert against specs/registry-authorization-model.md (the shipped evidence/disputed/seq_no model). It caught two factual errors I'd have shipped — a fabricated single evidence ladder (the real model is two axes: authorization evidence ∈ {adagents_json, agent_claim, community} + separate identifier confidence) and over-scoping #5750 — both corrected. The RFC explicitly restates catalog Design Principle #6 (registry is identity-of-last-resort, never authority-to-sell) and includes a 3.2 migration/versioning impact statement.

These are proposals for WG discussion, not normative changes — no wire/schema change.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
adcp	🟢 Ready	View Preview	Jun 30, 2026, 5:29 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[aao-release-bot]

Approving. Clean inclusive-day expiry fix plus two faithful WG framing docs — no wire surface touched, so the whole PR is non-authoritative by construction.

Things I checked

• Boundary logic, server/src/training-agent/brand-handlers.ts:940-952. New check is endMs < startOfTodayMs where startOfTodayMs = Date.UTC(getUTCFullYear, getUTCMonth, getUTCDate). A campaign ending today (new Date('YYYY-MM-DD') → UTC midnight) is ==, not <, so it stays licensable; yesterday is < and rejects. Both sides strictly UTC — getUTC* accessors, not local — so no timezone drift. Matches the success path's inclusive valid_until = ${endDate}T23:59:59Z at brand-handlers.ts:1098. The old endMs < Date.now() falsely expired same-day grants the instant UTC midnight ticked over. Real bug, right fix.
• NaN guard preserved. !Number.isNaN(endMs) carried through unchanged — a malformed end_date still falls through rather than rejecting on a NaN < x comparison.
• Test time-bomb removed, tests/addie/brand-sandbox-tools.test.ts:319-334. Hardcoded end_date: '2026-06-30' sat exactly on today's boundary and would flip to rejection (returning errors, not rights_constraint). Now computes next calendar year via getUTCFullYear()+1 — matches the handler's UTC basis — while preserving the exact T00:00:00Z/T23:59:59Z format assertions.
• Spec coherence against the shipped model. ad-tech-protocol-expert verified every factual claim in both docs against ground truth: the two-axis split (authorization evidence ∈ {adagents_json, agent_claim, community} per registry-authorization-model.md:82-84,155 vs. identifier-linking confidence ∈ {authoritative, strong, medium, weak} per property-registry-catalog.md:413,460), the disputed boolean, seq_no rotation-on-tombstone, the adagents_json-only snapshot default, the new-evidence-value extension path, and the Design Principle #6 restatement. Verdict: sound. The PR body's claim that a prior review caught a fabricated single-ladder evidence model is borne out — property-catalog-graduation.md:39-50 now reads "Two trust axes, not one ladder," no residue.
• No changeset needed. No static/schemas/source/**, no docs/reference/**, no wire shape. specs/*.md are non-normative WG proposals. Correctly fenced as proposal-vs-current-state throughout (graded Wikidata rank, candidate_edges, part_of, signed_attestation, the N=3 enum gate all labeled proposed/deferred).

Follow-ups (non-blocking — file as issues)

• property-catalog-graduation.md open-question #4 conflates two failure modes. The §"Resolved open questions" resolution for catalog Q#4 (domain re-registration / hand-off, property-registry-catalog.md:651) leans on the authorization model's refresh-on-crawl + soft-delete — but that machinery covers manifest-stopped-declaring lapse, not adversarial domain-changed-hands detection. Don't strike Q#4 from the catalog spec on merge as the doc proposes; tighten the wording before this graduates to normative so a reader doesn't infer re-registration is auto-detected. Q#3's resolution is fully closed and fine to strike.
• The alignment doc's AAO "registrar-of-last-resort" framing and the grad doc's "moderator-curated community tier" describe the same trust state from two angles — a one-line cross-reference would stop a reader treating them as distinct.

Minor nits (non-blocking)

1. Redundant Date wrap. brand-handlers.ts:941 — new Date(Date.now()) is equivalent to new Date(). Cosmetic.

LGTM. Follow-ups noted below.