Refresh the expired ACP release matrix that blocks every push to main #19

Outcome

Nothing can be pushed to main in this repository right now. The pre-push gate runs check:agent-client-protocol-conformance, and that check fails closed on clean origin/main because the ACP release matrix passed its freshness window. Decide how that window is meant to be refreshed, and refresh it, so delivery is gated by conformance rather than by the calendar.

Current behavior

check:release in packages/agent-client-protocol-conformance loads compatibility/release-matrix.json and validates it with validateAcpReleaseMatrix, which checks matrix format, protocol exclusions, revision and schema identity, tested platform identity, exact Grok and Cursor profile and binary identities, executable and installation-closure digests, initialize negotiation evidence, the 47-scenario catalog, per-evidence-class pass requirements, independently derived release eligibility, repository-local evidence references, secret absence — and freshness.

Only the freshness condition currently fails:

recordedAt:    2026-07-17T12:16:40Z
freshnessDays: 30
age at check:  37.2 days

Reproduced against a clean checkout of origin/main at df62c1fe:

{ "valid": false, "errors": ["matrix evidence is stale"] }

No conformance gap was detected. check:artifacts passes, and the deterministic generated artifacts are current.

There is also no sanctioned way out. generate rewrites only the fixture-derived artifacts. report executes the hermetic run and prints, without writing the matrix. live:release runs the opt-in real Grok and Cursor release runner and writes a candidate-live artifact that the README states explicitly has no authority to modify or promote the release matrix; a human-reviewed matrix edit is mandatory. So the gate is satisfiable only by a reviewed refresh that nobody can perform automatically, and in the meantime every unrelated slice in the repository is blocked from main.

This is what a gate failing closed should look like — the objection is not that it blocked a push, it is that the thing it is protecting has no maintained path back to green, so the first honest consequence of the design is a repository nobody can deliver into.

Contract

• Refresh the matrix through the reviewed path it requires: real Grok and Cursor release runs on a tested platform, recorded digests and negotiation evidence, and a human-reviewed matrix edit. The refreshed evidence must describe a run that happened, not a restamped recordedAt.
• Decide deliberately whether an expired window should block every push to this repository or only a release. Freshness protects promotion of a binary compatibility claim; an unrelated slice cannot invalidate it. If the answer is that it should not, move the freshness condition to the release path and keep the conformance conditions on push.
• If the window stays a push gate, own its recurrence: name who refreshes it, on what cadence relative to freshnessDays, and make expiry visible before it blocks delivery rather than at the moment someone tries to push.
• Never satisfy this check by editing recordedAt, widening freshnessDays to cover a lapse, or bypassing the hook. Each of those keeps the check green while deleting what it certifies.

Acceptance criteria

• check:agent-client-protocol-conformance passes on clean main.
• The matrix references evidence from an actual live run, and the run's platform, profile, and binary identities match what the validator asserts.
• A push of an unrelated change is not blocked by evidence age alone, or the repository states plainly that it is and names the refresh owner and cadence.
• The freshness lapse is detectable before it blocks a push.

Verification

From a clean checkout of main: pnpm run check:agent-client-protocol-conformance, then a push of a trivial unrelated commit. Include the live-run evidence paths in the refresh commit.

Context

Found while delivering OpenAgentsInc/openagents#15, which is implemented, verified, and committed locally at ca2bb64 but cannot reach main until this gate is green. The hook was not bypassed.