[botinc-agent]

Problem

Every spec sync was committed as chore(spec), even when the API changed in ways that break typed code. So the 2026-11-04 change shipped as 1.0.2/1.1.0, and the breaking changes PR #14 listed never reached the release notes. The detector also used its own list instead of DESIGN.md 3.1, and openapi-authentication.json was never synced.

Solution

• docs/DESIGN.md: the six shared edits, word for word (SHA-256 403e3243…db52).
• codegen/spec_sync.py:
  • feat(spec) when a caller can observe the change, chore(spec) for documentation only, never !. A oneOf/anyOf variant's title counts, because it names the generated type.
  • counts the DESIGN 3.1 list, including date-time, date and binary formats, a value that loses or gains its type (typed object), and success statuses only one side has: an added status without a body makes the result nullable, and a removed status whose body no other status returns removes a variant of it.
  • one nested api(spec): commit per breaking change, no cap.
• spec-sync.yml titles the pull request with that type and ends the body with a BEGIN_COMMIT_OVERRIDE block.
• release-please-config.json maps api to "API changes that can break typed code".
• openapi/authentication.json is synced, and a contract test holds the Authentication module to it.

Merge as ci:: here a docs: commit releases a patch.

Verification

• Fixtures: 2026-11-04 gives feat(spec) and the 14 listed changes (the issue says 15 but lists 14); 2026-11-06 gives chore(spec), "None detected".
• Review round 2 cases, against the committed spec: renaming "Selected transactions" is feat (recasing it, or a component title, stays chore); untyped SessionDecision.session_id, an added 204 on the decision endpoint and a removed AML monitoring 202 are each listed as breaking.
• release-please 17.6.0 parser: 14 lines through the block, none breaking.
• Local: the three changed test files pass (100 tests, including test_authentication_contract.py); ruff, mypy, pyright clean.
• CI on 24dffae (run 42224903393): all 12 jobs pass (tests on Python 3.10 to 3.14, macOS and Windows, lint, type check, generated code, wheel, secret scan); the live smoke tests skip without a sandbox key.
• Not run: the workflow_dispatch spec sync on this branch.