[bokelley]

Summary

Backport of #1576 and the conventional-commit rerun fix from #1550 to release/8.x. Both make 8.x CI more stable before 8.2.0 is cut.

• test(signing): accept any HTTP status in the real TLS handshake check #1576. test_real_tls_handshake_still_validates_hostname now accepts any HTTP status (100 <= status < 600). Getting a response at all shows the handshake and hostname check passed, because a certificate mismatch raises before any response exists. The test isn't checking the origin's own status, and example.com sometimes answers 503.
• fix(release): tighten V9 reporting and CI readiness checks #1550, rerun part only. A rerun of the conventional-commit job reuses the original webhook payload, so on 8.x it validated a PR body that had since been edited. scripts/check_main_policies.py now fetches the current title and body from the API. If the PR head has moved, it refuses with PR head changed; run current CI, so a rerun can't validate commits it didn't check out. The job in ci.yml gets GH_TOKEN and pull-requests: read.

Not taken from #1550

The row-storage readiness change, its Postgres conformance test, the export-resolution tweak and the public API snapshot additions. 8.x has no reporting/ledger/row_storage.py.

Tests

• Four tests from fix(release): tighten V9 reporting and CI readiness checks #1550 in tests/test_main_release_policies.py: a rerun reads the corrected body; a rerun rejects a body that has become invalid; a moved head is refused; the workflow job has the permission and token.
• tests/test_main_release_policies.py and tests/conformance/signing/test_ip_pinned_transport.py: 82 passed.
• make lint and make typecheck-all pass. Full suite: 12992 passed, 2434 skipped, 1 xfailed.
• This PR's own "Validate conventional commit format" job runs the new code path against the live API.

🤖 Generated with Claude Code

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — clean backport to release/8.x with no blocking or medium findings.

Checked:

• Backport of #1576 (TLS test status tolerance) and the conventional-commit rerun fix from #1550.
• conventional() re-fetches PR title/body via the API under the existing 30s urlopen timeout; the require(current["head"]["sha"] == pr["head"]["sha"], ...) guard is fail-closed (a rerun on a moved head refuses rather than validating stale commits).
• Dispatch wiring (GH_TOKEN, pull-requests: read) present in ci.yml and asserted by the new tests; all four tests use existing helpers.
• No public adcp.* surface, generated code, credentials, forward-compat, or import-layering concerns. CI gates remain armed.

No author team gate, no gated paths, high_risk false. Rows 1–8 do not fire; falls through to row 9.