chore: ingest jamfplatform-go-sdk v1.0.0

[neilmartin83]

Specs and the Go module both, at one tag.

The go.mod half

make sync-platform-specs-from-sdk only ever copied api/ and re-derived the manifests — nothing bumps the SDK as a Go dependency. go.mod had drifted to v0.20.1 while the committed specs came from v0.22.2. Harmless in practice, because the CLI drives the gateway through the SDK's transport rather than its generated methods, so a spec ahead of the library costs nothing until a hand-written call site wants a method the pinned version lacks. Both now name the same revision, and CLAUDE.md records the second step so the next ingest is two commands rather than one.

One spec moved

ai_governance_policies_api.json → build v2121, which adds an ETag/If-Match optimistic-concurrency protocol to the policies API: PolicyDetail.version, an ETag on the detail GET, If-Match on PATCH, 409 POLICY_VERSION_CONFLICT. All of it enforced on the wire.

Only the read half is reachable from here, and that is the one real capability gap this ingest opens. The platform emitter renders query parameters only, so a declared in: header parameter produces no flag and no error — the same silence that correctly costs audit's X-Environment-Id a flag. So platform ai-policies patch and apply send no If-Match and are always unconditional; a concurrent draft edit still silently wins last-writer. Closing it means teaching generator/platform/emitter.go header parameters, which is deliberately not in this PR. Worth knowing the SDK had to grow the same concept for the same reason: its generator never inspected a parameter's In, so an If-Match entry would have been emitted as a query key the server ignores, turning a conditional update into an unconditional one with nothing failing anywhere.

Also declared at v2121, all diagnostic only (nothing in the CLI reads a response declaration):

• ApiError.httpStatus required. CLAUDE.md had this API's envelope as {traceId, errors} without it, unlike the gateway's — that was a spec gap rather than a second envelope shape, and the wire has always sent it. Note corrected.
• 422 SCHEMA_VERSION_UNKNOWN on the tool-schema read, which CLAUDE.md recorded as this surface's one undeclared status.
• 400 BadRequest on four reads; x-preview: true / x-preview-owners at the root, plus Jamf-Preview: true on every 2xx.

One declaration to distrust. 409 POLICY_IN_USE on delete is new, and it reaches ai-policies delete --help verbatim — the only generated-code change in the drop. It contradicts the 2026-08-30 full-surface probe, which found archiving a blueprint-referenced policy answering a clean 204 and leaving the blueprint pointing at a policy nothing can read. Nothing has re-probed it. Wrong in the safe direction (it warns about a refusal that may not happen), but recorded as a declaration rather than a fact.

One Pro operation arrived

pro_api.json goes 476/700 → 477/701: v2121 restored GET /v1/mdm/commands (device-actions:read), the second reversed v1942 withdrawal after v2082's /v3/computers-inventory, and a verbatim revert of the pre-v1942 entry with no schema change.

It reaches no command. deduplicateVersionedOps keeps GET /v2/mdm/commands, which the gateway already published, so the refusal table did not move and the shipped binary still refuses 59. POST /v2/mdm/commands stays unpublished. Recorded anyway because the spec is wrong about the v1 path in both directions — it is a two-parameter point lookup rather than a list, both parameters are marked optional, and sending neither answers 400 while sending both answers 500, each with an empty errors array and no attribution.

Verification

make test, go vet ./..., make lint (0 issues), and all four CI-safe guards: verify-generated, verify-gateway-coverage, verify-classic-schemas, verify-platform-specs.

🤖 Generated with Claude Code