[purpshell]

Summary

Ban Credit claims gain two verdicts, linked_device_interactive and referral_group_send, plus the evidence flags linkedDeviceInteractive and referralGroupSend (polymorfa/polymorfa#845). All six server SDKs now type them on claim reads and bansafe.claim webhooks.

• Rust: ClaimVerdict and the webhook BanSafeClaimVerdict are closed serde enums. Before this change, a claim or webhook carrying either new verdict failed to deserialize.
• Go and C#: the verdict was already a string. The evidence struct and record now carry the two flags, which were dropped before.
• TypeScript, Python and PHP: the verdict unions, Literal types and phpstan shapes add both values. The evidence types add both flags. Runtime decoding was already pass-through.
• Source compatibility: code needs the added members in these cases:
  • Rust exhaustive match on the verdict enums and ClaimEvidence struct literals
  • Go unkeyed BanSafeClaimEvidence literals
  • the C# BanSafeClaimEvidence constructor and Deconstruct

contracts/ban-credit-waivers.json pins the verdict enums and evidence fields to API source 5ccd3dcb (#845 head), with published: false.

Verification

• TypeScript:
  • ban-credit-waivers-contract.test.ts checks the exhaustive verdict maps and evidence types against the pinned spec.
  • npm run typecheck, eslint and prettier --check . pass.
  • node scripts/check-native-coverage.mjs and npm run check:coverage report no gaps.
• Rust: tests/ban_credit_waivers.rs round-trips both verdicts on both enums and the evidence. Full cargo test passes (289), and cargo fmt --check is clean.
• Go: ban_credit_waivers_test.go passes, along with the full go test ./... and gofmt.
• Python: test_ban_credit_waivers.py passes, along with the full pytest run (1709), mypy and ruff.
• C#: the BanSafe wire test reads waived claims through GetClaimAsync and decodes the webhook payload. --bansafe-only and --simultaneous-calls-only pass, and dotnet format is clean for changed files.
• PHP, in the package's Dockerfile.test image (PHP 8.2):
  • lint and phpstan pass.
  • the BanSafe native wire suite passes with the added waived-claim case (18 fixtures).
  • the later framework-host step in tests/run.php needs examples/php/web-host dependencies that were not installed locally.
• Full vitest: packages/elements/test/native-bridges.test.ts fails in the same 5 cases on main. Not related to this change.

Release status

Source only. The API change (#845) is a draft and unmerged. Re-pin the supplement to the merged API revision, and wait for staging acceptance, before any package includes this.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Current source status, 28 October 2026

Head b64683984be4efef665e6680eea276ed266530aa remains source-only and blocked. Snippet inventory and native package receipt/version checks are red in runs40259917416/40259917460; no rerun or publication was requested. Re-pin after the final #845 producer, then qualify all six SDKs and the CLI against it. Matching staging/production and registry installation gates remain. Source-pinned dependency and internal impact evidence. Release coordinates merge slot/executor; no current approval or merge is claimed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}