Release Review: DeviceIdentifier r3.2 (rc Sync26)

[camara-release-automation]

Release Review: r3.2 rc

This PR finalizes the reviewable release content for the active snapshot.

Edit and review this PR before merging it into the release snapshot. After Codeowner and Release Management approval, merging this PR creates the draft release.

Release contents

API	Version	Status	Comparison target
device-identifier	0.4.0-rc.1	rc	0.3.0

Dependencies: Commonalities r4.3, ICM r4.2

Codeowner Actions

Tick each box once done. Ticking the last box — "The release is ready for Release Management review" — starts the Release Management review.

• Update the CHANGELOG

  What to do:

  • Copy all API-consumer-relevant changes from the provided list into the appropriate Breaking changes / Added / Changed / Fixed / Removed sections for each API. List breaking changes both in Breaking changes and in their normal change category.
  • Do not copy administrative, tooling-only, or internal maintenance changes unless they affect API consumers.
  • For each API, fill the CHANGELOG against the stated comparison target, following the release-type rules at the top of the CHANGELOG.

• Document deferred validation warnings (and hints)

  What to do:

  • Check the CAMARA Validation comment on this PR for warnings and hints.
  • For each warning you do not fix, document it in an issue: include a copy of the validation summary line(s) and the reason the fix is deferred.
  • Document in the same way any validation hint that is applicable to the API and needs to be fixed later.
  • You may group several findings into one issue or split them across issues — either is fine.
  • List the documenting issue(s) in a comment on this PR.
  • Note: documenting deferred warnings is optional but recommended for alpha pre-releases, and mandatory for rc pre-releases and public releases.

• The release is ready for Release Management review

  Check that:

  • All mandatory release assets for the declared status(es) are present (see the table below "Required release assets per API status" by expanding the arrow);
  • API documentation and test cases are adequate for the target status.

  Tick this box to confirm readiness and to start the Release Management review.

Release Management Actions

The following actions and checks are done by a Release Management reviewer before approving the PR:

• Assign the Release Management reviewer(s) as assignee(s) of this PR
• CHANGELOG follows the release documentation rules
• Breaking changes are documented and version updates follow SemVer rules
• Mandatory release assets are present for each API according to its status
• All remaining validation warnings are documented in issues and the reasons for deferral are defensible

Required release assets per API status

Nr	Asset	alpha	rc	initial public	stable public
1	Release Plan	M	M	M	M
2	API Definition(s)	M	M	M	M
3	Commonalities compliance	O	M	M	M
4	API Documentation	M	M	M	M
5	User Stories	O	O	O	M
6	Test Cases (basic)	O	M	M	M
7	Test Cases (enhanced)	O	O	O	M
8	API Description	O	O	M	M

M = Mandatory, O = Optional — Full documentation

Valid next actions for codeowners

• Merge this PR when all Codeowner Actions and Release Management Actions are complete and the required approvals are present — creates the draft release
• Use /discard-snapshot <reason> in the Release Issue to discard this snapshot, return to planned, and update content on main

---

Snapshot: r3.2-581e2cc

[camara-validation]

CAMARA Validation — PASS

0 errors, 0 warnings, 2 hints | Profile: standard

View full results

[hdamker]

@eric-murray the three points from the review of the second snapshot and the closed issues:

---

The Changed entry for #167 calls out the ppid format tightening, which is right: ppid was unconstrained at 0.3.0, so a provider using base64, a UUID or a shorter digest was conformant and now is not.

The same applies to two more fields, which I would add as a sub-bullet under the same entry:

  * Tightening of `model` and `manufacturer` formats by adding `maxLength: 32`

These are free-text fields with no standard-defined length, so a provider returning a longer model or manufacturer string was conformant at 0.3.0 and is not now.

---

The remaining findings are recorded as sub-issues of #191:

• Missing test coverage for device disambiguation, consent denial, and identifier-type/length validation #195 — missing test coverage for device disambiguation, consent denial, and identifier-type/length validation
• Test definitions point at a Response Object where an OAS schema path is expected #200 — 200-response schema steps point at a Response Object rather than a schema
• Remaining documentation fixes from #192 (example key typo, README scope, TAC expansion) #201 — remaining documentation fixes from Documentation gaps and inconsistencies (Appendix A markers, README scope, typos) #192

---

The two hints are the same two as on #190 — S-313 on model and manufacturer in code/API_definitions/device-identifier.yaml. They were answered on #190 (both are free-text fields for which no pattern is planned, the only requirement being printable strings). Recording that here, since #190 is discarded and this PR is the release record.

---

None of the above is blocking the release, let me know if you want to go forward and keep them for the next release candidate (after r4.4 of Commonalities).