Consent Scope and Expiry Governance - Prevent Schema Drift in BUILD_RECEIPT Rows 2026

Your ffprobe duration matrix was GREEN. Mux challenge M5 matched pre and post durations. Legal still blocked the July highlight reel because consent_scope in the WAV read highlight_reel while consent_log.csv still said fest_public_vo from last month’s playtest terms—and BUILD_RECEIPT.json promoted wav_consent_metadata_ok: true on a receipt schema your CI never validated.

June–July 2026 micro-studios automated VO consent metadata and waveform-level proof faster than they governed vocabulary. The new failure mode is not missing fields—it is schema drift: enums, expiry formats, and boolean columns that disagree across consent_log.csv, embedded WAV tags, cousin receipts, and Thursday BUILD_RECEIPT row review.

This Industry News & Analysis note defines consent scope and expiry governance—registry files, migration windows, and audit gates—so technical proof and legal audit read the same words. It does not replace the VO evening tutorial (export steps) or the top 20 receipts hub (index)—it owns cross-artifact schema discipline.

Non-repetition note: Zero Steam Next Fest metadata surface checklists. Distinct from iXML recovery case study (strip points) and ffprobe matrix (clocks). Primary keyword: consent scope expiry governance BUILD_RECEIPT schema drift.

Who this note is for

Time: 45 minutes read; half-day to publish first registry + migrate one build_label.
Prerequisites: Active playtest with facilitator VO; at least one of consent_log.csv, VO_CONSENT_METADATA_RECEIPT.json, or BUILD_RECEIPT.json.

Why this matters now (June–July 2026)

1. Automation outran vocabulary — Teams added wav_consent_metadata_ok and metadata_survives_mux_ok beside legacy playtest_clip_consent_ok without a single enum source.
2. Form version churn — Playtest terms updated for July reels; spreadsheets still reference April scope strings.
3. Expiry as string soup — 2027-12-31, 2027-12-31T23:59:59Z, and expires_after_fest coexist in different tools.
4. Publisher diligence — Q3 evidence packets join receipts; auditors compare column names, not waveforms.
5. AI VO pipelines — Model-generated WAVs copy field names from prompts; wrong enums pass ffprobe (matrix) and still fail legal.

Direct answer: Publish consent_schema_registry_v1.json, pin form_version on every consent row, run governance gates G1–G8, file consent_scope_governance_receipt_v1.json, and block BUILD_RECEIPT promotion when scope/expiry disagree across artifacts—even when mux and duration proofs are GREEN.

Industry pattern — schema drift without playback failure

consent_log.csv uses fest_public_vo (April)
        +
WAV embed uses highlight_reel (July playbook)
        +
BUILD_RECEIPT boolean true (stale receipt file)
        =
Audit FAIL, playback OK

H2 2026 observation: Micro-studios fixed technical gates (ffprobe, mux survival, design safe-zones) before fixing semantic gates. Legal reviews moved from “do we have a form?” to “do all systems use the same enum table on this build_label?”

Canonical field contract (four artifacts)

Beginner rule: If two cells disagree, playback truth loses to audit truth—re-export or fix CSV before public reel.

Developer rule: Never add ad-hoc scope strings in Audacity macros without registry bump—treat like API breaking changes.

consent_schema_registry_v1.json (source of truth)

Pin under release-evidence/governance/consent_schema_registry_v1.json:

{
  "schema": "consent_schema_registry_v1",
  "registry_version": "2026-05-playtest-july-v2",
  "effective_build_labels": ["playtest-july-2027-rc1"],
  "consent_scope_enum": [
    "highlight_reel",
    "internal_only",
    "press_review",
    "facilitator_raw_archive"
  ],
  "deprecated_scopes": {
    "fest_public_vo": {
      "replaced_by": "highlight_reel",
      "sunset_form_version": "playtest-april-2026-v1"
    }
  },
  "consent_expires_format": "YYYY-MM-DD",
  "expiry_policy": {
    "must_exceed_reel_publish_date": true,
    "grace_days_after_expiry": 0
  },
  "metadata_key_policy": "snake_case_v1",
  "wav_embed_keys": [
    "consent_record_id",
    "consent_scope",
    "consent_expires",
    "opt_out"
  ],
  "build_receipt_booleans": [
    "playtest_clip_consent_ok",
    "wav_consent_metadata_ok",
    "metadata_survives_mux_ok",
    "ffprobe_duration_matrix_ok"
  ],
  "form_version_enum": [
    "playtest-april-2026-v1",
    "playtest-july-2026-v2"
  ]
}

Working dev note: Version the registry file, not individual WAVs—WAVs reference form_version inside metadata when legal requires traceability.

Governance gates G1–G8

G2 — consent_log.csv governance (beginner path)

Required columns after July 2026 discipline:

Common mistakes:

G3 — WAV embed verification (developer path)

After VO tutorial V2–V3, add governance assert:

import json, csv
from pathlib import Path

REG = json.loads(Path("release-evidence/governance/consent_schema_registry_v1.json").read_text(encoding="utf-8"))
allowed = set(REG["consent_scope_enum"])

log = {r["consent_record_id"]: r for r in csv.DictReader(
    open("release-evidence/playtest/consent_log.csv", encoding="utf-8")
)}

# wav_fields: dict from your RIFF/iXML inspector keyed by consent_record_id
def assert_scope(wav_fields: dict) -> None:
    row = log[wav_fields["consent_record_id"]]
    if wav_fields["consent_scope"] not in allowed:
        raise ValueError(f"scope not in registry: {wav_fields['consent_scope']}")
    if wav_fields["consent_scope"] != row["consent_scope"]:
        raise ValueError("WAV scope != consent_log scope")
    if row["form_version"] not in REG["form_version_enum"]:
        raise ValueError(f"unknown form_version: {row['form_version']}")

Wire into pre-mux CI after technical gates—semantic failure should exit 2 with readable message.

Expiry governance (scope vs time)

Industry note: Teams confuse scope narrowing with opt_out. Narrowing scope requires re-export and registry-approved enum—not a silent spreadsheet edit.

Expiry vs fest calendar

Document buffer in registry expiry_policy—legal signs once, engineering enforces in CI.

Schema migration playbook (form_version bump)

When playtest terms change:

Do not flip wav_consent_metadata_ok true on old receipt paths after migration—auditors compare file mtimes.

Migration script sketch

DEPRECATED = {"fest_public_vo": "highlight_reel"}

def migrate_row(row: dict) -> dict:
    if row["consent_scope"] in DEPRECATED:
        row["consent_scope"] = DEPRECATED[row["consent_scope"]]
    row["form_version"] = "playtest-july-2026-v2"
    return row

Log every changed consent_record_id in MIGRATION_LOG.md for standup.

BUILD_RECEIPT column drift (G6)

Typical 2026 consent-related booleans:

Drift class A: Boolean true, receipt file missing.
Drift class B: Boolean true, receipt fields use deprecated scope.
Drift class C: Boolean false, marketing already uploaded reel.

Thursday row review gates R4–R7 on scope rows—add consent booleans to your row catalog template.

"consent_governance": {
  "consent_log_version": "playtest-july-2026-v2",
  "registry_version": "2026-05-playtest-july-v2",
  "governance_receipt": "release-evidence/governance/consent_scope_governance_receipt_v1.json"
}

consent_scope_governance_receipt_v1.json

{
  "schema": "consent_scope_governance_receipt_v1",
  "build_label": "playtest-july-2027-rc1",
  "registry_path": "release-evidence/governance/consent_schema_registry_v1.json",
  "registry_version": "2026-05-playtest-july-v2",
  "form_version_active": "playtest-july-2026-v2",
  "rows_in_consent_log": 12,
  "rows_scope_mismatch": 0,
  "rows_expiry_violation": 0,
  "wav_spot_check_count": 4,
  "wav_spot_check_pass": 4,
  "gates": {
    "G1_registry": "pass",
    "G2_consent_log": "pass",
    "G3_wav_embed": "pass",
    "G4_receipt_schema": "pass",
    "G5_expiry": "pass",
    "G6_build_receipt": "pass",
    "G7_thursday_diff": "pass",
    "G8_filed": "pass"
  },
  "consent_scope_governance_ok": true,
  "cousin_receipts": {
    "vo_consent_metadata": "release-evidence/audio/VO_CONSENT_METADATA_RECEIPT.json",
    "metadata_survives_mux": "release-evidence/audio/mux-challenge/latest/metadata_survives_mux_receipt_v1.json",
    "ffprobe_duration_matrix": "release-evidence/audio/ffprobe-matrix/ffprobe_duration_matrix_receipt_v1.json"
  },
  "public_reel_allowed": true
}

public_reel_allowed may be true only when consent_scope_governance_ok and cousin technical receipts agree.

Cross-link to reel design and disclaimers

Reel design R4 displays disclaimer text tied to build_label. If scope says internal_only but design template says public fest copy, governance fails even when typography passes.

Producer checklist: Design, legal, and registry must list the same surface name (fest_public, highlight_reel, etc.)—pick one vocabulary in registry appendix.

Facilitator and multi-channel contracts

Multi-channel facilitator contract should reference form_version in daily notes—facilitators must not invent scope strings in Discord.

AI-generated VO and backlog forward

Model pipelines should read registry JSON at generation time—not copy enums from last month’s prompt. #22 AI voice QA reason-codes triages wrong tags (G1–G8); this note handles approved vocabulary.

Comparison — governance vs cousin articles

Stakeholder RACI (July 2026 spine)

A = accountable, R = responsible, C = consulted, I = informed.
Beginner translation: Legal owns words; audio owns bytes; producer owns the registry file living in git.

Three drift scenarios (walkthrough)

Scenario A — Deprecated scope in log only

Triage: G2 FAIL—run migration script; re-export WAV; set boolean false until new receipt.
Not a mux bug—do not open ffmpeg tickets.

Scenario B — Expiry before reel date

Triage: G5 FAIL—legal extends expiry or narrows surface to internal_only and removes line from public manifest.
ffprobe matrix may still PASS—do not confuse clocks with consent dates.

Scenario C — Stale boolean after toolchain GREEN

Triage: G6 FAIL—reset booleans; re-run cousin receipts under new form_version.
Thursday row review catches this if consent columns are in the catalog.

jq CI asserts (registry-aware)

REG=release-evidence/governance/consent_schema_registry_v1.json
SCOPE=$(jq -r '.consent_scope' release-evidence/audio/VO_CONSENT_METADATA_RECEIPT.json)
jq -e --arg s "$SCOPE" '.consent_scope_enum | index($s)' "$REG"

FV=$(jq -r '.form_version_active' release-evidence/governance/consent_scope_governance_receipt_v1.json)
jq -e --arg f "$FV" '.form_version_enum | index($f)' "$REG"

Exit non-zero on failure—message should print registry_version for support.

Quarterly registry review calendar

Pair monthly review with Friday Block 5 evidence hygiene—archive superseded registry files under release-evidence/governance/archive/.

Publisher and platform diligence questions (2026)

Questions micro-studios should answer without opening Audacity:

1. Where is the enum source of truth for consent_scope?
2. What form_version applies to this build_label?
3. How do you detect deprecated scopes in old CSV rows?
4. What resets BUILD_RECEIPT booleans after a terms change?
5. Show governance receipt beside VO and mux cousin receipts.

PQ3 diligence packets that omit (5) get follow-up emails—even when demo smoke is GREEN.

OBS video consent vs WAV scope (do not merge)

Governance rule: highlight_reel on video does not imply highlight_reel on VO—both rows must exist in consent_log.csv with matching IDs.
OBS highlight preflight stays video-only.

Workshop — half-day registry install

Exit criterion: Team can recite difference between Drift class A/B/C without opening slides.

Surface vocabulary appendix (reduce design/legal drift)

Publish a one-page surface_vocabulary_v1.md beside the registry:

Beginner mistake: Using fest_public as a consent_scope value—registry should reject it at G2 CI.

Dual-audience quick start

Beginners (30 minutes):

1. Open consent_log.csv and confirm form_version column exists.
2. Compare one row’s consent_scope to VO tutorial field list.
3. If strings differ, stop public reel—ask legal which enum is correct.
4. File a ticket; do not edit WAV by hand without audio lead.

Developers (same day):

1. Commit registry JSON.
2. Add jq asserts to CI.
3. Wire governance receipt generation into mux night script.
4. Extend Thursday row review catalog with four consent booleans.

Incident response — scope mismatch discovered post-upload

Document in MIGRATION_LOG.md—partners may ask weeks later.

Contract with ten-minute ritual (#23)

Ritual is fast; registry is correct—the ritual runs after registry enums are decided, so you flip wav_consent_metadata_ok only on scope/expiry-aligned WAV bytes.

Evidence folder layout

release-evidence/governance/
  consent_schema_registry_v1.json
  archive/
    consent_schema_registry_v1-2026-04.json
  consent_scope_governance_receipt_v1.json
  MIGRATION_LOG.md
release-evidence/playtest/
  consent_log.csv

Industry signals (June–July 2026, qualitative)

Teams report three recurring phrases in compliance threads:

• “Playback is fine” — usually means technical receipts GREEN, governance not run.
• “We copied metadata” — often means spreadsheet copy, not re-export (metadata-as-artifact opinion #21).
• “Same UUID” — necessary but not sufficient; scope must match.

No invented metrics—pattern synthesis from public facilitator forums and partner intake checklists.

opt_out and scope interaction matrix

Automate this table in CI as public_surface_allowed(scope, opt_out)—do not rely on producer memory during upload night.

Auditor readout (what legal receives)

Zip without game repo:

1. consent_schema_registry_v1.json
2. Redacted consent_log.csv
3. consent_scope_governance_receipt_v1.json
4. Spot-check proof for one WAV
5. BUILD_RECEIPT excerpt (consent booleans only)

Auditors validate enums and dates—not DAW brand.

Key takeaways

1. Schema drift breaks audits while playback still works—govern vocabulary before adding more booleans.
2. consent_schema_registry_v1.json is the enum source of truth for scope, expiry format, and form versions.
3. form_version bumps trigger re-export and receipt reset—not spreadsheet-only edits.
4. Scope ≠ expiry ≠ opt_out—three different gates; do not merge in standup language.
5. BUILD_RECEIPT booleans must point at receipts validated under the active registry.
6. Pair G1–G8 with Thursday row review and the top 20 hub.
7. Deprecated scopes need explicit replaced_by in registry—no silent find-replace in CSV.
8. CI should assert registry membership before mux night.
9. Lesson 250 owns BUILD_RECEIPT milestone; this note owns cross-file enum discipline.
10. Pair with #21 metadata-as-artifact opinion for standup language; use #23 ten-minute ritual as the pre-mux promotion gate.
11. Archive superseded registry JSON under governance/archive/—never delete without migration log entry.
12. Treat registry bumps like API semver for consent fields.

FAQ

Is this legal advice

No—it's an engineering governance pattern; legal approves enums and expiry rules you encode in the registry.

Can we use camelCase in WAV tags

Only if registry metadata_key_policy changes—default July spine is snake_case_v1 per VO tutorial.

What if one line is press_review and others highlight_reel

Allowed—each row carries its own scope; reel manifest must not mux internal_only lines into public cuts.

Do we version the registry per game or per studio

Studio-wide registry with effective_build_labels array is typical; fork only when titles diverge on legal terms.

How often to bump form_version

When playtest terms change—not on every build_id.

Can governance pass if ffprobe matrix fails

No—governance is necessary, not sufficient; technical cousin receipts must also be GREEN.

Where does consent_log live

Default release-evidence/playtest/consent_log.csv—same spine as release evidence taxonomy.

Should publishers see deprecated scopes

Yes in migration logs—proves you did not silently rename without participant notice.

Relationship to BUILD_RECEIPT beginner tutorial

Adopt first BUILD_RECEIPT evening week one; add registry by week three when VO consent cluster goes live.

What blocks public_reel_allowed

consent_scope_governance_ok: false OR any cousin receipt blocking OR opt_out on any manifest line.

Can we store registry in Notion instead of git

No—CI and auditors need versioned JSON in release-evidence/; Notion may link to git hash only.

How does this relate to Lesson 243 and 250

243 governs video clip consent receipts; 250 governs VO BUILD_RECEIPT milestone—registry covers both field vocabularies where they share consent_record_id.

What if Steam playtest terms differ from fest reel terms

Use separate form_version values in registry; never mix rows in one CSV without form_version column.

Should facilitators sign form_version

Yes—add to facilitator contract acknowledgment line.

Can we auto-promote scope from internal to highlight_reel

Only with new participant consent row—governance migration is not a substitute for legal approval.

What is the minimum team size to maintain a registry

One producer plus legal consult quarterly—solo devs can run G1–G8 with a half-day install and Thursday diffs.

Does governance replace legal review of playtest terms

No—it ensures engineering artifacts use the same words legal already approved in those terms.

Govern consent scope and expiry like an API—registry enums, migration discipline, and BUILD_RECEIPT rows that agree with WAV bytes before the next July reel upload. Re-run G1–G8 whenever form_version changes, not only when ffmpeg changes.