[github-actions]

Automated regeneration of beta/openapi.beta.yaml (the embedded dci beta
command surface) detected drift against the source spec. Review the shape
changes below; merging updates what the next release embeds.

If an operation listed in beta/manifest.yaml disappeared from the source
spec, the generator fails instead of opening this PR — that case needs a
manifest edit (likely a GA promotion; see BETA-SPEC.md §2.8).

[claude]

Besides the inline findings, I checked two other things and neither is a problem. The new example URLs in the async results examples use placeholder values for the customer segment, the report ID and the signature. Also, no CLI code or command doc reads the old createdAt field, so renaming it to createTime breaks nothing.

Extended reasoning...

This is a generated regeneration of beta/openapi.beta.yaml only. The inline findings already flag the issues that need attention. This note only records two concerns that were checked and ruled out: possible tenant identifiers in the new example URLs, and the createdAt-to-createTime rename breaking CLI code.

[claude]

🔴 Users of the embedded dci beta spec would see what look like real attribution IDs in the report config example, where the base branch shows synthetic placeholders. The regeneration swapped ExampleAttribution10/ExampleAttribution20 for two realistic 20-character IDs copied from the upstream dev spec. That breaks the tenant-identifier hygiene rule for OpenAPI examples. Fix: make tools/betaspec replace example attribution values with synthetic placeholders when it generates the file (or fix the upstream example), then regenerate. Do not hand-edit the generated file. Check whether these IDs already exist in published history.

Why this was flagged

This PR regenerates beta/openapi.beta.yaml from the upstream dev spec. At beta/openapi.beta.yaml:882-883 the ExternalConfig example's attribution filter values changed from the synthetic ExampleAttribution10/ExampleAttribution20 to two realistic-looking Firestore-style 20-character IDs. The generator tools/betaspec/main.go has no example sanitization step (no match for example/sanitiz/scrub), so it copies whatever upstream publishes. The file is embedded as the dci beta command surface, so the next release would ship these IDs in the binary and in schema/help output. .agents/skills/tenant-identifier-hygiene/SKILL.md requires synthetic IDs in OpenAPI examples and generated artifacts, and says CI does not catch this. The base branch ships only synthetic placeholders here. If the IDs are real, merging publishes tenant-linked identifiers that a later cleanup commit cannot remove from history.

Verification: Trigger: this regeneration ships as-is, and the file is embedded into the CLI by //go:embed beta/openapi.beta.yaml (beta_commands.go:36). In the ExternalConfig example at beta/openapi.beta.yaml:879-884, the attribution filter values changed from the synthetic ExampleAttribution10/ExampleAttribution20 to two Firestore-style 20-character IDs. tools/betaspec contains no sanitization or example-rewriting step.

[claude]

🔴 In the default table output and in --output csv, the new --file-output flag on dci beta get-report-results never prints the signed URL it exists to return. The spec adds a top-level fileOutput string beside result. The table renderer (main.go:2851) and the CSV renderer (csv_output.go:25) keep only result.rows via extractGetReportRows (main.go:3150), so the URL is dropped without any message. Fix: print fileOutput whenever a non-JSON format drops it, for example a stderr note like notePageTokenDropped, while stdout stays pure CSV. That change is in Go, outside this spec-only PR. [also at: beta/openapi.beta.yaml:365 - Users who run dci beta get-report-results with --file-output in a terminal get a rows table but never see the download URL they asked for.]

Why this was flagged

After merge, the generated beta command takes a --file-output pdf|png|csv flag. beta_commands.go:265-272 turns every query param into a flag and forwards it. A user in a terminal runs dci beta get-report-results <op-id> --file-output pdf, and the format defaults to table (defaultOutputFormat, main.go:1370). The response reaches dciTableContentType.Marshal (main.go:2845), which calls toTableRows. That call goes to extractGetReportRows (main.go:3150-3203), which builds rows only from result.rows and drops every top-level key, including fileOutput. CSV output (csv_output.go:16-31) uses the same path. The API renders the file and signs a 7-day URL, but the user sees only the data table, with no hint that a URL came back. On the base branch the parameter does not exist, so nothing is lost. The only existing safeguard, notePageTokenDropped (pagination.go:441), warns only about a dropped pageToken on list wrappers. It says nothing for fileOutput. Only --output json, yaml or toon show the URL.

Verification: Trigger: a user runs dci beta get-report-results --file-output with the default table output or with --output csv. extractGetReportRows (main.go:3150-3203) returns only rows built from result.rows/results.rows, so every top-level sibling is discarded, fileOutput included. The only stderr note is notePageTokenDropped (pagination.go:441), and it covers pageToken, not fileOutput.