fix(canopy): skip the verification report when the declaration label is absent

[julianam-w]

main does not currently build. This restores it.

Cause

bestool-canopy does not ship its wire types — its build.rs fetches canopy's OpenAPI document live at build time from meta.tamanu.app. Cargo.lock pins the crate version; it cannot pin the spec.

Canopy made replica_id required on VerificationArgs sometime after 2026-08-11. bon only emits maybe_<field> setters for optional fields, so .maybe_replica_id(...) stopped existing:

error[E0599]: no method named `maybe_replica_id` found for struct `VerificationArgsBuilder<...>`
  --> src/controllers/canopy/verification.rs:148:4
help: there is a method `replica_id` with a similar name

No source change and no lockfile change was involved. CI was last green on ce0aa08 (2026-08-11); GitHub evicts build caches after roughly 7 days idle, so the next cold build recompiled bestool-canopy against the changed spec and broke. Verified: origin/main at ce0aa08 fails to build on Linux today from a clean target dir with exactly this error and nothing else.

The committed openapi.snapshot.json fallback is not a workaround — it is now stale in the other direction. Forcing it with CANOPY_OPENAPI_OFFLINE=1 gives four different errors (MigrationArgs/MigrationTimingArgs unresolved, maybe_migration missing, no field target_version). The repo currently builds against neither the live spec nor the snapshot.

Fix

replica_id comes from the DECLARATION_ID label and was previously optional. Now that canopy requires it, a report without one cannot be constructed at all, so guard the label exactly as GROUP and SERVER already are: warn and skip the report.

The alternative — sending Uuid::nil() — was rejected deliberately. Canopy keys worklist state on replica_id, so a nil identity is worse than no report.

Note

This is a structural fragility, not a one-off: any canopy spec change can break this build with no commit here. Worth a follow-up on whether CANOPY_OPENAPI_OFFLINE plus a refreshed committed snapshot should be the default in CI, so builds are reproducible against a pinned spec instead of whatever the network returns.

🤖 Generated with Claude Code