feat(issuing): add scheduled_revocation_date and update-card status

[armando-rodriguez-cko]

Summary
Adds card scheduled_revocation_date/status per the 2026-09-17 swagger delta (INT-1700), and reflects encrypted_cvv's removal from update-card-response (added by INT-1695, removed by this same delta). This SDK returns raw arrays for issuing card responses with no typed response classes, so the response-side change is test coverage, not a new type.

Changes

• lib/Checkout/Issuing/Cards/Create/CardRequest.php — add-card-request gains scheduled_revocation_date, revocation_date marked deprecated in the doc comment
• lib/Checkout/Issuing/Cards/Update/UpdateCardRequest.php — update-card-request gains scheduled_revocation_date and status
• test/Checkout/Tests/Issuing/Cards/CardsClientTest.php — coverage for the new request fields
• test/Checkout/Tests/Issuing/Cards/CardUpdateHeadersTest.php, CardsIntegrationTest.php — updated mocks/removed an integration test that asserted encrypted_cvv is still returned (no longer true against the live API)

API Reference

• POST /issuing/cards
• PATCH /issuing/cards/{cardId}

Breaking changes
update-card-response no longer includes encrypted_cvv (API-forced, minor per SDK, same precedent as INT-1695's activation_date rename).

README
No README changes needed.

🤖 Generated with Claude Code

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:All changes are non-destructive additions of new public fields to existing request DTOs and corresponding test updates, reusing existing endpoints and abstractions without introducing new types, auth changes, external integrations, or persisted data.

Operational gates

• ✅ jira_ticket (INT-1700)
• ✅ independent_review

Files analysed: 5

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — All changes are non-destructive additions of new public fields to existing request DTOs and corresponding test updates, reusing existing endpoints and abstractions without introducing new types, auth changes, external integrations, or persisted data.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:All changes are non-destructive additions of new public fields to existing request classes and corresponding test updates, reusing existing endpoints and abstractions without introducing new types, services, auth changes, or persisted data.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:All changes are non-destructive additions of new optional fields to existing request classes and a doc comment update, reusing existing endpoints and abstractions with no new integrations, persisted types, auth changes, or background processes.

Operational gates

• ✅ jira_ticket (INT-1700)
• ✅ independent_review

Files analysed: 6

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — All changes are non-destructive additions of new optional fields to existing request classes and a doc comment update, reusing existing endpoints and abstractions with no new integrations, persisted types, auth changes, or background processes.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:All changes are non-destructive additions of new optional fields to existing request classes and a doc comment update, reusing existing endpoints and abstractions with no new persisted types, auth changes, external integrations, or background processes.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}