@adcp/sdk 13.0.0-rc.14 → 13.0.0-rc.16

package/ADCP_VERSION

@@ -1 +1 @@
-3.1.11
+3.1.13

package/bin/adcp.js

@@ -1450,6 +1450,195 @@ function loadTestKitFile(testKitPath) {
   }
 }
 
+class TestKitComplianceSelectionError extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = 'TestKitComplianceSelectionError';
+    this.code = 'TEST_KIT_COMPLIANCE_VERSION_MISMATCH';
+    this.details = details;
+  }
+}
+
+function complianceVersionFromIndex(index, indexPath) {
+  const declared = index?.adcp_version;
+  const published = index?.published_version;
+  const { resolveBundleKey } = require('../dist/lib/validation/schema-loader.js');
+  const isConcreteVersion = value => {
+    if (typeof value !== 'string' || value.length === 0 || value === 'latest') return false;
+    try {
+      resolveBundleKey(value);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const concreteDeclared = isConcreteVersion(declared);
+  const concretePublished = isConcreteVersion(published);
+  if (concreteDeclared && concretePublished && declared !== published) {
+    throw new TestKitComplianceSelectionError(
+      `Compliance metadata at ${indexPath} disagrees internally: adcp_version is ${declared}, ` +
+        `but published_version is ${published}. Refusing to select an ambiguous compliance line.`,
+      { test_kit_index: indexPath, adcp_version: declared, published_version: published }
+    );
+  }
+  if (concreteDeclared) return declared;
+  if (concretePublished) return published;
+  return null;
+}
+
+function readComplianceMetadata(complianceDir, resolveOptions = {}) {
+  const fs = require('node:fs');
+  const indexPath = path.join(path.resolve(complianceDir), 'index.json');
+  if (!fs.existsSync(indexPath)) return null;
+  let index;
+  try {
+    index = JSON.parse(fs.readFileSync(indexPath, 'utf8'));
+  } catch (err) {
+    throw new TestKitComplianceSelectionError(`Failed to read compliance metadata at ${indexPath}: ${err.message}`, {
+      test_kit_index: indexPath,
+    });
+  }
+  const hasVersionMetadata = index?.adcp_version !== undefined || index?.published_version !== undefined;
+  const looksLikeComplianceIndex =
+    hasVersionMetadata ||
+    index?.generated_at !== undefined ||
+    Array.isArray(index?.universal) ||
+    Array.isArray(index?.protocols) ||
+    Array.isArray(index?.specialisms);
+  if (!hasVersionMetadata) {
+    if (!looksLikeComplianceIndex) return null;
+    throw new TestKitComplianceSelectionError(
+      `Compliance metadata at ${indexPath} is missing adcp_version and published_version. ` +
+        `Refusing to run before the test-kit line is known.`,
+      { test_kit_index: indexPath, adcp_version: null, published_version: null }
+    );
+  }
+  let version = complianceVersionFromIndex(index, indexPath);
+  if (!version) {
+    try {
+      const { loadComplianceIndex } = require('../dist/lib/testing/storyboard/index.js');
+      version = loadComplianceIndex({
+        complianceDir: path.dirname(indexPath),
+        ...(resolveOptions.schemaRoot && { schemaRoot: resolveOptions.schemaRoot }),
+      }).adcp_version;
+    } catch (err) {
+      throw new TestKitComplianceSelectionError(
+        `Unable to resolve a concrete compliance version from ${indexPath}: ${err.message}`,
+        {
+          test_kit_index: indexPath,
+          adcp_version: index?.adcp_version ?? null,
+          published_version: index?.published_version ?? null,
+          ...(resolveOptions.schemaRoot && { schema_root: path.resolve(resolveOptions.schemaRoot) }),
+        }
+      );
+    }
+  }
+  return version ? { version, complianceDir: path.dirname(indexPath), indexPath } : null;
+}
+
+function findTestKitComplianceMetadata(testKitPath, resolveOptions = {}) {
+  const fs = require('node:fs');
+  const resolved = fs.realpathSync(testKitPath);
+  let current = path.dirname(resolved);
+  while (true) {
+    const metadata = readComplianceMetadata(current, resolveOptions);
+    if (metadata) return metadata;
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return null;
+}
+
+function prepareTestKitComplianceSelection(args, opts) {
+  if (!opts.testKitPath) return { args, opts };
+
+  const resolvedTestKitPath = path.resolve(opts.testKitPath);
+  const loadedTestKit = loadTestKitFile(resolvedTestKitPath);
+  const testKitMetadata = findTestKitComplianceMetadata(resolvedTestKitPath, opts);
+  if (!testKitMetadata) return { args, opts: { ...opts, loadedTestKit } };
+
+  const explicitVersion = opts.complianceVersion;
+  if (explicitVersion && explicitVersion !== testKitMetadata.version) {
+    throw new TestKitComplianceSelectionError(
+      `--test-kit at ${resolvedTestKitPath} targets AdCP ${testKitMetadata.version} ` +
+        `(metadata: ${testKitMetadata.indexPath}), but --compliance-version ${explicitVersion} was specified. ` +
+        `Drop --compliance-version to auto-select the test-kit line, or select matching inputs.`,
+      {
+        test_kit_path: resolvedTestKitPath,
+        test_kit_index: testKitMetadata.indexPath,
+        test_kit_version: testKitMetadata.version,
+        compliance_version: explicitVersion,
+        compliance_version_source: '--compliance-version',
+      }
+    );
+  }
+
+  if (opts.complianceDir) {
+    const selectedMetadata = readComplianceMetadata(opts.complianceDir, opts);
+    if (!selectedMetadata) {
+      throw new TestKitComplianceSelectionError(
+        `--compliance-dir ${path.resolve(opts.complianceDir)} has no index.json with resolvable ` +
+          `adcp_version or published_version metadata. Refusing to run before the active storyboard line is known.`,
+        {
+          test_kit_path: resolvedTestKitPath,
+          test_kit_index: testKitMetadata.indexPath,
+          test_kit_version: testKitMetadata.version,
+          compliance_dir: path.resolve(opts.complianceDir),
+          compliance_version_source: '--compliance-dir',
+        }
+      );
+    }
+    if (selectedMetadata.version !== testKitMetadata.version) {
+      throw new TestKitComplianceSelectionError(
+        `--test-kit at ${resolvedTestKitPath} targets AdCP ${testKitMetadata.version} ` +
+          `(metadata: ${testKitMetadata.indexPath}), but --compliance-dir ${path.resolve(opts.complianceDir)} ` +
+          `targets AdCP ${selectedMetadata.version} (metadata: ${selectedMetadata.indexPath}). ` +
+          `Select a compliance directory from the same published line.`,
+        {
+          test_kit_path: resolvedTestKitPath,
+          test_kit_index: testKitMetadata.indexPath,
+          test_kit_version: testKitMetadata.version,
+          compliance_dir: path.resolve(opts.complianceDir),
+          compliance_index: selectedMetadata.indexPath,
+          compliance_version: selectedMetadata.version,
+          compliance_version_source: '--compliance-dir',
+        }
+      );
+    }
+  }
+
+  const inferredVersion = explicitVersion || testKitMetadata.version;
+  const inferredComplianceDir = opts.complianceDir || testKitMetadata.complianceDir;
+  const resolvedArgs = [...args];
+  if (!explicitVersion) resolvedArgs.push('--compliance-version', inferredVersion);
+  if (!opts.complianceDir) resolvedArgs.push('--compliance-dir', inferredComplianceDir);
+
+  return {
+    args: resolvedArgs,
+    opts: {
+      ...opts,
+      loadedTestKit,
+      complianceVersion: inferredVersion,
+      complianceDir: inferredComplianceDir,
+      testKitComplianceVersion: testKitMetadata.version,
+      testKitComplianceIndex: testKitMetadata.indexPath,
+    },
+  };
+}
+
+function exitTestKitSelectionError(error, jsonOutput) {
+  const message = error instanceof Error ? error.message : String(error);
+  const code = error?.code || 'TEST_KIT_LOAD_FAILED';
+  const details = error?.details || {};
+  if (jsonOutput) {
+    process.stdout.write(`${JSON.stringify({ success: false, error: { code, message, ...details } })}\n`);
+  } else {
+    console.error(`ERROR: ${message}`);
+  }
+  process.exit(2);
+}
+
 async function resolveAgent(agentArg, authToken, protocolFlag, jsonOutput, authScheme = null) {
   let agentUrl;
   let protocol = protocolFlag;
@@ -1779,7 +1968,9 @@ RUN OPTIONS (full assessment):
   --compliance-version VERSION
                       Select a compliance cache version, e.g. 3.0.12 or
                       3.1.0-beta.3. The runner uses this cache for
-                      storyboard resolution and wire-version defaults.
+                      storyboard resolution and wire-version defaults. When
+                      --test-kit points into a compliance cache, its version is
+                      selected automatically; an explicit mismatch is rejected.
   --compliance-dir PATH
                       Use a specific compliance cache directory
   --schema-root PATH  Use a specific schema bundle/root for validation.
@@ -1788,6 +1979,9 @@ RUN OPTIONS (full assessment):
                       Hosted badge mode: allow a stable line (e.g. 3.1)
                       to resolve against a prerelease compliance cache.
   --file PATH         Run an ad-hoc storyboard YAML (spec evolution)
+  --test-kit PATH     Load test-kit YAML. If an ancestor index.json declares
+                      adcp_version or published_version, the same compliance
+                      line is required for storyboard resolution.
   --timeout SECONDS   Soft budget in seconds: stop starting new storyboards
                       after this budget, without aborting an active storyboard
                       (default: 120)
@@ -2429,8 +2623,8 @@ function enforceStrictFlags(args, removedFound) {
 }
 
 async function handleStoryboardRun(args) {
-  const opts = parseAgentOptions(args);
-  const {
+  let opts = parseAgentOptions(args);
+  let {
     authToken,
     authScheme,
     protocolFlag,
@@ -2444,6 +2638,26 @@ async function handleStoryboardRun(args) {
 
   enforceStrictFlags(args, warnRemovedFlags(args));
 
+  try {
+    const prepared = prepareTestKitComplianceSelection(args, opts);
+    args = prepared.args;
+    opts = prepared.opts;
+  } catch (err) {
+    exitTestKitSelectionError(err, jsonOutput);
+  }
+
+  ({
+    authToken,
+    authScheme,
+    protocolFlag,
+    jsonOutput,
+    dryRun,
+    positionalArgs,
+    file: filePath,
+    localAgent,
+    format,
+  } = opts);
+
   // --local-agent <module>: spin the agent up in-process, seed fixtures,
   // run storyboards, tear down. Collapses the 300-line seller-side
   // bootstrap into one command. See `runAgainstLocalAgent` in
@@ -2606,15 +2820,7 @@ async function handleStoryboardRun(args) {
     ? await resolveWebhookReceiverOptions(args, { jsonOutput })
     : webhookReceiverBase;
 
-  let loadedTestKit = null;
-  if (opts.testKitPath) {
-    try {
-      loadedTestKit = loadTestKitFile(opts.testKitPath);
-    } catch (err) {
-      console.error(`ERROR: ${err.message}`);
-      process.exit(2);
-    }
-  }
+  const loadedTestKit = opts.loadedTestKit ?? null;
 
   const options = {
     protocol,
@@ -3464,13 +3670,14 @@ async function handleLocalAgentStoryboardRun(modulePath, args, opts) {
       createAgent,
       storyboards: storyboardsSpec,
       compliance: resolveOptions,
-      ...(opts.complianceVersion || opts.schemaRoot || opts.noSandbox || opts.assertsSeededState
+      ...(opts.complianceVersion || opts.schemaRoot || opts.noSandbox || opts.assertsSeededState || opts.loadedTestKit
         ? {
             runStoryboardOptions: {
               ...(opts.complianceVersion && !opts.complianceDir && { adcpVersion: opts.complianceVersion }),
               ...(opts.schemaRoot && { schemaRoot: opts.schemaRoot }),
               ...(opts.noSandbox && { sandbox: false, disable_sandbox: true }),
               ...(opts.assertsSeededState && { assertsSeededState: true }),
+              ...(opts.loadedTestKit && { test_kit: opts.loadedTestKit }),
             },
           }
         : {}),
@@ -3887,6 +4094,7 @@ async function handleMultiInstanceStoryboardRun(args, opts, urls) {
     ...(opts.schemaRoot && { schemaRoot: opts.schemaRoot }),
     ...(opts.noSandbox && { sandbox: false, disable_sandbox: true }),
     ...(opts.assertsSeededState && { assertsSeededState: true }),
+    ...(opts.loadedTestKit && { test_kit: opts.loadedTestKit }),
   };
 
   const restoreLogs = jsonOutput ? captureStdoutLogs() : null;
@@ -4150,6 +4358,7 @@ async function handleAgentsRoutedStoryboardRun(args, opts, routing) {
     ...(opts.schemaRoot && { schemaRoot: opts.schemaRoot }),
     ...(opts.noSandbox && { sandbox: false, disable_sandbox: true }),
     ...(opts.assertsSeededState && { assertsSeededState: true }),
+    ...(opts.loadedTestKit && { test_kit: opts.loadedTestKit }),
   };
 
   const restoreLogs = jsonOutput ? captureStdoutLogs() : null;
@@ -4341,15 +4550,7 @@ async function runFullAssessment(agentArg, rawArgs, parsedOpts) {
 
   await loadInvariantModules(rawArgs);
 
-  let loadedTestKit = null;
-  if (opts.testKitPath) {
-    try {
-      loadedTestKit = loadTestKitFile(opts.testKitPath);
-    } catch (err) {
-      console.error(`ERROR: ${err.message}`);
-      process.exit(2);
-    }
-  }
+  const loadedTestKit = opts.loadedTestKit ?? null;
 
   const testOptions = {
     protocol,

package/compliance/cache/{3.1.11.previous/protocols → 3.1.13/domains}/media-buy/scenarios/create_media_buy_async.yaml

@@ -4,6 +4,15 @@ title: "Seller returns submitted task envelope when create_media_buy goes async"
 category: media_buy_seller
 summary: "Verifies the AdCP-payload wire shape of the submitted-arm response from create_media_buy: status='submitted', task_id present, no media_buy_id and no packages on the envelope."
 track: media_buy
+
+# The submitted response arm is a production protocol path, but forcing a
+# seller into it is a sandbox-only compliance capability. Gate the entire
+# storyboard on the controller scenario advertisement so sellers that cannot
+# deterministically exercise this path skip before phase execution.
+requires_capability:
+  path: compliance_testing.scenarios
+  contains: force_create_media_buy_arm
+
 required_tools:
   - create_media_buy
   - comply_test_controller
@@ -33,9 +42,9 @@ narrative: |
   buys synchronously. To make this storyboard runnable across implementations, the test
   harness uses comply_test_controller force_create_media_buy_arm to drive the next
   create_media_buy call into the submitted arm. The directive is keyed to the caller's
-  authenticated sandbox account (account + principal pair); sellers that do not implement
-  the controller scenario return UNKNOWN_SCENARIO and the runner grades this storyboard
-  not_applicable rather than failed.
+  authenticated sandbox account (account + principal pair). The storyboard applies only
+  when get_adcp_capabilities advertises force_create_media_buy_arm under
+  compliance_testing.scenarios; other sellers skip before phase execution.
 
   Round-trip integrity. The deterministic task_id is captured from the controller
   response and reused as the expected task_id on the create_media_buy assertion, so the
@@ -68,11 +77,12 @@ caller:
 
 prerequisites:
   description: |
-    Seller exposes comply_test_controller in sandbox mode and supports
-    force_create_media_buy_arm. The directive is keyed to the caller's
-    authenticated sandbox account; without controller support, the storyboard
-    grades not_applicable — sellers cannot be deterministically driven into
-    the submitted arm by buyer-initiated requests alone.
+    Seller exposes comply_test_controller in sandbox mode and advertises
+    force_create_media_buy_arm under compliance_testing.scenarios. The
+    directive is keyed to the caller's authenticated sandbox account. Sellers
+    that omit the scenario grade not_applicable before phase execution because
+    buyer-initiated requests alone cannot deterministically drive the submitted
+    arm.
   test_kit: "test-kits/acme-outdoor.yaml"
   controller_seeding: true
 

package/compliance/cache/{3.1.11 → 3.1.13}/index.json

@@ -1,7 +1,7 @@
 {
-  "published_version": "3.1.11",
-  "adcp_version": "3.1.11",
-  "generated_at": "2026-08-07T04:42:01.239Z",
+  "published_version": "3.1.13",
+  "adcp_version": "3.1.13",
+  "generated_at": "2026-08-11T10:05:24.827Z",
   "universal": [
     "billing-gate-dispatch",
     "canonical-format-validate-input",

package/compliance/cache/{3.1.11 → 3.1.13}/protocols/media-buy/scenarios/create_media_buy_async.yaml

@@ -4,6 +4,15 @@ title: "Seller returns submitted task envelope when create_media_buy goes async"
 category: media_buy_seller
 summary: "Verifies the AdCP-payload wire shape of the submitted-arm response from create_media_buy: status='submitted', task_id present, no media_buy_id and no packages on the envelope."
 track: media_buy
+
+# The submitted response arm is a production protocol path, but forcing a
+# seller into it is a sandbox-only compliance capability. Gate the entire
+# storyboard on the controller scenario advertisement so sellers that cannot
+# deterministically exercise this path skip before phase execution.
+requires_capability:
+  path: compliance_testing.scenarios
+  contains: force_create_media_buy_arm
+
 required_tools:
   - create_media_buy
   - comply_test_controller
@@ -33,9 +42,9 @@ narrative: |
   buys synchronously. To make this storyboard runnable across implementations, the test
   harness uses comply_test_controller force_create_media_buy_arm to drive the next
   create_media_buy call into the submitted arm. The directive is keyed to the caller's
-  authenticated sandbox account (account + principal pair); sellers that do not implement
-  the controller scenario return UNKNOWN_SCENARIO and the runner grades this storyboard
-  not_applicable rather than failed.
+  authenticated sandbox account (account + principal pair). The storyboard applies only
+  when get_adcp_capabilities advertises force_create_media_buy_arm under
+  compliance_testing.scenarios; other sellers skip before phase execution.
 
   Round-trip integrity. The deterministic task_id is captured from the controller
   response and reused as the expected task_id on the create_media_buy assertion, so the
@@ -68,11 +77,12 @@ caller:
 
 prerequisites:
   description: |
-    Seller exposes comply_test_controller in sandbox mode and supports
-    force_create_media_buy_arm. The directive is keyed to the caller's
-    authenticated sandbox account; without controller support, the storyboard
-    grades not_applicable — sellers cannot be deterministically driven into
-    the submitted arm by buyer-initiated requests alone.
+    Seller exposes comply_test_controller in sandbox mode and advertises
+    force_create_media_buy_arm under compliance_testing.scenarios. The
+    directive is keyed to the caller's authenticated sandbox account. Sellers
+    that omit the scenario grade not_applicable before phase execution because
+    buyer-initiated requests alone cannot deterministically drive the submitted
+    arm.
   test_kit: "test-kits/acme-outdoor.yaml"
   controller_seeding: true
 

package/compliance/cache/{3.1.11 → 3.1.13}/test-kits/billing-gate-runner.yaml

@@ -23,7 +23,9 @@
 # This kit is the coordination contract between the runner and a seller-under-
 # test that wants the per-agent-gate phases graded. Sellers that do not ship
 # a passthrough-only test caller leave `commercial_relationship` unset and
-# the per-agent phases grade `not_applicable`.
+# the per-agent phases grade `not_applicable`. Sellers whose
+# `account.supported_billing` omits `agent` also grade those phases
+# `not_applicable`: capability-level rejection is covered separately.
 
 id: billing_gate_runner
 applies_to:
@@ -44,10 +46,12 @@ description: |
 
     commercial_relationship — (optional) declares the calling buyer agent's
       onboarded commercial state with the seller. When set to
-      "passthrough_only", the runner submits `billing: "agent"` on the
-      per-agent-gate-reject phase and asserts BILLING_NOT_PERMITTED_FOR_AGENT
-      with the clamped error.details shape. When unset, both per-agent
-      phases grade `not_applicable`.
+      "passthrough_only" AND the seller advertises `"agent"` in
+      `account.supported_billing`, the runner submits `billing: "agent"` on
+      the per-agent-gate-reject phase and asserts
+      BILLING_NOT_PERMITTED_FOR_AGENT with the clamped error.details shape.
+      When the relationship is unset or agent billing is not supported,
+      both per-agent phases grade `not_applicable`.
 
   Establishing the commercial relationship is offline (the same posture as
   operator account creation): the seller-under-test records the test

package/compliance/cache/{3.1.11.previous → 3.1.13}/test-kits/signed-requests-runner.yaml

@@ -3,7 +3,7 @@
 # Applies to: universal/signed-requests.yaml (gated on
 # `request_signing.supported: true` in get_adcp_capabilities).
 #
-# The signed-requests storyboard grades an agent's RFC 9421 verifier against 28
+# The signed-requests storyboard grades an agent's RFC 9421 verifier against
 # conformance vectors at /compliance/{version}/test-vectors/request-signing/.
 # Most vectors are pure black-box: the runner constructs a signed HTTP request,
 # sends it, and checks the response. Three negative vectors assert behavior that

package/compliance/cache/{3.1.11.previous → 3.1.13}/universal/billing-gate-dispatch.yaml

@@ -67,9 +67,10 @@ narrative: |
     field unset).
 
   - **`per_agent_gate_reject`** runs only when the test kit declares
-    `commercial_relationship: "passthrough_only"`. The runner submits
-    `billing: "agent"` (a value `supported_billing` accepts but the
-    per-agent record does not), and asserts
+    `commercial_relationship: "passthrough_only"` AND the seller's
+    `supported_billing` capability includes `"agent"`. The runner submits
+    `billing: "agent"` (a value the capability accepts but the per-agent
+    record does not), and asserts
     `BILLING_NOT_PERMITTED_FOR_AGENT` with the clamped
     `error.details` shape. The seller's `suggested_billing` value is
     captured into context for the recover phase.
@@ -119,9 +120,11 @@ prerequisites:
 
       commercial_relationship — (optional) declares whether the calling
         buyer agent is registered with the seller as passthrough-only.
-        When set to "passthrough_only", per_agent_gate_reject and
-        per_agent_gate_recover run. When unset or set to anything else,
-        both per-agent phases grade `not_applicable`.
+        When set to "passthrough_only" AND the seller advertises `"agent"`
+        in `account.supported_billing`, per_agent_gate_reject and
+        per_agent_gate_recover run. Sellers that do not offer agent billing
+        grade both phases `not_applicable`; they have no per-agent billing
+        permission boundary to exercise.
 
     Establishing the commercial relationship is offline — the
     seller-under-test records the test caller's commercial state in its
@@ -258,16 +261,22 @@ phases:
   - id: per_agent_gate_reject
     title: "Per-agent gate — BILLING_NOT_PERMITTED_FOR_AGENT (reject)"
     optional: true
+    requires_capability:
+      path: "account.supported_billing"
+      contains: "agent"
     skip_if: "test_kit.commercial_relationship != 'passthrough_only'"
     narrative: |
       The test kit declares the calling buyer agent is registered with
-      the seller as passthrough-only. The runner submits `billing:
-      "agent"` (which `supported_billing` accepts but the per-agent
-      record does not) and asserts the per-buyer-agent gate fires with
-      the clamped `error.details` shape. The seller's `suggested_billing`
-      value is captured into context for the recover phase, which
-      submits a new request (with a fresh idempotency_key) using the
-      suggested value.
+      the seller as passthrough-only, and the seller advertises `"agent"`
+      in `account.supported_billing`. The runner submits `billing: "agent"`
+      (which the capability accepts but the per-agent record does not) and
+      asserts the per-buyer-agent gate fires with the clamped
+      `error.details` shape. Sellers that do not offer agent billing skip
+      this phase as `not_applicable`: their rejection belongs to the
+      seller-wide `BILLING_NOT_SUPPORTED` capability gate instead. The
+      seller's `suggested_billing` value is captured into context for the
+      recover phase, which submits a new request (with a fresh
+      idempotency_key) using the suggested value.
 
     steps:
       - id: sync_accounts_passthrough_rejects_agent
@@ -360,6 +369,9 @@ phases:
   - id: per_agent_gate_recover
     title: "Per-agent gate — autonomous recovery via suggested_billing"
     optional: true
+    requires_capability:
+      path: "account.supported_billing"
+      contains: "agent"
     skip_if: "test_kit.commercial_relationship != 'passthrough_only'"
     narrative: |
       The runner submits a new request with the `billing` value the

package/compliance/cache/{3.1.11 → 3.1.13.previous}/domains/media-buy/scenarios/create_media_buy_async.yaml

@@ -4,6 +4,15 @@ title: "Seller returns submitted task envelope when create_media_buy goes async"
 category: media_buy_seller
 summary: "Verifies the AdCP-payload wire shape of the submitted-arm response from create_media_buy: status='submitted', task_id present, no media_buy_id and no packages on the envelope."
 track: media_buy
+
+# The submitted response arm is a production protocol path, but forcing a
+# seller into it is a sandbox-only compliance capability. Gate the entire
+# storyboard on the controller scenario advertisement so sellers that cannot
+# deterministically exercise this path skip before phase execution.
+requires_capability:
+  path: compliance_testing.scenarios
+  contains: force_create_media_buy_arm
+
 required_tools:
   - create_media_buy
   - comply_test_controller
@@ -33,9 +42,9 @@ narrative: |
   buys synchronously. To make this storyboard runnable across implementations, the test
   harness uses comply_test_controller force_create_media_buy_arm to drive the next
   create_media_buy call into the submitted arm. The directive is keyed to the caller's
-  authenticated sandbox account (account + principal pair); sellers that do not implement
-  the controller scenario return UNKNOWN_SCENARIO and the runner grades this storyboard
-  not_applicable rather than failed.
+  authenticated sandbox account (account + principal pair). The storyboard applies only
+  when get_adcp_capabilities advertises force_create_media_buy_arm under
+  compliance_testing.scenarios; other sellers skip before phase execution.
 
   Round-trip integrity. The deterministic task_id is captured from the controller
   response and reused as the expected task_id on the create_media_buy assertion, so the
@@ -68,11 +77,12 @@ caller:
 
 prerequisites:
   description: |
-    Seller exposes comply_test_controller in sandbox mode and supports
-    force_create_media_buy_arm. The directive is keyed to the caller's
-    authenticated sandbox account; without controller support, the storyboard
-    grades not_applicable — sellers cannot be deterministically driven into
-    the submitted arm by buyer-initiated requests alone.
+    Seller exposes comply_test_controller in sandbox mode and advertises
+    force_create_media_buy_arm under compliance_testing.scenarios. The
+    directive is keyed to the caller's authenticated sandbox account. Sellers
+    that omit the scenario grade not_applicable before phase execution because
+    buyer-initiated requests alone cannot deterministically drive the submitted
+    arm.
   test_kit: "test-kits/acme-outdoor.yaml"
   controller_seeding: true
 

package/compliance/cache/{3.1.11.previous → 3.1.13.previous}/index.json

@@ -1,7 +1,7 @@
 {
-  "published_version": "3.1.11",
-  "adcp_version": "3.1.11",
-  "generated_at": "2026-08-07T04:42:01.239Z",
+  "published_version": "3.1.13",
+  "adcp_version": "3.1.13",
+  "generated_at": "2026-08-11T10:05:24.827Z",
   "universal": [
     "billing-gate-dispatch",
     "canonical-format-validate-input",

package/compliance/cache/{3.1.11.previous/domains → 3.1.13.previous/protocols}/media-buy/scenarios/create_media_buy_async.yaml

@@ -4,6 +4,15 @@ title: "Seller returns submitted task envelope when create_media_buy goes async"
 category: media_buy_seller
 summary: "Verifies the AdCP-payload wire shape of the submitted-arm response from create_media_buy: status='submitted', task_id present, no media_buy_id and no packages on the envelope."
 track: media_buy
+
+# The submitted response arm is a production protocol path, but forcing a
+# seller into it is a sandbox-only compliance capability. Gate the entire
+# storyboard on the controller scenario advertisement so sellers that cannot
+# deterministically exercise this path skip before phase execution.
+requires_capability:
+  path: compliance_testing.scenarios
+  contains: force_create_media_buy_arm
+
 required_tools:
   - create_media_buy
   - comply_test_controller
@@ -33,9 +42,9 @@ narrative: |
   buys synchronously. To make this storyboard runnable across implementations, the test
   harness uses comply_test_controller force_create_media_buy_arm to drive the next
   create_media_buy call into the submitted arm. The directive is keyed to the caller's
-  authenticated sandbox account (account + principal pair); sellers that do not implement
-  the controller scenario return UNKNOWN_SCENARIO and the runner grades this storyboard
-  not_applicable rather than failed.
+  authenticated sandbox account (account + principal pair). The storyboard applies only
+  when get_adcp_capabilities advertises force_create_media_buy_arm under
+  compliance_testing.scenarios; other sellers skip before phase execution.
 
   Round-trip integrity. The deterministic task_id is captured from the controller
   response and reused as the expected task_id on the create_media_buy assertion, so the
@@ -68,11 +77,12 @@ caller:
 
 prerequisites:
   description: |
-    Seller exposes comply_test_controller in sandbox mode and supports
-    force_create_media_buy_arm. The directive is keyed to the caller's
-    authenticated sandbox account; without controller support, the storyboard
-    grades not_applicable — sellers cannot be deterministically driven into
-    the submitted arm by buyer-initiated requests alone.
+    Seller exposes comply_test_controller in sandbox mode and advertises
+    force_create_media_buy_arm under compliance_testing.scenarios. The
+    directive is keyed to the caller's authenticated sandbox account. Sellers
+    that omit the scenario grade not_applicable before phase execution because
+    buyer-initiated requests alone cannot deterministically drive the submitted
+    arm.
   test_kit: "test-kits/acme-outdoor.yaml"
   controller_seeding: true