@adcp/sdk 13.0.0-rc.8 → 13.0.0-rc.9

package/dist/lib/testing/storyboard/runner.mjs

@@ -30,7 +30,7 @@ import { IDENTIFIER_DIGEST_LIMIT } from "../../upstream-recorder/constants.mjs";
 import { enrichRequest, hasRequestEnricher } from "./request-builder.mjs";
 import {
   BUILD_ASSETS_FROM_FORMAT_DIRECTIVE,
-  expandCreativeAssetDirectives,
+  expandCreativeAssetDirectivesWithDiagnostics,
   findUnresolvedCreativeAssetDirectives
 } from "./creative-assets.mjs";
 import { resolveAccount, resolveBrand } from "../client.mjs";
@@ -62,6 +62,12 @@ import { runControllerSeeding } from "./seeding.mjs";
 import { applyFixtureBindingsToRequest } from "./fixture-resolution.mjs";
 import { getComplianceCacheDir } from "./compliance.mjs";
 import { signWebhook } from "../../signing/client.mjs";
+import { replayTrustedMatchContextVector } from "./trusted-match-context-replay.mjs";
+import {
+  gradeOAuthMetadataGraph,
+  redactOAuthUrlForOutput,
+  redactOAuthUrlsInText
+} from "./oauth-metadata-graph/index.mjs";
 import {
   buildRoutingContext,
   DiscoveryFailure,
@@ -80,6 +86,7 @@ const SKIP_DETAILS = {
   prerequisite_failed: "Skipped: a prerequisite step or contract did not pass.",
   missing_tool: "Skipped: agent did not advertise the required tool.",
   missing_test_controller: "Skipped: deterministic_testing phase requires comply_test_controller, which the agent did not advertise.",
+  fixture_unavailable: "Skipped: the runner test kit cannot synthesize a valid input for the seller-declared contract.",
   unsatisfied_contract: "Skipped: test-kit contract is out of scope for this grading run.",
   requirement_unmet: "Skipped: a requires: tag named a runtime requirement that is not available on this run (see RunnerSkipResult.requirement).",
   peer_branch_taken: "Skipped: a peer branch in the same any_of branch set already contributed the aggregation flag.",
@@ -129,6 +136,7 @@ const DETAILED_SKIP_DETAILS = {
   rate_limit_not_triggered: "No RATE_LIMITED response was observed within the configured max_attempts."
 };
 const REPLAY_WEBHOOK_VECTOR_TASK = "replay_webhook_vector";
+const REPLAY_TRUSTED_MATCH_CONTEXT_VECTOR_TASK = "replay_trusted_match_context_vector";
 const WEBHOOK_REPLAY_DEFAULT_TIMEOUT_MS = 1e4;
 function selectionForProbeSkip(reason, detail) {
   switch (reason) {
@@ -209,6 +217,9 @@ function evaluateRequiresCapabilityGate(predicate, profile, agentTools, adcpVers
     const actual = resolveCapabilityPathForGate(rawCaps, predicate, adcpVersion);
     return evaluateCapabilityPredicate(predicate, actual);
   }
+  if ("equals" in predicate && predicate.path === "oauth.supported" && predicate.equals === true) {
+    return evaluateCapabilityPredicate(predicate, void 0);
+  }
   const tools = agentTools ?? profile?.tools;
   if ("equals" in predicate && tools !== void 0 && !tools.includes("get_adcp_capabilities")) {
     return evaluateCapabilityPredicate(predicate, void 0);
@@ -233,6 +244,24 @@ function allExecutablePhasesCapabilitySkipped(storyboard, phaseCapabilitySkipDet
 function buildSkip(reason, detail) {
   return { reason, detail: detail ?? SKIP_DETAILS[reason] };
 }
+function buildCreativeAssetFixtureUnavailableStep(step, phaseId, context, allSteps, runState, failure, task = step.task) {
+  const detail = `creative_asset_fixture_unavailable: slot "${failure.slotId}", asset type "${failure.assetType}", constraint: ${failure.constraint} (${failure.path})`;
+  return {
+    step_id: step.id,
+    phase_id: phaseId,
+    title: step.title,
+    task,
+    passed: true,
+    skipped: true,
+    skip_reason: "fixture_unavailable",
+    skip: buildSkip("fixture_unavailable", detail),
+    duration_ms: 0,
+    validations: [],
+    context,
+    next: getNextStepPreview(step.id, allSteps, context, runState.runnerVars),
+    extraction: { path: "none" }
+  };
+}
 function detectResponseDerivedNotApplicable(step, request, response, runState, allSteps) {
   if (response === void 0 || response === null) return null;
   const gates = [
@@ -516,7 +545,10 @@ function filterResponseHeaders(headers) {
   if (!headers) return void 0;
   const out = {};
   for (const [k, v] of Object.entries(headers)) {
-    if (RESPONSE_HEADER_ALLOWLIST.has(k.toLowerCase())) out[k] = v;
+    const lower = k.toLowerCase();
+    if (RESPONSE_HEADER_ALLOWLIST.has(lower)) {
+      out[lower] = lower === "location" ? redactOAuthUrlForOutput(v) : v;
+    }
   }
   return Object.keys(out).length > 0 ? out : void 0;
 }
@@ -548,15 +580,6 @@ async function runStoryboardBody(agentUrlOrUrls, storyboard, options) {
       "runStoryboard: _client override is incompatible with multi-instance mode. Remove _client (or pass a single agent URL) to use round-robin dispatch."
     );
   }
-  const requestedStrategy = options.multi_instance_strategy ?? "round-robin";
-  if (requestedStrategy === "multi-pass" && isMultiInstance) {
-    if (options.webhook_receiver) {
-      throw new Error(
-        'runStoryboard: webhook_receiver is incompatible with multi_instance_strategy: "multi-pass". Each pass would bind a fresh receiver URL, so agents caching the pass-1 URL would deliver to a dead port in pass 2. Use round-robin when the storyboard needs a webhook receiver, or run multi-pass on a storyboard without webhook observation.'
-      );
-    }
-    return runMultiPass(agentUrls, storyboard, options);
-  }
   const allRequires = resolveStoryboardRequires(storyboard, options);
   if (allRequires.length) {
     const unmet = checkRequires(allRequires, storyboard, options, options._profile);
@@ -568,6 +591,15 @@ async function runStoryboardBody(agentUrlOrUrls, storyboard, options) {
       };
     }
   }
+  const requestedStrategy = options.multi_instance_strategy ?? "round-robin";
+  if (requestedStrategy === "multi-pass" && isMultiInstance) {
+    if (options.webhook_receiver) {
+      throw new Error(
+        'runStoryboard: webhook_receiver is incompatible with multi_instance_strategy: "multi-pass". Each pass would bind a fresh receiver URL, so agents caching the pass-1 URL would deliver to a dead port in pass 2. Use round-robin when the storyboard needs a webhook receiver, or run multi-pass on a storyboard without webhook observation.'
+      );
+    }
+    return runMultiPass(agentUrls, storyboard, options);
+  }
   if (options.agents) {
     const projected = Object.values(options.agents).map((e) => e.url);
     return executeStoryboardPass(projected, storyboard, options, 0);
@@ -646,7 +678,7 @@ function buildCapabilityUnsupportedResult(agentUrls, storyboard, detail) {
   return {
     storyboard_id: storyboard.id,
     storyboard_title: storyboard.title,
-    agent_url: agentUrls[0],
+    agent_url: redactOAuthUrlForOutput(agentUrls[0]),
     overall_passed: true,
     phases: [
       {
@@ -701,6 +733,8 @@ const REQUIREMENT_TO_SKIP_REASON = {
   seeded_state: "requirement_unmet",
   real_wire: "requirement_unmet",
   webhook_receiver: "requirement_unmet",
+  webhook_replay_receiver: "not_applicable",
+  trusted_match_context_router_runner: "not_applicable",
   request_signer: "not_applicable",
   multi_agent: "requirement_unmet"
 };
@@ -727,7 +761,7 @@ function buildRequirementUnmetResult(agentUrls, storyboard, requirement, detail)
   return {
     storyboard_id: storyboard.id,
     storyboard_title: storyboard.title,
-    agent_url: agentUrls[0],
+    agent_url: redactOAuthUrlForOutput(agentUrls[0]),
     overall_passed: true,
     phases: [
       {
@@ -777,7 +811,7 @@ function buildRequiredAnyOfToolsMissingResult(agentUrls, storyboard, detail) {
   return {
     storyboard_id: storyboard.id,
     storyboard_title: storyboard.title,
-    agent_url: agentUrls[0],
+    agent_url: redactOAuthUrlForOutput(agentUrls[0]),
     overall_passed: true,
     phases: [
       {
@@ -857,6 +891,25 @@ function checkRequires(requires, storyboard, options, profile) {
         }
         break;
       }
+      case "webhook_replay_receiver": {
+        if (!options.webhook_replay_receiver?.url) {
+          return {
+            requirement,
+            detail: "Storyboard contains a `replay_webhook_vector` step but no webhook replay receiver URL is configured. Pass `webhook_replay_receiver.url` in StoryboardRunOptions to run inbound buyer/orchestrator receiver conformance. Seller agents without an inbound receiver grade not_applicable for this storyboard."
+          };
+        }
+        break;
+      }
+      case "trusted_match_context_router_runner": {
+        const runner = options.trusted_match_context_router_runner;
+        if (!runner?.router_url || typeof runner.registerProviders !== "function") {
+          return {
+            requirement,
+            detail: "Storyboard contains a `replay_trusted_match_context_vector` step but no Trusted Match Context router harness is configured. Pass `trusted_match_context_router_runner` with `router_url` and `registerProviders` to run raw POST /context conformance."
+          };
+        }
+        break;
+      }
       case "request_signer": {
         if (!profile?.raw_capabilities) break;
         const supported = resolveCapabilityPath(profile.raw_capabilities, "request_signing.supported");
@@ -918,22 +971,32 @@ function valueContainsWebhookToken(value) {
 function detectImplicitRequires(storyboard, options = {}) {
   const requires = [];
   let needsWebhook = false;
+  let needsWebhookReplayReceiver = false;
+  let needsTrustedMatchContextRouterRunner = false;
   let needsSigner = storyboard.id === "signed_requests";
   const contractsInScope = new Set(options.contracts ?? []);
   for (const phase of storyboard.phases) {
     for (const step of phase.steps) {
-      const rateLimitTripInScope = !step.requires_contract || contractsInScope.has(step.requires_contract);
-      if (!needsWebhook && (step.sample_request && valueContainsWebhookToken(step.sample_request) || step.rate_limit_trip?.trip_target_sample_request && rateLimitTripInScope && valueContainsWebhookToken(step.rate_limit_trip.trip_target_sample_request))) {
+      const stepContractInScope = !step.requires_contract || contractsInScope.has(step.requires_contract);
+      if (!needsWebhook && (step.sample_request && valueContainsWebhookToken(step.sample_request) || step.rate_limit_trip?.trip_target_sample_request && stepContractInScope && valueContainsWebhookToken(step.rate_limit_trip.trip_target_sample_request))) {
         needsWebhook = true;
       }
       if (!needsSigner && step.task === "request_signing_probe") {
         needsSigner = true;
       }
-      if (needsWebhook && needsSigner) break;
+      if (!needsWebhookReplayReceiver && stepContractInScope && step.task === REPLAY_WEBHOOK_VECTOR_TASK) {
+        needsWebhookReplayReceiver = true;
+      }
+      if (!needsTrustedMatchContextRouterRunner && stepContractInScope && step.task === REPLAY_TRUSTED_MATCH_CONTEXT_VECTOR_TASK) {
+        needsTrustedMatchContextRouterRunner = true;
+      }
+      if (needsWebhook && needsWebhookReplayReceiver && needsTrustedMatchContextRouterRunner && needsSigner) break;
     }
-    if (needsWebhook && needsSigner) break;
+    if (needsWebhook && needsWebhookReplayReceiver && needsTrustedMatchContextRouterRunner && needsSigner) break;
   }
   if (needsWebhook) requires.push("webhook_receiver");
+  if (needsWebhookReplayReceiver) requires.push("webhook_replay_receiver");
+  if (needsTrustedMatchContextRouterRunner) requires.push("trusted_match_context_router_runner");
   if (needsSigner) requires.push("request_signer");
   return requires;
 }
@@ -956,7 +1019,7 @@ function buildDiscoveryFailedResult(agentUrls, storyboard, discoveryStep) {
   return {
     storyboard_id: storyboard.id,
     storyboard_title: storyboard.title,
-    agent_url: agentUrls[0],
+    agent_url: redactOAuthUrlForOutput(agentUrls[0]),
     overall_passed: false,
     phases: [
       {
@@ -988,7 +1051,7 @@ function buildRequiredToolsMissingResult(agentUrls, storyboard, detail) {
   return {
     storyboard_id: storyboard.id,
     storyboard_title: storyboard.title,
-    agent_url: agentUrls[0],
+    agent_url: redactOAuthUrlForOutput(agentUrls[0]),
     overall_passed: true,
     phases: [
       {
@@ -1330,6 +1393,33 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     storyboard,
     phaseCapabilitySkipDetails
   );
+  const capabilitySkippedPhaseIds = /* @__PURE__ */ new Set([
+    ...phaseCapabilitySkipDetails.keys(),
+    ...storyboard.phases.filter((phase) => shouldSkipPhase(phase, options)).map((phase) => phase.id)
+  ]);
+  let creativeAssetFixtureGap = preflightRemainingCreativeAssetDirectives(
+    allSteps,
+    -1,
+    context,
+    options,
+    {
+      contributions,
+      priorStepResults,
+      priorProbes,
+      agentUrl: agentUrls[0],
+      webhookReceiver,
+      runnerVars,
+      contextProvenance,
+      priorA2aEnvelopes,
+      stepRequestStarts,
+      responseDerivedNotApplicableContextKeys,
+      agentProfile: profile,
+      agentLibraryVersion: profile?.library_version,
+      storyboardRequiresRequestSigner: allRequires.includes("request_signer")
+    },
+    capabilitySkippedPhaseIds
+  );
+  let creativeAssetFixtureGapRecorded = false;
   if (!hasExecutableSteps) {
     const isScenarioComposed = (storyboard.requires_scenarios?.length ?? 0) > 0;
     const detail = isScenarioComposed ? `Storyboard "${storyboard.id}" has no local phases \u2014 its test surface is fully composed from the scenarios listed in \`requires_scenarios\`.` : `Storyboard "${storyboard.id}" has no executable phases \u2014 populate \`phases[].steps\` or remove the storyboard.`;
@@ -1387,7 +1477,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         fixtureDiscoveryClient = dispatch.nextFor(fixtureStep("get_products")).client;
       }
     }
-    const seeding = skipControllerSeedingForPhaseGates ? null : preSeeded !== void 0 ? preSeeded.result : await runControllerSeeding(fixtureSeedClient, storyboard, options, context, fixtureDiscoveryClient);
+    const seeding = creativeAssetFixtureGap ? null : skipControllerSeedingForPhaseGates ? null : preSeeded !== void 0 ? preSeeded.result : await runControllerSeeding(fixtureSeedClient, storyboard, options, context, fixtureDiscoveryClient);
     if (seeding) {
       const attach = preSeeded === void 0 || preSeeded.attach;
       if (attach) {
@@ -1435,6 +1525,32 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
       }
     }
   }
+  const buildExecutionState = (agentUrl = agentUrls[0], agentProfile = profile) => ({
+    contributions,
+    priorStepResults,
+    priorProbes,
+    agentUrl,
+    webhookReceiver,
+    runnerVars,
+    contextProvenance,
+    priorA2aEnvelopes,
+    stepRequestStarts,
+    responseDerivedNotApplicableContextKeys,
+    agentProfile,
+    agentLibraryVersion: agentProfile?.library_version,
+    storyboardRequiresRequestSigner: allRequires.includes("request_signer"),
+    fixtureBindings
+  });
+  if (!creativeAssetFixtureGap && !seedingMissingController && !seedingUnsupported && !seedingFailed && !fixtureUnsatisfied) {
+    creativeAssetFixtureGap = preflightRemainingCreativeAssetDirectives(
+      allSteps,
+      -1,
+      context,
+      options,
+      buildExecutionState(),
+      capabilitySkippedPhaseIds
+    );
+  }
   for (const phase of storyboard.phases) {
     options.signal?.throwIfAborted();
     const phaseStart = Date.now();
@@ -1448,6 +1564,33 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
       });
       continue;
     }
+    if (creativeAssetFixtureGap) {
+      const gapSteps = [];
+      if (!creativeAssetFixtureGapRecorded && creativeAssetFixtureGap.target.phaseId === phase.id) {
+        const gapStep = buildCreativeAssetFixtureUnavailableStep(
+          creativeAssetFixtureGap.target.step,
+          phase.id,
+          context,
+          allSteps,
+          buildExecutionState(),
+          creativeAssetFixtureGap.failure
+        );
+        gapStep.storyboard_id = storyboard.id;
+        gapSteps.push(gapStep);
+        priorStepResults.set(gapStep.step_id, gapStep);
+        skippedCount++;
+        creativeAssetFixtureGapRecorded = true;
+      }
+      phaseResults.push({
+        phase_id: phase.id,
+        phase_title: phase.title,
+        passed: true,
+        steps: gapSteps,
+        duration_ms: 0
+      });
+      priorPhaseIds.push(phase.id);
+      continue;
+    }
     const phaseCapabilitySkipDetail = phaseCapabilitySkipDetails.get(phase.id);
     if (phaseCapabilitySkipDetail !== void 0) {
       const skippedSteps = buildPhaseCapabilitySkippedSteps(storyboard, phase, phaseCapabilitySkipDetail, context);
@@ -1631,6 +1774,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         phasePassed = false;
         continue;
       }
+      const stepExecutionState = buildExecutionState(assignment.agentUrl, assignment.profile);
       const rawResult = await executeStep(
         assignment.client,
         step,
@@ -1639,26 +1783,11 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         context,
         allSteps,
         options,
-        {
-          contributions,
-          priorStepResults,
-          priorProbes,
-          agentUrl: assignment.agentUrl,
-          webhookReceiver,
-          runnerVars,
-          contextProvenance,
-          priorA2aEnvelopes,
-          stepRequestStarts,
-          responseDerivedNotApplicableContextKeys,
-          agentProfile: assignment.profile,
-          agentLibraryVersion: assignment.profile?.library_version,
-          storyboardRequiresRequestSigner: allRequires.includes("request_signer"),
-          fixtureBindings
-        }
+        stepExecutionState
       );
       const result2 = { ...rawResult, storyboard_id: storyboard.id };
       if (isMultiInstance || useRouting) {
-        result2.agent_url = assignment.agentUrl;
+        result2.agent_url = redactOAuthUrlForOutput(assignment.agentUrl);
         result2.agent_index = assignment.instanceIndex + 1;
       }
       stepResults.push(result2);
@@ -1777,6 +1906,39 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
           annotateMultiInstanceFailure(result2, storyboard, stepResults);
         }
       }
+      if (!result2.skipped && result2.passed) {
+        const currentGlobalIndex = allSteps.find(
+          (flat) => flat.phaseId === phase.id && flat.step.id === step.id
+        )?.globalIndex;
+        if (currentGlobalIndex !== void 0) {
+          creativeAssetFixtureGap = preflightRemainingCreativeAssetDirectives(
+            allSteps,
+            currentGlobalIndex,
+            context,
+            options,
+            stepExecutionState,
+            capabilitySkippedPhaseIds
+          );
+        }
+        if (creativeAssetFixtureGap) {
+          if (creativeAssetFixtureGap.target.phaseId === phase.id) {
+            const gapStep = buildCreativeAssetFixtureUnavailableStep(
+              creativeAssetFixtureGap.target.step,
+              phase.id,
+              context,
+              allSteps,
+              stepExecutionState,
+              creativeAssetFixtureGap.failure
+            );
+            gapStep.storyboard_id = storyboard.id;
+            stepResults.push(gapStep);
+            priorStepResults.set(gapStep.step_id, gapStep);
+            skippedCount++;
+            creativeAssetFixtureGapRecorded = true;
+          }
+          break;
+        }
+      }
     }
     if (phasePendingNotApplicable && !phaseEstablishedStatefulState && !phaseStatefulCascades.has(phase.id)) {
       const hadStatefulPeers = phaseStatefulStepIds.some((id) => id !== phasePendingNotApplicable.stepId);
@@ -1820,7 +1982,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     });
     priorPhaseIds.push(phase.id);
   }
-  const branchSetDelta = applyBranchSetGrading(
+  const branchSetDelta = creativeAssetFixtureGap ? { skippedDelta: 0 } : applyBranchSetGrading(
     storyboard.phases,
     phaseResults,
     branchSetsByPhaseId,
@@ -1829,12 +1991,14 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     countedAsFailed
   );
   skippedCount += branchSetDelta.skippedDelta;
-  for (const spec of assertions) {
-    if (!spec.onEnd) continue;
-    const raw = await spec.onEnd(assertionContexts.get(spec.id));
-    for (const r of raw) {
-      assertionResults.push({ ...r, assertion_id: spec.id, scope: "storyboard" });
-      if (!r.passed) assertionsFailed = true;
+  if (!creativeAssetFixtureGap) {
+    for (const spec of assertions) {
+      if (!spec.onEnd) continue;
+      const raw = await spec.onEnd(assertionContexts.get(spec.id));
+      for (const r of raw) {
+        assertionResults.push({ ...r, assertion_id: spec.id, scope: "storyboard" });
+        if (!r.passed) assertionsFailed = true;
+      }
     }
   }
   const requiredPhaseHasExecutedPass = phaseResults.some((p, idx) => {
@@ -1843,13 +2007,17 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     return p.steps.some((s) => !s.skipped && s.passed);
   });
   const requiredPhaseDefs = storyboard.phases.filter((phaseDef) => !phaseDef.optional);
+  const requiredPhasesNotApplicable = requiredPhaseDefs.length > 0 && requiredPhaseDefs.every((phaseDef) => {
+    const phaseResult = phaseResults.find((p) => p.phase_id === phaseDef.id);
+    return !!phaseResult && phaseResult.passed && phaseResult.steps.length > 0 && phaseResult.steps.every((step) => step.skipped && step.skip?.reason === "not_applicable");
+  });
   const requiredPhasesCoveredByCapabilityGates = phaseCapabilitySkippedIds.size > 0 && requiredPhaseDefs.length > 0 && requiredPhaseDefs.every((phaseDef) => {
     if (phaseCapabilitySkippedIds.has(phaseDef.id)) return true;
     const phaseResult = phaseResults.find((p) => p.phase_id === phaseDef.id);
     return !!phaseResult && phaseResult.passed && phaseResult.steps.some((s) => !s.skipped && s.passed);
   });
-  const requiredPhasesPassed = !hasExecutableSteps || requiredPhaseHasExecutedPass || failedCount === 0 && requiredPhasesCoveredByCapabilityGates;
-  const storyboardWideFixtureUnavailable = (seedingUnsupported || fixtureUnsatisfied) && failedCount === 0;
+  const requiredPhasesPassed = !hasExecutableSteps || requiredPhaseHasExecutedPass || requiredPhasesNotApplicable || failedCount === 0 && requiredPhasesCoveredByCapabilityGates;
+  const storyboardWideFixtureUnavailable = (seedingUnsupported || fixtureUnsatisfied || creativeAssetFixtureGap !== void 0) && failedCount === 0;
   if (seedingPhaseResult) phaseResults.unshift(seedingPhaseResult);
   const schemasUsed = collectSchemasUsed(phaseResults);
   const strictSummary = summarizeStrictValidation(phaseResults);
@@ -1861,13 +2029,17 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
   const result = {
     storyboard_id: storyboard.id,
     storyboard_title: storyboard.title,
-    agent_url: agentUrls[0],
-    ...isMultiInstance && { agent_urls: [...agentUrls] },
+    agent_url: redactOAuthUrlForOutput(agentUrls[0]),
+    ...isMultiInstance && { agent_urls: agentUrls.map(redactOAuthUrlForOutput) },
     // Inner multi-pass passes surface as `round-robin` (that's what they are
     // individually); the aggregating wrapper relabels the top-level result
     // `multi-pass`.
     ...isMultiInstance && { multi_instance_strategy: "round-robin" },
-    ...routingContext && { agent_map: { ...routingContext.agentMap } },
+    ...routingContext && {
+      agent_map: Object.fromEntries(
+        Object.entries(routingContext.agentMap).map(([specialism, url]) => [specialism, redactOAuthUrlForOutput(url)])
+      )
+    },
     overall_passed: failedCount === 0 && (requiredPhasesPassed || storyboardWideFixtureUnavailable) && !assertionsFailed,
     phases: phaseResults,
     context,
@@ -1886,12 +2058,8 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     ...routingContext && routingContext.discoveryFailures.length > 0 ? {
       discovery_failures: routingContext.discoveryFailures.map((f) => ({
         agent_key: f.agentKey,
-        // Scrub URL userinfo (`https://user:pass@host/`) before
-        // echoing onto the result — an operator may legitimately
-        // encode credentials in the URL, and the leaderboard /
-        // dashboard surface mustn't carry them.
-        url: f.url.replace(/\/\/[^/@\s]+@/, "//[REDACTED]@"),
-        error: f.underlying
+        url: redactOAuthUrlForOutput(f.url),
+        error: redactOAuthUrlsInText(f.underlying)
       }))
     } : {}
   };
@@ -1929,7 +2097,24 @@ async function runMultiPass(agentUrls, storyboard, options) {
     options.agentTools,
     options.adcpVersion
   );
-  const preSeededResult = allExecutablePhasesCapabilitySkipped(storyboard, phaseCapabilitySkipDetails) ? null : await runControllerSeeding(preSeedClients[0], storyboard, options, preSeedContext);
+  const preSeedExcludedPhaseIds = /* @__PURE__ */ new Set([
+    ...phaseCapabilitySkipDetails.keys(),
+    ...storyboard.phases.filter((phase) => shouldSkipPhase(phase, options)).map((phase) => phase.id)
+  ]);
+  const preSeedFixtureGap = preflightRemainingCreativeAssetDirectives(
+    flattenSteps(storyboard),
+    -1,
+    preSeedContext,
+    options,
+    {
+      contributions: /* @__PURE__ */ new Set(),
+      priorStepResults: /* @__PURE__ */ new Map(),
+      priorProbes: /* @__PURE__ */ new Map(),
+      agentUrl: agentUrls[0]
+    },
+    preSeedExcludedPhaseIds
+  );
+  const preSeededResult = preSeedFixtureGap || allExecutablePhasesCapabilitySkipped(storyboard, phaseCapabilitySkipDetails) ? null : await runControllerSeeding(preSeedClients[0], storyboard, options, preSeedContext);
   const passes = [];
   const passResults = [];
   for (let passIdx = 0; passIdx < agentUrls.length; passIdx++) {
@@ -1961,8 +2146,8 @@ async function runMultiPass(agentUrls, storyboard, options) {
   return {
     storyboard_id: storyboard.id,
     storyboard_title: storyboard.title,
-    agent_url: agentUrls[0],
-    agent_urls: [...agentUrls],
+    agent_url: redactOAuthUrlForOutput(agentUrls[0]),
+    agent_urls: agentUrls.map(redactOAuthUrlForOutput),
     multi_instance_strategy: "multi-pass",
     overall_passed: overallPassed,
     phases: first.phases,
@@ -2287,7 +2472,19 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     };
   }
   request = fixtureBinding.request;
-  request = expandCreativeAssetDirectives(request, context, options.test_kit);
+  const creativeAssetExpansion = expandCreativeAssetDirectivesWithDiagnostics(request, context, options.test_kit);
+  request = creativeAssetExpansion.value;
+  if (!creativeAssetExpansion.ok && creativeAssetExpansion.failure.reason === "fixture_unavailable") {
+    return buildCreativeAssetFixtureUnavailableStep(
+      step,
+      phaseId,
+      context,
+      allSteps,
+      runState,
+      creativeAssetExpansion.failure,
+      effectiveStep.task
+    );
+  }
   const unresolvedContextVars = findUnresolvedContextVars(request);
   const unresolvedAssetDirectives = findUnresolvedCreativeAssetDirectives(request).map((path) => ({
     key: path,
@@ -2359,7 +2556,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         transport: options.protocol === "a2a" ? "a2a" : "mcp",
         operation: effectiveStep.task,
         payload: redactSecrets(request),
-        ...runState.agentUrl ? { url: runState.agentUrl } : {}
+        ...runState.agentUrl ? { url: redactOAuthUrlForOutput(runState.agentUrl) } : {}
       },
       extraction: { path: "none" }
     };
@@ -2554,7 +2751,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     transport: useRawProbe ? "mcp" : options.protocol === "a2a" ? "a2a" : "mcp",
     operation: effectiveStep.task,
     payload: redactSecrets(request),
-    ...runState.agentUrl ? { url: runState.agentUrl } : {}
+    ...runState.agentUrl ? { url: redactOAuthUrlForOutput(runState.agentUrl) } : {}
   };
   const inputSchemaStripNotices = collectInputSchemaFieldStripNotices(
     taskResult?.debug_logs,
@@ -2910,6 +3107,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
 async function executeProbeStep(client, step, phaseId, context, allSteps, options, runState) {
   const start = Date.now();
   let httpResult;
+  let oauthMetadataGraph;
   const probeOpts = {
     allowPrivateIp: options.allow_http === true,
     fetchFn: options.transport?.fetchFn
@@ -2931,8 +3129,17 @@ async function executeProbeStep(client, step, phaseId, context, allSteps, option
   }
   if (httpResult) {
   } else if (step.task === "protected_resource_metadata") {
-    httpResult = await probeProtectedResourceMetadata(runState.agentUrl, probeOpts);
-    if (!httpResult.error && httpResult.status === 404) {
+    if (step.validations?.some((validation) => validation.check === "oauth_metadata_graph")) {
+      oauthMetadataGraph = await gradeOAuthMetadataGraph(runState.agentUrl, {
+        allowHttp: options.allow_http === true,
+        signal: options.signal,
+        trustedFetchFn: options.transport?.fetchFn
+      });
+      httpResult = oauthMetadataGraph.protected_resource_result;
+    } else {
+      httpResult = await probeProtectedResourceMetadata(runState.agentUrl, probeOpts);
+    }
+    if (!oauthMetadataGraph && !httpResult.error && httpResult.status === 404) {
       httpResult.skipped = true;
       httpResult.skip_reason = "oauth_not_advertised";
     }
@@ -2970,6 +3177,16 @@ async function executeProbeStep(client, step, phaseId, context, allSteps, option
       };
       const targetRequestResult = buildEffectiveStepRequest(targetStep, context, options, runState);
       if (!targetRequestResult.ok) {
+        if ("creativeAssetFailure" in targetRequestResult) {
+          return buildCreativeAssetFixtureUnavailableStep(
+            step,
+            phaseId,
+            context,
+            allSteps,
+            runState,
+            targetRequestResult.creativeAssetFailure
+          );
+        }
         const next = getNextStepPreview(step.id, allSteps, context, runState.runnerVars);
         return {
           step_id: step.id,
@@ -3083,7 +3300,34 @@ async function executeProbeStep(client, step, phaseId, context, allSteps, option
         transport: targetTransport,
         operation: rateLimitTrip.trip_target_task,
         payload: redactSecrets(observedRequest),
-        ...runState.agentUrl ? { url: runState.agentUrl } : {}
+        ...runState.agentUrl ? { url: redactOAuthUrlForOutput(runState.agentUrl) } : {}
+      };
+    }
+  } else if (step.task === REPLAY_TRUSTED_MATCH_CONTEXT_VECTOR_TASK) {
+    const routerRunner = options.trusted_match_context_router_runner;
+    if (!routerRunner?.router_url || typeof routerRunner.registerProviders !== "function") {
+      httpResult = {
+        url: routerRunner?.router_url ?? runState.agentUrl,
+        status: 0,
+        headers: {},
+        body: null,
+        skipped: true,
+        skip_reason: "grader_skipped",
+        error: "No Trusted Match Context router harness configured. Pass trusted_match_context_router_runner with router_url and registerProviders; the runner will not dispatch this pseudo-task over MCP/A2A."
+      };
+    } else {
+      const requestOverride = options.request ? injectContext({ ...options.request }, context, runState.runnerVars) : step.sample_request ? injectContext({ ...step.sample_request }, context, runState.runnerVars) : void 0;
+      const replay = await replayTrustedMatchContextVector(step, routerRunner, {
+        ...requestOverride && { requestOverride },
+        ...options.adcpVersion && { adcpVersion: options.adcpVersion },
+        ...options.signal && { signal: options.signal }
+      });
+      httpResult = replay.httpResult;
+      requestRecordOverride = {
+        transport: "http",
+        operation: step.task,
+        payload: redactSecrets(replay.request),
+        url: redactOAuthUrlForOutput(replay.httpResult.url)
       };
     }
   }
@@ -3093,7 +3337,7 @@ async function executeProbeStep(client, step, phaseId, context, allSteps, option
     transport: "http",
     operation: step.task,
     payload: null,
-    ...httpResult?.url ? { url: httpResult.url } : runState.agentUrl ? { url: runState.agentUrl } : {}
+    ...httpResult?.url ? { url: redactOAuthUrlForOutput(httpResult.url) } : runState.agentUrl ? { url: redactOAuthUrlForOutput(runState.agentUrl) } : {}
   };
   const filteredProbeHeaders = filterResponseHeaders(httpResult?.headers);
   const responseTransport = requestRecordOverride?.transport ?? "http";
@@ -3106,6 +3350,7 @@ async function executeProbeStep(client, step, phaseId, context, allSteps, option
   } : void 0;
   const redactedHttpResult = httpResult ? {
     ...httpResult,
+    headers: filteredProbeHeaders ?? {},
     body: redactSecrets(httpResult.body),
     ...responseTransport !== "http" && { status: void 0 }
   } : void 0;
@@ -3135,15 +3380,24 @@ async function executeProbeStep(client, step, phaseId, context, allSteps, option
     };
   }
   const vctx = {
-    taskName: step.task,
+    taskName: step.task === REPLAY_TRUSTED_MATCH_CONTEXT_VECTOR_TASK ? "context_match" : step.task,
     ...options.adcpVersion && { adcpVersion: options.adcpVersion },
     ...options._serverAdcpVersion && { responseAdcpVersion: options._serverAdcpVersion },
     httpResult: redactedHttpResult,
+    ...step.task === REPLAY_TRUSTED_MATCH_CONTEXT_VECTOR_TASK && redactedHttpResult && {
+      taskResult: {
+        success: !redactedHttpResult.error && redactedHttpResult.status >= 200 && redactedHttpResult.status < 300,
+        data: redactedHttpResult.body,
+        ...redactedHttpResult.error && { error: redactedHttpResult.error }
+      }
+    },
     agentUrl: runState.agentUrl,
     contributions: runState.contributions,
+    ...step.response_schema_ref && { responseSchemaRef: step.response_schema_ref },
     request: requestRecord,
     ...responseRecord && { response: responseRecord },
-    storyboardContext: context
+    storyboardContext: context,
+    ...oauthMetadataGraph && { oauthMetadataGraph }
   };
   const validations = step.validations?.length ? runValidations(step.validations, vctx) : [];
   const allValidationsPassed = validations.every((v) => v.passed);
@@ -3205,13 +3459,73 @@ function buildEffectiveStepRequest(step, context, options, runState) {
   request = applyIdempotencyInvariant(request, step.task, step);
   const fixtureBinding = applyFixtureBindingsSafely(request, step.task, options, runState);
   if (!fixtureBinding.ok) return fixtureBinding;
+  const creativeAssetExpansion = expandCreativeAssetDirectivesWithDiagnostics(
+    fixtureBinding.request,
+    context,
+    options.test_kit
+  );
+  if (!creativeAssetExpansion.ok && creativeAssetExpansion.failure.reason === "fixture_unavailable") {
+    return { ok: false, creativeAssetFailure: creativeAssetExpansion.failure };
+  }
   return {
     ok: true,
-    request: expandCreativeAssetDirectives(fixtureBinding.request, context, options.test_kit)
+    request: creativeAssetExpansion.value
   };
 }
+function preflightRemainingCreativeAssetDirectives(allSteps, afterGlobalIndex, context, options, runState, excludedPhaseIds = /* @__PURE__ */ new Set()) {
+  for (const target of allSteps) {
+    if (target.globalIndex <= afterGlobalIndex) continue;
+    if (excludedPhaseIds.has(target.phaseId)) continue;
+    const resolvedTask = resolveTaskName(target.step, options);
+    if (!resolvedTask) continue;
+    if (target.step.requires_tool && options.agentTools && !options.agentTools.includes(target.step.requires_tool)) {
+      continue;
+    }
+    if (target.step.requires_contract && !new Set(options.contracts ?? []).has(target.step.requires_contract)) {
+      continue;
+    }
+    if (!PROBE_TASKS.has(target.step.task) && options.agentTools && !options.agentTools.includes(resolvedTask)) {
+      continue;
+    }
+    let requestStep = resolvedTask === target.step.task ? target.step : { ...target.step, task: resolvedTask };
+    if (target.step.task === "expect_rate_limit_not_replayed") {
+      const rateLimitTrip = target.step.rate_limit_trip;
+      if (validateRateLimitTripSpec(rateLimitTrip) || !rateLimitTrip) continue;
+      requestStep = {
+        ...target.step,
+        task: rateLimitTrip.trip_target_task,
+        sample_request: rateLimitTrip.trip_target_sample_request,
+        omit_idempotency_key: true
+      };
+    }
+    const request = buildEffectiveStepRequest(requestStep, context, options, runState);
+    if (!request.ok && "creativeAssetFailure" in request) {
+      return { target, failure: request.creativeAssetFailure };
+    }
+  }
+  return void 0;
+}
 async function executeReplayWebhookVectorStep(step, phaseId, context, allSteps, options, runState) {
   const start = Date.now();
+  if (step.requires_contract && !new Set(options.contracts ?? []).has(step.requires_contract)) {
+    const detail = `Test-kit contract "${step.requires_contract}" is not configured on this runner.`;
+    const reason = "missing_test_kit_contract";
+    return {
+      step_id: step.id,
+      phase_id: phaseId,
+      title: step.title,
+      task: step.task,
+      passed: true,
+      skipped: true,
+      skip_reason: reason,
+      skip: buildSkip(DETAILED_SKIP_TO_CANONICAL[reason], detail),
+      duration_ms: Date.now() - start,
+      validations: [],
+      context,
+      next: getNextStepPreview(step.id, allSteps, context, runState.runnerVars),
+      extraction: { path: "none", note: "test-kit contract not configured" }
+    };
+  }
   const receiver = options.webhook_replay_receiver;
   if (!receiver?.url) {
     const detail = "No webhook replay receiver URL configured. Pass `webhook_replay_receiver.url` in StoryboardRunOptions to run inbound receiver conformance.";
@@ -3789,6 +4103,9 @@ function phaseContainsOauthMetadataProbe(phase) {
 function agentAdvertisesOauth(profile) {
   const rawCaps = profile?.raw_capabilities;
   if (rawCaps === void 0) return true;
+  const oauthSupported = resolveCapabilityPath(rawCaps, "oauth.supported");
+  if (oauthSupported === true) return true;
+  if (oauthSupported === false) return false;
   const endpoint = resolveCapabilityPath(rawCaps, "account.authorization_endpoint");
   return typeof endpoint === "string" && endpoint.length > 0;
 }
@@ -4044,7 +4361,7 @@ async function prefetchUpstreamTraffic(stepId, resolvedValidations, client, opti
       transport: options.protocol === "a2a" ? "a2a" : "mcp",
       operation: "comply_test_controller",
       payload: redactSecrets({ scenario: "query_upstream_traffic", params }),
-      ...runState.agentUrl ? { url: runState.agentUrl } : {}
+      ...runState.agentUrl ? { url: redactOAuthUrlForOutput(runState.agentUrl) } : {}
     };
     const startMs = Date.now();
     let payload;