@adcp/sdk 14.0.0-rc.37 → 14.0.0-rc.39

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "14.0.0-rc.37",
+  "version": "14.0.0-rc.39",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",
@@ -81,16 +81,6 @@
         "default": "./dist/lib/types/v2-5/index.js"
       }
     },
-    "./types/v3-1-beta": {
-      "import": {
-        "types": "./dist/lib/types/v3-1-beta/index.d.mts",
-        "default": "./dist/lib/types/v3-1-beta/index.mjs"
-      },
-      "require": {
-        "types": "./dist/lib/types/v3-1-beta/index.d.ts",
-        "default": "./dist/lib/types/v3-1-beta/index.js"
-      }
-    },
     "./types/*": {
       "types": "./dist/lib/types/*.d.ts"
     },
@@ -369,6 +359,16 @@
         "default": "./dist/lib/reporting/ledger/index.js"
       }
     },
+    "./reporting/service": {
+      "import": {
+        "types": "./dist/lib/reporting/service/index.d.mts",
+        "default": "./dist/lib/reporting/service/index.mjs"
+      },
+      "require": {
+        "types": "./dist/lib/reporting/service/index.d.ts",
+        "default": "./dist/lib/reporting/service/index.js"
+      }
+    },
     "./negotiation/verification": {
       "import": {
         "types": "./dist/lib/negotiation/verification.d.mts",
@@ -379,7 +379,17 @@
         "default": "./dist/lib/negotiation/verification.js"
       }
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./media-buy/actions": {
+      "import": {
+        "types": "./dist/lib/media-buy/actions.d.mts",
+        "default": "./dist/lib/media-buy/actions.mjs"
+      },
+      "require": {
+        "types": "./dist/lib/media-buy/actions.d.ts",
+        "default": "./dist/lib/media-buy/actions.js"
+      }
+    }
   },
   "typesVersions": {
     "*": {
@@ -398,9 +408,6 @@
       "types/v2-5": [
         "dist/lib/types/v2-5/index.d.ts"
       ],
-      "types/v3-1-beta": [
-        "dist/lib/types/v3-1-beta/index.d.ts"
-      ],
       "wholesale-feed-sync": [
         "dist/lib/wholesale-feed-sync/index.d.ts"
       ],
@@ -473,6 +480,9 @@
       "reporting/ledger": [
         "dist/lib/reporting/ledger/index.d.ts"
       ],
+      "reporting/service": [
+        "dist/lib/reporting/service/index.d.ts"
+      ],
       "enums": [
         "dist/lib/enums.d.ts"
       ],
@@ -490,6 +500,9 @@
       ],
       "negotiation/verification": [
         "dist/lib/negotiation/verification.d.ts"
+      ],
+      "media-buy/actions": [
+        "dist/lib/media-buy/actions.d.ts"
       ]
     }
   },
@@ -503,12 +516,9 @@
     "bin/**/*.js",
     "skills/**/*",
     ".claude-plugin/**/*",
-    "compliance/cache/**/*",
-    "!compliance/cache/*.previous/**/*",
-    "!compliance/cache/3.2.0-beta.0/**/*",
-    "!compliance/cache/3.2.0-beta.1/**/*",
-    "!compliance/cache/3.2.0-beta.8/**/*",
-    "!compliance/cache/3.2.0-rc.1/**/*",
+    "compliance/cache/3.0.25/**/*",
+    "compliance/cache/3.1.18/**/*",
+    "compliance/cache/3.2.0-rc.3/**/*",
     "ADCP_VERSION",
     "docs/README.md",
     "docs/TYPE-SUMMARY.md",
@@ -526,12 +536,15 @@
     "examples/README.md",
     "examples/CONTRIBUTING.md",
     "examples/adcp.config.json",
+    "examples/reliable-reporting-service/README.md",
     "examples/seller-3.2-starter.ts",
     "examples/comply-controller-seller.ts",
     "examples/seller-test-controller.ts",
     "examples/gcp-kms-signing-provider.ts",
     "examples/error-compliant-server.ts",
     "examples/existing-platform-thin.ts",
+    "examples/durable-buyer-writes/**/*",
+    "examples/targeting-input-existing-platform.ts",
     "examples/signals-agent.ts",
     "examples/decisioning-platform-mock-seller.ts",
     "examples/decisioning-platform-broadcast-tv.ts",
@@ -552,7 +565,7 @@
   "scripts": {
     "prepare": "node scripts/install-hooks.js 2>/dev/null || true",
     "sync:agents": "node scripts/import-claude-agents.mjs",
-    "prepublishOnly": "npm run clean && npm run sync-schemas:all && (test -f src/lib/types/tools.generated.ts || npm run generate-types) && npm run build:lib && node --test-timeout=60000 --test-force-exit --test test/lib/adcp-client.test.js test/lib/validation.test.js test/lib/zod-schemas.test.js",
+    "prepublishOnly": "npm run clean && npm run sync-schemas:all && (test -f src/lib/types/tools.generated.ts || npm run generate-types) && npm run build:lib && npm run check:publish-protocol-artifacts && node --test-timeout=60000 --test-force-exit --test test/lib/adcp-client.test.js test/lib/validation.test.js test/lib/zod-schemas.test.js",
     "build": "npm run build:lib",
     "build:lib": "npm run sync-version && npm run schemas:ensure && tsx scripts/generate-wire-spec-fields.ts && tsup && node --max-old-space-size=8192 ./node_modules/typescript/bin/tsc --project tsconfig.lib.json --emitDeclarationOnly && tsx scripts/copy-schemas-to-dist.ts && tsx scripts/copy-reporting-source-schemas.ts && tsx scripts/copy-reporting-consumer-status-fixtures.ts && tsx scripts/sync-canonical-storyboard-fixtures.ts --copy-dist && tsx scripts/copy-v2-projection-catalog.ts && tsx scripts/generate-per-tool-types.ts && tsx scripts/generate-dmts-declarations.ts",
     "build:test-agents": "npm run build:lib && tsc -p test-agents/tsconfig.json --rootDir test-agents",
@@ -583,19 +596,17 @@
     "test:status-report": "node test/utils/final-status-report.js",
     "sync-schemas": "tsx scripts/sync-schemas.ts",
     "sync-schemas:v2.5": "tsx scripts/sync-v2-5-schemas.ts",
-    "sync-schemas:3.1-beta": "tsx scripts/sync-3-1-beta-schemas.ts",
-    "sync-schemas:all": "npm run sync-schemas && npm run sync-schemas -- 3.1.18 && npm run sync-schemas -- 3.0.25 && npm run sync-schemas:v2.5 && npm run sync-schemas:3.1-beta",
+    "sync-schemas:all": "npm run sync-schemas && npm run sync-schemas -- 3.1.18 && npm run sync-schemas -- 3.0.25 && npm run sync-schemas:v2.5",
     "sync:canonical-storyboard-fixtures": "tsx scripts/sync-canonical-storyboard-fixtures.ts --update",
     "check:canonical-storyboard-fixtures": "tsx scripts/sync-canonical-storyboard-fixtures.ts --check",
     "sync-registry-schemas": "tsx scripts/generate-registry-types.ts --sync",
     "schemas:ensure": "tsx scripts/schemas-ensure.ts",
     "schema-diff": "tsx scripts/schema-diff.ts",
-    "generate-types": "tsx scripts/generate-types.ts && tsx scripts/generate-enum-arrays.ts && tsx scripts/generate-inline-enum-arrays.ts && tsx scripts/generate-manifest-derived.ts && tsx scripts/generate-entity-hydration.ts && tsx scripts/generate-media-buy-update-fields.ts",
+    "generate-types": "tsx scripts/generate-types.ts && tsx scripts/generate-enum-arrays.ts && tsx scripts/generate-inline-enum-arrays.ts && tsx scripts/generate-manifest-derived.ts && tsx scripts/generate-entity-hydration.ts && tsx scripts/generate-media-buy-update-fields.ts && tsx scripts/generate-media-buy-action-metadata.ts",
     "generate-manifest-derived": "tsx scripts/generate-manifest-derived.ts",
     "generate-entity-hydration": "tsx scripts/generate-entity-hydration.ts",
     "generate-types:v2.5": "tsx scripts/generate-v2-5-types.ts",
-    "generate-types:3.1-beta": "tsx scripts/generate-3-1-beta-types.ts",
-    "generate-types:all": "npm run generate-types && npm run generate-types:v2.5 && npm run generate-types:3.1-beta",
+    "generate-types:all": "npm run generate-types && npm run generate-types:v2.5",
     "generate-registry-types": "tsx scripts/generate-registry-types.ts",
     "generate-enum-arrays": "tsx scripts/generate-enum-arrays.ts",
     "generate-inline-enum-arrays": "tsx scripts/generate-inline-enum-arrays.ts",
@@ -606,10 +617,11 @@
     "compliance:fork-matrix": "node --test --test-timeout=300000 'test/examples/hello-*.test.js' test/examples/proxy-seller-snap.test.js",
     "typecheck:skill-examples": "tsx scripts/typecheck-skill-examples.ts",
     "check:skill-sync": "tsx scripts/check-skill-sync.ts",
-    "check:package": "npm run check:runtime-compat && npm run check:packed-artifact && npm run typecheck:examples && publint --strict && node --max-old-space-size=8192 ./node_modules/@arethetypeswrong/cli/dist/index.js --pack . --exclude-entrypoints compliance-fixtures/reporting-consumer-status-v1.json compliance-fixtures/principal.yaml compliance-fixtures/reporting-core.yaml compliance-fixtures/canonical-storyboards-provenance.json",
+    "check:package": "npm run check:runtime-compat && npm run check:packed-artifact && npm run check:publish-protocol-artifacts && npm run typecheck:examples && publint --strict && node --max-old-space-size=8192 ./node_modules/@arethetypeswrong/cli/dist/index.js --pack . --exclude-entrypoints compliance-fixtures/reporting-consumer-status-v1.json compliance-fixtures/principal.yaml compliance-fixtures/reporting-core.yaml compliance-fixtures/canonical-storyboards-provenance.json",
     "check:packed-artifact": "node scripts/check-packed-artifact.mjs",
     "check:runtime-compat": "node scripts/check-runtime-compat.mjs",
     "check:package-size": "node scripts/check-package-size.mjs",
+    "check:publish-protocol-artifacts": "node scripts/check-publish-protocol-artifacts.mjs",
     "verify:package": "node scripts/verify-package.mjs",
     "check:adopter-types": "tsx scripts/check-adopter-types.ts",
     "check:adopter-types-narrow": "tsx scripts/check-adopter-types-narrow.ts",
@@ -628,7 +640,7 @@
     "ci:validate": "node scripts/ci-validate.js",
     "ci:quick": "npm run format:check && npm run typecheck && npm run build:lib && npm test",
     "test:zod-openapi-portability": "node --test test/lib/zod-openapi-portability.test.js",
-    "ci:schema-check": "npm run sync-schemas && npm run generate-types && npm run generate-registry-types -- --sync && git diff --exit-code -I '// Generated at:' src/lib/types/ src/lib/agents/ src/lib/registry/types.generated.ts schemas/registry/registry.yaml || (echo '⚠️  Generated files are out of sync. Run: npm run sync-schemas && npm run generate-types && npm run generate-registry-types -- --sync' && exit 1)",
+    "ci:schema-check": "npm run sync-schemas && npm run generate-types && npm run generate-registry-types -- --sync && git diff --exit-code -I '// Generated at:' src/lib/types/ src/lib/agents/ src/lib/media-buy/action-metadata.generated.ts src/lib/media-buy/update-fields.generated.ts src/lib/registry/types.generated.ts schemas/registry/registry.yaml || (echo '⚠️  Generated files are out of sync. Run: npm run sync-schemas && npm run generate-types && npm run generate-registry-types -- --sync' && exit 1)",
     "ci:codegen-strict": "tsx scripts/check-no-loose-oneof.ts",
     "ci:docs-check": "npm run generate-agent-docs && npm run generate-release-worksheet && git diff --exit-code -I '> Generated at:' docs/llms.txt docs/TYPE-SUMMARY.md docs/migration-14.x-rc-worksheet.md || (echo '⚠️  Generated docs are out of sync. Run: npm run generate-agent-docs && npm run generate-release-worksheet' && exit 1)",
     "ci:doc-links": "tsx scripts/check-doc-links.ts",

package/skills/build-seller-agent/SKILL.md

@@ -108,6 +108,8 @@ Single-host HTTP from `serve(...)` is the default. Multi-host, Express, or stdio
 
 `BuildCreativeReturn` has 4 valid shapes (framework auto-wraps the bare manifest). `VASTAsset` requires an embedded `delivery_type` discriminator. Targeting overlay echo on `get_media_buys` requires `createMediaBuyStore`. See [`SHAPE-GOTCHAS.md`](../SHAPE-GOTCHAS.md) — schema validators catch these at runtime; type checkers don't.
 
+**Targeting `null` is a command, not a value (AdCP 3.2).** On a mutation request every targeting dimension has three states: **omitted** inherits the product default on create / preserves stored state on update, **`null`** suppresses that default / clears the dimension, and a **non-null value** replaces it. Responses, accepted snapshots, and package readback use the strict overlay, whose schema forbids `null`. Persisting a request overlay verbatim writes a clear command into durable state, and echoing it back emits `null` on a shape that rejects it — both silent. Project with `resolveTargetingInput` (create) and `applyTargetingInput` (update) from `@adcp/sdk/server`, or use `createMediaBuyStore`, which does it on both paths. Reject a clear the product cannot execute rather than silently retaining the default. Full table: [`MEDIA-BUY-3.2-COMPATIBILITY.md`](../../docs/guides/MEDIA-BUY-3.2-COMPATIBILITY.md#request-only-targeting-input-null--clear).
+
 ## Migration notes
 
 - 6.6 → 6.7: **Two seller-affecting breaking changes — audit before bumping**: `accounts.resolution: 'implicit'` now refuses inline `{account_id}` references (#10), and `SalesPlatform` split into `SalesCorePlatform & SalesIngestionPlatform` (#11) — all methods individually optional, self-announcing under `tsc --noEmit`. See [`docs/migration-6.6-to-6.7.md`](../../docs/migration-6.6-to-6.7.md) for the worked diff plus 15 additive recipes around `definePlatform`, `composeMethod`, typed errors, `BuyerAgentRegistry`.

package/skills/build-seller-agent/specialisms/signed-requests.md

@@ -33,7 +33,9 @@ const platform = definePlatform({
     pricingModels: ['cpm'] as const,
   },
   accounts: { resolve: async (ref, ctx) => /* ... */ null },
-  sales: defineSalesCorePlatform({ /* handlers */ }),
+  sales: defineSalesCorePlatform({
+    /* handlers */
+  }),
 });
 
 createAdcpServerFromPlatform(platform, {
@@ -89,6 +91,14 @@ const revocationStore = new InMemoryRevocationStore({
 ```bash
 npx tsx agent.ts &
 npx @adcp/sdk@latest storyboard run http://localhost:3001/mcp signed_requests --json
+
+# Dev loop: skip the cap+1 flood, and any vector your deployment can't satisfy
+npx @adcp/sdk@latest storyboard run http://localhost:3001/mcp signed_requests \
+  --signing-skip-rate-abuse --signing-skip-vectors 007-missing-content-digest --json
 ```
 
 Every negative vector must return the exact `expected_outcome.error_code` in `WWW-Authenticate: Signature error="<code>"`. A non-claiming agent is not graded against this specialism.
+
+Grade the MCP (or REST) binding. The conformance vectors are framed as `tools/call` envelopes by default, or as per-operation HTTP requests with `--signing-transport raw`. The runner does not yet dispatch them through the official A2A client, so on an A2A run every probed vector reports `COVERAGE UNAVAILABLE`, the storyboard cannot report a pass, the track holds at `partial`, and the command exits 3 — it never reads as a pass you did not earn. There is no agent-side fix for that: grade the MCP or REST binding, or run with `--soft-fail` while you wire one. Only `025-jwk-alg-crv-mismatch` still grades there, and it grades the SDK verifier rather than your agent: it publishes a malformed JWK you never serve, so your implementation cannot affect it.
+
+Two vectors are excluded on their own terms rather than by transport, on every protocol: `026-non-ascii-host` (`transport_ungradable` — `fetch` punycodes a non-ASCII authority before the request leaves, so no HTTP client can carry it) and `028-unsigned-protocol-method-required` (`capability_profile_mismatch` unless your capabilities declare `request_signing.protocol_methods_required_for`, e.g. `['tasks/cancel']` — that one field is read on its own, so a minimal `{ supported: true }` block gates it the same way a fully populated one does). Declare that bucket if you verify signatures on JSON-RPC protocol methods; otherwise the vector is legitimately out of scope for you.

package/skills/cross-cutting.md

@@ -1,4 +1,4 @@
-# Cross-cutting rules for every build-*-agent skill
+# Cross-cutting rules for every build-\*-agent skill
 
 Every `build-*-agent` skill points here. These rules apply regardless of which specialism you're building. The hello-adapter fork targets in `examples/hello_*_adapter_*.ts` wire all of them — read this section once if you're forking, every time if you're building from scratch.
 
@@ -17,15 +17,15 @@ Every `build-*-agent` skill points here. These rules apply regardless of which s
 
 Every mutating tool requires a client-supplied `idempotency_key`. The full list (authoritative — derived at runtime from `MUTATING_TASKS` in `src/lib/utils/idempotency.ts`, 28 tools grouped by skill domain):
 
-| Skill domain | Mutating tools |
-| --- | --- |
-| account (cross-cutting — used by every adopter that registers buyer accounts or reports usage) | `sync_accounts`, `report_usage` |
-| media-buy (sales) | `create_media_buy`, `update_media_buy`, `sync_audiences`, `sync_catalogs`, `sync_event_sources`, `log_event`, `provide_performance_feedback` |
-| creative | `sync_creatives`, `build_creative` |
-| signals | `activate_signal` |
-| governance | `sync_plans`, `sync_governance`, `report_plan_outcome`, `create_property_list`, `update_property_list`, `delete_property_list`, `create_collection_list`, `update_collection_list`, `delete_collection_list`, `create_content_standards`, `update_content_standards`, `calibrate_content` |
-| brand-rights | `acquire_rights`, `update_rights` |
-| sponsored-intelligence | `si_initiate_session`, `si_send_message` |
+| Skill domain                                                                                   | Mutating tools                                                                                                                                                                                                                                                                            |
+| ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| account (cross-cutting — used by every adopter that registers buyer accounts or reports usage) | `sync_accounts`, `report_usage`                                                                                                                                                                                                                                                           |
+| media-buy (sales)                                                                              | `create_media_buy`, `update_media_buy`, `sync_audiences`, `sync_catalogs`, `sync_event_sources`, `log_event`, `provide_performance_feedback`                                                                                                                                              |
+| creative                                                                                       | `sync_creatives`, `build_creative`                                                                                                                                                                                                                                                        |
+| signals                                                                                        | `activate_signal`                                                                                                                                                                                                                                                                         |
+| governance                                                                                     | `sync_plans`, `sync_governance`, `report_plan_outcome`, `create_property_list`, `update_property_list`, `delete_property_list`, `create_collection_list`, `update_collection_list`, `delete_collection_list`, `create_content_standards`, `update_content_standards`, `calibrate_content` |
+| brand-rights                                                                                   | `acquire_rights`, `update_rights`                                                                                                                                                                                                                                                         |
+| sponsored-intelligence                                                                         | `si_initiate_session`, `si_send_message`                                                                                                                                                                                                                                                  |
 
 Wire `createIdempotencyStore({ ... })` once and pass it to `createAdcpServerFromPlatform(platform, { idempotency })`. The framework handles replay detection, payload-hash conflict (`IDEMPOTENCY_CONFLICT`), expiry (`IDEMPOTENCY_EXPIRED`), and in-flight parallelism. Don't reimplement in handlers.
 
@@ -49,6 +49,23 @@ How to get it right:
 
 An agent that accepts unauthenticated requests is non-compliant — the universal `security_baseline` storyboard fails it. Wire `serve({ authenticate })` with `verifyApiKey`, `verifyBearer`, or `anyOf(...)` from `@adcp/sdk/server` before you claim any specialism.
 
+### Advertise one allowlisted read tool, or auth cannot be graded
+
+`security_baseline` proves authentication by calling a **protected AdCP tool** with an empty request body. It picks that target from `test_kit.auth.probe_task` when you advertise one of `list_creatives`, `get_media_buy_delivery`, `list_authorized_properties`, `get_signals`, `list_property_lists`, `list_collection_lists`, `list_content_standards`, `list_accounts`.
+
+Advertise none of them and the runner falls back to an MCP session probe, which selects a target from the **canonical AdCP task registry** — `get_principal`, `list_tasks`, `list_transformers`, `get_plan_audit_logs` are the parameter-free protected reads outside the allowlist today. Selection order is the runner's, not your advertisement order, and it will never use:
+
+- **tool names you invented** — only canonical AdCP tasks are eligible. Enforcing credentials on a `get_probe_target` of your own while leaving the real surface open certifies nothing;
+- **public-tier tools** — `get_adcp_capabilities` (mandatory-public), `get_products`, `list_products`, `list_creative_formats`;
+- **mutating tools** — an empty-argument write is not a read probe;
+- **`tools/list`** — MCP discovery is not an AdCP protected task, so it is never the evidence.
+
+If nothing qualifies, the step reports `session_probe_ungradable` and **no auth mechanism can be certified**. Static-credential-only agents are affected most: the positive API-key/Basic probe asserts an AdCP response body that no protocol operation produces, so that branch cannot contribute on session evidence alone. The durable fix is to advertise one allowlisted read tool; serving RFC 9728 metadata and running with `--oauth` verifies the OAuth branch instead.
+
+If your tool refuses an empty-argument call on shape (`INVALID_REQUEST`, a missing required field), the probe retries the next candidate and — if they all refuse — reports **inconclusive** rather than a pass or a fail. It cannot tell a credential decision from a schema decision.
+
+A pass here means the mechanism is enforced **at the tool that was graded** (the step note names it). It is not a certificate that every tool checks credentials, and it verifies nothing cryptographic about the credential or its issuer.
+
 ## Don't break when RFC 9421 Signature headers arrive
 
 Even if you don't claim `signed-requests`, a buyer may send `Signature-Input` / `Signature` headers. Your transport must pass through without rejecting. If you do claim the specialism, verify per the signed-requests delta in your skill.
@@ -70,7 +87,7 @@ The hello adapters use simple in-memory `accounts.resolution: 'lookup'` against
 
 `createTenantStore` is the right default for any adopter handling more than one advertiser. It refuses inline `{account_id}` references unless your store explicitly lists them — that's a hard security gate, not a soft warning.
 
-Its `refAccess` field is required and has no default: `'auth-scoped'` makes a ref naming another tenant fail closed, `'ref-routed'` lets one credential span tenants on purpose. The sync-tool isolation gate is always on and is a *separate* decision — `refAccess` governs `accounts.resolve`, which is the account path for `create_media_buy` / `update_media_buy`. See `skills/build-holdco-agent/SKILL.md`.
+Its `refAccess` field is required and has no default: `'auth-scoped'` makes a ref naming another tenant fail closed, `'ref-routed'` lets one credential span tenants on purpose. The sync-tool isolation gate is always on and is a _separate_ decision — `refAccess` governs `accounts.resolve`, which is the account path for `create_media_buy` / `update_media_buy`. See `skills/build-holdco-agent/SKILL.md`.
 
 ## Webhooks: stable `operation_id` across retries
 

package/compliance/cache/3.1.0-beta.7/domains/brand/index.yaml

@@ -1,160 +0,0 @@
-id: brand_baseline
-version: "1.0.0"
-title: "Brand baseline"
-protocol: brand
-category: brand_baseline
-summary: "Baseline protocol storyboard — every brand agent must declare the brand protocol in capabilities and return a schema-valid brand identity."
-track: brand
-required_tools:
-  - get_brand_identity
-
-narrative: |
-  Brand protocol agents are the identity layer of AdCP. Their job is to hold
-  brand identity data (names, logos, colors, fonts, tone) and expose it to
-  other agents — buyer agents, creative agents, DSPs — that need to render
-  on-brand creative or verify who a campaign is for.
-
-  The baseline tests the minimum contract that every brand agent honors,
-  regardless of what additional capabilities (rights licensing, creative
-  approval) it layers on top:
-
-    1. Declare `brand` in `supported_protocols` on `get_adcp_capabilities`.
-    2. Respond to `get_brand_identity` with a schema-valid identity manifest.
-    3. Reject unknown `brand_id` values with a structured error.
-
-  Rights licensing (`get_rights`, `acquire_rights`, `update_rights`,
-  `creative_approval`) ships experimentally in 3.0 and is covered by the
-  `brand-rights` specialism storyboard, not this baseline.
-
-agent:
-  interaction_model: brand_agent
-  capabilities: []
-  examples:
-    - "Any brand agent (simple identity host or full rights platform)"
-    - "Brand-owned agents (Acme Outdoor)"
-    - "Third-party brand identity platforms"
-    - "Agency-hosted brand agents"
-
-caller:
-  role: buyer_agent
-  example: "Any buyer, creative agent, or DSP needing brand identity"
-
-prerequisites:
-  description: |
-    The test kit provides a sample brand (Nova Motors) that any brand agent
-    can serve identity for.
-  test_kit: "test-kits/nova-motors.yaml"
-
-phases:
-  - id: capability_discovery
-    title: "Capability discovery"
-    narrative: |
-      The buyer calls `get_adcp_capabilities` to confirm the agent declares
-      the brand protocol before issuing any brand-identity call.
-
-    steps:
-      - id: get_capabilities
-        title: "Check agent capabilities"
-        narrative: |
-          Verify that the agent declares `brand` in `supported_protocols`.
-          Without this claim the buyer MUST NOT send `get_brand_identity`.
-        task: get_adcp_capabilities
-        schema_ref: "protocol/get-adcp-capabilities-request.json"
-        response_schema_ref: "protocol/get-adcp-capabilities-response.json"
-        doc_ref: "/protocol/get_adcp_capabilities"
-        comply_scenario: capability_discovery
-        stateful: false
-        expected: |
-          Return capabilities declaring `brand` in `supported_protocols`.
-
-        sample_request:
-          context:
-            correlation_id: "brand_baseline--get_capabilities"
-        validations:
-          - check: response_schema
-            description: "Response matches get-adcp-capabilities-response.json schema"
-          - check: field_present
-            path: "supported_protocols"
-            description: "Response declares supported_protocols"
-
-  - id: brand_identity_retrieval
-    title: "Brand identity retrieval"
-    narrative: |
-      The buyer calls `get_brand_identity` to retrieve the brand's identity
-      manifest. The minimum contract is a schema-valid response that echoes
-      the requested `brand_id` and carries at least one name.
-
-    steps:
-      - id: get_brand_identity
-        title: "Retrieve brand identity"
-        narrative: |
-          The buyer calls `get_brand_identity` with a known `brand_id`. The
-          response MUST match the brand-identity schema and echo the
-          requested `brand_id`. Rich fields (logos, colors, fonts, tone,
-          visual_guidelines) are optional at the baseline level — the
-          minimum bar is that identity resolution works and is schema-valid.
-        task: get_brand_identity
-        schema_ref: "brand/get-brand-identity-request.json"
-        response_schema_ref: "brand/get-brand-identity-response.json"
-        doc_ref: "/brand-protocol/tasks/get_brand_identity"
-        stateful: false
-        expected: |
-          Return a schema-valid brand identity that echoes the requested
-          brand_id and includes at least one name.
-
-        sample_request:
-          brand_id: "nova_motors"
-          context:
-            correlation_id: "brand_baseline--get_brand_identity"
-        context_outputs:
-          - path: "brand_id"
-            key: "brand_id"
-
-        validations:
-          - check: response_schema
-            description: "Response matches get-brand-identity-response.json schema"
-          - check: field_present
-            path: "brand_id"
-            description: "Response includes brand_id"
-          - check: field_value
-            path: "brand_id"
-            value: "nova_motors"
-            description: "Returned brand_id echoes the requested brand"
-          - check: field_present
-            path: "names"
-            description: "Response includes brand names"
-
-  - id: unknown_brand_rejection
-    title: "Unknown brand rejection"
-    narrative: |
-      Agents MUST reject unknown `brand_id` values with a structured
-      AdCP error rather than returning an empty or fabricated manifest.
-
-    steps:
-      - id: get_brand_identity_unknown
-        title: "Reject unknown brand ID"
-        narrative: |
-          The buyer calls `get_brand_identity` with a `brand_id` the agent
-          does not serve. The response MUST be a structured error with a
-          recovery classification — not a success response with empty
-          fields.
-        task: get_brand_identity
-        schema_ref: "brand/get-brand-identity-request.json"
-        response_schema_ref: "brand/get-brand-identity-response.json"
-        doc_ref: "/brand-protocol/tasks/get_brand_identity"
-        stateful: false
-        expected: |
-          Return an AdCP error response indicating the brand is not known
-          to this agent.
-
-        sample_request:
-          brand_id: "brand_that_does_not_exist_12345"
-          context:
-            correlation_id: "brand_baseline--get_brand_identity_unknown"
-
-        expect_error: true
-        negative_path: payload_well_formed
-        validations:
-          - check: error_code
-            value: "REFERENCE_NOT_FOUND"
-            description: "Error code indicates brand-not-found. REFERENCE_NOT_FOUND is the canonical fallback per error-handling.mdx (brands lack a dedicated *_NOT_FOUND code)."