@adcp/sdk 14.0.0-rc.52 → 14.0.0-rc.53

package/dist/lib/testing/compliance/index.d.mts

@@ -4,7 +4,7 @@
  * comply → "Your agent works"  (deterministic, per-track)
  */
 export { comply, collectObservations, buildComplianceBundleResults, computeOverallStatus, formatComplianceResults, formatComplianceResultsJSON, rotateStoryboardsForOffset, } from './comply.mjs';
-export type { ComplyOptions, ComplianceBundleAssessmentOptions } from './comply.mjs';
+export type { ComplyOptions, ComplianceBundleAssessmentOptions, ComplyRouteStoryboardContext, ComplyStoryboardRoute, ComplyStoryboardRouting, ComplyStoryboardSkip, } from './comply.mjs';
 export { buildComplianceSummary, buildCrashSummary, formatComplianceSummaryText, formatComplianceSummaryMarkdown, } from './summary.mjs';
 export type { ComplianceSummaryArtifact, ComplianceSummaryFailure, ComplianceSummaryFailureKind, BuildSummaryOptions, BuildCrashSummaryOptions, } from './summary.mjs';
 export { SAMPLE_BRIEFS, getBriefById, getBriefsByVertical } from './briefs.mjs';

package/dist/lib/testing/compliance/index.d.ts

@@ -4,7 +4,7 @@
  * comply → "Your agent works"  (deterministic, per-track)
  */
 export { comply, collectObservations, buildComplianceBundleResults, computeOverallStatus, formatComplianceResults, formatComplianceResultsJSON, rotateStoryboardsForOffset, } from './comply';
-export type { ComplyOptions, ComplianceBundleAssessmentOptions } from './comply';
+export type { ComplyOptions, ComplianceBundleAssessmentOptions, ComplyRouteStoryboardContext, ComplyStoryboardRoute, ComplyStoryboardRouting, ComplyStoryboardSkip, } from './comply';
 export { buildComplianceSummary, buildCrashSummary, formatComplianceSummaryText, formatComplianceSummaryMarkdown, } from './summary';
 export type { ComplianceSummaryArtifact, ComplianceSummaryFailure, ComplianceSummaryFailureKind, BuildSummaryOptions, BuildCrashSummaryOptions, } from './summary';
 export { SAMPLE_BRIEFS, getBriefById, getBriefsByVertical } from './briefs';

package/dist/lib/testing/index.d.mts

@@ -1,6 +1,6 @@
 export { testAgent, testAgentA2A, testAgentClient, createTestAgent, TEST_AGENT_TOKEN, TEST_AGENT_MCP_CONFIG, TEST_AGENT_A2A_CONFIG, testAgentNoAuth, testAgentNoAuthA2A, TEST_AGENT_NO_AUTH_MCP_CONFIG, TEST_AGENT_NO_AUTH_A2A_CONFIG, creativeAgent, } from './test-helpers.mjs';
 export { testAgent as runAgentTests, formatTestResults, formatTestResultsJSON, formatTestResultsSummary, setAgentTesterLogger, getLogger, createTestClient, runStep, testHealthCheck, testDiscovery, testCreateMediaBuy, testFullSalesFlow, testReportingFlow, testCreativeSync, testCreativeInline, testCreativeFlow, testSignalsFlow, testErrorHandling, testValidation, testPricingEdgeCases, testTemporalValidation, testBehaviorAnalysis, testResponseConsistency, testGovernancePropertyLists, testGovernanceContentStandards, testPropertyListFilters, testSISessionLifecycle, testSIAvailability, testSIHandoff, testCapabilityDiscovery, testSyncAudiences, resolveAccountForMediaBuy, resolveAccountForAudiences, testSchemaCompliance, testMediaBuyLifecycle, testTerminalStateEnforcement, testPackageLifecycle, testCreativeStateMachine, testMediaBuyStateMachine, testAccountStateMachine, testSessionStateMachine, testDeliverySimulation, testBudgetSimulation, testControllerValidation, testBrandRightsFlow, hasBrandRightsTools, hasGovernanceTools, hasSITools, likelySupportsV3, testAllScenarios, getApplicableScenarios, SCENARIO_REQUIREMENTS, DEFAULT_SCENARIOS, formatSuiteResults, formatSuiteResultsJSON, type TestScenario, type TestOptions, type OrchestratorOptions, type TestResult, type SuiteResult, type TestStepResult, type AgentProfile, type TaskResult, type TestClient, type Logger, } from './agent-tester.mjs';
-export { comply, buildComplianceBundleResults, formatComplianceResults, formatComplianceResultsJSON, buildComplianceSummary, SAMPLE_BRIEFS, getBriefById, getBriefsByVertical, type ComplyOptions, type ComplianceBundleAssessmentOptions, type ComplianceTrack, type TrackResult, type TestedTrackEntry, type TrackStatus, type ComplianceBundleResult, type ComplianceBundleStatus, type ComplianceResult, type ComplianceSummary, type ComplianceSummaryArtifact, type BuildSummaryOptions, type AdvisoryObservation, type ObservationSource, type SampleBrief, } from './compliance/index.mjs';
+export { comply, buildComplianceBundleResults, formatComplianceResults, formatComplianceResultsJSON, buildComplianceSummary, SAMPLE_BRIEFS, getBriefById, getBriefsByVertical, type ComplyOptions, type ComplianceBundleAssessmentOptions, type ComplyRouteStoryboardContext, type ComplyStoryboardRoute, type ComplyStoryboardRouting, type ComplyStoryboardSkip, type ComplianceTrack, type TrackResult, type TestedTrackEntry, type TrackStatus, type ComplianceBundleResult, type ComplianceBundleStatus, type ComplianceResult, type ComplianceSummary, type ComplianceSummaryArtifact, type BuildSummaryOptions, type AdvisoryObservation, type ObservationSource, type SampleBrief, } from './compliance/index.mjs';
 export { GovernanceAgentStub } from './stubs/index.mjs';
 export type { StubCallRecord } from './stubs/index.mjs';
 export { expectControllerError, expectControllerSuccess } from './controller-assertions.mjs';

package/dist/lib/testing/index.d.ts

@@ -1,6 +1,6 @@
 export { testAgent, testAgentA2A, testAgentClient, createTestAgent, TEST_AGENT_TOKEN, TEST_AGENT_MCP_CONFIG, TEST_AGENT_A2A_CONFIG, testAgentNoAuth, testAgentNoAuthA2A, TEST_AGENT_NO_AUTH_MCP_CONFIG, TEST_AGENT_NO_AUTH_A2A_CONFIG, creativeAgent, } from './test-helpers';
 export { testAgent as runAgentTests, formatTestResults, formatTestResultsJSON, formatTestResultsSummary, setAgentTesterLogger, getLogger, createTestClient, runStep, testHealthCheck, testDiscovery, testCreateMediaBuy, testFullSalesFlow, testReportingFlow, testCreativeSync, testCreativeInline, testCreativeFlow, testSignalsFlow, testErrorHandling, testValidation, testPricingEdgeCases, testTemporalValidation, testBehaviorAnalysis, testResponseConsistency, testGovernancePropertyLists, testGovernanceContentStandards, testPropertyListFilters, testSISessionLifecycle, testSIAvailability, testSIHandoff, testCapabilityDiscovery, testSyncAudiences, resolveAccountForMediaBuy, resolveAccountForAudiences, testSchemaCompliance, testMediaBuyLifecycle, testTerminalStateEnforcement, testPackageLifecycle, testCreativeStateMachine, testMediaBuyStateMachine, testAccountStateMachine, testSessionStateMachine, testDeliverySimulation, testBudgetSimulation, testControllerValidation, testBrandRightsFlow, hasBrandRightsTools, hasGovernanceTools, hasSITools, likelySupportsV3, testAllScenarios, getApplicableScenarios, SCENARIO_REQUIREMENTS, DEFAULT_SCENARIOS, formatSuiteResults, formatSuiteResultsJSON, type TestScenario, type TestOptions, type OrchestratorOptions, type TestResult, type SuiteResult, type TestStepResult, type AgentProfile, type TaskResult, type TestClient, type Logger, } from './agent-tester';
-export { comply, buildComplianceBundleResults, formatComplianceResults, formatComplianceResultsJSON, buildComplianceSummary, SAMPLE_BRIEFS, getBriefById, getBriefsByVertical, type ComplyOptions, type ComplianceBundleAssessmentOptions, type ComplianceTrack, type TrackResult, type TestedTrackEntry, type TrackStatus, type ComplianceBundleResult, type ComplianceBundleStatus, type ComplianceResult, type ComplianceSummary, type ComplianceSummaryArtifact, type BuildSummaryOptions, type AdvisoryObservation, type ObservationSource, type SampleBrief, } from './compliance';
+export { comply, buildComplianceBundleResults, formatComplianceResults, formatComplianceResultsJSON, buildComplianceSummary, SAMPLE_BRIEFS, getBriefById, getBriefsByVertical, type ComplyOptions, type ComplianceBundleAssessmentOptions, type ComplyRouteStoryboardContext, type ComplyStoryboardRoute, type ComplyStoryboardRouting, type ComplyStoryboardSkip, type ComplianceTrack, type TrackResult, type TestedTrackEntry, type TrackStatus, type ComplianceBundleResult, type ComplianceBundleStatus, type ComplianceResult, type ComplianceSummary, type ComplianceSummaryArtifact, type BuildSummaryOptions, type AdvisoryObservation, type ObservationSource, type SampleBrief, } from './compliance';
 export { GovernanceAgentStub } from './stubs';
 export type { StubCallRecord } from './stubs';
 export { expectControllerError, expectControllerSuccess } from './controller-assertions';

package/dist/lib/testing/storyboard/runner.js

@@ -42,6 +42,7 @@ __export(runner_exports, {
   applyStoryboardVersionOptions: () => applyStoryboardVersionOptions,
   buildDiscoveryFailedResult: () => buildDiscoveryFailedResult,
   buildStepRequest: () => buildStepRequest,
+  collectCapabilityNotices: () => collectCapabilityNotices,
   describeStoryboardCapabilityGates: () => describeStoryboardCapabilityGates,
   evaluateCapabilityPredicate: () => evaluateCapabilityPredicate,
   getFirstStepPreview: () => getFirstStepPreview,
@@ -52,6 +53,7 @@ __export(runner_exports, {
   runStoryboardStep: () => runStoryboardStep,
   signingCoverage: () => signingCoverage,
   signingCoverageUnverified: () => signingCoverageUnverified,
+  storyboardCapabilityGateUnmet: () => storyboardCapabilityGateUnmet,
   storyboardCapabilityPredicates: () => storyboardCapabilityPredicates,
   summarizeStrictValidation: () => summarizeStrictValidation
 });
@@ -377,6 +379,12 @@ function evaluateStoryboardCapabilityGates(storyboard, profile, agentTools, adcp
   return `Capability predicates not satisfied:
 ${failures.map((detail) => `- ${detail}`).join("\n")}`;
 }
+function storyboardCapabilityGateUnmet(storyboard, options) {
+  if (storyboardCapabilityPredicates(storyboard).length === 0) return null;
+  const versioned = applyStoryboardVersionOptions(storyboard, applyReusableProfileOptions(options));
+  if (versioned._profile === void 0) return null;
+  return evaluateStoryboardCapabilityGates(storyboard, versioned._profile, versioned.agentTools, versioned.adcpVersion);
+}
 function collectPhaseCapabilitySkipDetails(storyboard, profile, agentTools, adcpVersion) {
   const skipDetails = /* @__PURE__ */ new Map();
   for (const phase of storyboard.phases) {
@@ -6562,6 +6570,7 @@ function getFirstStepPreview(storyboard, context = {}) {
   applyStoryboardVersionOptions,
   buildDiscoveryFailedResult,
   buildStepRequest,
+  collectCapabilityNotices,
   describeStoryboardCapabilityGates,
   evaluateCapabilityPredicate,
   getFirstStepPreview,
@@ -6572,6 +6581,7 @@ function getFirstStepPreview(storyboard, context = {}) {
   runStoryboardStep,
   signingCoverage,
   signingCoverageUnverified,
+  storyboardCapabilityGateUnmet,
   storyboardCapabilityPredicates,
   summarizeStrictValidation
 });

package/dist/lib/testing/storyboard/runner.mjs

@@ -401,6 +401,12 @@ function evaluateStoryboardCapabilityGates(storyboard, profile, agentTools, adcp
   return `Capability predicates not satisfied:
 ${failures.map((detail) => `- ${detail}`).join("\n")}`;
 }
+function storyboardCapabilityGateUnmet(storyboard, options) {
+  if (storyboardCapabilityPredicates(storyboard).length === 0) return null;
+  const versioned = applyStoryboardVersionOptions(storyboard, applyReusableProfileOptions(options));
+  if (versioned._profile === void 0) return null;
+  return evaluateStoryboardCapabilityGates(storyboard, versioned._profile, versioned.agentTools, versioned.adcpVersion);
+}
 function collectPhaseCapabilitySkipDetails(storyboard, profile, agentTools, adcpVersion) {
   const skipDetails = /* @__PURE__ */ new Map();
   for (const phase of storyboard.phases) {
@@ -6585,6 +6591,7 @@ export {
   applyStoryboardVersionOptions,
   buildDiscoveryFailedResult,
   buildStepRequest,
+  collectCapabilityNotices,
   describeStoryboardCapabilityGates,
   evaluateCapabilityPredicate,
   getFirstStepPreview,
@@ -6595,6 +6602,7 @@ export {
   runStoryboardStep,
   signingCoverage,
   signingCoverageUnverified,
+  storyboardCapabilityGateUnmet,
   storyboardCapabilityPredicates,
   summarizeStrictValidation
 };

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "14.0.0-rc.52";
+export declare const RUNNER_CAPABILITY_VERSION = "14.0.0-rc.53";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "14.0.0-rc.52";
+export declare const RUNNER_CAPABILITY_VERSION = "14.0.0-rc.53";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/version.d.mts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "14.0.0-rc.52";
+export declare const LIBRARY_VERSION = "14.0.0-rc.53";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "14.0.0-rc.52";
+    readonly library: "14.0.0-rc.53";
     readonly adcp: "3.2.0-rc.7";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.0-rc.7", "3.2-rc.7"];
-    readonly generatedAt: "2026-09-30T05:16:13.982Z";
+    readonly generatedAt: "2026-09-30T09:24:27.054Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.d.ts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "14.0.0-rc.52";
+export declare const LIBRARY_VERSION = "14.0.0-rc.53";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "14.0.0-rc.52";
+    readonly library: "14.0.0-rc.53";
     readonly adcp: "3.2.0-rc.7";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.0-rc.7", "3.2-rc.7"];
-    readonly generatedAt: "2026-09-30T05:16:13.982Z";
+    readonly generatedAt: "2026-09-30T09:24:27.054Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -31,7 +31,7 @@ __export(version_exports, {
   toReleasePrecisionVersion: () => toReleasePrecisionVersion
 });
 module.exports = __toCommonJS(version_exports);
-const LIBRARY_VERSION = "14.0.0-rc.52";
+const LIBRARY_VERSION = "14.0.0-rc.53";
 const ADCP_VERSION = "3.2.0-rc.7";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -95,10 +95,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2-rc.7"
 ];
 const VERSION_INFO = {
-  library: "14.0.0-rc.52",
+  library: "14.0.0-rc.53",
   adcp: "3.2.0-rc.7",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-09-30T05:16:13.982Z"
+  generatedAt: "2026-09-30T09:24:27.054Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/version.mjs

@@ -1,4 +1,4 @@
-const LIBRARY_VERSION = "14.0.0-rc.52";
+const LIBRARY_VERSION = "14.0.0-rc.53";
 const ADCP_VERSION = "3.2.0-rc.7";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -62,10 +62,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2-rc.7"
 ];
 const VERSION_INFO = {
-  library: "14.0.0-rc.52",
+  library: "14.0.0-rc.53",
   adcp: "3.2.0-rc.7",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-09-30T05:16:13.982Z"
+  generatedAt: "2026-09-30T09:24:27.054Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/docs/TYPE-SUMMARY.md

@@ -1,7 +1,7 @@
 # AdCP Type Summary
 
 > Generated at: 2026-09-30
-> @adcp/sdk v14.0.0-rc.52
+> @adcp/sdk v14.0.0-rc.53
 
 Curated reference of the types that matter for using the AdCP client. For full generated types see `src/lib/types/tools.generated.ts` and `src/lib/types/core.generated.ts`.
 

package/docs/guides/VALIDATE-YOUR-AGENT.md

@@ -187,6 +187,55 @@ await comply(agentUrl, {
 });
 ```
 
+**Multi-agent storyboards under `comply()`.** `comply()` grades one agent, so
+storyboards that declare `requires: [multi_agent]` (for example the
+governance-aware seller scenarios) skip with `requirement_unmet` and cap their
+bundle at `partial`. A grader that can supply the other agents can route them
+per storyboard with `routeStoryboard`; every other storyboard keeps the
+ordinary single-URL run:
+
+```ts
+await comply(agentUrl, {
+  auth: { type: 'bearer', token: ownerToken },
+  routeStoryboard: storyboard => {
+    if (!storyboard.requires?.includes('multi_agent')) return undefined; // unchanged run
+    if (!canRoute(storyboard)) return { skip: `${storyboard.id}: no governance agent for this topology` };
+    return {
+      agents: {
+        seller: { url: agentUrl }, // agent under test: inherits the run-level auth
+        governance: { url: governanceUrl, auth: { type: 'bearer', token: governanceToken } },
+      },
+      default_agent: 'seller',
+      context: { seller_agent_url: agentUrl },
+    };
+  },
+});
+```
+
+A routed result lands in `tracks`, `failures`, `storyboards_executed` and
+`bundle_results` like any other run, graded against the agent under test
+only. A failed step, or a discovery failure, on another routed agent becomes a
+`prerequisite_failed` coverage gap (`partial`, never `failing`). A routed
+storyboard in which no step served by the agent under test passed cannot reach
+`passing`. `{ skip }` records the same `requirement_unmet` row an unrouted
+`multi_agent` storyboard gets, with your reason (control characters stripped)
+as `skip.detail`, so the bundle stays `partial`. Storyboards whose root
+capability predicate the agent under test does not satisfy are never passed to
+the hook and stay `not_applicable`. The hook's `profile` argument is the
+agent's own capability answer, so treat it as untrusted.
+
+`comply()` throws on caller misconfiguration. That covers a `default_agent`
+that is not the agent under test, an entry whose `auth` is not a real
+credential object (only the agent-under-test entry may omit it; it then keeps
+the run-level credential, which is dropped from the shared routed options), run-level
+`headers` (they are sent to every routed agent), and a replacement
+`storyboard` that changes phases, steps, validations or gates. A storyboard that
+would send `$test_kit.auth` or `from_test_kit` credentials through a step not
+pinned to the agent under test is recorded as a skip instead of being routed.
+Run-level `transport`, including a `trustedFetchFn` egress guard, applies to
+every routed agent. Version negotiation is done once, against the agent under
+test, and shared by the routed agents.
+
 **OAuth-protected agents.** Storyboard runs reuse tokens saved under an alias. Two supported flows:
 
 ```bash

package/docs/llms.txt

@@ -1,7 +1,7 @@
 # Ad Context Protocol (AdCP)
 
 > Generated at: 2026-09-30
-> Library: @adcp/sdk v14.0.0-rc.52
+> Library: @adcp/sdk v14.0.0-rc.53
 > AdCP major version: 3
 > Canonical URL: https://adcontextprotocol.github.io/adcp-client/llms.txt
 > Note: the `Library` stamp reflects the package.json version at doc-generation time. The narrative below describes the surface that lands on the next-published minor — including any 6.7 helpers documented here ahead of the release tag.

package/docs/migration-13-to-14.md

@@ -975,12 +975,16 @@ SDK 13 used the legacy AdCP 3.0/3.1 representation. SDK 14 selects between two p
 
 High-level A2A/MCP clients carry the configured agent version automatically. Low-level signing integrations should pass their trusted version context and can inspect the signature encoding with `requestSigningEncodingForVersion()`. For SDK 13 source compatibility, a low-level verifier with no `adcpVersion` accepts either signature encoding and applies its configured digest-coverage policy; an explicit trusted 3.2 pin keeps mandatory digest coverage.
 
-For a staged server rollout, set the internal verifier option
-`signedRequests.covers_content_digest: 'either'` to accept SDK 13 Base64URL
-signatures and SDK 14's 3.2 encoding on the same endpoint. Continue advertising
-`covers_content_digest: 'required'` in the 3.2 capability document; SDK 14
-projects that strict public contract automatically. Move the internal verifier
-to `required` after legacy callers are gone.
+A verifier pinned to AdCP 3.2 parses `Signature` and `Content-Digest` only as
+RFC 8941 padded standard Base64. It rejects an SDK 13 Base64URL token with
+`request_signature_header_malformed` at parse time (checklist step 1 for
+`Signature`), even when the internal verifier policy is
+`signedRequests.covers_content_digest: 'either'`; the spec forbids a 3.2
+verifier from retrying a legacy token through a second decoder. To keep
+accepting SDK 13 signers, serve them from a separately configured endpoint
+pinned to 3.0/3.1, or coordinate the cutover before the shared endpoint
+advertises 3.2. A 3.0/3.1-pinned endpoint in `'either'` mode still accepts both
+serializations.
 
 Do not select a signing profile from a version value inside an unverified request body or header. On the server, bind the version to the endpoint, tenant, or authenticated agent configuration. Webhook signatures do not move to the 3.2 request profile.
 
@@ -988,7 +992,10 @@ Low-level `verifyRequestSignature()` calls that omit `adcpVersion` tolerate both
 the legacy Base64URL and 3.2 RFC 8941 Base64 serialization so frozen 3.0/3.1
 integrations do not inherit the SDK's own protocol pin. This does not relax
 digest policy: `capability.covers_content_digest` remains authoritative. Pass a
-trusted `adcpVersion` whenever one is available for deterministic diagnostics.
+trusted `adcpVersion` whenever one is available. An endpoint that advertises
+3.2 must pass `adcpVersion: '3.2'` (or its exact 3.2 release): an unpinned
+verifier accepts a Base64URL token that a 3.2 verifier must reject, so it fails
+the `profile-3.2/negative/001-base64url-sf-binary` conformance vector.
 
 ## Cross-role governance is capability-gated
 

package/docs/migration-14.x-rc-worksheet.md

@@ -11,8 +11,8 @@ below as the publication/deployment gate.
 
 | Fact | Value |
 | --- | --- |
-| Exact npm package | `@adcp/sdk@14.0.0-rc.52` |
-| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@14.0.0-rc.52 dist.integrity` |
+| Exact npm package | `@adcp/sdk@14.0.0-rc.53` |
+| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@14.0.0-rc.53 dist.integrity` |
 | Node.js runtime | `^20.19.0 || >=22.12.0` |
 | Default AdCP wire release | `3.2.0-rc.7` |
 | Maintained wire releases | `v2.5`, `v2.6`, `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.1.19`, `3.1.20`, `3.1.21`, `3.1.22`, `3.1.23`, `3.1.24`, `3.2.0-rc.7`, `3.2-rc.7` |
@@ -21,8 +21,8 @@ below as the publication/deployment gate.
 Install exact production inputs rather than a moving prerelease range:
 
 ```bash
-npm install --save-exact '@adcp/sdk@14.0.0-rc.52'
-npm view '@adcp/sdk@14.0.0-rc.52' dist.integrity
+npm install --save-exact '@adcp/sdk@14.0.0-rc.53'
+npm view '@adcp/sdk@14.0.0-rc.53' dist.integrity
 ```
 
 ### Required and optional peers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "14.0.0-rc.52",
+  "version": "14.0.0-rc.53",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",