@adcp/sdk 15.0.0 → 15.2.1

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/001-unsigned-sendmessage-required.json

@@ -0,0 +1,38 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage carrying create_media_buy; operation is in required_for",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-001\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-001\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"create_media_buy\",\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_required",
+    "failed_step": 0,
+    "resolved_operation": "create_media_buy"
+  },
+  "$comment": "The bypass in adcp#7820: the JSON-RPC method is SendMessage, not tools/call, so a verifier following the superseded cross-namespace rule never enters the required_for check and the unsigned create_media_buy proceeds."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/002-unsigned-message-send-v0-3-required.json

@@ -0,0 +1,36 @@
+{
+  "name": "Unsigned A2A 0.3 message/send carrying create_media_buy; operation is in required_for",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-002\",\"method\":\"message/send\",\"params\":{\"message\":{\"kind\":\"message\",\"messageId\":\"msg-a2a-neg-002\",\"role\":\"user\",\"parts\":[{\"kind\":\"data\",\"data\":{\"skill\":\"create_media_buy\",\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_required",
+    "failed_step": 0,
+    "resolved_operation": "create_media_buy"
+  },
+  "$comment": "Same resolution rule as negative/001, exercised on a different invocation-carrying method or A2A version."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/003-unsigned-sendstreamingmessage-required.json

@@ -0,0 +1,38 @@
+{
+  "name": "Unsigned A2A 1.0 SendStreamingMessage carrying create_media_buy; operation is in required_for",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-003\",\"method\":\"SendStreamingMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-003\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"create_media_buy\",\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_required",
+    "failed_step": 0,
+    "resolved_operation": "create_media_buy"
+  },
+  "$comment": "Streaming invocation methods resolve the operation exactly like SendMessage."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/004-duplicate-invocation-datapart.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage with two invocation DataParts; the operation is ambiguous",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-004\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-004\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"get_products\",\"input\":{\"buying_mode\":\"brief\",\"brief\":\"Premium CTV inventory for a spring campaign\"}}},{\"data\":{\"skill\":\"create_media_buy\",\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "Fail closed. First-wins resolves get_products (not required) while last-wins would dispatch create_media_buy. The verifier rejects before consulting required_for and never treats an unresolvable invocation as \"not in required_for\"."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/005-signed-duplicate-invocation-datapart.json

@@ -0,0 +1,41 @@
+{
+  "name": "Validly signed A2A 1.0 SendMessage with two invocation DataParts; still rejected as ambiguous",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3",
+      "Content-Digest": "sha-256=:G8Ya2ddfY5+V70IpRpEnMjU10OZFdt3DgK+hdkhJvOY=:",
+      "Signature-Input": "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"QTJBLW5lZy0wMDUtZHVwcw\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+      "Signature": "sig1=:AvohMIrAS1SGt0irlsGMH6P+L24Lupg9ISsk3RjT9wcsHa58FMjG4YmLzkf0/exh/crH6hsY+cshQL/lE9BRBA==:"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-005\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-005\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"get_products\",\"input\":{\"buying_mode\":\"brief\",\"brief\":\"Premium CTV inventory for a spring campaign\"}}},{\"data\":{\"skill\":\"create_media_buy\",\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_signature_base": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/a2a/jsonrpc\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:G8Ya2ddfY5+V70IpRpEnMjU10OZFdt3DgK+hdkhJvOY=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1776520800;expires=1776521100;nonce=\"QTJBLW5lZy0wMDUtZHVwcw\";keyid=\"test-ed25519-2026\";alg=\"ed25519\";tag=\"adcp/request-signing/v1\"",
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "AdCP 3.2 request-signing wire profile, unchanged: the signature covers content-digest and binary values are RFC 8941 sf-binary. Only the operation-resolution rule is new. The signature is valid over the body, but the body does not resolve to exactly one operation, so the verifier rejects before handler entry. Same class as step 14: a valid signature does not make an ambiguous body safe."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/006-missing-skill.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage whose only DataPart has no skill; the operation cannot be resolved",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-006\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-006\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "No resolvable operation. The verifier MUST NOT fall through to \"not in required_for\" and let a dispatcher guess the operation from the input shape."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/007-protocol-method-required-covers-sendmessage.json

@@ -0,0 +1,44 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage carrying get_products; SendMessage is in protocol_methods_required_for",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-007\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-007\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"get_products\",\"input\":{\"buying_mode\":\"brief\",\"brief\":\"Premium CTV inventory for a spring campaign\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ],
+    "protocol_methods_supported_for": [
+      "SendMessage"
+    ],
+    "protocol_methods_required_for": [
+      "SendMessage"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_required",
+    "failed_step": 0,
+    "resolved_operation": "get_products"
+  },
+  "$comment": "Namespaces stay disjoint and independent. protocol_methods_required_for matches the JSON-RPC method only, so listing SendMessage demands a signature on every A2A 1.0 message, including get_products. This is the over-covering interim mitigation for operators who cannot adopt the operation-resolution rule yet; it is unchanged by the operation-resolution rule."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/008-no-extension-header.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage carrying create_media_buy with no A2A-Extensions header; still resolved and still requires a signature",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-008\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-008\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"create_media_buy\",\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_signature_required",
+    "failed_step": 0,
+    "resolved_operation": "create_media_buy"
+  },
+  "$comment": "Resolution keys on the JSON-RPC method, not on extension activation. Omitting A2A-Extensions MUST NOT move a create_media_buy out of required_for."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/009-extra-non-invocation-datapart.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage with an invocation DataPart plus a second DataPart that has no skill",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-009\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-009\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"get_products\",\"input\":{\"buying_mode\":\"brief\",\"brief\":\"Premium CTV inventory for a spring campaign\"}}},{\"data\":{\"note\":\"extra\"}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "A Message carries exactly one DataPart. A gate that counts only DataParts shaped like an invocation and a dispatcher that counts every DataPart can disagree about which Part is authoritative."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/010-filepart-present.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage with an invocation DataPart plus a FilePart",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "hardening",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-010\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-010\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"get_products\",\"input\":{\"buying_mode\":\"brief\",\"brief\":\"Premium CTV inventory for a spring campaign\"}}},{\"url\":\"https://cdn.example.com/creative.mp4\",\"mediaType\":\"video/mp4\"}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "FileParts are outside the AdCP A2A invocation profile; a Message that carries one does not resolve to exactly one operation."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/011-part-with-text-and-data.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage whose single Part carries both text and data members",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "hardening",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-011\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-011\",\"role\":\"ROLE_USER\",\"parts\":[{\"text\":\"AdCP task: get_products\",\"data\":{\"skill\":\"create_media_buy\",\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "A 1.0 Part is a oneof by member presence. A lenient parser can read it as the TextPart while another reads it as the DataPart, so a Part with more than one content member is rejected."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/012-non-object-data.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage whose DataPart data is an array, not an object",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-012\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-012\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":[\"create_media_buy\",{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}]}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "A2A 1.0 models data as a protobuf Value, so an array, string, or number is representable on the wire. Only a JSON object with a string skill resolves."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/013-v0-3-kind-mismatch.json

@@ -0,0 +1,35 @@
+{
+  "name": "Unsigned A2A 0.3 message/send whose Part declares kind text but carries a data member",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "hardening",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-013\",\"method\":\"message/send\",\"params\":{\"message\":{\"kind\":\"message\",\"messageId\":\"msg-a2a-neg-013\",\"role\":\"user\",\"parts\":[{\"kind\":\"text\",\"data\":{\"skill\":\"create_media_buy\",\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "A 0.3 kind that disagrees with the member present is ambiguous. A 0.3-to-1.0 compatibility translator and the gate could otherwise pick different Parts."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/014-duplicate-skill-key.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage whose DataPart object repeats the skill key",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "hardening",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-014\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-014\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":\"get_products\",\"skill\":\"create_media_buy\",\"input\":{}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "Parser differential: first-wins reads get_products, last-wins reads create_media_buy. The resolver MUST use a duplicate-key-rejecting parser on the unsigned path too, not only at checklist step 14."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/015-non-string-skill.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage whose skill is a number",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-015\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-015\",\"role\":\"ROLE_USER\",\"parts\":[{\"data\":{\"skill\":7,\"input\":{\"idempotency_key\":\"vector-a2a-create-media-buy-0001\",\"account\":{\"brand\":{\"domain\":\"acmeoutdoor.example\"},\"operator\":\"pinnacle-agency.example\",\"sandbox\":false},\"packages\":[{\"product_id\":\"prod-1\",\"budget\":5000,\"pricing_option_id\":\"cpm_usd_fixed\",\"paused\":false}],\"brand\":{\"domain\":\"brand.example\"},\"start_time\":\"2027-01-04T00:00:00Z\",\"end_time\":\"2027-02-01T00:00:00Z\",\"paused\":false,\"plan_id\":\"plan_001\"}}}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "skill MUST be a non-empty string. A coercing parser could turn a non-string into a name the dispatcher then matches."
+}

package/compliance/cache/3.2.3/test-vectors/request-signing/a2a/negative/016-text-only-message.json

@@ -0,0 +1,37 @@
+{
+  "name": "Unsigned A2A 1.0 SendMessage with only a TextPart on an interface that dispatches AdCP operations",
+  "spec_reference": "#verifier-checklist-requests pre-check (operation resolution over A2A)",
+  "signing_profile_version": "3.2",
+  "tier": "contradiction-resolution",
+  "reference_now": 1776520800,
+  "request": {
+    "method": "POST",
+    "url": "https://seller.example.com/a2a/jsonrpc",
+    "headers": {
+      "Content-Type": "application/json",
+      "A2A-Version": "1.0",
+      "A2A-Extensions": "https://adcontextprotocol.org/extensions/adcp/v3"
+    },
+    "body": "{\"jsonrpc\":\"2.0\",\"id\":\"a2a-neg-016\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"msg-a2a-neg-016\",\"role\":\"ROLE_USER\",\"parts\":[{\"text\":\"Please create a media buy for the spring campaign\",\"mediaType\":\"text/plain\"}]}}}"
+  },
+  "verifier_capability": {
+    "supported": true,
+    "covers_content_digest": "required",
+    "supported_for": [
+      "create_media_buy",
+      "get_products"
+    ],
+    "required_for": [
+      "create_media_buy"
+    ]
+  },
+  "jwks_ref": [
+    "test-ed25519-2026"
+  ],
+  "expected_outcome": {
+    "success": false,
+    "error_code": "request_body_malformed",
+    "failed_step": 0
+  },
+  "$comment": "Zero DataParts: no operation resolves. A text- or model-based router MUST NOT infer create_media_buy from the prose and dispatch it past the signature gate."
+}