@adcp/sdk 16.2.0 → 16.4.0

package/dist/lib/testing/storyboard/runner.js

@@ -48,6 +48,7 @@ __export(runner_exports, {
   getFirstStepPreview: () => getFirstStepPreview,
   listStrictOnlyFailures: () => listStrictOnlyFailures,
   prepareGovernedStoryboardWireArgs: () => prepareGovernedStoryboardWireArgs,
+  prepareStoryboardFixtures: () => prepareStoryboardFixtures,
   resolveCapabilityPath: () => resolveCapabilityPath,
   runStoryboard: () => runStoryboard,
   runStoryboardStep: () => runStoryboardStep,
@@ -69,6 +70,8 @@ var import_rawResponseCapture = require('../../protocols/rawResponseCapture.js')
 var import_task_map = require('./task-map.js');
 var import_functional_dispatch = require('./request-signing/functional-dispatch.js');
 var import_context = require('./context.js');
+var import_protected_context = require('./protected-context.js');
+var import_prepared_fixtures = require('./prepared-fixtures.js');
 var import_rejection_hints = require('./rejection-hints.js');
 var import_shape_drift_hints = require('./shape-drift-hints.js');
 var import_strict_validation_hints = require('./strict-validation-hints.js');
@@ -79,6 +82,7 @@ var import_rate_limit_trip = require('./rate-limit-trip.js');
 var import_redact_secrets = require('../../utils/redact-secrets.js');
 var import_property_list_reference = require('./property-list-reference.js');
 var import_response_unwrapper = require('../../utils/response-unwrapper.js');
+var import_errors = require('../../errors/index.js');
 var import_envelope_status_compat = require('../../utils/envelope-status-compat.js');
 var import_test_controller = require('../test-controller.js');
 var import_constants = require('../../upstream-recorder/constants.js');
@@ -123,12 +127,35 @@ function getPreparedTrustedMatchPublisherAuth(options) {
 function withPreparedTrustedMatchPublisherAuth(options, prepared) {
   return { ...options, [PREPARED_TRUSTED_MATCH_PUBLISHER_AUTH]: prepared };
 }
+function tryProtectedContextPatch(context, patch, options) {
+  try {
+    (0, import_protected_context.applyProtectedContextPatch)(context, patch, options);
+    return void 0;
+  } catch (error) {
+    if (!(error instanceof import_protected_context.ProtectedContextViolation)) throw error;
+    return {
+      check: "protected_context_violation",
+      passed: false,
+      description: "Reserved fixture-preparation context keys are immutable for the rest of the run",
+      error: error.message,
+      json_pointer: null,
+      expected: "no write, delete or metadata change to the __adcp_fixture_ namespace",
+      actual: error.keys.join(", "),
+      // required_on_failure, and null outside `response_schema`. Omitting
+      // the keys is not the same as recording null — a consumer cannot
+      // tell "no schema applies" from "the runner forgot".
+      schema_id: null,
+      schema_url: null
+    };
+  }
+}
 const SKIP_DETAILS = {
   not_applicable: "Not applicable: agent did not declare the protocol or specialism this storyboard targets.",
   no_phases: "Storyboard has no executable phases (placeholder).",
   prerequisite_failed: "Skipped: a prerequisite step or contract did not pass.",
   missing_tool: "Skipped: agent did not advertise the required tool.",
   missing_test_controller: "Skipped: deterministic_testing phase requires comply_test_controller, which the agent did not advertise.",
+  fixture_unsatisfied: "Skipped: every enabled strategy for a declared fixture handle was exhausted without finding or creating a qualifying entity.",
   fixture_unavailable: "Skipped: the runner test kit cannot synthesize a valid input for the seller-declared contract.",
   unsatisfied_contract: "Skipped: test-kit contract is out of scope for this grading run.",
   requirement_unmet: "Skipped: a requires: tag named a runtime requirement that is not available on this run (see RunnerSkipResult.requirement).",
@@ -490,6 +517,17 @@ function responseNotApplicableContextKeys(step, gate) {
   if (gate.context_keys?.length) return gate.context_keys;
   return (step.context_outputs ?? []).filter((o) => o.path === "pagination.cursor").map((o) => o.key).filter((key) => typeof key === "string" && key.length > 0);
 }
+const FIXTURE_CAPTURE_STEP_ID = "__fixture_capture__";
+function describeFixtureCaptureTask(captures, refusedKeys) {
+  for (const key of refusedKeys) {
+    const task = captures?.provenance?.[key]?.source_task;
+    if (typeof task === "string" && task.length > 0) return task;
+  }
+  const distinct = new Set(
+    Object.values(captures?.provenance ?? {}).map((entry) => entry.source_task).filter((task) => typeof task === "string" && task.length > 0)
+  );
+  return distinct.size === 1 ? [...distinct][0] : import_loader.VALIDATION_ONLY_TASK;
+}
 function responseDerivedContextResult(runState) {
   const entries = runState.responseDerivedNotApplicableContextKeys;
   return entries && entries.size > 0 ? { response_derived_not_applicable_context_keys: Object.fromEntries(entries) } : {};
@@ -781,27 +819,53 @@ async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
             "Credential-isolated property-list references currently require MCP; A2A probe coverage is unavailable."
           );
         }
-        if ((0, import_client.hasTestClientScope)() && options._client && !options.agents) {
-          const resolution = (0, import_client.getOrCreateClientResolution)(
-            typeof agentUrlOrUrls === "string" ? agentUrlOrUrls : agentUrlOrUrls[0],
-            options
-          );
-          const discovered = await (0, import_client.getOrDiscoverProfile)(resolution.client, options);
-          options = {
-            ...options,
-            _profile: discovered.step.passed ? discovered.profile : void 0,
-            agentTools: discovered.step.passed ? discovered.profile.tools : void 0
-          };
-        }
+        storyboard = (0, import_loader.normalizeValidationOnlyTasks)(storyboard);
+        (0, import_loader.validateStoryboardShape)(storyboard);
         const schemaRoot = getRunSchemaRoot(options);
-        const runBody = () => (0, import_schema_loader.withServedReleaseSchemaRoots)(
-          options.servedReleaseSchemaRoots,
-          () => runStoryboardBody(agentUrlOrUrls, storyboard, options)
-        );
+        const gatedBody = async () => {
+          const metadataRefusal = describeReservedCallerOptions(options);
+          if (metadataRefusal !== void 0) {
+            return denyPreparedFixtures(
+              options,
+              buildPreparedRefusalRunResult(resolveBindingAgentUrls(agentUrlOrUrls, options), storyboard, {
+                code: "unauthorized_metadata",
+                detail: metadataRefusal
+              }),
+              "unauthorized_metadata"
+            );
+          }
+          if (options.prepared_fixtures !== void 0) {
+            const urls = resolveBindingAgentUrls(agentUrlOrUrls, options);
+            const gate = await gatePreparedFixtures(storyboard, urls, options, void 0, "run");
+            if (gate.used && "refusal" in gate) {
+              return denyPreparedFixtures(
+                options,
+                buildPreparedRefusalRunResult(urls, storyboard, gate.refusal),
+                gate.refusal.code
+              );
+            }
+          }
+          if ((0, import_client.hasTestClientScope)() && options._client && !options.agents) {
+            const resolution = (0, import_client.getOrCreateClientResolution)(
+              typeof agentUrlOrUrls === "string" ? agentUrlOrUrls : agentUrlOrUrls[0],
+              options
+            );
+            const discovered = await (0, import_client.getOrDiscoverProfile)(resolution.client, options);
+            options = {
+              ...options,
+              _profile: discovered.step.passed ? discovered.profile : void 0,
+              agentTools: discovered.step.passed ? discovered.profile.tools : void 0
+            };
+          }
+          return (0, import_schema_loader.withServedReleaseSchemaRoots)(
+            options.servedReleaseSchemaRoots,
+            () => runStoryboardBody(agentUrlOrUrls, storyboard, options)
+          );
+        };
         if (schemaRoot) {
-          return await (0, import_schema_loader.withExternalSchemaRoot)(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
+          return await (0, import_schema_loader.withExternalSchemaRoot)(schemaRoot.adcpVersion, schemaRoot.schemaRoot, gatedBody);
         }
-        return await runBody();
+        return await gatedBody();
       },
       { isolate: !(0, import_client.hasTestClientScope)() }
     )
@@ -1562,10 +1626,380 @@ function runnerNoticeKey(notice) {
 function collectStepNotices(phases) {
   return phases.flatMap((phase) => phase.steps.flatMap((step) => step.notices ?? []));
 }
+const CREATIVE_PROBE_CONTEXT_SUFFIXES = [
+  "capability_id",
+  "target_format_id",
+  "message",
+  "creative_manifest",
+  "creative_id",
+  "transformer_id",
+  "config"
+];
+function createRunContext(storyboard, options) {
+  const protectedWriter = (0, import_protected_context.createProtectedContextWriter)();
+  const context = {};
+  (0, import_protected_context.registerProtectedContext)(context, protectedWriter);
+  (0, import_protected_context.applyProtectedContextPatch)(
+    context,
+    { set: { ...storyboard.context } },
+    { origin: `[${storyboard.id}] storyboard.context` }
+  );
+  (0, import_protected_context.applyProtectedContextPatch)(context, { set: { ...options.context } }, { origin: "options.context" });
+  if (storyboard.context) (0, import_context.forwardAliasCache)(storyboard.context, context);
+  if (options.context) (0, import_context.forwardAliasCache)(options.context, context);
+  return { context, protectedWriter };
+}
+function describeReservedCallerMetadata(map, location) {
+  if (!map) return void 0;
+  const offending = Object.keys(map).filter(
+    (key) => (0, import_protected_context.isProtectedContextKey)(key) || key === "__proto__" || key === "constructor" || key === "prototype"
+  );
+  if (offending.length === 0) return void 0;
+  return `${location}: cannot carry reserved or prototype-sensitive key(s) ${offending.join(", ")}; fixture-preparation metadata is not caller-supplied. Rename the key to anything not starting with "__adcp_fixture_" and not named __proto__, constructor or prototype \u2014 or, if you meant to reuse a prepared graph, pass it as options.prepared_fixtures with an authorizer instead of threading its context back.`;
+}
+function describeReservedCallerOptions(options) {
+  return describeReservedCallerMetadata(options.context, "options.context") ?? describeReservedCallerMetadata(options.context_provenance, "options.context_provenance") ?? describeReservedCallerMetadata(
+    options.response_derived_not_applicable_context_keys,
+    "options.response_derived_not_applicable_context_keys"
+  );
+}
+function describeStepAuthDirective(directive) {
+  if (directive === "none") return "none";
+  if (typeof directive !== "object") return JSON.stringify(directive);
+  const parts = [JSON.stringify(directive.type)];
+  for (const [key, value] of Object.entries(directive).sort(
+    ([a], [b]) => a < b ? -1 : 1
+  )) {
+    if (key === "type") continue;
+    parts.push(JSON.stringify([key, value]));
+  }
+  return parts.join(";");
+}
+function resolveBindingAgentUrls(agentUrlOrUrls, options) {
+  if (options.agents) return Object.values(options.agents).map((entry) => entry.url);
+  return Array.isArray(agentUrlOrUrls) ? agentUrlOrUrls : [agentUrlOrUrls];
+}
+async function gatePreparedFixtures(storyboard, agentUrls, options, step, gate = "pass") {
+  const outcome = await (0, import_prepared_fixtures.resolvePreparedFixtures)({
+    supplied: options.prepared_fixtures,
+    // The run context is built here so the binding can report the account
+    // the step's request will ACTUALLY carry. Without it the standalone
+    // entry gate — the one `runStoryboardStep` uses — reported no
+    // `request_account_scope` at all, and a caller-supplied or
+    // context-substituted foreign account reached the seller while the
+    // authorizer saw nothing to refuse. Building the context performs no
+    // I/O and is what the run would build moments later anyway.
+    current: buildCurrentPreparedBinding(
+      storyboard,
+      agentUrls,
+      options,
+      step,
+      options,
+      step !== void 0 ? createRunContext(storyboard, options).context : void 0
+    ),
+    ...options.prepared_fixtures_authorizer && { authorizer: options.prepared_fixtures_authorizer },
+    ...step !== void 0 && { stepId: step.id },
+    gate
+  });
+  if (outcome === void 0) return { used: false };
+  if (!outcome.ok) return { used: true, refusal: outcome.refusal };
+  return { used: true, state: outcome.state };
+}
+function hydratePreparedCaptures(state, context, protectedWriter, contextProvenance) {
+  const captures = state.captures;
+  if (Object.keys(captures).length === 0) return void 0;
+  return tryProtectedContextPatch(
+    context,
+    { set: captures, setProvenance: state.captureProvenance },
+    { writer: protectedWriter, sinks: { provenance: contextProvenance }, origin: "prepared fixture state" }
+  );
+}
+async function prepareStoryboardFixtures(agentUrl, storyboard, options = {}) {
+  options = applyReusableProfileOptions(options);
+  return (0, import_property_list_reference.withPropertyListCredentialRedaction)(
+    () => (0, import_protocols.withMCPConnectionScope)(
+      async () => {
+        storyboard = (0, import_loader.normalizeValidationOnlyTasks)(storyboard);
+        (0, import_loader.validateStoryboardShape)(storyboard);
+        options = applyStoryboardVersionOptions(storyboard, options);
+        options = (0, import_functional_dispatch.applyFunctionalRequestSigning)(options, {
+          ...options.complianceDir && { complianceDir: options.complianceDir },
+          ...options.adcpVersion && { version: options.adcpVersion }
+        });
+        options = (0, import_test_kit.resolveDeclaredTestKit)(storyboard, options);
+        options = (0, import_native_a2a_compliance.applyNativeA2AComplianceTransportOptions)(options);
+        const schemaRoot = getRunSchemaRoot(options);
+        const body = () => (0, import_schema_loader.withServedReleaseSchemaRoots)(
+          options.servedReleaseSchemaRoots,
+          () => prepareStoryboardFixturesBody(agentUrl, storyboard, options)
+        );
+        if (schemaRoot) {
+          return await (0, import_schema_loader.withExternalSchemaRoot)(schemaRoot.adcpVersion, schemaRoot.schemaRoot, body);
+        }
+        return await body();
+      },
+      { isolate: !(0, import_client.hasTestClientScope)() }
+    )
+  );
+}
+function resolvePreparationRouteOptions(agentUrl, options) {
+  const agents = options.agents;
+  if (!agents) return options;
+  const match = Object.entries(agents).find(([, entry2]) => entry2?.url === agentUrl);
+  if (!match) return options;
+  const [, entry] = match;
+  return {
+    ...options,
+    ...entry?.auth !== void 0 && { auth: entry.auth },
+    ...entry?.transport !== void 0 && { protocol: entry.transport }
+  };
+}
+async function prepareStoryboardFixturesBody(agentUrl, storyboard, options) {
+  const agentUrls = resolveBindingAgentUrls(agentUrl, options);
+  const metadataRefusal = describeReservedCallerOptions(options);
+  if (metadataRefusal !== void 0) {
+    return buildPreparedFixtures(storyboard, agentUrls, options, void 0, {
+      status: "failed",
+      detail: metadataRefusal
+    });
+  }
+  if (options.prepared_fixtures !== void 0) {
+    return buildPreparedFixtures(storyboard, agentUrls, options, void 0, {
+      status: "failed",
+      detail: "prepareStoryboardFixtures() does not accept prepared_fixtures: it produces prepared state, it does not consume it. Passing state here authorizes nothing \u2014 the authorizer is never consulted \u2014 and preparation would re-resolve the graph against the seller anyway. Pass the state to runStoryboard() or runStoryboardStep() instead, with prepared_fixtures_authorizer. See docs/guides/COLLECTION-FIXTURE-FOUNDATION.md section 4."
+    });
+  }
+  const callerOwnsClients = (0, import_client.hasTestClientScope)();
+  const preparationOptions = resolvePreparationRouteOptions(agentUrls[0], options);
+  const resolution = (0, import_client.getOrCreateClientResolution)(agentUrls[0], preparationOptions);
+  const client = resolution.client;
+  const bindingOptions = options;
+  options = preparationOptions;
+  try {
+    let profile = options._profile;
+    if (!profile && !resolution.reusedShared) {
+      const discovered = await (0, import_client.getOrDiscoverProfile)(client, options);
+      if (discovered.step.passed === false) {
+        return buildPreparedFixtures(storyboard, agentUrls, bindingOptions, void 0, {
+          status: "failed",
+          detail: discovered.step.error ?? "agent discovery failed before fixture preparation"
+        });
+      }
+      profile = discovered.profile;
+    }
+    if (profile && (!options._profile || !options.agentTools)) {
+      options = {
+        ...options,
+        ...!options._profile && { _profile: profile },
+        ...!options.agentTools && { agentTools: (0, import_agent_routing.normalizeAgentToolNames)(profile.tools) }
+      };
+    }
+    const context = createRunContext(storyboard, options).context;
+    const seeding = await (0, import_seeding.runControllerSeeding)(client, storyboard, options, context);
+    if (!seeding) {
+      return buildPreparedFixtures(storyboard, agentUrls, bindingOptions, void 0, { status: "resolved" });
+    }
+    const disposition = seeding.missingController ? { status: "unsupported", detail: "agent does not advertise comply_test_controller" } : seeding.seedUnsupported ? { status: "unsupported", detail: "agent did not advertise a required seed_* scenario" } : seeding.failedCount > 0 ? {
+      status: "failed",
+      detail: seeding.phase.steps.find((step) => step.error)?.error ?? "fixture resolution failed during preparation"
+    } : seeding.fixtureUnsatisfied === true ? { status: "unsatisfied", detail: describeUnsatisfiedFixtures(seeding.resolutionRecords) } : { status: "resolved" };
+    return buildPreparedFixtures(storyboard, agentUrls, bindingOptions, seeding, disposition);
+  } finally {
+    if (!callerOwnsClients) await (0, import_protocols.closeScopedConnections)(options.protocol);
+  }
+}
+function describeUnsatisfiedFixtures(records) {
+  const unsatisfied = (records ?? []).filter((record) => record.status === "unsatisfied");
+  if (unsatisfied.length === 0) return "a declared strategy ladder exhausted without a binding";
+  const names = unsatisfied.map(
+    (record) => record.fixture_type === "pricing_option" && record.product_handle ? `pricing_option:${record.product_handle}/${record.handle}` : `${record.fixture_type}:${record.handle}`
+  );
+  return `fixture_unsatisfied: ${names.join(", ")}`;
+}
+function buildPreparedFixtures(storyboard, agentUrls, options, seeding, disposition) {
+  const captures = disposition.status === "resolved" ? seeding?.preparedCaptures?.values ?? {} : {};
+  const captureProvenance = disposition.status === "resolved" ? seeding?.preparedCaptures?.provenance ?? {} : {};
+  const witnesses = disposition.status === "resolved" ? seeding?.preparedCaptures?.witnesses ?? {} : {};
+  const unsatisfied = (seeding?.resolutionRecords ?? []).filter((record) => record.status === "unsatisfied");
+  return (0, import_prepared_fixtures.createPreparedStoryboardFixtures)({
+    binding: buildCurrentPreparedBinding(storyboard, agentUrls, options),
+    ...seeding?.bindings && { bindings: seeding.bindings },
+    resolutions: seeding?.resolutionRecords ?? [],
+    coverageGaps: unsatisfied.length > 0 ? [
+      {
+        reason: "fixture_unsatisfied",
+        detail: "detail" in disposition ? disposition.detail : "a declared strategy ladder exhausted without a binding",
+        fixtures: unsatisfied.map((record) => ({
+          fixture_type: record.fixture_type,
+          handle: record.handle,
+          ...record.product_handle && { product_handle: record.product_handle },
+          requirements: record.requirements
+        }))
+      }
+    ] : [],
+    captures,
+    captureProvenance,
+    witnesses,
+    disposition,
+    ...seeding?.phase && { phase: seeding.phase }
+  });
+}
+function buildCurrentPreparedBinding(storyboard, agentUrls, options, step, runOptions, context, selectedRoute, runnerVars) {
+  return (0, import_prepared_fixtures.buildPreparedBinding)({
+    storyboard,
+    agentUrls,
+    ...options.adcpVersion && { adcpVersion: options.adcpVersion },
+    ...(runOptions ?? options).agents && {
+      agentRouteMap: Object.entries((runOptions ?? options).agents ?? {}).map(
+        ([key, entry]) => [key, entry?.url ?? ""]
+      )
+    },
+    accountScope: resolveBindingAccountScope(storyboard, options),
+    brandScope: resolveBindingBrandScope(storyboard, options),
+    ...step !== void 0 && { ...resolveBindingRequestAccountScope(step, context, options, runnerVars) },
+    sandbox: !(options.disable_sandbox === true || options.sandbox === false),
+    ...options.prepared_fixtures_principal !== void 0 && { principal: options.prepared_fixtures_principal },
+    // The diffed credential always comes from the RUN options. A routed
+    // dispatch flattens `agents[key].auth` into a bare `auth` on its
+    // per-step view, so deriving it from `assignment.options` would make an
+    // unchanged routed credential read as a mismatch and refuse every step
+    // of every routed run. The step's own view feeds the separate,
+    // undiffed `step_credential_fingerprint` instead.
+    credential: resolveBindingCredential(runOptions ?? options),
+    ...(() => {
+      if (step === void 0) return {};
+      const stepCredential = resolveBindingCredential(options, step);
+      if (stepCredential === resolveBindingCredential(runOptions ?? options)) return {};
+      return {
+        stepCredential,
+        // The fingerprint is an HMAC under a per-process key, so a host can
+        // observe that it changed but never what it is. This companion is the
+        // value an authorizer can actually branch on.
+        stepAuthKind: step.auth === void 0 ? "routed" : step.auth === "none" ? "none" : "override"
+      };
+    })(),
+    ...step !== void 0 && runOptions !== void 0 && (runOptions.agents || selectedRoute) ? resolveBindingStepRoute(step, runOptions, selectedRoute) : {},
+    // Never mint one here: `current.run_id` is handed to the authorizer as
+    // "identity of the preparation run", and a fresh UUID per lookup is
+    // noise for a host trying to correlate on it.
+    runId: options.prepared_fixtures_run_id ?? ""
+  });
+}
+function resolveBindingStepRoute(step, runOptions, selected) {
+  if (typeof selected?.agentUrl === "string" && selected.agentUrl.length > 0) {
+    return { stepRoute: `${selected.agentKey ?? "#default"}@${(0, import_oauth_metadata_graph.redactOAuthUrlForOutput)(selected.agentUrl)}` };
+  }
+  const agents = runOptions.agents ?? {};
+  const key = step.agent;
+  if (typeof key !== "string" || !Object.hasOwn(agents, key)) return {};
+  const url = agents[key]?.url;
+  if (typeof url !== "string") return {};
+  return { stepRoute: `${key}@${(0, import_oauth_metadata_graph.redactOAuthUrlForOutput)(url)}` };
+}
+function resolveBindingRequestAccountScope(step, context, options, runnerVars) {
+  if (!context) return {};
+  let account;
+  try {
+    const resolvedTask = (0, import_agent_routing.resolveTaskName)(step, options) ?? step.task;
+    const effectiveStep = resolvedTask === step.task ? step : { ...step, task: resolvedTask };
+    account = buildStepRequest(step, effectiveStep, context, options, runnerVars).account;
+  } catch {
+    return {};
+  }
+  if (account === void 0 || account === null) return {};
+  return { requestAccountScope: canonicalizeScope(account) };
+}
+function resolveBindingBrandScope(storyboard, options) {
+  const merged = { ...storyboard.context, ...options.context };
+  const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+  const contextAccount = record(merged.account);
+  const brand = record(merged.brand) ?? record(contextAccount?.brand) ?? (0, import_client2.resolveBrand)(options);
+  return canonicalizeScope(brand ?? {});
+}
+function canonicalizeScope(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalizeScope).join(",")}]`;
+  return `{${Object.entries(value).filter(([, nested]) => nested !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, nested]) => `${JSON.stringify(key)}:${canonicalizeScope(nested)}`).join(",")}}`;
+}
+function resolveBindingAccountScope(storyboard, options) {
+  const merged = { ...storyboard.context, ...options.context };
+  const contextAccount = merged.account !== null && typeof merged.account === "object" && !Array.isArray(merged.account) ? merged.account : void 0;
+  const account = contextAccount ?? (0, import_client2.resolveAccount)(options);
+  return canonicalizeScope(account ?? {});
+}
+function resolveBindingCredential(options, step) {
+  const parts = [];
+  if (step?.auth !== void 0) {
+    parts.push(`step_auth:${JSON.stringify(describeStepAuthDirective(step.auth))}`);
+  }
+  const headerEntries = Object.entries(options.headers ?? {}).sort(([a], [b]) => {
+    const left = a.toLowerCase();
+    const right = b.toLowerCase();
+    return left < right ? -1 : left > right ? 1 : 0;
+  });
+  for (const [name, value] of headerEntries) {
+    if (value !== void 0 && value !== null)
+      parts.push(`header:${JSON.stringify([name.toLowerCase(), String(value)])}`);
+  }
+  const describeAuth = (auth, label) => {
+    if (!auth) return;
+    if (auth.type === "bearer") parts.push(`${label}:bearer:${JSON.stringify(auth.token)}`);
+    else if (auth.type === "basic") parts.push(`${label}:basic:${JSON.stringify([auth.username, auth.password])}`);
+    else if (auth.type === "oauth") {
+      parts.push(
+        `${label}:oauth:${JSON.stringify([
+          auth.client?.client_id ?? null,
+          typeof auth.tokens?.refresh_token === "string" ? auth.tokens.refresh_token : null,
+          typeof auth.tokens?.refresh_token === "string" ? null : auth.tokens ?? null
+        ])}`
+      );
+    } else {
+      parts.push(
+        `${label}:oauth_cc:${JSON.stringify([
+          auth.credentials?.client_id ?? null,
+          auth.credentials?.client_secret ?? null
+        ])}`
+      );
+    }
+  };
+  describeAuth(options.auth, "run");
+  for (const [key, entry] of Object.entries(options.agents ?? {}).sort(([a], [b]) => a < b ? -1 : 1)) {
+    describeAuth(entry?.auth, `agent:${JSON.stringify([key, entry?.url ?? null])}`);
+  }
+  const kit = options.test_kit;
+  if (kit) {
+    for (const [key, value] of Object.entries(kit).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+      if (key === "auth") {
+        for (const [authField, authValue] of Object.entries(value ?? {}).sort(
+          ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+        )) {
+          if (authField === "probe_task") continue;
+          if (authValue !== void 0 && authValue !== null) {
+            parts.push(`test_kit:${JSON.stringify([`auth.${authField}`, authValue])}`);
+          }
+        }
+        continue;
+      }
+      if (value !== void 0 && value !== null) parts.push(`test_kit:${JSON.stringify([key, value])}`);
+    }
+  }
+  return parts.length > 0 ? parts.join("\0") : "none";
+}
 async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOffset, preSeeded) {
   const start = Date.now();
   const isMultiInstance = agentUrls.length > 1;
   const useRouting = options.agents !== void 0;
+  let preparedGate = { used: false };
+  if (options.prepared_fixtures !== void 0) {
+    preparedGate = await gatePreparedFixtures(storyboard, agentUrls, options);
+    if (preparedGate.used && "refusal" in preparedGate) {
+      return denyPreparedFixtures(
+        options,
+        buildPreparedRefusalRunResult(agentUrls, storyboard, preparedGate.refusal),
+        preparedGate.refusal.code
+      );
+    }
+  }
   let clients;
   let routingContext;
   let profile;
@@ -1632,7 +2066,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
       }
     }
   }
-  if (preSeeded === void 0) {
+  if (preSeeded === void 0 && !preparedGate.used) {
     const resetTargets = routingContext && options.agents ? [...routingContext.profiles.entries()].map(([key, profile2]) => ({
       client: routingContext.clients.get(key),
       options: (0, import_agent_routing.routedAgentOptions)(options.agents[key], options, profile2)
@@ -1667,7 +2101,9 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
   const routedControllerRoutes = /* @__PURE__ */ new Map();
   const routedErrors = /* @__PURE__ */ new Map();
   const reportedRoutingErrors = /* @__PURE__ */ new Set();
-  let context = { ...storyboard.context, ...options.context };
+  const runContext = createRunContext(storyboard, options);
+  const protectedWriter = runContext.protectedWriter;
+  let context = runContext.context;
   const routingFailedStep = (step, phaseId, err) => {
     const detail = (0, import_oauth_metadata_graph.redactOAuthUrlsInText)(
       err instanceof import_agent_routing.RoutingError ? err.message : err?.message ?? String(err)
@@ -1864,8 +2300,6 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
       };
     }
   }
-  if (storyboard.context) (0, import_context.forwardAliasCache)(storyboard.context, context);
-  if (options.context) (0, import_context.forwardAliasCache)(options.context, context);
   const contributions = /* @__PURE__ */ new Set();
   const contributionSources = /* @__PURE__ */ new Map();
   const priorStepResults = /* @__PURE__ */ new Map();
@@ -2023,6 +2457,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     skippedCount++;
   }
   let seedingPhaseResult = null;
+  let probeViolationStep;
   let seedingFailed = false;
   let creativeBuildCatalogFailed = false;
   let seedingMissingController = false;
@@ -2109,18 +2544,38 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         ]
       };
     } else if (resolution.status === "resolved") {
-      for (const key of [
-        "capability_id",
-        "target_format_id",
-        "message",
-        "creative_manifest",
-        "creative_id",
-        "transformer_id",
-        "config"
-      ]) {
-        delete context[`${handle}_${key}`];
+      const probeViolation = tryProtectedContextPatch(
+        context,
+        {
+          unset: CREATIVE_PROBE_CONTEXT_SUFFIXES.map((key) => `${handle}_${key}`),
+          set: resolution.context
+        },
+        { origin: `creative_build_probe '${handle}'` }
+      );
+      if (probeViolation) {
+        seedingFailed = true;
+        failedCount += 1;
+        probeViolationStep = {
+          storyboard_id: storyboard.id,
+          phase_id: "fixture_resolution",
+          step_id: `creative_build_probe_context.${handle}`,
+          title: "Publish creative build probe context",
+          task: "get_adcp_capabilities",
+          passed: false,
+          duration_ms: 0,
+          validations: [probeViolation],
+          context: withoutProtectedCaptures(context),
+          extraction: { path: "none" },
+          error: probeViolation.error
+        };
+        seedingPhaseResult = {
+          phase_id: "fixture_resolution",
+          phase_title: "Creative build fixture resolution",
+          passed: false,
+          duration_ms: 0,
+          steps: [probeViolationStep]
+        };
       }
-      Object.assign(context, resolution.context);
       options = { ...options, contracts: [.../* @__PURE__ */ new Set([...options.contracts ?? [], "creative_build_probe_runner"])] };
     } else {
       fixtureUnsatisfied = true;
@@ -2132,10 +2587,45 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
       };
     }
   }
+  let preparedFixtureState;
+  let preparedRefused;
+  {
+    const prepared = preparedGate;
+    if (prepared.used && "state" in prepared) {
+      const hydrationViolation = hydratePreparedCaptures(prepared.state, context, protectedWriter, contextProvenance);
+      if (hydrationViolation) {
+        if (!callerOwnsClients) await (0, import_protocols.closeScopedConnections)(options.protocol);
+        return buildDiscoveryFailedResult(agentUrls, storyboard, {
+          step: "Publish prepared fixture captures",
+          passed: false,
+          duration_ms: 0,
+          error: hydrationViolation.error
+        });
+      }
+      preparedFixtureState = prepared.state;
+      fixtureBindings = (0, import_prepared_fixtures.preparedBindingRegistryFor)(prepared.state);
+      fixtureResolutionRecords = prepared.state.resolutions;
+      const disposition = prepared.state.disposition;
+      if (disposition.status === "failed") {
+        if (!callerOwnsClients) await (0, import_protocols.closeScopedConnections)(options.protocol);
+        return buildDiscoveryFailedResult(agentUrls, storyboard, {
+          step: "Reuse prepared fixture state",
+          passed: false,
+          duration_ms: 0,
+          error: disposition.detail
+        });
+      }
+      if (disposition.status === "unsatisfied") {
+        fixtureUnsatisfied = true;
+        fixtureCoverageGap = prepared.state.coverageGaps[0] ?? fixtureCoverageGap;
+      }
+      if (disposition.status === "unsupported") seedingMissingController = true;
+    }
+  }
   {
     let seeding;
     try {
-      seeding = creativeAssetFixtureGap || fixtureUnsatisfied || seedingFailed || skipControllerSeedingForPhaseGates ? null : preSeeded !== void 0 ? preSeeded.result : await (0, import_seeding.runControllerSeeding)(
+      seeding = preparedFixtureState !== void 0 || creativeAssetFixtureGap || fixtureUnsatisfied || seedingFailed || skipControllerSeedingForPhaseGates ? null : preSeeded !== void 0 ? preSeeded.result : await (0, import_seeding.runControllerSeeding)(
         clients[0],
         storyboard,
         options,
@@ -2189,6 +2679,10 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
       const attach = preSeeded === void 0 || preSeeded.attach;
       if (attach) {
         seedingPhaseResult = seeding.phase;
+        if (probeViolationStep && !seeding.phase.steps.some((entry) => entry.step_id === probeViolationStep.step_id)) {
+          seeding.phase.steps.unshift({ ...probeViolationStep, phase_id: seeding.phase.phase_id });
+          seeding.phase.passed = false;
+        }
         passedCount += seeding.passedCount;
         failedCount += seeding.failedCount;
         if (seeding.missingController || seeding.seedUnsupported || seeding.fixtureUnsatisfied) {
@@ -2196,6 +2690,56 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         }
       }
       fixtureBindings = seeding.bindings;
+      if (seeding.preparedCaptures) {
+        try {
+          (0, import_protected_context.applyProtectedContextPatch)(
+            context,
+            { set: seeding.preparedCaptures.values, setProvenance: seeding.preparedCaptures.provenance },
+            {
+              writer: protectedWriter,
+              sinks: { provenance: contextProvenance },
+              origin: "fixture preparation"
+            }
+          );
+        } catch (error) {
+          if (!(error instanceof import_protected_context.ProtectedContextViolation)) throw error;
+          seedingFailed = true;
+          seeding.phase.passed = false;
+          const alreadyReported = seeding.phase.steps.some((entry) => entry.step_id === FIXTURE_CAPTURE_STEP_ID);
+          if (attach && !alreadyReported) {
+            seeding.phase.steps.push({
+              storyboard_id: storyboard.id,
+              step_id: FIXTURE_CAPTURE_STEP_ID,
+              phase_id: seeding.phase.phase_id,
+              title: "Publish fixture captures",
+              task: describeFixtureCaptureTask(seeding.preparedCaptures, error.keys),
+              passed: false,
+              duration_ms: 0,
+              validations: [
+                {
+                  check: "fixture_capture_unbuildable",
+                  passed: false,
+                  description: "Every declared fixture capture must be detachable from the pinned entity",
+                  error: error.message,
+                  json_pointer: null,
+                  expected: "a capture the runner can deep-clone and freeze",
+                  actual: error.keys.join(", "),
+                  schema_id: null,
+                  schema_url: null
+                }
+              ],
+              // The commit failed, so nothing reserved is in `context` yet —
+              // but the projection is applied unconditionally so a partially
+              // applied patch can never surface a protected value in a
+              // report.
+              context: withoutProtectedCaptures(context),
+              extraction: { path: "none" },
+              error: error.message
+            });
+            failedCount += 1;
+          }
+        }
+      }
       fixtureResolutionRecords = fixtureResolutionRecords ? [...fixtureResolutionRecords, ...seeding.resolutionRecords ?? []] : seeding.resolutionRecords;
       fixtureUnsatisfied = seeding.fixtureUnsatisfied === true && seeding.failedCount === 0;
       if (fixtureUnsatisfied) {
@@ -2214,12 +2758,13 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
           ...record.product_handle && { product_handle: record.product_handle },
           requirements: record.requirements
         }));
-        const names = fixtures.map(
-          (fixture) => fixture.fixture_type === "pricing_option" ? `pricing_option "${fixture.product_handle}/${fixture.handle}"` : `product "${fixture.handle}"`
-        );
         fixtureCoverageGap = {
           reason: "fixture_unsatisfied",
-          detail: `fixture_unsatisfied: no seller fixture satisfied ${names.join(", ")}`,
+          // The SAME spelling the disposition uses. Two renderings of one
+          // reason over the same data meant a consumer parsing the
+          // documented `<fixture_type>:<handle>` grammar matched on one
+          // field and not the other.
+          detail: describeUnsatisfiedFixtures(fixtureResolutionRecords),
           fixtures
         };
       }
@@ -2430,7 +2975,9 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     if (!routingContext && phaseContainsOauthMetadataProbe(phase) && !agentAdvertisesOauth(profile)) {
       phaseAbsent = true;
     }
+    const priorPhaseContext = context;
     context = { ...context };
+    (0, import_protected_context.forwardProtectedContext)(priorPhaseContext, context);
     if (seedingMissingController || seedingUnsupported || seedingFailed) {
       const cascadeSkip = seedingMissingController ? {
         skip_reason: "missing_test_controller",
@@ -2602,7 +3149,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
             );
             const missingKeys = /* @__PURE__ */ new Set([
               ...(effectiveRequest.ok ? findUnresolvedContextVars(effectiveRequest.request) : []).filter((v) => hardKeys.has(v.key)).map((v) => v.key),
-              ...(step.context_inputs ?? []).filter((input) => !(input.key in context) && hardKeys.has(input.key)).map((input) => input.key)
+              ...(step.context_inputs ?? []).filter((input) => !Object.hasOwn(context, input.key) && hardKeys.has(input.key)).map((input) => input.key)
             ]);
             if (missingKeys.size > 0) {
               capabilityUnavailable = false;
@@ -2663,6 +3210,78 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
           missingPrerequisiteContextKeysByPhase
         );
       }
+      if (preparedFixtureState !== void 0) {
+        const recheck = await (0, import_prepared_fixtures.resolvePreparedFixtures)({
+          supplied: options.prepared_fixtures,
+          // The EFFECTIVE scope for this step: the routed options actually
+          // dispatching it, plus its own auth directive.
+          current: buildCurrentPreparedBinding(
+            storyboard,
+            agentUrls,
+            assignment.options ?? options,
+            step,
+            options,
+            context,
+            {
+              ...assignment.agentKey !== void 0 && { agentKey: assignment.agentKey },
+              ...assignment.agentUrl !== void 0 && { agentUrl: assignment.agentUrl }
+            },
+            runnerVars
+          ),
+          ...options.prepared_fixtures_authorizer && { authorizer: options.prepared_fixtures_authorizer },
+          stepId: step.id,
+          gate: "step"
+        });
+        if (recheck !== void 0 && !recheck.ok) {
+          const refusalResult = {
+            storyboard_id: storyboard.id,
+            step_id: step.id,
+            phase_id: phase.id,
+            title: step.title,
+            task: step.task,
+            passed: false,
+            duration_ms: 0,
+            validations: [
+              {
+                check: "prepared_fixtures_authorization",
+                passed: false,
+                // One description for all three gates. Three spellings of
+                // the same check read to a report renderer as three kinds.
+                description: "Prepared fixture state is re-validated and re-authorized on every lookup",
+                error: recheck.refusal.detail,
+                json_pointer: null,
+                expected: "an authorized prepared state bound to this exact step scope",
+                actual: recheck.refusal.code,
+                schema_id: null,
+                schema_url: null,
+                // Explicit nulls, not omission: this is a PRE-WIRE
+                // refusal, and an absent key cannot be told apart from a
+                // runner that forgot to record one.
+                request: null,
+                response: null
+              }
+            ],
+            // UNREDACTED. This result is never returned to the refused
+            // caller — it goes to the host's authorized audit scope, where
+            // withholding the evidence would defeat the point.
+            context,
+            extraction: { path: "none" },
+            error: recheck.refusal.detail
+          };
+          stepResults.push(refusalResult);
+          preparedRefused = recheck.refusal.code;
+          failedCount++;
+          phasePassed = false;
+          countedAsFailed.add(refusalResult);
+          priorStepResults.set(step.id, refusalResult);
+          if (step.stateful) phaseStatefulCascades.set(phase.id, null);
+          if (isMultiInstance || useRouting) {
+            refusalResult.agent_url = (0, import_oauth_metadata_graph.redactOAuthUrlForOutput)(assignment.agentUrl);
+            refusalResult.agent_index = assignment.instanceIndex + 1;
+          }
+          continue;
+        }
+      }
       const rawResult = routedCapabilityDetail !== void 0 ? buildPhaseCapabilitySkippedSteps(
         storyboard,
         { ...phase, steps: [step] },
@@ -2706,7 +3325,10 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
           });
           continue;
         }
-        const raw = await spec.onStep(assertionContexts.get(spec.id), result2);
+        const raw = await spec.onStep(assertionContexts.get(spec.id), {
+          ...result2,
+          context: withoutProtectedCaptures(result2.context ?? {})
+        });
         for (const r of raw) {
           const full = { ...r, assertion_id: spec.id, scope: "step", step_id: step.id };
           assertionResults.push(full);
@@ -2984,6 +3606,8 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     ...assertionResults.length > 0 ? { assertions: assertionResults } : {},
     strict_validation_summary: strictSummary,
     notices,
+    // `fixture_resolutions` carries `seller_ids`, so it is withheld on the
+    // same condition as the context projection above.
     ...fixtureResolutionRecords && { fixture_resolutions: fixtureResolutionRecords },
     ...fixtureCoverageGap && { coverage_gaps: [fixtureCoverageGap] },
     ...routingContext && routingContext.discoveryFailures.length > 0 ? {
@@ -2998,14 +3622,26 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
     await (0, import_protocols.closeScopedConnections)(options.protocol);
   }
   if (webhookReceiver) await webhookReceiver.close();
+  if (preparedRefused !== void 0) {
+    await emitPreparedFixturesAudit(options, result);
+    throw new import_errors.PreparedFixturesDeniedError(preparedRefused);
+  }
   return result;
 }
 async function runMultiPass(agentUrls, storyboard, options) {
   const start = Date.now();
+  if (options.prepared_fixtures !== void 0) {
+    const gate = await gatePreparedFixtures(storyboard, agentUrls, options, void 0, "run");
+    if (gate.used && "refusal" in gate) {
+      return denyPreparedFixtures(
+        options,
+        buildPreparedRefusalRunResult(agentUrls, storyboard, gate.refusal),
+        gate.refusal.code
+      );
+    }
+  }
   const preSeedClients = agentUrls.map((url) => (0, import_client.getOrCreateClientResolution)(url, options).client);
-  const preSeedContext = { ...storyboard.context, ...options.context };
-  if (storyboard.context) (0, import_context.forwardAliasCache)(storyboard.context, preSeedContext);
-  if (options.context) (0, import_context.forwardAliasCache)(options.context, preSeedContext);
+  const preSeedContext = createRunContext(storyboard, options).context;
   let preSeedProfile = options._profile;
   if (!preSeedProfile) {
     const discovered = await (0, import_client.getOrDiscoverProfile)(preSeedClients[0], options);
@@ -3022,13 +3658,15 @@ async function runMultiPass(agentUrls, storyboard, options) {
       ...options.agentTools ? {} : { agentTools: (0, import_agent_routing.normalizeAgentToolNames)(preSeedProfile.tools) }
     };
   }
-  const resetFailure = await resetControllerStates(
-    preSeedClients.map((client) => ({ client, options })),
-    storyboard
-  );
-  if (resetFailure) {
-    await (0, import_protocols.closeScopedConnections)(options.protocol);
-    return buildDiscoveryFailedResult(agentUrls, storyboard, resetFailure);
+  if (options.prepared_fixtures === void 0) {
+    const resetFailure = await resetControllerStates(
+      preSeedClients.map((client) => ({ client, options })),
+      storyboard
+    );
+    if (resetFailure) {
+      await (0, import_protocols.closeScopedConnections)(options.protocol);
+      return buildDiscoveryFailedResult(agentUrls, storyboard, resetFailure);
+    }
   }
   if (storyboardCapabilityPredicates(storyboard).length > 0) {
     const unmetDetail = evaluateStoryboardCapabilityGates(
@@ -3083,7 +3721,13 @@ async function runMultiPass(agentUrls, storyboard, options) {
     },
     preSeedExcludedPhaseIds
   );
-  const preSeededResult = preSeedFixtureGap || allExecutablePhasesCapabilitySkipped(storyboard, phaseCapabilitySkipDetails) ? null : await (0, import_seeding.runControllerSeeding)(preSeedClients[0], storyboard, options, preSeedContext);
+  const preSeededResult = (
+    // A pinned graph is authoritative across every pass. Re-seeding would
+    // issue fresh `seed_*` mutations that replace the very seller state the
+    // prepared captures describe, while the passes keep the original
+    // bindings — the reset is guarded above for the same reason.
+    options.prepared_fixtures !== void 0 || preSeedFixtureGap || allExecutablePhasesCapabilitySkipped(storyboard, phaseCapabilitySkipDetails) ? null : await (0, import_seeding.runControllerSeeding)(preSeedClients[0], storyboard, options, preSeedContext)
+  );
   const passes = [];
   const passResults = [];
   for (let passIdx = 0; passIdx < agentUrls.length; passIdx++) {
@@ -3136,6 +3780,10 @@ async function runMultiPass(agentUrls, storyboard, options) {
     tested_at: (/* @__PURE__ */ new Date()).toISOString(),
     ...schemasDedup.length > 0 ? { schemas_used: schemasDedup } : {},
     ...assertionsAgg.length > 0 ? { assertions: assertionsAgg } : {},
+    // `fixture_resolutions` carries `seller_ids`, so the aggregate withholds
+    // it on the same condition the single-pass result does. Projecting
+    // `phases` and `context` but republishing the pinned seller ids here
+    // withheld the copies and published the original.
     ...first.fixture_resolutions ? { fixture_resolutions: first.fixture_resolutions } : {},
     ...first.coverage_gaps ? { coverage_gaps: first.coverage_gaps } : {},
     notices: noticesDedup
@@ -3265,8 +3913,200 @@ async function runStoryboardStep(agentUrl, storyboard, stepId, options = {}) {
     )
   );
 }
+function withoutProtectedCaptures(context) {
+  const projected = {};
+  for (const [key, value] of Object.entries(context)) {
+    if (!(0, import_protected_context.isProtectedContextKey)(key)) projected[key] = value;
+  }
+  return projected;
+}
+async function denyPreparedFixtures(options, record, refusalCode) {
+  await emitPreparedFixturesAudit(options, record);
+  throw new import_errors.PreparedFixturesDeniedError(refusalCode);
+}
+async function emitPreparedFixturesAudit(options, record) {
+  const sink = options.prepared_fixtures_audit_sink;
+  if (!sink) return;
+  try {
+    await sink(record);
+  } catch {
+  }
+}
+function buildPreparedRefusalRunResult(agentUrls, storyboard, refusal) {
+  const base = buildDiscoveryFailedResult(agentUrls, storyboard, {
+    step: "Authorize prepared fixture state",
+    passed: false,
+    duration_ms: 0,
+    error: refusal.detail
+  });
+  const validation = {
+    check: "prepared_fixtures_authorization",
+    passed: false,
+    description: "Prepared fixture state is re-validated and re-authorized on every lookup",
+    error: refusal.detail,
+    json_pointer: null,
+    expected: "an authorized prepared state bound to this exact run scope",
+    actual: refusal.code,
+    schema_id: null,
+    schema_url: null,
+    // Explicit nulls. This gate precedes all seller contact, so the
+    // exchange genuinely did not happen — and an omitted key cannot be
+    // told apart from a runner that forgot to record one.
+    request: null,
+    response: null
+  };
+  return {
+    ...base,
+    phases: base.phases.map((phase) => ({
+      ...phase,
+      steps: phase.steps.map((step) => ({ ...step, validations: [...step.validations, validation] }))
+    }))
+  };
+}
+function buildPreparedRefusalStepResult(storyboard, found, context, refusal, contributions) {
+  return {
+    storyboard_id: storyboard.id,
+    step_id: found.step.id,
+    phase_id: found.phaseId,
+    title: found.step.title,
+    task: found.step.task,
+    passed: false,
+    duration_ms: 0,
+    validations: [
+      {
+        check: "prepared_fixtures_authorization",
+        passed: false,
+        description: "Prepared fixture state is re-validated and re-authorized on every lookup",
+        error: refusal.detail,
+        json_pointer: null,
+        // `step scope`, matching the per-step gate. This builds a STEP
+        // result; saying `run scope` here made the published grammar
+        // disagree with itself depending on which gate refused.
+        expected: "an authorized prepared state bound to this exact step scope",
+        actual: refusal.code,
+        schema_id: null,
+        schema_url: null,
+        request: null,
+        response: null
+      }
+    ],
+    // UNREDACTED: this record is the host's audit evidence, never the
+    // refused caller's report.
+    context,
+    extraction: { path: "none" },
+    contributions: Array.from(contributions),
+    error: refusal.detail
+  };
+}
+function buildPreparedDispositionStepResult(storyboard, found, context, disposition, contributions) {
+  const detail = "detail" in disposition ? disposition.detail : "fixture preparation did not resolve";
+  if (disposition.status === "failed") {
+    return {
+      storyboard_id: storyboard.id,
+      step_id: found.step.id,
+      phase_id: found.phaseId,
+      title: found.step.title,
+      task: found.step.task,
+      passed: false,
+      duration_ms: 0,
+      // A failed step MUST carry at least one failing validation
+      // (runner-output-contract.yaml, `step_result`). The `error`-only
+      // carve-out beside that rule is for TRANSPORT failures, and a failed
+      // preparation is discovery, schema validation or setup — none of
+      // which is transport. Without this the caller saw a red step with no
+      // `check` discriminator and had to regex the prose, which is the one
+      // thing the synthesized kinds exist to avoid.
+      validations: [
+        {
+          check: "fixture_capture_unbuildable",
+          passed: false,
+          description: "Fixture preparation must resolve before a step can reuse it",
+          error: detail,
+          json_pointer: null,
+          expected: "a fixture graph that resolved during preparation",
+          actual: "preparation_failed",
+          schema_id: null,
+          schema_url: null
+        }
+      ],
+      context: withoutProtectedCaptures(context),
+      extraction: { path: "none" },
+      contributions: Array.from(contributions),
+      error: detail
+    };
+  }
+  return {
+    storyboard_id: storyboard.id,
+    step_id: found.step.id,
+    phase_id: found.phaseId,
+    title: found.step.title,
+    task: found.step.task,
+    passed: true,
+    skipped: true,
+    skip_reason: disposition.status === "unsatisfied" ? "fixture_unsatisfied" : "missing_test_controller",
+    // Match the full runner: reporting a missing controller as a
+    // branch-substitutable `not_applicable` would let a consumer credit a
+    // peer path that does not exist.
+    //
+    // `fixture_unsatisfied` is now the canonical reason too, not a
+    // detailed one mapped down to `not_applicable`. The published contract
+    // lists it as a canonical `skip_result.reason`, and "our other code
+    // path spells it differently" was SDK precedent, not a spec argument —
+    // which the repo's own `spec → mock → SDK` triage order resolves
+    // against the SDK. Promoting it in `RunnerSkipReason` fixed both paths
+    // at once, so the two no longer disagree.
+    skip: {
+      reason: disposition.status === "unsatisfied" ? "fixture_unsatisfied" : "missing_test_controller",
+      detail
+    },
+    duration_ms: 0,
+    validations: [],
+    context: withoutProtectedCaptures(context),
+    extraction: { path: "none" },
+    contributions: Array.from(contributions)
+  };
+}
 async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
   (0, import_test_kit.validateTestKit)(options.test_kit);
+  const metadataRefusal = describeReservedCallerOptions(options);
+  if (metadataRefusal !== void 0) {
+    const target = flattenSteps(storyboard).find((entry) => entry.step.id === stepId);
+    if (!target) throw new Error(`Step "${stepId}" not found in storyboard "${storyboard.id}".`);
+    return denyPreparedFixtures(
+      options,
+      buildPreparedRefusalStepResult(
+        storyboard,
+        target,
+        {},
+        { code: "unauthorized_metadata", detail: metadataRefusal },
+        options.contributions ?? []
+      ),
+      "unauthorized_metadata"
+    );
+  }
+  let standaloneGate = { used: false };
+  if (options.prepared_fixtures !== void 0) {
+    const target = flattenSteps(storyboard).find((entry) => entry.step.id === stepId);
+    if (!target) {
+      throw new Error(
+        `Step "${stepId}" not found in storyboard "${storyboard.id}". Available steps: ${flattenSteps(storyboard).map((entry) => entry.step.id).join(", ")}`
+      );
+    }
+    standaloneGate = await gatePreparedFixtures(storyboard, [agentUrl], options, target.step, "step");
+    if (standaloneGate.used && "refusal" in standaloneGate) {
+      return denyPreparedFixtures(
+        options,
+        buildPreparedRefusalStepResult(
+          storyboard,
+          target,
+          createRunContext(storyboard, options).context,
+          standaloneGate.refusal,
+          options.contributions ?? []
+        ),
+        standaloneGate.refusal.code
+      );
+    }
+  }
   if (storyboard.requires?.[0] === "property_list_reference_runner" && storyboardCapabilityPredicates(storyboard).length === 0 && propertyListReferenceNeedsMcp(options)) {
     const found2 = flattenSteps(storyboard).find((entry) => entry.step.id === stepId);
     if (!found2) throw new Error(`Step "${stepId}" not found in storyboard "${storyboard.id}".`);
@@ -3286,7 +4126,9 @@ async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
       },
       duration_ms: 0,
       validations: [],
-      context: { ...storyboard.context, ...options.context },
+      // Validated the same way as the executing path so a reserved key in
+      // caller context fails closed on the early-return branch too.
+      context: createRunContext(storyboard, options).context,
       extraction: { path: "none" }
     };
   }
@@ -3306,9 +4148,9 @@ async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
   } else {
     profile = options._profile;
   }
-  const context = { ...storyboard.context, ...options.context };
-  if (storyboard.context) (0, import_context.forwardAliasCache)(storyboard.context, context);
-  if (options.context) (0, import_context.forwardAliasCache)(options.context, context);
+  const standaloneRunContext = createRunContext(storyboard, options);
+  const protectedWriter = standaloneRunContext.protectedWriter;
+  const context = standaloneRunContext.context;
   const allSteps = flattenSteps(storyboard);
   const found = allSteps.find((s) => s.step.id === stepId);
   if (!found) {
@@ -3389,7 +4231,11 @@ async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
         passed: true,
         skipped: true,
         skip_reason: "fixture_unsatisfied",
-        skip: { reason: "not_applicable", detail: resolution.detail },
+        // Canonical too, now that `fixture_unsatisfied` is in
+        // `RunnerSkipReason`. Both unsatisfied paths spell it the same way,
+        // which is what the contract asks for and what the previous
+        // `not_applicable` mapping obscured.
+        skip: { reason: "fixture_unsatisfied", detail: resolution.detail },
         duration_ms: 0,
         validations: [],
         context,
@@ -3397,18 +4243,30 @@ async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
         contributions: Array.from(options.contributions ?? [])
       };
     }
-    for (const key of [
-      "capability_id",
-      "target_format_id",
-      "message",
-      "creative_manifest",
-      "creative_id",
-      "transformer_id",
-      "config"
-    ]) {
-      delete context[`${storyboard.creative_build_probe.context_prefix}_${key}`];
-    }
-    Object.assign(context, resolution.context);
+    const probeViolation = tryProtectedContextPatch(
+      context,
+      {
+        unset: CREATIVE_PROBE_CONTEXT_SUFFIXES.map((key) => `${storyboard.creative_build_probe.context_prefix}_${key}`),
+        set: resolution.context
+      },
+      { origin: `creative_build_probe '${storyboard.creative_build_probe.context_prefix}'` }
+    );
+    if (probeViolation) {
+      return {
+        storyboard_id: storyboard.id,
+        step_id: found.step.id,
+        phase_id: found.phaseId,
+        title: found.step.title,
+        task: found.step.task,
+        passed: false,
+        duration_ms: 0,
+        validations: [probeViolation],
+        context: withoutProtectedCaptures(context),
+        extraction: { path: "none" },
+        contributions: Array.from(options.contributions ?? []),
+        error: probeViolation.error
+      };
+    }
     options = { ...options, contracts: [.../* @__PURE__ */ new Set([...options.contracts ?? [], "creative_build_probe_runner"])] };
   }
   const injectedReceiver = options._webhookReceiver;
@@ -3448,8 +4306,35 @@ async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
       agentProfile: profile,
       agentLibraryVersion: profile?.library_version,
       storyboardRequiresRequestSigner: resolveStoryboardRequires(storyboard, options).includes("request_signer"),
-      storyboardRequiresPublisherAuthRunner: storyboard.requires?.includes("trusted_match_publisher_auth_runner") === true
+      storyboardRequiresPublisherAuthRunner: storyboard.requires?.includes("trusted_match_publisher_auth_runner") === true,
+      protectedWriter
     };
+    const prepared = standaloneGate;
+    if (prepared.used && "state" in prepared) {
+      const disposition = prepared.state.disposition;
+      if (disposition.status !== "resolved") {
+        return buildPreparedDispositionStepResult(storyboard, found, context, disposition, contributions);
+      }
+      const hydrationViolation = hydratePreparedCaptures(prepared.state, context, protectedWriter, contextProvenance);
+      if (hydrationViolation) {
+        return {
+          storyboard_id: storyboard.id,
+          step_id: found.step.id,
+          phase_id: found.phaseId,
+          title: found.step.title,
+          task: found.step.task,
+          passed: false,
+          duration_ms: 0,
+          validations: [hydrationViolation],
+          context: withoutProtectedCaptures(context),
+          extraction: { path: "none" },
+          contributions: Array.from(contributions),
+          error: hydrationViolation.error
+        };
+      }
+      runState.fixtureBindings = (0, import_prepared_fixtures.preparedBindingRegistryFor)(prepared.state);
+      runState.preparedFixtures = prepared.state;
+    }
     let prerequisiteFailure;
     if (storyboard.id === "media_buy_seller/acceptance_policy_discovery" && found.step.id === "get_contextual_products" && options.acceptancePolicyDiscovery?.enabled !== false) {
       const capabilityStep = allSteps.find((value) => value.step.id === "get_acceptance_policy_capability");
@@ -3505,7 +4390,11 @@ async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
         contributions.add(found.step.contributes_to);
       }
     }
-    return { ...result, contributions: Array.from(contributions) };
+    return {
+      ...result,
+      context: withoutProtectedCaptures(result.context ?? {}),
+      contributions: Array.from(contributions)
+    };
   } finally {
     await Promise.all([
       ...!clientResolution.reusedShared ? [(0, import_protocols.closeScopedConnections)(options.protocol)] : [],
@@ -3515,7 +4404,7 @@ async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
 }
 function unresolvedStepContextVars(step, request, context, runState) {
   const unavailableInputs = (step.context_inputs ?? []).filter(
-    (input) => !(input.key in context) && (runState.capabilityUnavailableContextKeys?.has(input.key) === true || runState.missingPrerequisiteContextKeys?.has(input.key) === true)
+    (input) => !Object.hasOwn(context, input.key) && (runState.capabilityUnavailableContextKeys?.has(input.key) === true || runState.missingPrerequisiteContextKeys?.has(input.key) === true)
   );
   return [
     ...findUnresolvedContextVars(request),
@@ -3808,7 +4697,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         synthesized.push({
           check: "unresolved_substitution",
           passed: false,
-          description: v.token === import_creative_assets.BUILD_ASSETS_FROM_FORMAT_DIRECTIVE ? `request directive "${v.token}" did not resolve \u2014 the test kit could not populate every seller-required asset at ${v.key}` : `request token "${v.token}" did not resolve \u2014 prior step did not populate context.${v.key}`,
+          description: v.token === import_creative_assets.BUILD_ASSETS_FROM_FORMAT_DIRECTIVE ? `request directive "${v.token}" did not resolve \u2014 the test kit could not populate every seller-required asset at ${v.key}` : DOTTED_CONTEXT_TOKEN_RE.test(v.token) ? `request token "${v.token}" is not a supported substitution \u2014 $context.<key> matches a whole key only and cannot drill into a captured object. Capture the field directly with context_outputs: [{ key: ..., path: ${suggestedCapturePath(v.token)} }], or branch on the snapshot with a phase skip_if.` : `request token "${v.token}" did not resolve \u2014 prior step did not populate context.${v.key}`,
           json_pointer: null,
           expected: v.token,
           actual: null,
@@ -4327,21 +5216,38 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     allSteps
   );
   if (responseDerivedSkip && !step.expect_error) {
-    for (const key of responseDerivedSkip.contextKeys) {
-      runState.responseDerivedNotApplicableContextKeys?.set(key, responseDerivedSkip.detail);
-    }
+    const unavailableViolation = tryProtectedContextPatch(
+      context,
+      {
+        markUnavailable: Object.fromEntries(
+          responseDerivedSkip.contextKeys.map((key) => [key, responseDerivedSkip.detail])
+        )
+      },
+      {
+        ...runState.responseDerivedNotApplicableContextKeys && {
+          sinks: { unavailable: runState.responseDerivedNotApplicableContextKeys }
+        },
+        origin: `step '${step.id}' not_applicable_if response gate`
+      }
+    );
     const next2 = getNextStepPreview(step.id, allSteps, context, runState.runnerVars);
     return {
       step_id: step.id,
       phase_id: phaseId,
       title: step.title,
       task: step.task,
-      passed: true,
-      skipped: true,
-      skip_reason: "not_applicable",
-      skip: buildSkip("not_applicable", responseDerivedSkip.detail),
+      // A refused metadata write is a failure, not a skip: the gate did not
+      // actually mark anything unavailable, so reporting `not_applicable`
+      // would claim a disposition the runner never reached.
+      passed: unavailableViolation === void 0,
+      ...unavailableViolation === void 0 && {
+        skipped: true,
+        skip_reason: "not_applicable",
+        skip: buildSkip("not_applicable", responseDerivedSkip.detail)
+      },
       duration_ms: stepResult.duration_ms,
-      validations: [],
+      validations: unavailableViolation ? [unavailableViolation] : [],
+      ...unavailableViolation && { error: unavailableViolation.error },
       context,
       ...responseDerivedContextResult(runState),
       response: (0, import_redact_secrets.redactSecrets)(taskResult?.data),
@@ -4581,33 +5487,60 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   }
   const updatedContext = { ...context };
   (0, import_context.forwardAliasCache)(context, updatedContext);
+  (0, import_protected_context.forwardProtectedContext)(context, updatedContext);
+  const protectedSinks = {
+    ...runState.contextProvenance && { provenance: runState.contextProvenance },
+    ...runState.responseDerivedNotApplicableContextKeys && {
+      unavailable: runState.responseDerivedNotApplicableContextKeys
+    }
+  };
+  const protectedViolations = [];
+  const commitContextPatch = (patch, origin) => {
+    try {
+      (0, import_protected_context.applyProtectedContextPatch)(updatedContext, patch, { sinks: protectedSinks, origin });
+    } catch (error) {
+      if (!(error instanceof import_protected_context.ProtectedContextViolation)) throw error;
+      protectedViolations.push({
+        check: "protected_context_violation",
+        passed: false,
+        description: "Reserved fixture-preparation context keys are immutable for the rest of the run",
+        error: error.message,
+        json_pointer: null,
+        expected: "no write, delete or metadata change to the __adcp_fixture_ namespace",
+        actual: error.keys.join(", "),
+        schema_id: null,
+        schema_url: null
+      });
+    }
+  };
   const hasData = taskResult?.data !== void 0 && taskResult?.data !== null;
   if (passed && hasData && taskResult && !(effectiveStep.task === "sync_accounts" && request.dry_run === true)) {
     const extracted = (0, import_context.extractContextWithProvenance)(effectiveStep.task, taskResult.data, step.id);
+    const conventionUnset = [];
     for (const group of extracted.clearGroups ?? []) {
       if (group.when && !group.when.values.includes(updatedContext[group.when.key])) continue;
       for (const key of group.keys) {
         const provenance = runState.contextProvenance?.get(key);
         if (provenance && provenance.source_kind !== "convention") continue;
-        delete updatedContext[key];
-        runState.responseDerivedNotApplicableContextKeys?.delete(key);
-        runState.contextProvenance?.delete(key);
-      }
-    }
-    Object.assign(updatedContext, extracted.values);
-    for (const key of Object.keys(extracted.values)) {
-      runState.responseDerivedNotApplicableContextKeys?.delete(key);
-    }
-    if (runState.contextProvenance) {
-      for (const [key, entry] of Object.entries(extracted.provenance)) {
-        runState.contextProvenance.set(key, entry);
+        conventionUnset.push(key);
       }
     }
+    commitContextPatch(
+      {
+        set: extracted.values,
+        unset: conventionUnset,
+        setProvenance: extracted.provenance,
+        unsetProvenance: conventionUnset,
+        clearUnavailable: [...conventionUnset, ...Object.keys(extracted.values)]
+      },
+      `step '${step.id}' convention extraction for ${effectiveStep.task}`
+    );
   }
   if (step.context_outputs?.length) {
-    for (const output of step.context_outputs) {
-      if (output.key) runState.responseDerivedNotApplicableContextKeys?.delete(output.key);
-    }
+    commitContextPatch(
+      { clearUnavailable: step.context_outputs.map((output) => output.key).filter((key) => typeof key === "string") },
+      `step '${step.id}' context_outputs availability reset`
+    );
     const taskCompletionResolution = await resolveTaskCompletionOutputs(
       taskResult,
       step.context_outputs,
@@ -4624,15 +5557,14 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
       effectiveStep.task,
       updatedContext
     );
-    Object.assign(updatedContext, explicit.values);
-    for (const key of Object.keys(explicit.values)) {
-      runState.responseDerivedNotApplicableContextKeys?.delete(key);
-    }
-    if (runState.contextProvenance) {
-      for (const [key, entry] of Object.entries(explicit.provenance)) {
-        runState.contextProvenance.set(key, entry);
-      }
-    }
+    commitContextPatch(
+      {
+        set: explicit.values,
+        setProvenance: explicit.provenance,
+        clearUnavailable: Object.keys(explicit.values)
+      },
+      `step '${step.id}' context_outputs capture`
+    );
     if (explicit.failures && explicit.failures.length > 0) {
       for (const failure of explicit.failures) {
         const wasTaskCompletion = step.context_outputs.some(
@@ -4669,6 +5601,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
       }
     }
   }
+  if (protectedViolations.length > 0) validations.push(...protectedViolations);
   const allValidationsPassedFinal = validations.every((v) => !(0, import_validations.validationFailsStep)(v));
   const stepFailed = !(passed && allValidationsPassedFinal);
   const contextRejectionHints = stepFailed && runState.contextProvenance ? (0, import_rejection_hints.detectContextRejectionHints)(taskResult, request, context, runState.contextProvenance, effectiveStep.task) : [];
@@ -4699,9 +5632,21 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     // modern `response_record.payload` path is already redacted.
     response: (0, import_redact_secrets.redactSecrets)(taskResult?.data),
     validations,
+    // NOT projected here: the full runner threads this map from step to
+    // step, so stripping the reserved namespace would break the very
+    // substitution the captures exist for. The STANDALONE entry point
+    // projects it on the way out — see `runStoryboardStepBody` — because
+    // there the map is a thread-back channel the next call refuses.
     context: updatedContext,
     ...runState.contextProvenance && runState.contextProvenance.size > 0 && {
-      context_provenance: Object.fromEntries(runState.contextProvenance)
+      // Reserved-namespace provenance is withheld from the echo: the
+      // standalone contract threads this map back in on the NEXT call,
+      // where `assertUnreservedCallerMetadata` refuses it. Emitting
+      // something we then reject would break the hosted step loop this
+      // feature exists for.
+      context_provenance: Object.fromEntries(
+        [...runState.contextProvenance].filter(([key]) => !(0, import_protected_context.isProtectedContextKey)(key))
+      )
     },
     ...responseDerivedContextResult(runState),
     error: step.expect_error || schemaRejectionIsAdvisory ? void 0 : truncateError(stepResult.error || taskResult?.error),
@@ -6715,12 +7660,22 @@ function collectUpstreamIdentifierDigests(validations, requestPayload, sampleReq
 function sha256Hex(value) {
   return (0, import_node_crypto.createHash)("sha256").update(value, "utf8").digest("hex");
 }
+const DOTTED_CONTEXT_TOKEN_RE = /^\$context\.(\w+)((?:\.\w+|\[\d+\])+)$/;
+function suggestedCapturePath(token) {
+  const match = token.match(DOTTED_CONTEXT_TOKEN_RE);
+  const accessor = match?.[2] ?? "";
+  return accessor.startsWith(".") ? accessor.slice(1) : accessor;
+}
 function findUnresolvedContextVars(obj) {
   const vars = [];
   const walk = (val) => {
     if (typeof val === "string") {
       const match = val.match(/^\$context\.(\w+)$/);
       if (match?.[1]) vars.push({ key: match[1], token: val });
+      else {
+        const dotted = val.match(DOTTED_CONTEXT_TOKEN_RE);
+        if (dotted?.[1]) vars.push({ key: dotted[1], token: val });
+      }
     } else if (Array.isArray(val)) {
       val.forEach(walk);
     } else if (val !== null && typeof val === "object") {
@@ -6921,6 +7876,7 @@ function getFirstStepPreview(storyboard, context = {}) {
   getFirstStepPreview,
   listStrictOnlyFailures,
   prepareGovernedStoryboardWireArgs,
+  prepareStoryboardFixtures,
   resolveCapabilityPath,
   runStoryboard,
   runStoryboardStep,