@adcp/sdk 16.4.0 → 16.5.0

package/ADCP_VERSION

@@ -1 +1 @@
-3.2.5
+3.2.7

package/README.md

@@ -668,18 +668,22 @@ has its own, tighter 64 KiB cap and does not use this mechanism.)
 Bytes are counted as they stream in, a declared `Content-Length` over the cap
 is refused before the body is read, and an oversized response fails with a
 typed `ResponseTooLargeError`. Nothing is silently truncated.
+The error names `transport.maxResponseBytes` and explains how to raise it.
+For large catalog, signal, media-buy, and delivery reads, choose a larger client
+cap such as 64 MiB based on expected payloads. Capability and preview probes can
+use the default or an explicitly smaller cap.
 
 ```typescript
 import { ResponseTooLargeError } from '@adcp/sdk';
 
 // Raise the cap for an agent that legitimately publishes a large catalog.
 const client = new ADCPMultiAgentClient(agents, {
-  transport: { maxResponseBytes: 32 * 1024 * 1024 },
+  transport: { maxResponseBytes: 64 * 1024 * 1024 },
 });
 
 // …or per call.
 await client.agent('agent_x').getProducts(params, {
-  transport: { maxResponseBytes: 32 * 1024 * 1024 },
+  transport: { maxResponseBytes: 64 * 1024 * 1024 },
 });
 
 // Opt out entirely — explicit, never the default. Only `0` opts out;

package/compliance/cache/{3.2.5 → 3.2.7}/domains/creative/scenarios/billing_out_of_band.yaml

@@ -143,6 +143,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_billing_out_of_band-07c4ce40"
+            sandbox: true
           idempotency_key: "$generate:uuid_v4#creative_billing_out_of_band_report_usage"
           reporting_period:
             start: "2099-07-01T00:00:00Z"

package/compliance/cache/{3.2.5 → 3.2.7}/domains/creative/scenarios/canonical_supported_formats.yaml

@@ -151,6 +151,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_canonical_supported_formats-5b23e65e"
+            sandbox: true
           brand:
             domain: "acmeoutdoor.example"
           quality: "draft"
@@ -209,6 +210,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_canonical_supported_formats-5b23e65e"
+            sandbox: true
           brand:
             domain: "acmeoutdoor.example"
           quality: "draft"

package/compliance/cache/{3.2.5/protocols → 3.2.7/domains}/creative/scenarios/evaluator_auth.yaml

@@ -1,5 +1,5 @@
 id: creative/evaluator_auth
-version: "1.0.3"
+version: "1.0.5"
 title: "Creative evaluator authentication boundary"
 category: creative
 summary: "Verifies that build_creative evaluator pointers use the verifier allowlist, keep credentials out of payloads, and invoke accepted evaluator agents through get_creative_features."
@@ -11,9 +11,17 @@ introduced_in: "3.1"
 required_tools:
   - build_creative
 
-requires_capability:
-  path: creative.supports_evaluator
-  equals: true
+# The compound gate requires an established positive profile. A single
+# requires_capability permits unknown raw capabilities after a failed probe.
+requires_all_capabilities:
+  - path: creative
+    present: true
+  - path: creative.supports_evaluator
+    equals: true
+
+creative_build_probe:
+  context_prefix: build
+  message: "Create one creative for Acme Outdoor's winter trip offer."
 
 narrative: |
   `build_creative.evaluator` is an experimental buyer-attached pointer for
@@ -43,6 +51,18 @@ narrative: |
   are not cryptographic proof of transport authentication. Authentication proof
   remains a normative obligation on the producing agent and evaluator.
 
+  Applicability requires the established positive capability profile above;
+  unknown capability evidence receives no executed security coverage. For a
+  supporting agent, both off-list rejection phases are required independently: the
+  evaluator spec and build_creative reference require rejection before any
+  outbound call. A later discovery response cannot opt out of these checks.
+  The creative-build-probe runner resolves a real build route and its input as
+  one binding before seeding or transport. It honors explicit operations and
+  legacy omitted operations; an unavailable input fixture is a visible
+  fixture_unsatisfied coverage gap, not producer nonconformance or security
+  coverage. Ranking, feature vocabulary and variant support are not prerequisites
+  for the two required boundary probes.
+
 agent:
   interaction_model: creative_agent
   capabilities:
@@ -61,9 +81,19 @@ prerequisites:
   description: |
     The creative agent advertises `creative.supports_evaluator: true`, lists
     `creative.evaluator` in `experimental_features`, exposes at least one
-    targetable `creative.supported_formats[].capability_id`, and exposes at
-    least one `governance.creative_features[].feature_id` for the account under
-    test. Its sandbox `creative_policy.accepted_verifiers[]` includes
+    usable build entry in `creative.supported_formats[]`. For 3.1, provision a
+    matched legacy `target_format_id` recipe; do not derive it from a capability ID. The runner contract
+    `test-kits/creative-build-probe-runner.yaml` documents preparation of that
+    entry. Add operator recipes to the brand kit named below, or supply your
+    kit through the runner test_kit option/--test-kit. Provision account-specific transformation/library/transformer inputs
+    in `test_kit.creative_build_probes` when a unique generation route cannot be
+    inferred. The provisioned sandbox account must be authorized and entitled
+    to build with the selected route/input, including any required governance
+    authorization. This runner contract currently requires a build fixture
+    without per-request signed governance_context; advertised signed-context
+    build enforcement yields a zero-credit fixture gap. Optional ranking probes
+    additionally use creative feature
+    vocabulary. Its sandbox `creative_policy.accepted_verifiers[]` includes
     `https://quality-evaluator.example/adcp`.
 
     The evaluator fixture exposes the standard `get_creative_features` contract.
@@ -101,8 +131,8 @@ phases:
     narrative: |
       The buyer reads capabilities before sending evaluator inputs. Agents that
       do not advertise evaluator support skip the remaining evaluator-specific
-      phases. Supporting agents also need a build capability id and a creative
-      feature id so later phases do not hardcode fixture-specific values.
+      phases. The runner binds an actual build route and valid input before execution;
+      optional ranking phases additionally discover a creative feature id.
 
     steps:
       - id: get_capabilities
@@ -116,7 +146,7 @@ phases:
         expected: |
           Return the creative capability block. When `creative.supports_evaluator`
           is true, the following phases validate the evaluator boundary using
-          discovered build and feature identifiers.
+          the route and valid input bound by the runner.
         sample_request:
           protocols:
             - "creative"
@@ -126,10 +156,6 @@ phases:
         context_outputs:
           - name: "supports_evaluator"
             path: "creative.supports_evaluator"
-          - name: "build_capability_id"
-            path: "creative.supported_formats[0].capability_id"
-          - name: "creative_feature_id"
-            path: "governance.creative_features[0].feature_id"
         validations:
           - check: response_schema
             description: "Response matches get-adcp-capabilities-response.json schema"
@@ -170,6 +196,9 @@ phases:
             - "governance"
           context:
             correlation_id: "creative_evaluator_auth--feature_contract"
+        context_outputs:
+          - name: "creative_feature_id"
+            path: "governance.creative_features[0].feature_id"
         validations:
           - check: response_schema
             description: "Response matches get-adcp-capabilities-response.json schema"
@@ -181,9 +210,6 @@ phases:
             path: "experimental_features[*]"
             value: "creative.evaluator"
             description: "Experimental evaluator feature id is declared"
-          - check: field_present
-            path: "creative.supported_formats[0].capability_id"
-            description: "A targetable build capability id is discoverable"
           - check: field_present
             path: "governance.creative_features[0].feature_id"
             description: "Creative feature vocabulary is discoverable for evaluator rank_by/eval.features"
@@ -194,11 +220,9 @@ phases:
 
   - id: reject_off_list_evaluator
     title: "Reject an off-list evaluator URL"
-    optional: true
     requires_capability:
       path: "creative.supports_evaluator"
       equals: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
     narrative: |
       The buyer supplies a well-formed external evaluator URL that is not in the
       seller's accepted verifier allowlist. The creative agent must reject it
@@ -208,6 +232,7 @@ phases:
       - id: reject_unaccepted_agent_url
         title: "Build with an unaccepted evaluator URL"
         task: build_creative
+        requires_contract: creative_build_probe_runner
         schema_ref: "media-buy/build-creative-request.json"
         response_schema_ref: "media-buy/build-creative-response.json"
         doc_ref: "/creative/task-reference/build_creative"
@@ -220,27 +245,34 @@ phases:
           off-list URL before any outbound call to the supplied evaluator.
         sample_request:
           idempotency_key: "$generate:uuid_v4#creative_evaluator_auth_off_list"
-          message: "Create two best-of-N display variants for Acme Outdoor's winter trip offer."
-          target_capability_id: "$context.build_capability_id"
-          max_variants: 2
-          variant_axis:
-            dimension: "best_of_n"
-          keep_mode: "keep_one"
           evaluator:
             agent_url: "https://unaccepted-evaluator.example/adcp"
-            rank_by:
-              - feature_id: "$context.creative_feature_id"
-                direction: "maximize"
           account:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_evaluator_auth-1e409e0c"
+            sandbox: true
           brand:
             domain: "acmeoutdoor.example"
           context:
             correlation_id: "creative_evaluator_auth--off_list"
+        context_inputs:
+          - key: build_capability_id
+            inject_at: target_capability_id
+          - key: build_target_format_id
+            inject_at: target_format_id
+          - key: build_message
+            inject_at: message
+          - key: build_creative_manifest
+            inject_at: creative_manifest
+          - key: build_creative_id
+            inject_at: creative_id
+          - key: build_transformer_id
+            inject_at: transformer_id
+          - key: build_config
+            inject_at: config
         validations:
           - check: response_schema
             description: "Response matches build-creative-response.json schema"
@@ -250,25 +282,24 @@ phases:
           - check: upstream_traffic
             description: "Off-list direct evaluator URL is never called"
             min_count: 0
-            endpoint_pattern: "POST https://unaccepted-evaluator.example/adcp*"
+            endpoint_pattern: "* https://unaccepted-evaluator.example/*"
 
   - id: reject_off_list_feature_agent
     title: "Reject an off-list feature_agent URL"
-    optional: true
     requires_capability:
       path: "creative.supports_evaluator"
       equals: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
     narrative: |
-      The buyer supplies a well-formed `feature_agent.agent_url` alongside an
-      account-arranged evaluator id. The nested feature agent uses the same
-      accepted-verifier allowlist and must be rejected before any outbound call
+      The buyer supplies a well-formed `feature_agent.agent_url` alongside the
+      accepted external evaluator source configured in the prerequisites. The
+      nested feature agent uses the same accepted-verifier allowlist and must be rejected before any outbound call
       when it is off-list.
 
     steps:
       - id: reject_unaccepted_feature_agent
         title: "Build with an unaccepted feature_agent URL"
         task: build_creative
+        requires_contract: creative_build_probe_runner
         schema_ref: "media-buy/build-creative-request.json"
         response_schema_ref: "media-buy/build-creative-response.json"
         doc_ref: "/creative/task-reference/build_creative"
@@ -282,30 +313,36 @@ phases:
           endpoint.
         sample_request:
           idempotency_key: "$generate:uuid_v4#creative_evaluator_auth_feature_agent_off_list"
-          message: "Create two best-of-N display variants for Acme Outdoor's winter trip offer."
-          target_capability_id: "$context.build_capability_id"
-          max_variants: 2
-          variant_axis:
-            dimension: "best_of_n"
-          keep_mode: "keep_one"
           evaluator:
-            evaluator_id: "quality-default"
+            agent_url: "https://quality-evaluator.example/adcp"
             feature_agent:
               agent_url: "https://unaccepted-evaluator.example/adcp"
-              feature_id: "$context.creative_feature_id"
-            rank_by:
-              - feature_id: "$context.creative_feature_id"
-                direction: "maximize"
           account:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_evaluator_auth-1e409e0c"
+            sandbox: true
           brand:
             domain: "acmeoutdoor.example"
           context:
             correlation_id: "creative_evaluator_auth--feature_agent_off_list"
+        context_inputs:
+          - key: build_capability_id
+            inject_at: target_capability_id
+          - key: build_target_format_id
+            inject_at: target_format_id
+          - key: build_message
+            inject_at: message
+          - key: build_creative_manifest
+            inject_at: creative_manifest
+          - key: build_creative_id
+            inject_at: creative_id
+          - key: build_transformer_id
+            inject_at: transformer_id
+          - key: build_config
+            inject_at: config
         validations:
           - check: response_schema
             description: "Response matches build-creative-response.json schema"
@@ -315,7 +352,7 @@ phases:
           - check: upstream_traffic
             description: "Off-list nested feature_agent URL is never called"
             min_count: 0
-            endpoint_pattern: "POST https://unaccepted-evaluator.example/adcp*"
+            endpoint_pattern: "* https://unaccepted-evaluator.example/*"
 
   - id: payload_credentials_advisory
     title: "Keep evaluator credentials out of the payload"
@@ -323,7 +360,7 @@ phases:
     requires_capability:
       path: "creative.supports_evaluator"
       equals: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
+    skip_if: "context.supports_evaluator != true || !context.creative_feature_id"
     narrative: |
       The buyer attempts to pass an evaluator API key inside the evaluator
       object. The payload is schema-valid but non-conforming: evaluator
@@ -337,6 +374,7 @@ phases:
       - id: evaluator_api_key_payload
         title: "Build with a credential-shaped evaluator field"
         task: build_creative
+        requires_contract: creative_build_probe_runner
         schema_ref: "media-buy/build-creative-request.json"
         response_schema_ref: "media-buy/build-creative-response.json"
         doc_ref: "/creative/task-reference/build_creative"
@@ -349,8 +387,6 @@ phases:
           must not forward the smuggled credential to the evaluator.
         sample_request:
           idempotency_key: "$generate:uuid_v4#creative_evaluator_auth_payload_credential"
-          message: "Create two best-of-N display variants for Acme Outdoor's winter trip offer."
-          target_capability_id: "$context.build_capability_id"
           max_variants: 2
           variant_axis:
             dimension: "best_of_n"
@@ -368,10 +404,26 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_evaluator_auth-1e409e0c"
+            sandbox: true
           brand:
             domain: "acmeoutdoor.example"
           context:
             correlation_id: "creative_evaluator_auth--payload_credential"
+        context_inputs:
+          - key: build_capability_id
+            inject_at: target_capability_id
+          - key: build_target_format_id
+            inject_at: target_format_id
+          - key: build_message
+            inject_at: message
+          - key: build_creative_manifest
+            inject_at: creative_manifest
+          - key: build_creative_id
+            inject_at: creative_id
+          - key: build_transformer_id
+            inject_at: transformer_id
+          - key: build_config
+            inject_at: config
         validations:
           - check: response_schema
             description: "Response matches build-creative-response.json schema"
@@ -401,7 +453,7 @@ phases:
     requires_capability:
       path: "creative.supports_evaluator"
       equals: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
+    skip_if: "context.supports_evaluator != true || !context.creative_feature_id"
     narrative: |
       The buyer supplies an accepted external evaluator URL. The creative agent
       builds variants, calls the evaluator through the `get_creative_features`
@@ -412,6 +464,7 @@ phases:
       - id: build_with_accepted_evaluator
         title: "Build and rank with an accepted evaluator"
         task: build_creative
+        requires_contract: creative_build_probe_runner
         schema_ref: "media-buy/build-creative-request.json"
         response_schema_ref: "media-buy/build-creative-response.json"
         doc_ref: "/creative/task-reference/build_creative"
@@ -426,8 +479,6 @@ phases:
           authentication mechanism.
         sample_request:
           idempotency_key: "$generate:uuid_v4#creative_evaluator_auth_accepted"
-          message: "Create two best-of-N display variants for Acme Outdoor's winter trip offer."
-          target_capability_id: "$context.build_capability_id"
           max_variants: 2
           variant_axis:
             dimension: "best_of_n"
@@ -446,10 +497,26 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_evaluator_auth-1e409e0c"
+            sandbox: true
           brand:
             domain: "acmeoutdoor.example"
           context:
             correlation_id: "creative_evaluator_auth--accepted"
+        context_inputs:
+          - key: build_capability_id
+            inject_at: target_capability_id
+          - key: build_target_format_id
+            inject_at: target_format_id
+          - key: build_message
+            inject_at: message
+          - key: build_creative_manifest
+            inject_at: creative_manifest
+          - key: build_creative_id
+            inject_at: creative_id
+          - key: build_transformer_id
+            inject_at: transformer_id
+          - key: build_config
+            inject_at: config
         validations:
           - check: response_schema
             description: "Response matches build-creative-response.json schema"
@@ -481,7 +548,7 @@ phases:
     requires_capability:
       path: "creative.supports_evaluator"
       equals: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
+    skip_if: "context.supports_evaluator != true || !context.creative_feature_id"
     narrative: |
       An accepted evaluator can be unreachable or can reject the producing
       agent's transport authentication. The buyer-visible build should not fail
@@ -494,6 +561,7 @@ phases:
       - id: force_evaluator_unavailable
         title: "Force accepted evaluator unavailable"
         task: comply_test_controller
+        requires_contract: creative_build_probe_runner
         schema_ref: "compliance/comply-test-controller-request.json"
         response_schema_ref: "compliance/comply-test-controller-response.json"
         doc_ref: "/building/by-layer/L3/comply-test-controller"
@@ -529,6 +597,7 @@ phases:
       - id: build_with_unavailable_evaluator
         title: "Build falls back to seller-default ranking"
         task: build_creative
+        requires_contract: creative_build_probe_runner
         schema_ref: "media-buy/build-creative-request.json"
         response_schema_ref: "media-buy/build-creative-response.json"
         doc_ref: "/creative/task-reference/build_creative"
@@ -541,8 +610,6 @@ phases:
           evaluator ranking was unavailable and seller-default ranking was used.
         sample_request:
           idempotency_key: "$generate:uuid_v4#creative_evaluator_auth_unavailable"
-          message: "Create two best-of-N display variants for Acme Outdoor's winter trip offer."
-          target_capability_id: "$context.build_capability_id"
           max_variants: 2
           variant_axis:
             dimension: "best_of_n"
@@ -558,10 +625,26 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_evaluator_auth-1e409e0c"
+            sandbox: true
           brand:
             domain: "acmeoutdoor.example"
           context:
             correlation_id: "creative_evaluator_auth--unavailable_degrade"
+        context_inputs:
+          - key: build_capability_id
+            inject_at: target_capability_id
+          - key: build_target_format_id
+            inject_at: target_format_id
+          - key: build_message
+            inject_at: message
+          - key: build_creative_manifest
+            inject_at: creative_manifest
+          - key: build_creative_id
+            inject_at: creative_id
+          - key: build_transformer_id
+            inject_at: transformer_id
+          - key: build_config
+            inject_at: config
         validations:
           - check: response_schema
             description: "Response matches build-creative-response.json schema despite evaluator unavailability"

package/compliance/cache/{3.2.5/protocols → 3.2.7/domains}/creative/scenarios/native_in_feed.yaml

@@ -175,6 +175,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_native_in_feed-39ac3445"
+            sandbox: true
           creatives:
             - creative_id: "native_trail_pro_full_bundle"
               name: "Trail Pro 3000 — Native Content Recommendation"
@@ -284,6 +285,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_native_in_feed-39ac3445"
+            sandbox: true
           creatives:
             - creative_id: "native_reject_title_long"
               name: "Reject — title too long"
@@ -337,6 +339,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_native_in_feed-39ac3445"
+            sandbox: true
           creatives:
             - creative_id: "native_reject_image_size"
               name: "Reject — image wrong size"
@@ -394,6 +397,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_native_in_feed-39ac3445"
+            sandbox: true
           creatives:
             - creative_id: "native_reject_cta_enum"
               name: "Reject — CTA not in enum"
@@ -449,6 +453,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_native_in_feed-39ac3445"
+            sandbox: true
           creatives:
             - creative_id: "native_reject_custom_tracker"
               name: "Reject — pixel_tracker custom without name"
@@ -517,6 +522,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-creative_native_in_feed-39ac3445"
+            sandbox: true
           request_type: "single"
           creative_manifest:
             creative_id: "native_trail_pro_full_bundle"

package/compliance/cache/{3.2.5/protocols → 3.2.7/domains}/governance/scenarios/property_list_change_webhook_signing.yaml

@@ -84,6 +84,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-governance_property_list_change_webh-10a451ce"
+            sandbox: true
           name: "Acme Outdoor webhook properties"
           base_properties:
             - selection_type: "identifiers"
@@ -116,6 +117,7 @@ phases:
             operator: "pinnacle-agency.example"
             operator_unit:
               id: "compliance-governance_property_list_change_webh-10a451ce"
+            sandbox: true
           webhook_url: "{{runner.webhook_url:update_property_list_for_webhook}}"
           base_properties:
             - selection_type: "identifiers"

package/compliance/cache/{3.2.5/protocols → 3.2.7/domains}/media-buy/index.yaml

@@ -179,6 +179,14 @@ phases:
             path: "context.correlation_id"
             value: "media_buy_seller--get_capabilities"
             description: "Context correlation_id returned unchanged"
+          - id: request_signing_required_in_4_0
+            check: field_value
+            path: "request_signing.supported"
+            value: true
+            description: "[4.0 compatibility] Seller verifies RFC 9421 signed requests; 4.0 requires signing on spend-committing operations"
+            severity: advisory
+            permanent_advisory:
+              reason: "AdCP 4.0 compatibility check (universal/v4-compatibility.yaml). Request signing is optional in 3.x, so this stays advisory on every 3.x bundle."
 
   - id: account_setup
     title: "Account setup"
@@ -415,6 +423,13 @@ phases:
           - check: field_present
             path: "products[0].publisher_properties"
             description: "Products include publisher_properties"
+          - id: format_ids_removed_in_4_0
+            check: all_fields_present
+            path: "products[*].format_options"
+            description: "[4.0 compatibility] Every returned product declares canonical format_options; 4.0 removes format_ids"
+            severity: advisory
+            permanent_advisory:
+              reason: "AdCP 4.0 compatibility check (universal/v4-compatibility.yaml). 3.x still accepts format_ids-only legacy products, so this stays advisory on every 3.x bundle; 4.0 schemas enforce format_options directly."
   - id: create_buy
     title: "Create the media buy"
     depends_on: [product_discovery]
@@ -722,6 +737,13 @@ phases:
           - check: field_present
             path: "products[0].publisher_properties"
             description: "Products include publisher_properties"
+          - id: format_ids_removed_in_4_0
+            check: all_fields_present
+            path: "products[*].format_options"
+            description: "[4.0 compatibility] Every returned product declares canonical format_options; 4.0 removes format_ids"
+            severity: advisory
+            permanent_advisory:
+              reason: "AdCP 4.0 compatibility check (universal/v4-compatibility.yaml). 3.x still accepts format_ids-only legacy products, so this stays advisory on every 3.x bundle; 4.0 schemas enforce format_options directly."
 
   - id: buyer_selected_create_buy
     title: "Buyer-selected timezone media buy"

package/compliance/cache/{3.2.5/protocols → 3.2.7/domains}/media-buy/scenarios/availability_windows.yaml

@@ -134,6 +134,10 @@ phases:
             description: "Context correlation_id returned unchanged"
 
   - id: mirror_read
+    # The availability promise does not require the optional wholesale path.
+    requires_capability:
+      path: media_buy.lifecycle_tools
+      contains: list_products
     title: "Capture the feed version without forecast"
     depends_on: [setup]
     narrative: |
@@ -189,6 +193,9 @@ phases:
             description: "Context correlation_id returned unchanged"
 
   - id: flexible_window_read
+    requires_capability:
+      path: media_buy.lifecycle_tools
+      contains: list_products
     title: "Flexible-window availability discovery"
     depends_on: [mirror_read]
     narrative: |
@@ -298,6 +305,9 @@ phases:
             description: "Context correlation_id returned unchanged"
 
   - id: conditional_read
+    requires_capability:
+      path: media_buy.lifecycle_tools
+      contains: list_products
     title: "Forecast is a per-read overlay, never feed content"
     depends_on: [mirror_read]
     narrative: |
@@ -349,8 +359,12 @@ phases:
             description: "Context correlation_id returned unchanged"
 
   - id: buy_rejections
+    # Keep forecast reads applicable for sellers without compact direct buying.
+    requires_capability:
+      path: media_buy.lifecycle_tools
+      contains: buy_products
     title: "The buy is the authoritative availability check"
-    depends_on: [flexible_window_read]
+    depends_on: [mirror_read, flexible_window_read]
     narrative: |
       availability_status is a snapshot, never a hold. The seller re-checks the
       calendar at buy time and rejects both a flight inside a booked span and a