test(compliance): prove signal governance denial

.agents/sdk-shim-ledger.json

@@ -30,7 +30,7 @@
     "paths": [
       "scripts/overlay-compliance-cache.sh",
       "scripts/run-storyboards-matrix.sh",
-      "tests/patch-sdk-rc15.test.cjs"
+      "tests/sdk-runtime-compat.test.cjs"
     ],
     "terms": [
       "node_modules/@adcp/sdk/compliance/cache",
@@ -39,26 +39,5 @@
       "node_modules/@adcp/sdk/dist/lib/types/schemas.generated.mjs",
       "schemas.generated.js"
     ]
-  },
-  {
-    "id": "sdk-storyboard-product-wire",
-    "title": "SDK storyboard product-wire routing fix",
-    "kind": "installed_sdk_runtime_patch",
-    "status": "temporary",
-    "owner": "training-agent",
-    "upstream": "adcontextprotocol/adcp-client#2495, adcontextprotocol/adcp-client#2527",
-    "problem": "The rc.18 storyboard task map forces get_products onto a legacy-only wire, and scoped transports discover capabilities without carrying them into request adaptation. The latter makes 3.1 sellers look pre-3.1 and strips filters.pricing_currencies.",
-    "localBehavior": "Patch both compiled SDK module formats after installation so the storyboard runner leaves get_products wire selection unspecified and request-local capabilities drive version adaptation without cross-tenant caching.",
-    "removalCondition": "Remove the patch script, Docker invocations, and ledger entry after an SDK release fixes storyboard get_products routing and carries scoped capabilities into request adaptation, and both current and released-3.0 storyboard matrices pass without the patch.",
-    "paths": [
-      "scripts/patch-sdk-rc15.mjs",
-      "tests/patch-sdk-rc15.test.cjs"
-    ],
-    "terms": [
-      "node_modules/@adcp/sdk/dist/lib/testing/storyboard/task-map.js",
-      "node_modules/@adcp/sdk/dist/lib/testing/storyboard/task-map.mjs",
-      "node_modules/@adcp/sdk/dist/lib/core/SingleAgentClient.js",
-      "node_modules/@adcp/sdk/dist/lib/core/SingleAgentClient.mjs"
-    ]
   }
 ]

.changeset/prove-signal-governance-denial.md

@@ -0,0 +1,5 @@
+---
+"adcontextprotocol": minor
+---
+
+Gate signal-activation governance conformance on the task-scoped `adcp.governance_enforcement` claim. The denied activation scenario now exercises an explicit paid activation, grades missing signed authorization, and verifies that rejection caused no platform-primary deployment call instead of treating a response echo as governance evidence.

.github/workflows/migration-smoke-test.yml

@@ -11,7 +11,6 @@ on:
       - 'server/src/config.ts'
       - 'server/tsconfig.json'
       - 'Dockerfile'
-      - 'scripts/patch-sdk-rc15.mjs'
   push:
     branches: [main]
     paths:
@@ -22,7 +21,6 @@ on:
       - 'server/src/config.ts'
       - 'server/tsconfig.json'
       - 'Dockerfile'
-      - 'scripts/patch-sdk-rc15.mjs'
 
 jobs:
   migrate:

.github/workflows/release.yml

@@ -59,7 +59,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
           changed_files="$(git show --format= --name-only --no-renames "${GITHUB_SHA}")"
-          if grep -Eq '^(\.changeset/|package(-lock)?[.]json$|dist/(schemas|compliance|protocol)/|static/(schemas|compliance)/source/|server/src/training-agent/|scripts/(build-schemas[.]cjs|build-compliance[.]cjs|build-protocol-tarball[.]cjs|sign-protocol-tarball[.]sh|run-storyboards-[^/]+[.]sh|run-storyboards-matrix[.]sh|stage-sdk-schema-bundle[.]sh|overlay-compliance-cache[.]sh|patch-sdk-rc15[.]mjs)|[.]github/workflows/(release|training-agent-storyboards)[.]yml$)' <<< "${changed_files}"; then
+          if grep -Eq '^(\.changeset/|package(-lock)?[.]json$|dist/(schemas|compliance|protocol)/|static/(schemas|compliance)/source/|server/src/training-agent/|scripts/(build-schemas[.]cjs|build-compliance[.]cjs|build-protocol-tarball[.]cjs|sign-protocol-tarball[.]sh|run-storyboards-[^/]+[.]sh|run-storyboards-matrix[.]sh|stage-sdk-schema-bundle[.]sh|overlay-compliance-cache[.]sh)|[.]github/workflows/(release|training-agent-storyboards)[.]yml$)' <<< "${changed_files}"; then
             echo "relevant=true" >> "$GITHUB_OUTPUT"
             echo "Release-relevant files changed."
             exit 0

.github/workflows/training-agent-storyboards.yml

@@ -11,7 +11,6 @@ on:
       - 'package-lock.json'
       - 'scripts/build-compliance.cjs'
       - 'scripts/overlay-compliance-cache.sh'
-      - 'scripts/patch-sdk-rc15.mjs'
       - 'scripts/run-storyboards-matrix.sh'
       - 'scripts/run-storyboards-3-0-compat.sh'
       - 'scripts/stage-sdk-schema-bundle.sh'
@@ -30,7 +29,6 @@ on:
       - 'package-lock.json'
       - 'scripts/build-compliance.cjs'
       - 'scripts/overlay-compliance-cache.sh'
-      - 'scripts/patch-sdk-rc15.mjs'
       - 'scripts/run-storyboards-matrix.sh'
       - 'scripts/run-storyboards-3-0-compat.sh'
       - 'scripts/stage-sdk-schema-bundle.sh'

.husky/pre-push

@@ -46,7 +46,7 @@ DOC_PATHS='^(docs/|dist/docs/|mintlify-docs/|docs\.json|mint\.json|README\.md|se
 
 CHANGED=$(git diff --name-only "$RANGE" 2>/dev/null || echo "")
 
-STORYBOARD_PATHS='^(server/src/training-agent/|server/src/services/hosted-compliance-version\.ts|server/tests/manual/run-storyboards\.ts|static/compliance/source/|dist/compliance/|scripts/build-compliance\.cjs|scripts/overlay-compliance-cache\.sh|scripts/patch-sdk-rc15\.mjs|scripts/run-storyboards-matrix\.sh|scripts/run-storyboards-3-0-compat\.sh|package\.json|package-lock\.json)'
+STORYBOARD_PATHS='^(server/src/training-agent/|server/src/services/hosted-compliance-version\.ts|server/tests/manual/run-storyboards\.ts|static/compliance/source/|dist/compliance/|scripts/build-compliance\.cjs|scripts/overlay-compliance-cache\.sh|scripts/run-storyboards-matrix\.sh|scripts/run-storyboards-3-0-compat\.sh|package\.json|package-lock\.json)'
 
 if echo "$CHANGED" | grep -Eq "$STORYBOARD_PATHS"; then
   echo "🔍 Training-agent or compliance source changed — running storyboard matrix (~3min)..."

Dockerfile

@@ -12,11 +12,6 @@ RUN npm ci --ignore-scripts
 # Copy source code
 COPY . .
 
-# rc.15's storyboard runner forces get_products onto the legacy-only wire,
-# hiding the transitional 3.1 dual response. Apply the exact-version patch
-# explicitly because installs disable scripts.
-RUN npm run patch:sdk-rc15
-
 # Build the TypeScript server (increase heap for large tsc compilation)
 RUN NODE_OPTIONS=--max-old-space-size=4096 npm run build
 
@@ -161,9 +156,6 @@ RUN npm ci --omit=dev --ignore-scripts \
  && npm rebuild sharp \
  && npm cache clean --force
 
-COPY --from=builder /app/scripts/patch-sdk-rc15.mjs ./scripts/patch-sdk-rc15.mjs
-RUN node scripts/patch-sdk-rc15.mjs
-
 # Copy built files from builder. Runtime assets under server/src/** (JSON
 # format catalogs, SQL migrations, Addie rule markdown, etc.) are mirrored
 # into dist/ by scripts/copy-server-assets.cjs during `npm run build`, so

package.json

@@ -62,6 +62,7 @@
     "test:rights-attestations": "node --test --test-force-exit --test-timeout=30000 tests/rights-attestations.test.cjs",
     "test:governance-runtime-attestations": "node --test --test-force-exit --test-timeout=30000 tests/governance-runtime-attestations.test.cjs",
     "test:governance-conditions-storyboard": "node --test --test-force-exit --test-timeout=30000 tests/governance-conditions-storyboard.test.cjs",
+    "test:signal-governance-storyboard": "node --test --test-force-exit --test-timeout=30000 tests/signal-governance-storyboard.test.cjs",
     "test:audience-evidence": "node --test --test-force-exit --test-timeout=30000 tests/audience-evidence.test.cjs",
     "test:status-as-of-vectors": "node --test --test-force-exit --test-timeout=30000 tests/media-buy-status-as-of-vectors.test.cjs",
     "test:storyboard-scoping": "node --test --test-force-exit --test-timeout=30000 tests/lint-storyboard-scoping.test.cjs",
@@ -89,7 +90,7 @@
     "test:pagination-invariant": "node --test --test-force-exit --test-timeout=30000 tests/lint-pagination-invariant.test.cjs",
     "test:version-envelope": "node --test --test-force-exit --test-timeout=30000 tests/lint-version-envelope.test.cjs",
     "test:test-dynamic-imports": "node --test --test-force-exit --test-timeout=30000 tests/lint-test-dynamic-imports.test.cjs",
-    "test:sdk-shims": "node --test --test-force-exit --test-timeout=30000 tests/lint-sdk-shims.test.cjs tests/patch-sdk-rc15.test.cjs",
+    "test:sdk-shims": "node --test --test-force-exit --test-timeout=30000 tests/lint-sdk-shims.test.cjs tests/sdk-runtime-compat.test.cjs",
     "test:tenant-routing": "vitest run --config server/vitest.config.ts server/src/training-agent/tenants/tenant-smoke.test.ts",
     "test:format-identity-boundaries": "node --test --test-force-exit --test-timeout=30000 tests/lint-format-identity-boundaries.test.cjs",
     "test:sdk-runner-capability-gates": "node --test --test-force-exit --test-timeout=30000 tests/sdk-runner-capability-gates.test.cjs",
@@ -129,15 +130,13 @@
     "audit:oneof": "node scripts/audit-oneof.mjs",
     "test:schema-utf8": "node scripts/normalize-schema-utf8.mjs --check",
     "fix:schema-utf8": "node scripts/normalize-schema-utf8.mjs",
-    "test": "npm run test:docs-nav && npm run test:owned-links && npm run test:release-docs-nav && npm run test:rewrite-dist-redirect-links && npm run test:rewrite-dist-links-idempotency && npm run test:docs-error-handling-copy && npm run test:schemas && npm run test:performance-feedback && npm run test:mcp-schema-projection && npm run test:dist-schema-version-ids && npm run test:examples && npm run test:extensions && npm run test:extension-schemas && npm run test:error-handling && npm run test:json-schema && npm run test:audio-radio && npm run test:adagents-catalog-only && npm run test:canonical-reference-resolver && npm run test:composed && npm run test:rejection-arm-mutex && npm run test:migrations && npm run test:hmac-vectors && npm run test:hmac-signer-conformance && npm run test:webhook-signing-vectors && npm run test:webhook-receiver-envelope && npm run test:oauth-setup-vectors && npm run test:transport-errors && npm run test:targeting-overlay-vectors && npm run test:targeting-aware-discovery && npm run test:demographic-targeting && npm run test:attestation-vectors && npm run test:rights-attestations && npm run test:governance-runtime-attestations && npm run test:governance-conditions-storyboard && npm run test:audience-evidence && npm run test:status-as-of-vectors && npm run test:storyboard-scoping && npm run test:storyboard-branch-sets && npm run test:storyboard-provides-state-for && npm run test:storyboard-fixture-resolution && npm run test:storyboard-contradictions && npm run test:storyboard-context-entity && npm run test:storyboard-auth-shape && npm run test:storyboard-test-kits && npm run test:compliance-packaged-refs && npm run test:compliance-source-authority && npm run test:storyboard-sample-request-schema && npm run test:storyboard-response-schema && npm run test:storyboard-context-output-paths && npm run test:storyboard-validations-paths && npm run test:storyboard-check-enum && npm run test:update-media-buy-affected-packages && npm run test:storyboard-advisory-expiry && npm run test:storyboard-raw-mode-required && npm run test:storyboard-upstream-traffic-paths && npm run test:refine-finalize-validation-ids && npm run test:run-storyboards-schema-root && npm run test:storyboard-doc-parity && npm run test:pagination-invariant && npm run test:version-envelope && npm run test:test-dynamic-imports && npm run test:sdk-shims && npm run test:format-identity-boundaries && npm run test:sdk-runner-capability-gates && npm run test:callapi-state-change && npm run test:sign-protocol-tarball && npm run test:chat-streaming-code-fences && npm run test:certification-demo-formatting && npm run test:build-schemas-hoist-enums && npm run test:build-schemas-hoist-marked && npm run test:build-schemas-async-response-refs && npm run test:release-workflow && npm run test:immutable-release-artifacts && npm run test:patch-3-0-compat-bundle && npm run test:error-codes && npm run test:compliance-snippets && npm run test:doc-compliance-drift && npm run test:substitution-vector-names && npm run test:platform-agnostic && npm run test:oneof-discriminators && npm run test:schema-utf8 && npm run test:unit && npm run test:server-unit && npm run test:openapi && npm run typecheck",
+    "test": "npm run test:docs-nav && npm run test:owned-links && npm run test:release-docs-nav && npm run test:rewrite-dist-redirect-links && npm run test:rewrite-dist-links-idempotency && npm run test:docs-error-handling-copy && npm run test:schemas && npm run test:performance-feedback && npm run test:mcp-schema-projection && npm run test:dist-schema-version-ids && npm run test:examples && npm run test:extensions && npm run test:extension-schemas && npm run test:error-handling && npm run test:json-schema && npm run test:audio-radio && npm run test:adagents-catalog-only && npm run test:canonical-reference-resolver && npm run test:composed && npm run test:rejection-arm-mutex && npm run test:migrations && npm run test:hmac-vectors && npm run test:hmac-signer-conformance && npm run test:webhook-signing-vectors && npm run test:webhook-receiver-envelope && npm run test:oauth-setup-vectors && npm run test:transport-errors && npm run test:targeting-overlay-vectors && npm run test:targeting-aware-discovery && npm run test:demographic-targeting && npm run test:attestation-vectors && npm run test:rights-attestations && npm run test:governance-runtime-attestations && npm run test:governance-conditions-storyboard && npm run test:signal-governance-storyboard && npm run test:audience-evidence && npm run test:status-as-of-vectors && npm run test:storyboard-scoping && npm run test:storyboard-branch-sets && npm run test:storyboard-provides-state-for && npm run test:storyboard-fixture-resolution && npm run test:storyboard-contradictions && npm run test:storyboard-context-entity && npm run test:storyboard-auth-shape && npm run test:storyboard-test-kits && npm run test:compliance-packaged-refs && npm run test:compliance-source-authority && npm run test:storyboard-sample-request-schema && npm run test:storyboard-response-schema && npm run test:storyboard-context-output-paths && npm run test:storyboard-validations-paths && npm run test:storyboard-check-enum && npm run test:update-media-buy-affected-packages && npm run test:storyboard-advisory-expiry && npm run test:storyboard-raw-mode-required && npm run test:storyboard-upstream-traffic-paths && npm run test:refine-finalize-validation-ids && npm run test:run-storyboards-schema-root && npm run test:storyboard-doc-parity && npm run test:pagination-invariant && npm run test:version-envelope && npm run test:test-dynamic-imports && npm run test:sdk-shims && npm run test:format-identity-boundaries && npm run test:sdk-runner-capability-gates && npm run test:callapi-state-change && npm run test:sign-protocol-tarball && npm run test:chat-streaming-code-fences && npm run test:certification-demo-formatting && npm run test:build-schemas-hoist-enums && npm run test:build-schemas-hoist-marked && npm run test:build-schemas-async-response-refs && npm run test:release-workflow && npm run test:immutable-release-artifacts && npm run test:patch-3-0-compat-bundle && npm run test:error-codes && npm run test:compliance-snippets && npm run test:doc-compliance-drift && npm run test:substitution-vector-names && npm run test:platform-agnostic && npm run test:oneof-discriminators && npm run test:schema-utf8 && npm run test:unit && npm run test:server-unit && npm run test:openapi && npm run typecheck",
     "test:all": "npm run test:schemas && npm run test:examples && npm run test:extensions && npm run test:error-handling && npm run test:snippets && npm run typecheck",
     "precommit:server-unit": "node scripts/precommit-server-unit.cjs",
     "precommit": "bash scripts/with-timeout.sh 180 npm run test:unit && npm run test:test-dynamic-imports && npm run test:format-identity-boundaries && npm run test:callapi-state-change && bash scripts/with-timeout.sh 240 npm run precommit:server-unit && npm run typecheck",
     "test:storyboards": "bash scripts/run-storyboards-matrix.sh",
     "test:storyboards:3.0-compat": "bash scripts/run-storyboards-3-0-compat.sh",
     "prepare": "husky",
-    "postinstall": "node scripts/patch-sdk-rc15.mjs",
-    "patch:sdk-rc15": "node scripts/patch-sdk-rc15.mjs",
     "changeset": "changeset",
     "version": "changeset version && npm install --package-lock-only --ignore-scripts && npm run build:schemas -- --release && npm run build:compliance -- --release && npm run build:protocol-tarball -- --release && npm run sign:protocol-tarball",
     "sign:protocol-tarball": "bash scripts/sign-protocol-tarball.sh",
@@ -158,7 +157,7 @@
     "docs:json-field-audit": "node scripts/docs-json-field-audit.cjs"
   },
   "dependencies": {
-    "@adcp/sdk": "13.0.0-rc.21",
+    "@adcp/sdk": "13.0.0-rc.25",
     "@anthropic-ai/sdk": "^0.115.0",
     "@asteasolutions/zod-to-openapi": "^8.5.0",
     "@contentauth/c2pa-node": "^0.8.3",