[bokelley]

Summary

Fixes #2882 by removing the required_tools selector/runner divergence using the established lenient any-of applicability semantics: a storyboard is applicable when at least one listed tool is advertised. The runner already intentionally uses this rule, including unioned multi-agent tool families; this focused backport aligns capability-driven suite selection.

Independent semantic audit confirmed that this is the intended behavior, commit 708ebf533ec6ce80552b517d8c99c604f9fa3e23 is the smallest correct stable backport, and the helper body is byte-identical to main.

Release base and scope

• Exact base: @adcp/sdk@13.0.3, currently npm latest
• Base commit / parent: 6424498b695858954ad86585735e27aeb36d38c9
• Backport commit: 708ebf533ec6ce80552b517d8c99c604f9fa3e23
• Tree: a6f29455a9e920ac364b1ca8dcf97381b88128ec
• Delta: exactly three files, +122/-18
• Includes an @adcp/sdk patch changeset for a possible stable 13.0.4
• Does not edit package versions, generated/released artifacts, or tags

Release-ordering gate (blocking)

Do not publish stable @adcp/sdk@13.0.4 until the corrected AdCP 3.1 compliance artifact tracked by adcontextprotocol/adcp#7405 and adcontextprotocol/adcp#7406 is published first, or the artifact and SDK correction are published atomically as one coordinated release.

Shipping #2890 alone makes the CLI use the hosted grader's established lenient any-of semantics while the old 3.1.20 compliance data still mis-selects suites. The release coordinator must verify the corrected artifact is available and normal PR CI is green before authorizing publication.

Verification

• npm run build — passed
• npm run typecheck — passed
• npm run lint — passed (0 errors; existing warning-only backlog)
• Focused selector regression — 3/3 passed
• Fast suite — 13,281 passed, 0 failed, 0 cancelled, 7 skipped
• Slow suite — 64/64 passed
• ESLint-plugin workspace suite — 30/30 passed
• Package export validation (npm run check:package) — passed

Local optional PostgreSQL caveat: the inherited DATABASE_URL pointed to an unavailable local service at 127.0.0.1:58433, so five optional PG suite setup hooks returned ECONNREFUSED and cascaded to 115 cancellations. With the optional DB variable unset, the documented skip path was clean and all non-PG suites passed. Normal PR CI remains required before approval or release.

Routed options.agents coverage to add

The existing regression test manually unions tool arrays; it does not execute the true options.agents routed discovery path. The prepared follow-up test matrix is:

• required tool found on the first routed tenant
• required tool found only on a secondary routed tenant
• required tool families split across routed tenants
• no routed tenant advertises a required tool
• routed discovery failure
• caller-supplied agentTools conflicts with routed discovery

No test or implementation files are changed by this body-only update. Adding this coverage or changing behavior requires a fresh review of the resulting exact head before the patch is broadened.

Follow-ups and boundaries

• Introduce a shared hasAnyRequiredTool primitive so selector and runner semantics cannot drift again.
• Resolve the precedence/behavior where caller-supplied agentTools overrides routed discovery.
• Prevent structurally universal tool declarations through AdCP source lint warnings, not a blanket SDK load failure.
• Do not refresh this branch onto the fix(deps): remediate transitive audit advisories #2891 → ci(13.x): use checked-in registry schema for generated checks #2892 → ci(13.x): run CI, CodeQL and interop on the maintenance branch #2893 13.x stack until all three have landed. Any later refresh requires coordinator approval and a fresh exact-head/diff review.

Human product/release decision required

A maintainer/coordinator must explicitly choose one:

1. After satisfying the compliance-artifact ordering gate above, approve a stable @adcp/sdk@13.0.4 release with this correction.
2. Formally declare 13.x unsupported/EOL and update support documentation, release automation, and npm channel policy instead.

This draft does not authorize merge, versioning, npm publication, tag changes, auto-merge, or branch refresh. Human maintainer approval and normal PR CI are required.

---

Open workspace in Conductor

[bokelley]

Exact-head manual interop evidence

The existing workflow_dispatch entry point was run against exact head 708ebf533ec6ce80552b517d8c99c604f9fa3e23: Reference Seller Interop run 34809412775. The workflow and all six jobs concluded successfully.

• Current-checkout TypeScript seller: 33 passed, 0 failed, 13 skipped.
• Go reference seller: 79 passed, 0 failed, 20 skipped.
• Strict TypeScript AdCP 3.0 seller: 2 passed, 0 failed.
• External TypeScript and Python seller lanes completed with their workflow-designated advisory warnings for existing response-fixture/schema mismatches; those failures do not exercise or implicate this PR's selector change.

This closes the exact-head interop evidence gap only. The 13.x branch is still excluded from automatic full Test & Build and CodeQL PR workflows, so those gates, human maintainer approval, and the explicit stable-13.x release/dist-tag decision remain required before merge or release.

[bokelley]

Published 13.x prerequisite stack

The maintenance-branch safety prerequisites are now published as Draft PRs:

1. fix(deps): remediate transitive audit advisories #2891 — dependency advisory repair, exact head e7ab513f0e5603fef3d754b0c128cbfc008bb4bd.
2. ci(13.x): use checked-in registry schema for generated checks #2892 — deterministic registry generation from the checked-in snapshot, exact head ed30537c3222515b96613fbf7bb8318bbc65cbb4.
3. ci(13.x): run CI, CodeQL and interop on the maintenance branch #2893 — run CI, CodeQL, and interop for 13.x maintenance PRs, exact head 63a5b5e0d4815d2c24f2fb76e2b1258b393f5d71.

All three remain Draft, auto-merge off, and awaiting genuine human maintainer review. The workflow PRs cannot self-prove their new 13.x pull-request triggers because their base workflows exclude 13.x; their local and independent evidence is recorded on the PRs.

Do not refresh or merge this PR yet. After #2891 → #2892 → #2893 lands, push/rebase this PR onto the resulting 13.x tip so the newly enabled exact-head CI, CodeQL, and automatic interop checks run. Human administrators should extend branch protection only after observing the exact emitted check names on that refreshed head.

[aao-secretariat]

Ladon verdict: Approve

Approve.

PR #2890 aligns comply()'s capability-driven suite selection with the storyboard runner's any-of required_tools semantics. The extracted partitionStoryboardsByRequiredTools now excludes a storyboard only when none of its required tools are discovered, matching the runner (runner.ts:2547) rather than the prior stricter all-of filter. Correct fix, well-tested with three cases (no-tools, any-of exclusion, cross-agent unions), and shipped with an appropriate patch changeset.

No blocking, Medium, or load-bearing Low findings. Not high-risk, no gated paths, no author team gate. Falls through to row 9.