[EvgenyAndroid]

Summary

• Backport the required_tools OR-gate fixes to the 3.1 maintenance line, which both registry cards grade on today (3.1.20).
• fix(compliance): drop get_adcp_capabilities from required_tools across 17 storyboards (OR-gate bug) #6774 (a1e72ec) removed get_adcp_capabilities from required_tools on 17 storyboards on main. Four of them exist on 3.1.x; this carries those four — billing_gate_dispatch, billing_out_of_band, canonical_supported_formats, evaluator_auth — and its changeset. billing_gate_dispatch is the one visible on a card: 1/2 on the signals agent, whose sync_accounts step fails because the gate admitted the storyboard on get_adcp_capabilities alone.
• Plus the canonical_format_validate_input fix from fix(compliance): drop comply_test_controller from canonical_format_validate_input required_tools (OR-gate) #7405: drop comply_test_controller from its required_tools (17 spurious failures on each of two cards).

Deliberate exclusions

• The 13 fix(compliance): drop get_adcp_capabilities from required_tools across 17 storyboards (OR-gate bug) #6774 storyboards that do not exist on 3.1.x (account timezone, budget-cap timezone, geo region/place targeting, portfolio routing, native localization, agent notification configs). Nothing to fix there on this line.
• No version bumps, no dist artifact changes, no 3.2 material.

Provenance

Cherry-picked with -x from main a1e72ec (#6774), with the 13 absent files dropped from the pick, then the companion fix commit. Net diff: five one-line required_tools removals and two changesets.

Validation

• node --test tests/lint-compliance-source-authority.test.cjs on this branch — 6/6.
• tests/lint-compliance-packaged-refs.test.cjs needs the installed toolchain; relying on CI for it.

Refs #7404 (bug 1 and the billing_gate_dispatch note), #6773, #6774.

[aao-secretariat]

(non-blocking) This changeset text is carried verbatim from #6774 on main and overstates this backport. This PR fixes 4 storyboards, not 17: billing_gate_dispatch, billing_out_of_band, canonical_supported_formats, evaluator_auth. Line 7 then names agent_notification_configs — which the PR body explicitly lists under Deliberate exclusions as not existing on 3.1.x — and "15 scenarios across the media-buy and creative protocol families," but zero media-buy scenarios are touched here. The 3.1.x changelog will claim fixes it did not ship. Reword to the four files actually changed on this line.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean backport with no blocking or medium findings.

This is a complete backport of the required_tools OR-gate fixes to 3.1.x: five one-line removals across four storyboards plus canonical_format_validate_input, matching precedent #6774. The reviewer verified scope completeness (signed-requests.yaml correctly retains get_adcp_capabilities as its sole gate), OR-gate semantics against the SDK runner tests, and confirmed no wire/schema surface is touched.

The single non-blocking observation is that the fix-storyboard-required-tools-or-gate.md changeset was copied verbatim from main and overstates the backport (references 17 storyboards, agent_notification_configs, and media-buy scenarios not on this line). This is a Low-severity changeset-wording issue where the underlying change is sound, and does not block.

No findings of medium-or-higher severity. high_risk is false, gated_paths is false, no author team gate, no prior decision. Rows 1–8 do not fire → row 9 approve.

[EvgenyAndroid]

@bokelley ready to merge when you have a minute — MERGEABLE, CLEAN, checks green, no source edits beyond five one-line required_tools removals and two changesets.

Why it is worth landing ahead of the main side: 3.1.20 is the line both of my registry cards are graded on today, and these five gates account for 35 of their failing steps — canonical_format_validate_input 17 on each card, billing_gate_dispatch 1 on the signals one. None of them are reachable by anything I can change in either agent.

One thing to confirm rather than assume: this touches static/compliance/source/** only, so the hosted grader picks it up at the next 3.1.x patch cut, not on merge. If there is no cut planned soon, say so and I will stop watching the cards for it.

#7405 (the main half) is sitting on REVIEW_REQUIRED — the Ladon approval does not satisfy it, so it needs a human pass whenever you are in there. Its CI is green now; the first run tripped the /governance and /brand passing-step ratchet, which was the guard working correctly: with the controller off the gate, neither tenant selects that storyboard any more and each loses the one step it contributed. Both floors are down by one in all three places they are pinned, with the reasoning in the PR body.

[EvgenyAndroid]

@bokelley following up on the cut question, now that there is a concrete one to aim at.

#7426 is open and will publish adcontextprotocol@3.1.22, regenerating dist/compliance/3.1.22/** — which is the artifact the hosted grader actually reads. It currently carries a single changeset, 5739f1b (legacy format asset variants), and 3.1.x is one commit ahead of v3.1.21.

Three backports are sitting CLEAN and unmerged against 3.1.x right now:

PR	opened	author
#7406 (this one)	2026-09-10	me
#7424 — single-user context privacy	2026-09-11	you
#7425 — request-aware context caching	2026-09-11	you

If #7426 merges first, all three wait for 3.1.23. Merging them ahead of it puts the whole set in one cut, and for this PR specifically that is the difference between the gate fix existing and the gate fix reaching the line both my cards are graded on — 17 spurious failures per card, on 3.1.20 today.

No urgency beyond the ordering. If 3.1.22 is not the intended target for these, say so and I will stop watching the release PR for it.

Also still open above: this branch has no standing review. Ladon approved the first push and that approval was dismissed by the two follow-up commits, so #7405 (the main half) needs a human pass whenever you are in there. Its CI is green.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean pass, no blocking findings.

No critical/high/medium findings. gated_paths is false and review_decision is APPROVED; no no-auto-approve team match; high_risk is false. Delta since the prior approve is three files: a one-line removal of comply_test_controller from canonical-format-validate-input.yaml required_tools (controller dependency preserved independently via requires: - controller and controller_seeding: true, matching the #6774 OR-gate pattern) plus two accurate patch changesets, one rewritten to correctly scope the backport to the four storyboards present on 3.1.x.

Rows 1–8 do not fire; falls through to row 9 → approve.

[bokelley]

Release coordination hold — please do not merge the current head 36d33b2e.

Current 3.1.x is 8a933dff1078224fc35a444c67267461da9072a1, ahead of the PR's recorded base. An isolated local refresh has been prepared at f625e6cb633fbaebe87cb6ca69162eeaf970992a:

• all three commits and the complete 7-file delta are patch-identical to the reviewed series;
• all five intended required_tools removals are present, including canonical_format_validate_input;
• no release/version/migration/generated-3.1.23 drift;
• 793 tests, typecheck/build, all six maintenance-line tenant floors, and required-storyboard checks passed;
• independent review found no candidate blocker; five runtime failure cases reproduce identically on unchanged 3.1.x.

That candidate is deliberately unpublished. This PR's head branch belongs to EvgenyAndroid/adcp, so any update must target that fork with an explicit lease on 36d33b2e (or be coordinated with the branch owner); pushing an adcp-org branch would not update this PR.

Required order remains:

1. fix(compliance): drop comply_test_controller from canonical_format_validate_input required_tools (OR-gate) #7405 receives genuine human/CODEOWNERS approval and lands on main.
2. Refresh this PR onto then-current 3.1.x, run exact CI, and obtain fresh human approval.
3. Merge fix(compliance): backport required_tools OR-gate fixes to 3.1.x (#6774 subset + canonical_format_validate_input) #7406.
4. Regenerate Version Packages #7486/3.1.23 from that exact tree, sign the new artifact, run exact CI, and obtain human approval.

The current bot approval is not a substitute for human review. No merge, push, or PR-state change is authorized by this note.