fix(compliance): set aside unadvertised request signing in Strict Spec - #8952

Refs #8534

No Strict Spec verdict changes today. webhook-emission, webhook-receiver-envelope and idempotency (hosted runner and test-kit gaps) keep every hosted agent partial. 3.1 media-buy sellers also keep their declined-capability bundles until the SDK change below ships. This PR removes one universal blocker for every agent that does not sign requests, and makes the saved run list the bundles that block Strict.

Problem

Strict Spec (strict-complete-bundles in server/src/services/verification-profile-assessment.ts) counts every relevant partial or untested bundle as incomplete. #8534 lists 19 such bundles for a media-buy 3.1 seller whose executed checks all pass. Most of them are now covered elsewhere:

signed_requests "runs for any agent advertising request_signing.supported: true". For other agents, "absence of advertisement is not a failure" (signed-requests.yaml, every release since 3.0.1). The runner reports this as requirement_unmet:request_signer (skip_reason: not_applicable, requirement: request_signer). The SDK grades it partial on every release, so every agent that does not sign requests has an incomplete universal bundle.

Changes

server/src/services/verification-profile-request-signing.ts (new)

requestSigningNotAdvertised(result) is true only when all of these hold; the assessment then sets signed_requests aside:

• the agent's raw capabilities are present and do not declare request_signing.supported: true;
• the storyboard was executed and is not in storyboards_missing_tools;
• no failure or storyboard-assertion-failed observation names it;
• its only projected result is the runner's single unmet-signer row, with no validations.

Any other unmet requirement, test-kit gap or fixture gap stays a coverage gap (runner-output-contract.yaml > skip_result).

server/src/services/verification-profile-assessment.ts

• A universal bundle left partial only by fix(compliance): stop Strict counting undeclared universal surfaces as incomplete (#8527) #8824's undeclared surfaces or by this rule is reported in not_applicable_universal_bundle_ids.
• The evidence gains incomplete_bundle_ids (kind:id). Only a count was stored before, so the saved run did not say which bundles block Strict.

server/src/services/verification-profile-tool-obligations.ts

Exports record() for reuse.

server/src/schemas/registry.ts, static/openapi/registry.yaml

Document incomplete_bundle_ids and the widened not_applicable_universal_bundle_ids. The OpenAPI file is regenerated.

docs/building/verification/how-grading-works.mdx

Adds one "Pass vs partial coverage" row for signed_requests, noting that other unmet runner requirements still count as incomplete. The next row now excepts both the controller and request_signer rows.

Tests

server/tests/unit/verification-profile-request-signing.test.ts models the #8534 agent: media-buy, sales-non-guaranteed, supported_protocols: ["media_buy"], no wholesale feed, request signing, audience targeting or reach metrics. Gate rows come from the SDK's own runStoryboard (with a client that fails if called) and its track projection. Bundle statuses come from buildComplianceBundleResults on the real 3.1.29 and 3.2.10 catalogs.

• 3.1.29 issue run: signed-requests and fix(compliance): stop Strict counting undeclared universal surfaces as incomplete (#8527) #8824's six bundles are set aside. incomplete_bundle_ids lists the five wholesale-feed-* bundles, webhook-emission, webhook-receiver-envelope, idempotency and protocol:media-buy.
• 3.2.10 run with the runner gaps closed: Strict passes. The SDK sets aside the declined capability gates; this PR sets aside signed-requests.
• Fail-closed guards, each checked against the positive case:
  • the agent advertises signing;
  • raw capabilities are missing;
  • a different requirement;
  • the storyboard is also listed as missing tools;
  • a recorded failure;
  • a storyboard-scoped assertion failure;
  • a step ran beside the row;
  • validations on the row;
  • the storyboard was not executed;
  • an unmet-signer row on another storyboard.
• All 12 tests fail without the assessment change. Removing any single guard fails its test.
• Related suites: 17 files, 298 tests pass. The server typecheck, link-compliance-symbols --check and the changeset scope check pass. Committed with HUSKY=0; CI is authoritative for the full suite.

Changeset

None: server and non-normative docs only. The protocol-scope check passes.

Out of scope / follow-ups

• SDK: the companion adcp-client change fix(compliance): apply the capability rollup to AdCP 3.1.24+ bundles adcp-client#3699 applies the declined-capability rollup to 3.1.24+ bundles. Until it ships and hosted pins it, 3.1 sellers keep wholesale-feed-* and protocol bundles with declined scenarios incomplete. The test asserts the current SDK verdicts on purpose, so the SDK bump trips it.
• signed_requests source (maintainer option): this rule could be paired, in this PR or next to it, with a root requires_capability: {path: request_signing.supported, equals: true} in signed-requests.yaml. The fix(registry): pick JWKS per-token from iss claim, not WORKOS_CLIENT_ID #2960 rollup then neutralizes it from the next release, so SDK and hosted agree there. Released 3.1/3.2 bundles still need this server rule.
• Hosted runner: webhook_emission, webhook_receiver_envelope and the idempotency rate-limit phase need a webhook receiver, a replay receiver and the rate-limit test kit. A maintainer could also decide that webhook_receiver_envelope ("not for seller endpoint grading") does not apply to seller roles. Until then no hosted agent reaches Strict.
• The observation-only shadow (verification-profile-shadow.ts) is not aligned, as in fix(compliance): stop Strict counting undeclared universal surfaces as incomplete (#8527) #8824. Dashboard wording is Strict Spec card shows a hypothetical now+48h grace deadline as if it were running #8535. Hosted compliance grader fails controller-seeded storyboards for sellers without comply_test_controller (regression since SDK 17) #8576 is separate.

🤖 Generated with Claude Code