feat: AdCP 3.0.12 + denial gate + silent assertion status + size-limit wrap

[bokelley]

Bundle of four Bucket-A triage closures from session 2026-05-17. Each commit is a self-contained close.

#1522 — AdCP 3.0.12 + comply_controller_mode_gate denial gate

Adopts the new universal storyboard from adcp#4028 as a graded path on hello_seller_adapter_guaranteed. The bump unblocks the storyboard end-to-end against framework-gated sellers; the SDK changes close wire-level gaps surfaced during integration.

• ADCP_VERSION 3.0.11 → 3.0.12; sync-schemas pulls the new universal storyboard + test-kit fixture.
• Framework gate echoes context/ext on FORBIDDEN refusal (from-platform.ts). The denial storyboard asserts context.correlation_id round-trips on refusal — previously the gate dropped them.
• rawMcpProbe parses Streamable-HTTP MCP SSE responses (probes.ts). Sends Accept: application/json, text/event-stream + parses the SSE data: line. Storyboards routed via the raw probe now grade against Streamable-HTTP MCP servers; previously the probe 406'd silently. Unit test added.
• adcp storyboard run --test-kit PATH (bin/adcp.js) — loads the test-kit YAML into options.test_kit so from_test_kit: true / $test_kit.* references resolve from the CLI.
• Worked example wires the live-mode probe principal (hello_seller_adapter_guaranteed.ts). Registers demo-acme-outdoor-live-v1 as a second bearer; resolver stamps mode: 'live' to trigger the gate.
• CI gate added via new extraStoryboards parameter on runHelloAdapterGates.

#1524 — mock-server-authority anchor

Replaces SDK-author "mock is the impartial referee" prose with a forward link to the spec's normative triage section (Mock-server authority and failure triage, landed in adcp#4030). Touches docs/proposals/lifecycle-state-and-sandbox-authority.md, CLAUDE.md, and bin/adcp.js (mock-server help).

#1797 — AssertionResult.status: 'silent' | 'pass' | 'fail'

status.monotonic and impairment.coherence now stamp status: 'silent' on the onEnd summary record when zero lifecycle resources were observed, and status: 'pass' once at least one was. Downstream renderers (the spec-side grader at adcp#2834, Addie, CLI summary) read this per-assertion enum directly rather than inferring from observation_count === 0. Track-level rollup unchanged. Tests added for both invariants.

#1799 — getAgentInfo() honors transport.maxResponseBytes

transport.maxResponseBytes was dormant on the discovery path: mcpClient.listTools() and A2AClient.fromCardUrl bypassed the ALS slot, so a hostile vendor could return arbitrarily large discovery payloads against a size-capped client. getAgentInfo now wraps both call sites in withResponseSizeLimit, and the A2A auth-stamping fetchImpl is composed through wrapFetchWithSizeLimit. Regression test added at test/unit/get-agent-info-size-limit.test.js.

Test plan

• npm run format:check clean
• npm run build clean
• node --test test/examples/hello-seller-adapter-guaranteed.test.js — 4/4 pass (denial gate green)
• node --test test/lib/storyboard-security.test.js — 23/23 suites pass, new SSE rawMcpProbe test green
• node --test test/lib/storyboard-default-invariants.test.js — 146/146 pass
• node --test test/unit/a2a-card-size-limit.test.js test/unit/mcp-tool-size-limit.test.js test/unit/oauth-size-limit.test.js test/unit/response-size-limit.test.js test/unit/get-agent-info-size-limit.test.js — 32/32 pass
• CI green

Closes #1522, #1524, #1797, #1799.

🤖 Generated with Claude Code

[bokelley]

Expert review (2026-05-17)

Three reviews in parallel (code-reviewer + security-reviewer + ad-tech-protocol-expert) on the initial four-commit bundle. Convergent finding addressed in commit `fa25a6f6`; additional defense-in-depth follow-ups from the security review applied in the same commit.

Convergent finding (fixed)

rawMcpProbe SSE parser took only the first `data:` line. MCP Streamable HTTP allows server-initiated frames (e.g. `notifications/progress`) before the final `tools/call` response on the same SSE stream. The probe would parse the progress envelope and grade the storyboard against the wrong payload.

Fix in `src/lib/testing/storyboard/probes.ts`: walk all `data:` lines, JSON-parse each, select the envelope whose `id` matches the request, fall back to the last parseable envelope otherwise. New unit test in `test/lib/storyboard-security.test.js` asserts the progress-frame-before-result ordering.

Defense-in-depth nits (applied)

• Comply gate context/ext echo cap. Open-object fields on the request schema could be stuffed with arbitrary payloads. Self-reflection only (no cross-tenant amplifier), but bounded at 8 KiB serialized to prevent the gate from being a self-amplifier (`from-platform.ts`).
• Bearer JSDoc warning on the worked-example `demo-acme-outdoor-live-v1` token, callout that it's published in the open-source SDK and the public compliance test-kit and MUST NOT be copied into a production seller's keys map (`hello_seller_adapter_guaranteed.ts`).

Out-of-scope gaps filed as follow-ups

• Wrap fetchA2ACanonicalUrl + other A2A discovery sites in withResponseSizeLimit #1804 — `fetchA2ACanonicalUrl` and other A2A discovery sites still bypass `transport.maxResponseBytes` (PR feat: AdCP 3.0.12 + denial gate + silent assertion status + size-limit wrap #1802 only scoped `getAgentInfo` per withResponseSizeLimit doesn't wrap getAgentInfo / mcpClient.listTools — tools/list body uncapped #1799).
• Implement force_scenario_unsupported runner detection (AdCP 3.0.12 runner-output-contract) #1805 — `force_scenario_unsupported` runner-MUST from AdCP 3.0.12 `runner-output-contract.yaml` not yet implemented.

Reviewer-flagged but accepted as-is

• `AssertionResult.status` is ahead of the spec (adcp#2834 is open). Field-name collision risk is low; flagging in case spec lands with a different shape.
• `ctx.authInfo.token` is `@deprecated` in `ResolvedAuthInfo`; used in the worked example for principal detection. Comment explicitly directs production sellers to `credential.key_id` or a tenant-store lookup.