fix(addie): grade_agent_signing auto-skips capability-profile mismatches

[bokelley]

Summary

When the first end-to-end grade demo ran in prod Slack, Addie reported 31 pass / 2 fail / 6 skip against https://test-agent.adcontextprotocol.org/mcp-strict and diagnosed the 2 fails as real verifier bugs. They aren't:

• Vector 007-missing-content-digest tests that an agent declaring covers_content_digest: 'required' rejects digest-less signatures.
• Vector 018-digest-covered-when-forbidden tests that an agent declaring covers_content_digest: 'forbidden' rejects digest-covering signatures.

/mcp-strict declares covers_content_digest: 'either', so both vectors are testing modes the agent didn't promise to enforce. The in-process gradeRequestSigning() has an agentCapability option that auto-skips these as capability_profile_mismatch; the CLI surface doesn't expose it.

This wrapper now does the equivalent CLI-side:

• Anonymously probes get_adcp_capabilities for request_signing.covers_content_digest.
• Maps mode → inapplicable vectors and passes --skip <ids> to the CLI.
• Exposes a content_digest_mode parameter for routes where the anonymous probe is auth-gated.
• Probe-failure path preserves today's no-skip behavior — better to over-report than silently swallow a real verifier bug.

Result

Against https://test-agent.adcontextprotocol.org/mcp-strict:

	passed	failed	skipped
Before	31	2 (false)	6
After (mode='either')	31	0	8

The 2 extra skips are correctly classified as capability-profile mismatches.

Follow-ups

• The in-process gradeRequestSigning() does richer capability-aware skipping than just content-digest. Long-term the right fix is to upstream a --auto-skip-capability-mismatches flag to @adcp/client's CLI so this wrapper doesn't need to maintain a hardcoded vector→mode map.
• The probe is anonymous today. For auth-gated routes (test agent's strict variants) it falls back to no-skip unless the caller passes content_digest_mode. Could plumb evaluate_agent_quality's resolveAgentAuth here so saved credentials drive the probe automatically.

Test plan

• npx vitest run tests/unit/auth-grader-tools.test.ts — 10 tests pass (was 6; new contentDigestSkipsForMode cases for null / either / required / forbidden).
• Server typecheck clean.
• CLI grade against /mcp-strict with --skip 007-...,018-... produces 31 pass / 0 fail / 8 skip against prod test agent.
• After deploy: re-run the Slack demo with content_digest_mode: either and confirm clean report.

🤖 Generated with Claude Code