fix(compliance): correct wire-placement assertions in governance denial storyboards

[bokelley]

Closes #3998

Summary

The brand_rights/governance_denied storyboard scenario was asserting expect_error: true + check: error_code, value: GOVERNANCE_DENIED on acquire_rights. Per the GOVERNANCE_DENIED wire-placement rule (landed in #3929), tasks that define a structured rejection arm MUST use that arm — not errors[]. AcquireRightsRejected carries not: { required: [errors] } at the schema layer, so the prior storyboard was grading a schema-violating response shape as passing for any brand agent that had run the brand_rights specialism suite.

What changes:

1. brand_rights/scenarios/governance_denied.yaml — fixes Case 1 (acquire_rights):

   • Removes expect_error: true and negative_path: payload_well_formed
   • Adds expected_arm: "rejected" for correct path-resolution lint scoping
   • Replaces check: error_code, value: GOVERNANCE_DENIED with rejection-arm assertions:
     • check: response_schema — enforces not: { required: [errors] } on the Rejected arm
     • check: field_value path: status value: rejected — arm discriminator
     • check: field_present path: reason — governance findings propagated
     • check: field_absent path: errors — explicit dual-emission guard
     • check: field_value path: context.correlation_id — context echo

2. media-buy/scenarios/governance_denied.yaml — documents Case 2 (create_media_buy):

   • Updates expected: block to document the Case-2 wire-placement rule explicitly (no rejection arm → errors[].code + adcp_error.code, transport failure markers flip)
   • Updates error_code description to reference the two-layer model

Non-breaking justification: Both changes are purely in storyboard YAML assertions. They correct incorrect test expectations to match spec-required behavior; no schema, task definition, or protocol surface is changed.

Case 3 (negative/violation test) — deferred: The issue also requested a fixture that populates both the rejection arm AND errors[] and asserts schema validation rejects it. This cannot be implemented as a live storyboard step (the runner has no mechanism to force a seller to emit an invalid response shape). It belongs as a test vector in static/compliance/source/test-vectors/acquire-rights-response/negative/ and is tracked for a follow-up.

Pre-PR review:

• ad-tech-protocol-expert: approved — wire-placement rule enforcement is protocol-correct; adcp_error absent on rejection-arm responses is normative per protocol-envelope.json; expected_arm: "rejected" added per authoring guide
• code-reviewer: approved — YAML valid; field_absent is in authored_check_kinds; field_present: errors dropped from media-buy scenario in favor of the existing shape-agnostic error_code check

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_01QW7uzhT3g9LEVMX9y6Ew1R

---

Generated by Claude Code

[bokelley]

Audit pass complete (per request before merge). Surveyed every storyboard mentioning GOVERNANCE_DENIED or living under a governance_denied.yaml filename:

File	Task	Schema arms	Case	Status
protocols/media-buy/scenarios/governance_denied.yaml	create_media_buy	Success/Error/Submitted	Case-2 (no rejection arm)	fixed in this PR
specialisms/brand-rights/scenarios/governance_denied.yaml	acquire_rights	Acquired/PendingApproval/Rejected/Error	Case-1 (rejection arm)	fixed in this PR
specialisms/signal-marketplace/scenarios/governance_denied.yaml	activate_signal	Success/Error (no rejection arm)	Case-2	already correct
protocols/media-buy/scenarios/governance_denied_recovery.yaml	create_media_buy	Success/Error/Submitted	Case-2	already correct
specialisms/governance-aware-seller/index.yaml	(narrative only)	—	—	not affected

The two files this PR touches are the only governance-denial storyboards that needed wire-placement corrections.

Adjacent finding (out of scope): the acquire_expired_rights step in specialisms/brand-rights/index.yaml uses a generic check: error_code against acquire_rights which has both AcquireRightsError and AcquireRightsRejected arms. The test is for business-rule rejection (expired campaign dates), likely intentionally targeting the Error arm, not the Rejected arm — but the assertion doesn't pin which. Worth a separate look-over but not this PR.

[bokelley]

Audit confirmed — the two files this PR touches are the only governance-denial storyboards that needed wire-placement corrections. Scope is clean.

Adjacent finding noted (acquire_expired_rights → acquire_rights assertion in specialisms/brand-rights/index.yaml not pinning Error vs Rejected arm). Out of scope here; worth a standalone issue to track the arm-disambiguation gap before the next compliance sweep.

---

Generated by Claude Code