From aeda70f05fa02859ff7688194f807c589585ef82 Mon Sep 17 00:00:00 2001 From: Mykola Danyliuk Date: Wed, 24 Jun 2026 11:34:36 +0300 Subject: [PATCH] fix(compliance): default governance_agent_url to seller-local stub (#5665) Option B (alternative) for #5665: point the default governance_agent_url at a seller-served stub instead of the external training agent, removing the counterparty-supplied-URL egress/SSRF surface. Keeps the scenario mandatory; depends on runner support for a controller-self-URL placeholder. Co-Authored-By: Claude Opus 4.8 (1M context) --- .changeset/5665-governance-agent-url-seller-stub.md | 4 ++++ .../media-buy/scenarios/governance_denied.yaml | 10 +++++++++- .../scenarios/governance_denied_recovery.yaml | 10 +++++++++- 3 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 .changeset/5665-governance-agent-url-seller-stub.md diff --git a/.changeset/5665-governance-agent-url-seller-stub.md b/.changeset/5665-governance-agent-url-seller-stub.md new file mode 100644 index 0000000000..31f8422eb1 --- /dev/null +++ b/.changeset/5665-governance-agent-url-seller-stub.md @@ -0,0 +1,4 @@ +--- +--- + +Empty changeset: Default `governance_agent_url` in the `governance_denied` / `governance_denied_recovery` storyboards to a seller-local stub served by the seller's `comply_test_controller`, removing the counterparty-supplied-URL egress/SSRF surface. Alternative to #5665 Option A; depends on runner support for a controller-self-URL placeholder. Addresses #5665 (Option B). diff --git a/static/compliance/source/protocols/media-buy/scenarios/governance_denied.yaml b/static/compliance/source/protocols/media-buy/scenarios/governance_denied.yaml index 224d3a451f..56274cb69b 100644 --- a/static/compliance/source/protocols/media-buy/scenarios/governance_denied.yaml +++ b/static/compliance/source/protocols/media-buy/scenarios/governance_denied.yaml @@ -23,7 +23,15 @@ narrative: | (e.g., via `--context` on `adcp storyboard run` once the CLI supports it). context: - governance_agent_url: "https://test-agent.adcontextprotocol.org" + # Option B (#5665): default the governance agent to a seller-local stub served + # by the seller's own comply_test_controller, instead of the external training + # agent. This removes the counterparty-supplied-URL egress/SSRF surface (the + # seller calls its own controller) and lets sellers without an external + # governance agent still exercise the denial path. NOTE: depends on the runner + # exposing a controller-self-URL placeholder (cf. {{runner.webhook_url:...}}); + # {{runner.controller_url}} does not exist yet — adcp-client support required. + # An explicit --context governance_agent_url still overrides this default. + governance_agent_url: "{{runner.controller_url}}/stub-governance-agent" agent: interaction_model: media_buy_seller diff --git a/static/compliance/source/protocols/media-buy/scenarios/governance_denied_recovery.yaml b/static/compliance/source/protocols/media-buy/scenarios/governance_denied_recovery.yaml index 4dbefa2064..f0b1dc4227 100644 --- a/static/compliance/source/protocols/media-buy/scenarios/governance_denied_recovery.yaml +++ b/static/compliance/source/protocols/media-buy/scenarios/governance_denied_recovery.yaml @@ -24,7 +24,15 @@ narrative: | (e.g., via `--context` on `adcp storyboard run` once the CLI supports it). context: - governance_agent_url: "https://test-agent.adcontextprotocol.org" + # Option B (#5665): default the governance agent to a seller-local stub served + # by the seller's own comply_test_controller, instead of the external training + # agent. This removes the counterparty-supplied-URL egress/SSRF surface (the + # seller calls its own controller) and lets sellers without an external + # governance agent still exercise the denial path. NOTE: depends on the runner + # exposing a controller-self-URL placeholder (cf. {{runner.webhook_url:...}}); + # {{runner.controller_url}} does not exist yet — adcp-client support required. + # An explicit --context governance_agent_url still overrides this default. + governance_agent_url: "{{runner.controller_url}}/stub-governance-agent" agent: interaction_model: media_buy_seller