From 73c41368f4a01b52fda8ae3acbecbe71087ea630 Mon Sep 17 00:00:00 2001
From: Brian O'Kelley <bokelley@scope3.com>
Date: Mon, 17 Aug 2026 00:34:45 +0200
Subject: [PATCH 1/3] chore(deps): update @adcp/sdk to 13.0.0

---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 2ed3ed9bdf..1c2fb37b61 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,7 +8,7 @@
       "name": "adcontextprotocol",
       "version": "3.1.1",
       "dependencies": {
-        "@adcp/sdk": "13.0.0-rc.26",
+        "@adcp/sdk": "13.0.0",
         "@anthropic-ai/sdk": "^0.115.0",
         "@asteasolutions/zod-to-openapi": "^8.5.0",
         "@contentauth/c2pa-node": "^0.8.3",
@@ -131,9 +131,9 @@
       }
     },
     "node_modules/@adcp/sdk": {
-      "version": "13.0.0-rc.26",
-      "resolved": "https://registry.npmjs.org/@adcp/sdk/-/sdk-13.0.0-rc.26.tgz",
-      "integrity": "sha512-EKHz3GaqhNdtrcWvhvdSPDLppsdaQ7kmvyHbnnGzRV/ENuusupGX+wOJcOYJv2KrKq3fyi0UyYR8gF2Vd5N8OQ==",
+      "version": "13.0.0",
+      "resolved": "https://registry.npmjs.org/@adcp/sdk/-/sdk-13.0.0.tgz",
+      "integrity": "sha512-Hrqd0wStEQNaY6ehHT1bfOvbSOk2OXNYBt7j+2fVUFmkJqGkfdn1TFucmtTsLlxz6yzD+/wWi6kfD7u5qeEo7A==",
       "license": "Apache-2.0",
       "workspaces": [
         ".",
diff --git a/package.json b/package.json
index 058ddff60b..08c44020be 100644
--- a/package.json
+++ b/package.json
@@ -158,7 +158,7 @@
     "docs:json-field-audit": "node scripts/docs-json-field-audit.cjs"
   },
   "dependencies": {
-    "@adcp/sdk": "13.0.0-rc.26",
+    "@adcp/sdk": "13.0.0",
     "@anthropic-ai/sdk": "^0.115.0",
     "@asteasolutions/zod-to-openapi": "^8.5.0",
     "@contentauth/c2pa-node": "^0.8.3",

From 6482026821d2fa25ab5a48eedc945d2f141141ba Mon Sep 17 00:00:00 2001
From: Brian O'Kelley <bokelley@scope3.com>
Date: Mon, 17 Aug 2026 00:40:12 +0200
Subject: [PATCH 2/3] fix(compliance): register package-only 3.1.15 bundle

---
 static/compliance/published-versions.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/static/compliance/published-versions.json b/static/compliance/published-versions.json
index 5abe25c723..3c625b82c1 100644
--- a/static/compliance/published-versions.json
+++ b/static/compliance/published-versions.json
@@ -2,7 +2,7 @@
   "schema_version": 1,
   "description": "Compliance bundles available from a published @adcp/sdk npm package. Hosted grading must use published_versions; package_only_versions are SDK opt-in surfaces that are not hosted protocol releases.",
   "npm_tags": ["adcp-3.0", "latest", "rc"],
-  "package_only_versions": ["3.2.0"],
+  "package_only_versions": ["3.1.15", "3.2.0"],
   "published_versions": [
     "3.0.0",
     "3.0.1",

From 4335ae4805d975b202b3e8eeac68ef184919344e Mon Sep 17 00:00:00 2001
From: Brian O'Kelley <bokelley@scope3.com>
Date: Mon, 17 Aug 2026 00:48:43 +0200
Subject: [PATCH 3/3] test(compliance): exercise SDK 13 portfolio validation

---
 tests/portfolio-routing-scope.test.cjs | 58 ++++++++++++++------------
 1 file changed, 32 insertions(+), 26 deletions(-)

diff --git a/tests/portfolio-routing-scope.test.cjs b/tests/portfolio-routing-scope.test.cjs
index 5d29e3fd5f..6c211f5c97 100644
--- a/tests/portfolio-routing-scope.test.cjs
+++ b/tests/portfolio-routing-scope.test.cjs
@@ -44,30 +44,36 @@ test("portfolio routing scope is authoritative when present and advisory in 3.2"
     1
   );
 
-  const [legacyRunnerResult] = runValidations(
-    [
-      {
-        check: "all_fields_in_context_array",
-        path: "products[*].channels[*]",
-        context_key: "portfolio_channels",
-        description: "Every product channel stays within declared scope",
-      },
-    ],
-    {
-      taskName: "get_products",
-      taskResult: {
-        success: true,
-        data: { products: [{ channels: ["display"] }] },
-      },
-      agentUrl: "https://seller.example",
-      contributions: new Set(),
-      storyboardContext: { portfolio_channels: ["display"] },
-    }
-  );
-  assert.equal(legacyRunnerResult.passed, true);
-  assert.equal(
-    legacyRunnerResult.not_applicable,
-    true,
-    "pre-implementation SDKs must skip the additive check, not false-fail it"
-  );
+  const validation = {
+    check: "all_fields_in_context_array",
+    path: "products[*].channels[*]",
+    context_key: "portfolio_channels",
+    description: "Every product channel stays within declared scope",
+  };
+  const runnerContext = {
+    taskName: "get_products",
+    agentUrl: "https://seller.example",
+    contributions: new Set(),
+    storyboardContext: { portfolio_channels: ["display"] },
+  };
+
+  const [inScopeRunnerResult] = runValidations([validation], {
+    ...runnerContext,
+    taskResult: {
+      success: true,
+      data: { products: [{ channels: ["display"] }] },
+    },
+  });
+  assert.equal(inScopeRunnerResult.passed, true);
+
+  const [outOfScopeRunnerResult] = runValidations([validation], {
+    ...runnerContext,
+    taskResult: {
+      success: true,
+      data: { products: [{ channels: ["audio"] }] },
+    },
+  });
+  assert.equal(outOfScopeRunnerResult.passed, false);
+  assert.deepEqual(outOfScopeRunnerResult.expected, ["display"]);
+  assert.deepEqual(outOfScopeRunnerResult.actual, ["audio"]);
 });