feat(governance): complete cross-role conformance for 3.2

[bokelley]

Summary

• complete exact task/mode-gated governance conformance across media buying, signals, brand rights, and paid creative
• add accepted and denied signed-authorization proofs plus a universal governance discoverability index
• align reference tenants with their advertised capabilities, canonical schemas, durable state, and side-effect evidence

Root cause

AdCP 3.2 had the governance primitives, but conformance and reference enforcement remained incomplete outside the earlier media-buy and signals work. Coverage still relied on coarse gating and denial-heavy scenarios instead of exact capability gates and end-to-end accepted execution proofs.

Impact

Services are now graded only for the exact tasks and modes they advertise. Enforcing implementations must prove signed authorization, durable or side-effect evidence after accepted execution, and fail-closed rejection for unauthorized execution.

Validation

• full npm test
• repository pre-commit suite
• current and 3.0 compatibility storyboard matrices
• focused cross-tenant signed-token integration coverage
• code and protocol expert reviews

Closes #3086

[aao-secretariat]

Ladon verdict: Approve

Approve — additive AdCP 3.2 governance-conformance PR with 2 medium findings, no blocking issues.

What I checked:

• No changes under static/schemas/source/** or dist/** — no wire drift, oneOf discriminator, or immutability exposure. Schema↔docs coherence gate not triggered.
• Changeset present and correct (.changeset/close-3-2-governance-loop.md), scope appropriate for the protocol/compliance surface touched.
• Additive proofs (capability-gated approved/denied for signals, brand-rights, creative-transformers), a non-executable cross-role governance index, a new field_greater_than check kind, and reference-agent enforcement changes. All well-tested.
• high_risk is true only via docs/reference/migration/cross-role-governance-enforcement.mdx (modified). No medium-or-higher finding lands on that file, so the modification is presumed safe (row 5 does not fire). No deletions in high-risk paths.
• gated_paths is false; no no-auto-approve team match.

Decision path: No critical/high findings (row 1 no). gated_paths false (row 2 no). No (deleted) high-risk reason (row 3 no). Both mediums are category auth-divergence / test-coverage — not data-loss/schema/infra (row 4 no). The two mediums do not land on the modified high-risk file (row 5 no). No prior escalation (row 6 no). No team gate (row 7 no). Only 2 medium findings, fewer than 3 (row 8 no). Falls through to row 9 → approve.

Medium findings (non-blocking):

• server/src/training-agent/v6-creative-platform.ts:104 — authInfo.kind divergence on null-ref sandbox path vs sales precedent.
• server/src/training-agent/task-handlers.ts:10184 — media-buy denied/conditions governance proofs no longer run against any reference tenant (coverage follow-up).

Medium findings

• server/src/training-agent/v6-creative-platform.ts:104 — authInfo.kind divergence on null-ref sandbox path vs sales precedent
• server/src/training-agent/task-handlers.ts:10184 — Media-buy denied/conditions governance proofs no longer run against any reference tenant

[bokelley]

Follow-up on the review summary’s media-buy coverage note: the reference sales tenant intentionally advertises signed_context only, so governance_conditions and governance_denied—which require both signed_context and online_execution_check—must grade not applicable for it. Advertising the online mode would overclaim behavior because this tenant verifies signed authorization locally rather than calling the governance provider during execution. Commit 7e1043b adds a runner regression that locks this exact mode boundary; the signed-context approved path and direct runtime rejection/tamper coverage continue to exercise the reference tenant.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean subsequent review, both prior medium findings resolved or out of scope.

This is a follow-up push to a prior approve. The two prior medium findings are cleared:

• Prior #1 (v6-creative-platform.ts:104 — authInfo.kind divergence on null-ref sandbox path): resolved. v6-brand/creative/creative-builder platforms now return authInfo { kind: 'public', ...principal } matching the sales precedent at v6-sales-platform.ts:391, with a new tenant-smoke test locking the shape.
• Prior #2 (task-handlers.ts:10184 — media-buy governance proofs): absent from the delta and skipped per scope rules.

The current run surfaces no new findings. Reviewer also added coverage in sdk-runner-capability-gates.test.cjs for signed-context-only media-buy sellers skipping the conditions proof as capability_unsupported.

Gate checks:

• No author no-auto-approve team match.
• gated_paths: false — path gate not engaged (REVIEW_REQUIRED does not force escalate when gated_paths is false).
• high_risk: true only via docs/reference/cross-role-governance-enforcement.mdx (modified) with no medium-or-higher finding on it → presumed safe per high-risk-flag reading; not a deletion.
• Prior decision was approve, not escalate, so sticky-escalation (row 6) does not apply.
• Zero medium findings → rows 1, 8 do not fire.

No blocking or medium findings; none of rows 1–8 fire → row 9 approve.