test(comply): regression guard for extractFailures attribution parity (#1708)

.changeset/comply-storyboard-parity-guard-1708.md

@@ -0,0 +1,44 @@
+---
+'@adcp/sdk': patch
+---
+
+test(comply): regression guard for storyboard-runner ↔ comply aggregation parity (#1708)
+
+Locks the post-7.1.0 attribution invariants so future refactors of
+`comply()`'s `extractFailures` aggregation can't silently reintroduce the
+BidMachine misattribution shape (adcp#4419).
+
+What's locked:
+
+- A storyboard step carrying both a synthesized `response_schema` failure
+  (prepended by the runner per #1709 / PR #1712) and an `assertion` entry
+  surfaces `validation.check === 'response_schema'` in
+  `ComplianceResult.failures` — never `'assertion'`. This is the
+  attribution that was silently broken pre-7.1.0 (Zod rejects fell
+  through to the next invariant, canonically `context.no_secret_echo`).
+
+- Skipped-invariant markers (`passed: true` entries the runner emits when
+  short-circuiting invariants downstream of a schema failure per #1712)
+  are correctly filtered out — only failed validations surface in
+  `failures`. A future change that included `passed: true` entries would
+  crowd out the real failure.
+
+- A clean BidMachine-shape response (structured `authorization` field on
+  passing `no_secret_echo` per #1713 / PR #1714) produces zero failures
+  through the aggregation layer.
+
+- Multi-storyboard aggregation preserves per-storyboard
+  `(storyboard_id, step_id, validation.check)` tuples — A failed, B clean,
+  C failed produces exactly two `failures` entries with stable attribution.
+
+API change (minor): `extractFailures` (previously file-internal) is now
+`export`-ed from `src/lib/testing/compliance/comply.ts` so the regression
+test can call it directly with synthetic `StoryboardResult` fixtures.
+Functionally identical; just visibility.
+
+Scope correction relative to the original #1708 framing: the
+"cross-evaluator divergence" symptom was version-driven (different
+`@adcp/sdk` versions hitting #1713 and #1709 differently), not a true
+parity gap between `comply()` and `runStoryboard()`. Both root causes
+shipped in 7.1.0; this test is the durable guard for the
+aggregation-layer invariants those fixes depend on.

src/lib/testing/compliance/comply.ts

@@ -698,8 +698,17 @@ function buildNotApplicableStoryboardResult(agentUrl: string, na: NotApplicableS
  * Extract a flat list of failures from raw storyboard results.
  * Preserves step_id and expected text from the storyboard YAML,
  * and includes a fix_command for targeted re-running.
+ *
+ * Exported so the parity-guard test (adcp-client#1708) can call it directly
+ * with synthetic `StoryboardResult` fixtures and assert that
+ * `ComplianceResult.failures` preserves the per-storyboard
+ * `(storyboard_id, step_id, validation.check)` attribution from
+ * `runStoryboard()`. The post-fix invariant we're locking: a `response_schema`
+ * failure on a step always surfaces as `validation.check === 'response_schema'`
+ * here (never as `'assertion'`), so the aggregation layer can't silently
+ * reorder failures and reintroduce the BidMachine misattribution shape.
  */
-function extractFailures(
+export function extractFailures(
   results: StoryboardResult[],
   storyboards: Storyboard[],
   agentRef: string

src/lib/version.ts

@@ -4,7 +4,7 @@
 /**
  * AdCP SDK library version
  */
-export const LIBRARY_VERSION = '7.0.0';
+export const LIBRARY_VERSION = '7.1.0';
 
 /**
  * AdCP specification version this library is built for
@@ -59,10 +59,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export const VERSION_INFO = {
-  library: '7.0.0',
+  library: '7.1.0',
   adcp: '3.0.11',
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: '2026-05-12T01:00:50.163Z',
+  generatedAt: '2026-05-12T14:47:55.363Z',
 } as const;
 
 /**