Add a storyboard exercising rejection-arm vs errors[] mutual-exclusion for GOVERNANCE_DENIED / CREATIVE_REJECTED

[bokelley]

Background

Surfaced during expert review of #3996 (3.0.6 cherry-picks). The wire-placement guidance for `GOVERNANCE_DENIED` (and the parallel rule for `CreativeRejected`) is now MUST-language in `enumDescriptions` and `error-handling.mdx`:

Case 1. Task response defines a structured rejection arm. The arm IS the canonical denial shape. The seller populates `reason` and does NOT additionally emit `GOVERNANCE_DENIED` in `errors[]` or `adcp_error`. The rejection arms enforce this at the schema layer: e.g., `AcquireRightsRejected` and `CreativeRejected` both declare `not: { required: [errors] }`, so dual-emission is already a schema violation.

Case 2. Task response has no rejection arm. The seller populates `errors[].code: GOVERNANCE_DENIED` in the payload AND `adcp_error.code: GOVERNANCE_DENIED` on the envelope.

Today the only mechanism enforcing "rejection arm AND `errors[]` is a violation" is the schema-layer `not: { required: [errors] }` constraint. Conformant agents are protected at validation time, but no storyboard exercises both arms of the rule end-to-end. A seller that relaxes `additionalProperties` (or that runs ahead of the schema constraint via a hand-rolled response shape) can drift without detection until a buyer's runtime trips on the dual emission.

What this issue tracks

Add a storyboard that exercises the wire-placement rule on both arms:

1. Case-1 path (`acquire_rights` with `AcquireRightsRejected`) — the agent returns the rejection arm. Storyboard asserts:

   • `status: 'rejected'` discriminator present
   • `reason` populated
   • `errors[]` absent (or empty)
   • `adcp_error` absent
   • Transport-level success markers retained (HTTP 200 / MCP `isError: false` / A2A `succeeded`)

2. Case-2 path (`create_media_buy` with no rejection arm — denial returned via `errors[]` + `adcp_error`) — the agent returns a failed task. Storyboard asserts:

   • `errors[].code: GOVERNANCE_DENIED` present
   • `adcp_error.code: GOVERNANCE_DENIED` present
   • Transport-level failure markers flipped (HTTP 4xx / MCP `isError: true` / A2A `failed`)

3. Negative case (intentional violation) — a fixture variant that populates BOTH the rejection arm AND `errors[].code: GOVERNANCE_DENIED`. Storyboard asserts the agent's schema validation rejects the response.

Why now

The wire-placement guidance just shipped to `main` (#3929) and is being cherry-picked to 3.0.6 via #3996. Without a storyboard, the rule is asserted only in prose — adopters reading the long-form `GOVERNANCE_DENIED` description have no executable conformance check, and `@adcp/sdk` storyboard runners can't surface drift to a seller during onboarding.

Refs

• spec(errors): wire-placement guidance for GOVERNANCE_DENIED and GOVERNANCE_UNAVAILABLE #3929 — landed wire-placement guidance on `main`
• 3.0.6 cherry-picks: governance wire-placement + ctx_metadata reservation + storyboard fixture fixes #3996 — 3.0.6 cherry-pick that triggered this audit
• `AcquireRightsRejected` / `CreativeRejected` schema constraints (`not: { required: [errors] }`)

🤖 Generated with Claude Code

[bokelley]

Triage

Classification: Feature request / conformance correction
Bucket(s): compliance-suite
Status: drafting-pr

What the experts said:

• ad-tech-protocol-expert: The existing brand_rights/governance_denied scenario was testing the wrong wire shape — check: error_code: GOVERNANCE_DENIED on acquire_rights asserts the Case-2 (errors[]) path, but acquire_rights defines AcquireRightsRejected with not: { required: [errors] } at the schema layer. Any brand agent that had run this specialism and passed was being certified against a schema-violating shape. Fix is unambiguous. Case 3 (negative/violation) is not implementable as a live storyboard step — belongs as a test-vector in static/compliance/source/test-vectors/.
• code-reviewer: YAML-only changes; no schema or comply_test_controller changes needed. expected_arm: "rejected" is required per storyboard authoring guide for proper path-resolution lint scoping. field_absent is in authored_check_kinds. field_present: errors on media-buy scenario dropped — existing error_code check is shape-agnostic and covers both layers per storyboard guidance.

My take: The prior scenario was grading schema-violating behavior as passing; this PR corrects it to match the wire-placement rule that shipped in #3929. Draft PR opens the fix for review. Case 3 (the negative fixture) is deferred — it needs a test-vector approach, not a live storyboard step.

Drafting PR #4004 which:

1. Fixes brand_rights/governance_denied — replaces expect_error: true + error_code: GOVERNANCE_DENIED with rejection-arm assertions (expected_arm: rejected, field_value: status=rejected, field_present: reason, field_absent: errors, context echo)
2. Documents Case-2 wire-placement explicitly in media_buy_seller/governance_denied error_code description
3. Case 3 (dual-emission negative fixture as test-vector) — deferred, follow-up issue

---

Triaged by Claude Code. Session: https://claude.ai/code/session_01QW7uzhT3g9LEVMX9y6Ew1R

---

Generated by Claude Code