fix(compliance): use truthiness form in evaluator_auth skip_if guards

.changeset/fix-evaluator-auth-skip-if-boolean-guard.md

@@ -0,0 +1,9 @@
+---
+"adcontextprotocol": patch
+---
+
+Fix `evaluator_auth` storyboard: use truthiness form `!context.supports_evaluator` in all `skip_if` guards.
+
+The storyboard used `context.supports_evaluator != true` (strict typed equality) to gate evaluator-specific phases. When a creative agent returns `creative.supports_evaluator: false`, the runner captures the boolean `false` into `context.supports_evaluator` but mishandles the `!= true` strict comparison — evaluating it as `false` instead of `true` — so the guarded phase executes instead of being skipped. The underlying bug is in the adcp-client runner's `skip_if` evaluator (tracked separately); this change applies a defensive storyboard workaround that is semantically equivalent for boolean values and avoids the typed equality path entirely.
+
+Changed all six `skip_if` guards from `"context.supports_evaluator != true ..."` to `"!context.supports_evaluator ..."`, matching the truthiness style already used for `context.build_capability_id` and `context.creative_feature_id` in the same expressions. The storyboard was correctly authored per protocol semantics; the change is purely defensive against the runner bug during the 3.1 pre-release window.

dist/compliance/storyboard-runner-options.d.ts

@@ -0,0 +1,42 @@
+import type { StoryboardRunOptions } from '@adcp/sdk/testing';
+export interface LoadedTestKit {
+    brand?: {
+        house?: {
+            domain?: string;
+        };
+        brand_id?: string;
+    };
+    auth?: {
+        api_key?: string;
+        basic?: {
+            username?: string;
+            password?: string;
+            credentials?: string;
+        };
+        probe_task?: string;
+    };
+}
+/**
+ * Per-tenant probe-task override for security_baseline's auth probes.
+ *
+ * Most shared test-kits declare `auth.probe_task: list_creatives`, but cached
+ * prerelease kits can lag the allowlist. Sales/creative explicitly pin the
+ * allowlisted protected read they serve. /signals and /governance serve
+ * different SDK-allowlisted protected reads.
+ */
+export declare const PROBE_TASK_BY_TENANT: Record<string, string>;
+/**
+ * Thread the test-kit's auth material through to the storyboard runner so
+ * kit-gated auth phases execute instead of being skipped by `skip_if`.
+ */
+export declare function testKitOptionsFromKit(kit: LoadedTestKit | undefined, tenantPath?: any): StoryboardRunOptions['test_kit'] | undefined;
+/**
+ * Pick run-scoped transport auth for the manual storyboard runner.
+ *
+ * `security_baseline` positive credential probes use normal initialized
+ * transport calls, so a single run can only prove one static credential type.
+ * Dual-credential kits must be split into per-mechanism runs before they can
+ * be graded safely here.
+ */
+export declare function authForStoryboard(storyboardId: string, kit: LoadedTestKit | undefined, defaultBearerToken: string): StoryboardRunOptions['auth'];
+//# sourceMappingURL=storyboard-runner-options.d.ts.map

static/compliance/source/protocols/creative/scenarios/evaluator_auth.yaml

@@ -111,7 +111,7 @@ phases:
   - id: evaluator_capability_contract
     title: "Confirm experimental feature declaration"
     optional: true
-    skip_if: "context.supports_evaluator != true"
+    skip_if: "!context.supports_evaluator"
     narrative: |
       Because evaluator support is experimental, agents that set
       `creative.supports_evaluator` must also list `creative.evaluator` in
@@ -162,7 +162,7 @@ phases:
   - id: reject_off_list_evaluator
     title: "Reject an off-list evaluator URL"
     optional: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
+    skip_if: "!context.supports_evaluator || !context.build_capability_id || !context.creative_feature_id"
     narrative: |
       The buyer supplies a well-formed external evaluator URL that is not in the
       seller's accepted verifier allowlist. The creative agent must reject it
@@ -219,7 +219,7 @@ phases:
   - id: reject_off_list_feature_agent
     title: "Reject an off-list feature_agent URL"
     optional: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
+    skip_if: "!context.supports_evaluator || !context.build_capability_id || !context.creative_feature_id"
     narrative: |
       The buyer supplies a well-formed `feature_agent.agent_url` alongside an
       account-arranged evaluator id. The nested feature agent uses the same
@@ -281,7 +281,7 @@ phases:
   - id: payload_credentials_advisory
     title: "Keep evaluator credentials out of the payload"
     optional: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
+    skip_if: "!context.supports_evaluator || !context.build_capability_id || !context.creative_feature_id"
     narrative: |
       The buyer attempts to pass an evaluator API key inside the evaluator
       object. The payload is schema-valid but non-conforming: evaluator
@@ -356,7 +356,7 @@ phases:
   - id: accepted_evaluator_invocation
     title: "Invoke an accepted evaluator"
     optional: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
+    skip_if: "!context.supports_evaluator || !context.build_capability_id || !context.creative_feature_id"
     narrative: |
       The buyer supplies an accepted external evaluator URL. The creative agent
       builds variants, calls the evaluator through the `get_creative_features`
@@ -433,7 +433,7 @@ phases:
   - id: accepted_evaluator_unavailable_degrades
     title: "Degrade when an accepted evaluator is unavailable"
     optional: true
-    skip_if: "context.supports_evaluator != true || !context.build_capability_id || !context.creative_feature_id"
+    skip_if: "!context.supports_evaluator || !context.build_capability_id || !context.creative_feature_id"
     narrative: |
       An accepted evaluator can be unreachable or can reject the producing
       agent's transport authentication. The buyer-visible build should not fail