Training agent: implement provenance enforcement (provenance_requirements + accepted_verifiers + PROVENANCE_* codes)

[bokelley]

Follow-up to #3468.

#3468 lands the spec for creative_policy.provenance_requirements, creative_policy.accepted_verifiers[], the verify_agent shape on embedded_provenance / watermarks, and six PROVENANCE_* error codes. The conformance scenario creative_sales_agent/provenance_enforcement (under static/compliance/source/protocols/media-buy/scenarios/) grades the structural-rejection contract end to end.

The training agent (server/src/training-agent/) does not yet implement any of this, so the storyboard fails 3 of its 5 step validations against the reference implementation. Until this issue closes, the storyboard is on the KNOWN_FAILING_STORYBOARDS list in server/tests/manual/run-storyboards.ts.

What needs to ship

get_products (task-handlers.ts + product-factory.ts)

Surface the seeded creative_policy.provenance_required, creative_policy.provenance_requirements, and creative_policy.accepted_verifiers fields on returned products. The fixture format used by the storyboard runner already seeds these via comply_test_controller seed_product — they just need to round-trip through the product factory and into the response.

sync_creatives (task-handlers.ts)

Implement structural enforcement of creative_policy.{provenance_required, provenance_requirements, accepted_verifiers}:

Condition	Reject with
provenance_required: true and no provenance object on the resolved manifest/asset chain	PROVENANCE_REQUIRED
provenance_requirements.require_digital_source_type: true and no digital_source_type on resolved provenance	PROVENANCE_DIGITAL_SOURCE_TYPE_MISSING
provenance_requirements.require_disclosure_metadata: true and no disclosure.required (or disclosure.required: true with no jurisdictions)	PROVENANCE_DISCLOSURE_MISSING
provenance_requirements.require_embedded_provenance: true and no embedded_provenance[] entry	PROVENANCE_EMBEDDED_MISSING
Buyer's verify_agent.agent_url (on any embedded_provenance[] or watermarks[] entry) does not canonicalize-match any accepted_verifiers[].agent_url	PROVENANCE_VERIFIER_NOT_ACCEPTED

Each rejection should populate errors[] with the matching code, error.field pointing at the offending path, and error.recovery: 'correctable'. See static/schemas/source/enums/error-code.json for the canonical descriptions.

PROVENANCE_CLAIM_CONTRADICTED (truth-of-claim, requires calling get_creative_features against an on-list governance agent) is out of scope for this initial implementation — the structural-rejection codes are sufficient to make the storyboard pass.

Cleanup

• Remove creative_sales_agent/provenance_enforcement from KNOWN_FAILING_STORYBOARDS in server/tests/manual/run-storyboards.ts
• Bump min_clean_storyboards and min_passing_steps in .github/workflows/training-agent-storyboards.yml to reflect the new floor

Reference

Spec landed in #3468. Provenance docs at docs/creative/provenance.mdx and docs/governance/creative/provenance-verification.mdx.

[bokelley]

Triage

Classification: Feature request (implementation)
Bucket(s): compliance suite, addie (server/)
Status: drafting-pr
Milestone: none (non-protocol change, --empty changeset)

What the experts said:

• ad-tech-protocol-expert: approved — enforcement logic, field paths, check ordering, and PROVENANCE_DISCLOSURE_MISSING condition all correct per spec; PROVENANCE_CLAIM_CONTRADICTED correctly deferred (separate truth-of-claim surface)
• code-reviewer: approved — two issues fixed before PR opened: (1) provenance_requirements now gated on provenance_required === true per spec MUST-ignore rule; (2) verify_agent.agent_url field path now names the correct sub-array (embedded_provenance vs watermarks)

My take: Spec landed in #3468 (closed), storyboard was already written — this is a clean implementation with no ambiguity. Drafting PR #3779 targeting main.

Drafting PR: #3779 — handleGetProducts surfaces seeded creative_policy fields; handleSyncCreatives enforces provenance_required, provenance_requirements, and accepted_verifiers with per-creative action: 'failed' rejections; removes storyboard from KNOWN_FAILING_STORYBOARDS.

Follow-up needed (cannot be done by this routine): bump min_clean_storyboards and min_passing_steps in .github/workflows/training-agent-storyboards.yml — the routine cannot edit .github/**.

---

Triaged by Claude Code. Session: https://claude.ai/code/session_013AgZkVzoaN9YBEJp3FeBk8

---

Generated by Claude Code