Hosted grader: bump @adcp/sdk from 15.8.1 to 15.9.x — 15.8.1 can't build 3.2.4 signed_requests negatives 029–031 #8221

Summary

The hosted grader pins @adcp/sdk 15.8.1 in package.json (#8148). On bundle 3.2.4, 15.8.1 can't grade three of the signed_requests profile-3.2 negative vectors: 029, 030 and 031. For each one the runner throws request_signing_probe threw: No adversarial builder registered for negative vector … before it sends the signed request. It gets only as far as the MCP initialize handshake, so the agent's verifier never sees the vector.

Any agent graded on 3.2.4 that declares request_signing.supported: true therefore gets 3 failed steps it can't pass, and its card reads degraded. Agents without signing never run the storyboard, so they aren't affected.

adcp-client#3217 (changeset 5b1d06c) added the missing builders. They first shipped in 15.9.0 on 10-13, and 15.9.1 is npm latest. The vectors came from #8066 and #8068 (#7905).

No current card shows this yet. One registry agent already has a 3.2.4 card, but it doesn't advertise request signing. The two agents that do are both graded on 3.1.24.

We merged 3.2 support for our signals agent (https://adcp.signal-stack.io/mcp) behind a flag today. We're holding the flag until the grader can grade these vectors.

Evidence

Each row below is a local adcp storyboard run against the same agent build, with 3.2 serving on, on the 3.2.4 bundle. Each was run twice with identical results.

15.9.1 also skips positive 015 (bracketed IPv6 host with port) as mcp_mode_flattens_url_edges, which 15.8.1 graded. That's why it's 33/33, not 34/34.

• Production run. We first saw this against production on 10-15 at 08:16Z: 15.8.1 on 3.2.4 against the live signals agent, which was still serving 3.1. The same three steps failed the same way. That run also failed 001-base64url-sf-binary, a 3.2-only rule the 3.1 build doesn't enforce; the 3.2 build in the table passes it.
• 3.1 cards are unaffected. These vectors first ship in the 3.2.4 bundle, and 3.1.24 doesn't have them.

Ask

Bump the registry's @adcp/sdk pin to 15.9.1 or later.

Two notes for whoever does it:

• 15.9.0's release notes ask hosts to re-apply REPORTING_LEDGER_MIGRATION / REPORTING_ROW_STORAGE_MIGRATION. chore(deps): update @adcp/sdk to 15.8.1 #8148 needed migration 621 for the same ledger, so the bump may need a companion migration.
• published-versions.json's policy registers a version once "the pinned hosted @adcp/sdk can load the bundle". 15.8.1 loads 3.2.4 but can't build three of its vectors.

Related: adcp-client#3217, #7905, #8066, #8068, #8148, #8153.