training-agent: surface human_oversight ↔ disclosure.required inconsistency as audit observation in get_creative_features

[bokelley]

Context

Sibling to #4438, which defines the spec-side governance contract for surfacing the human_oversight: edited|directed + disclosure.required: false pattern as an audit observation. This issue tracks the reference training agent implementation.

PR #4437 added the non-normative warning to docs and schema; depends on #4438 landing the audit_observations[] wire shape before implementation can begin.

Scope

Implementation in server/src/training-agent/ against the spec-side contract from #4438.

1. get_creative_features handler — when called against a creative whose provenance carries human_oversight ∈ {edited, directed} AND disclosure.required == false, emit an audit_observations[] entry with:

   • code: OVERSIGHT_DISCLOSURE_CARVEOUT_CLAIMED (or whatever code lands in provenance: governance-agent flag rule for human_oversight ↔ disclosure.required inconsistency #4438)
   • claimed_value: human_oversight=<value>, disclosure.required=false
   • severity: audit-worthy (or per provenance: governance-agent flag rule for human_oversight ↔ disclosure.required inconsistency #4438's enum)
   • recovery: 'informational' — this is not a rejection signal.

2. No change to sync_creatives enforcement. The PROVENANCE_* structural-rejection family stays untouched. This pattern surfaces, it does not reject.

3. Storyboard / conformance scenario registered in static/compliance/source/protocols/media-buy/scenarios/ covering:

   • Setup: seller publishes a creative-policy requiring get_creative_features verification.
   • Step 1: buyer submits creative with human_oversight: edited + disclosure.required: false.
   • Step 2: seller calls get_creative_features against the seeded on-list verifier.
   • Step 3: verifier response includes audit_observations[] entry for the oversight/disclosure combination.
   • Step 4: seller accepts the creative (the combination is permitted) but the observation is now recorded on the artifact for downstream audit.

4. Floor bumps in .github/workflows/training-agent-storyboards.yml:

   • min_clean_storyboards +1
   • min_passing_steps +N for the new scenario

Pre-reqs

• provenance: governance-agent flag rule for human_oversight ↔ disclosure.required inconsistency #4438 lands the wire shape and conformance pattern before this issue can start.
• Storyboard audit-observations predicate may need adding to the conformance harness — coordinate with Storyboard conformance: required-clean allowlist + errors[*] predicate + pre-commit gate #3803 if still open.

Out of scope

• Detection logic for the actual digital_source_type truth-of-claim. The structural inconsistency is the only thing flagged here; truth-of-claim verification is Training agent: implement PROVENANCE_CLAIM_CONTRADICTED truth-of-claim verification #3802 territory.
• Auto-rejection or any human-reviewer routing. The training agent emits the observation and accepts the creative.

Refs

• provenance: governance-agent flag rule for human_oversight ↔ disclosure.required inconsistency #4438 — spec / governance contract this issue implements
• PR docs(provenance): frame provenance as transport, not compliance #4437 — the non-normative warning that motivates the audit flag
• Training agent: implement provenance enforcement (provenance_requirements + accepted_verifiers + PROVENANCE_* codes) #3777, Training agent: implement PROVENANCE_CLAIM_CONTRADICTED truth-of-claim verification #3802, Storyboard conformance: required-clean allowlist + errors[*] predicate + pre-commit gate #3803 — prior provenance-enforcement implementation work