ztdsp supply-audit commands

The Supply Audit CLI is ztdsp supply-audit plus a verb. MCP mirrors the same jobs.

Use these commands:

• status to see whether the account is enrolled and what the last run said.
• activate / deactivate to turn the nightly scan on or off for the account. The scan still no-ops without an enabled policy row.
• policy to read thresholds.
• flags to list findings.
• acknowledge or dismiss to record a human decision without changing targeting.
• apply --flag <saf_id> to clone targeting. See Apply a Supply Audit finding.
• scan to request a run, and scans to list prior runs.

MCP names follow the same jobs: get_supply_audit_status, list_supply_audit_flags, apply_supply_audit_flag, run_supply_audit_scan.

How to read a scan response

POST /scans returns 202 when a run starts, 200 with scanned: false when the interval gate skipped it, and 503 when provider credentials are missing. The default interval is 24 hours on a covered run. Failed coverage does not start that 24-hour clock, so a bad credential night does not lock you out of a retry.

The cron that hosts the job fires often. The scan itself self-throttles so it is not another per-minute database wake-up. The kill switch is a Worker var, not a dashboard toggle.

Covered is the only green

coverage_verdict is covered, no_account_rows, no_provider_rows, or no_campaigns. Only covered means the scan reviewed your delivery. The CLI prints a warning when it did not. Coverage verdict is the term. Incomplete coverage is not clean is the Lab piece.

Do not verify production coverage with a local direct runner if local exchange credentials are stale. A 401 locally is not a clean account. Verify against the deployed API.

The scan does not pause campaigns and does not apply exclusions by itself. Mode is recommend_only. Apply is a separate, targeting-only step.