@deeeed/metamask-harness 0.47.4 → 0.48.0

package/library/recipes/mobile/networks/release-multichain-visibility.recipe.json

@@ -1,11 +1,12 @@
 {
   "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
   "title": "Mobile multi-network asset visibility",
-  "description": "Proves funded assets from multiple protocol families are visible together in the opaque Mobile wallet.",
+  "description": "Checks that the requested asset symbols and formatted fiat values appear together in the Mobile wallet. Symbols alone do not prove network identity or funding.",
   "paramsSchema": {
     "type": "object",
     "additionalProperties": false,
     "properties": {
+      "capture_path": { "type": "string", "default": "screenshots/mobile-multichain-assets.png" },
       "symbols": {
         "type": "array",
         "items": { "type": "string" },
@@ -39,14 +40,14 @@
         "minimum_asset_count": "{{params.minimum_asset_count}}",
         "require_fiat": true,
         "max_items": 100,
-        "intent": "Prove assets from the requested protocol families are simultaneously visible",
+        "intent": "Prove the requested asset symbols and formatted fiat values appear together",
         "next": "capture-wallet"
       },
       "capture-wallet": {
         "action": "ui.screenshot",
-        "path": "screenshots/mobile-multichain-assets.png",
+        "path": "{{params.capture_path}}",
         "label": "Mobile multi-network asset visibility",
-        "intent": "Preserve reviewer-visible proof of aggregate multi-network holdings",
+        "intent": "Preserve reviewer-visible proof of the requested asset rows",
         "next": "done"
       },
       "done": {

package/library/recipes/mobile/wallet/smoke.recipe.json

@@ -2,18 +2,27 @@
   "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
   "title": "MetaMask Mobile wallet smoke",
   "description": "Fixture-backed proof that the Mobile wallet is reachable, unlocked, readable, and visually capturable without depending on a product feature domain.",
+  "paramsSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "capture_path": { "type": "string", "default": "screenshots/wallet-smoke.png" }
+    }
+  },
   "workflow": {
-    "entry": "status",
+    "entry": "fixture",
     "nodes": {
-      "status": {
-        "action": "app.status",
-        "next": "fixture",
-        "intent": "Confirm the Mobile runtime is reachable"
-      },
       "fixture": {
         "action": "metamask.wallet.fixture_status",
+        "next": "require-fixture",
+        "intent": "Read the checkout's wallet fixture readiness without changing it"
+      },
+      "require-fixture": {
+        "action": "assert_output",
+        "source": "fixture",
+        "assert": { "path": "$.status", "operator": "eq", "value": "ready" },
         "next": "unlock",
-        "intent": "Confirm the checkout wallet fixture is ready"
+        "intent": "Require a ready on-disk fixture before interacting with the wallet; this does not prove imported account identity"
       },
       "unlock": {
         "action": "metamask.wallet.ensure_unlocked",
@@ -27,7 +36,7 @@
       },
       "screenshot": {
         "action": "ui.screenshot",
-        "path": "screenshots/wallet-smoke.png",
+        "path": "{{params.capture_path}}",
         "next": "done",
         "intent": "Record the visible wallet state as evidence"
       },

package/library/recipes/{assets → shared/assets}/release-token-address-import.recipe.json

@@ -32,6 +32,13 @@
         "decimals": "{{params.decimals}}",
         "timeout_ms": "{{params.timeout_ms}}",
         "intent": "Import the token by address on the selected network and verify its metadata",
+        "next": "assert-imported"
+      },
+      "assert-imported": {
+        "action": "assert_output",
+        "source": "import-token",
+        "assert": { "path": "$.changed", "operator": "eq", "value": true },
+        "intent": "Require a completed import rather than reusing an already-imported token",
         "next": "capture-imported-token"
       },
       "capture-imported-token": {

package/library/recipes/{assets → shared/assets}/release-token-details.recipe.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
   "title": "Assets release token details",
-  "description": "Opens the first visible asset and proves its live chart and market cap render through visible product UI.",
+  "description": "Open a visible token matching symbol and assert its chart and market cap through product UI. Symbol-only selection does not identify a network or token contract; use a uniquely matching row for this proof. Native reader compatibility must be validated on the tested build.",
   "paramsSchema": {
     "type": "object",
     "additionalProperties": false,
@@ -24,7 +24,7 @@
         "action": "metamask.assets.open_details",
         "symbol": "{{params.symbol}}",
         "timeout_ms": "{{params.timeout_ms}}",
-        "intent": "Open the requested visible funded asset",
+        "intent": "Open the visible token matching the requested symbol; no funding or network claim",
         "next": "assert-details"
       },
       "assert-details": {

package/library/recipes/shared/assets/release-token-hide-readd.recipe.json

@@ -0,0 +1,91 @@
+{
+  "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
+  "title": "Assets release token hide and re-add",
+  "description": "Requires an enabled imported token, hides and re-enables it through Manage tokens, and restores the enabled baseline on failure. Both proof transitions must change state.",
+  "paramsSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "query": { "type": "string", "default": "DAI" },
+      "asset_id": { "type": "string", "default": "", "description": "Exact ERC-20 identity on Extension; leave empty for Mobile query-only selection." },
+      "hidden_capture_path": { "type": "string", "default": "screenshots/assets-token-hidden.png" },
+      "restored_capture_path": { "type": "string", "default": "screenshots/assets-token-restored.png" },
+      "timeout_ms": { "type": "integer", "minimum": 1000, "default": 45000 }
+    }
+  },
+  "workflow": {
+    "entry": "open-wallet",
+    "teardown": "baseline-known",
+    "nodes": {
+      "open-wallet": {
+        "action": "ui.navigate",
+        "page": "home",
+        "intent": "Open the all-network asset list",
+        "next": "assert-baseline"
+      },
+      "assert-baseline": {
+        "action": "metamask.assets.set_token_visibility",
+        "asset_id": "{{params.asset_id}}",
+        "query": "{{params.query}}",
+        "visible": true,
+        "require_unchanged": true,
+        "timeout_ms": "{{params.timeout_ms}}",
+        "intent": "Verify the original enabled token before authorizing any restoration",
+        "next": "hide-token"
+      },
+      "hide-token": {
+        "action": "metamask.assets.set_token_visibility",
+        "asset_id": "{{params.asset_id}}",
+        "query": "{{params.query}}",
+        "visible": false,
+        "require_change": true,
+        "timeout_ms": "{{params.timeout_ms}}",
+        "intent": "Disable the imported token and prove its row disappears",
+        "next": "capture-hidden"
+      },
+      "capture-hidden": {
+        "action": "ui.screenshot",
+        "path": "{{params.hidden_capture_path}}",
+        "label": "Token hidden",
+        "intent": "Preserve reviewer-visible hidden state",
+        "next": "readd-token"
+      },
+      "readd-token": {
+        "action": "metamask.assets.set_token_visibility",
+        "asset_id": "{{params.asset_id}}",
+        "query": "{{params.query}}",
+        "visible": true,
+        "require_change": true,
+        "timeout_ms": "{{params.timeout_ms}}",
+        "intent": "Re-enable the token and prove its metadata row returns",
+        "next": "capture-restored"
+      },
+      "capture-restored": {
+        "action": "ui.screenshot",
+        "path": "{{params.restored_capture_path}}",
+        "label": "Token restored",
+        "intent": "Preserve reviewer-visible restored state",
+        "next": "done"
+      },
+      "done": { "action": "end", "status": "pass" },
+      "baseline-known": {
+        "action": "assert_output",
+        "source": "assert-baseline",
+        "stream": "requested",
+        "match": "^true$",
+        "intent": "Refuse restoration when this run did not verify the original enabled token",
+        "next": "restore-enabled"
+      },
+      "restore-enabled": {
+        "action": "metamask.assets.set_token_visibility",
+        "asset_id": "{{params.asset_id}}",
+        "query": "{{params.query}}",
+        "visible": true,
+        "timeout_ms": "{{params.timeout_ms}}",
+        "intent": "Restore the original enabled token after success or failure without changing the proof verdict",
+        "next": "cleanup-done"
+      },
+      "cleanup-done": { "action": "end", "status": "pass" }
+    }
+  }
+}

package/library/recipes/{assets → shared/assets}/release-token-persistence.recipe.json

@@ -6,6 +6,7 @@
     "type": "object",
     "additionalProperties": false,
     "properties": {
+      "asset_id": { "type": "string", "default": "", "description": "Optional exact ERC-20 identity on Extension; Mobile supports only empty/query-only mode." },
       "query": { "type": "string", "default": "DAI" },
       "timeout_ms": { "type": "integer", "minimum": 1000, "default": 45000 }
     }
@@ -21,6 +22,7 @@
       },
       "assert-prestate": {
         "action": "metamask.assets.set_token_visibility",
+        "asset_id": "{{params.asset_id}}",
         "query": "{{params.query}}",
         "visible": true,
         "require_unchanged": true,
@@ -53,6 +55,7 @@
       },
       "assert-persisted": {
         "action": "metamask.assets.set_token_visibility",
+        "asset_id": "{{params.asset_id}}",
         "query": "{{params.query}}",
         "visible": true,
         "require_unchanged": true,

package/library/recipes/{assets → shared/assets}/release-token-search-import.recipe.json

@@ -1,12 +1,13 @@
 {
   "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
   "title": "Assets release token search import",
-  "description": "Imports one token through live Manage tokens search and proves it appears in the token list.",
+  "description": "Requires a token that is not already enabled, imports it through live Manage tokens search, and proves it appears in the token list.",
   "paramsSchema": {
     "type": "object",
     "additionalProperties": false,
     "properties": {
       "query": { "type": "string", "default": "DAI" },
+      "asset_id": { "type": "string", "default": "", "description": "Optional exact ERC-20 identity on Extension to disambiguate search results; leave empty for Mobile query-only selection." },
       "timeout_ms": { "type": "integer", "minimum": 1000, "default": 45000 }
     }
   },
@@ -22,7 +23,9 @@
       "import-token": {
         "action": "metamask.assets.set_token_visibility",
         "query": "{{params.query}}",
+        "asset_id": "{{params.asset_id}}",
         "visible": true,
+        "require_change": true,
         "timeout_ms": "{{params.timeout_ms}}",
         "intent": "Find the token through the live API and enable its management toggle",
         "next": "capture-imported-token"

package/library/recipes/{assets → shared/assets}/release-token-sorting.recipe.json

@@ -2,6 +2,17 @@
   "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
   "title": "Assets release token sorting",
   "description": "Exercises and verifies both token-list sort modes through visible product controls.",
+  "paramsSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "capture_path": {
+        "type": "string",
+        "default": "screenshots/assets-sorted.png",
+        "description": "Final sort-state capture; pass distinct paths when composing repeated checks."
+      }
+    }
+  },
   "workflow": {
     "entry": "open-wallet",
     "nodes": {
@@ -18,8 +29,8 @@
       },
       "capture-sorted-list": {
         "action": "ui.screenshot",
-        "path": "screenshots/assets-sorted-high-low.png",
-        "label": "Assets sorted by declining balance",
+        "path": "{{params.capture_path}}",
+        "label": "Final asset sort state",
         "intent": "Preserve reviewer-visible sorted token list evidence",
         "next": "done"
       },

package/library/recipes/{swap-bridge → shared/swap-bridge}/release-quote.recipe.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
   "title": "Swap release quote",
-  "description": "Selects an exact live Swap pair, enters a capped amount, and proves a destination quote through visible product UI without submitting a transaction.",
+  "description": "Select an exact Swap pair, enter a fixed amount or use Max, and verify a reviewable destination quote without submitting. Extension quote identity requires exposed bridge quote state; an opaque build without it is not certified by UI amounts alone.",
   "paramsSchema": {
     "type": "object",
     "additionalProperties": false,
@@ -14,7 +14,18 @@
       "destination_query": { "type": "string", "default": "WETH" },
       "source_asset_id": { "type": "string", "default": "" },
       "destination_asset_id": { "type": "string", "default": "" },
+      "amount_mode": {
+        "type": "string",
+        "enum": ["fixed", "max"],
+        "default": "fixed",
+        "description": "Enter amount or use the visible Max balance. Neither branch submits a transaction."
+      },
       "amount": { "type": "number", "minimum": 0.00000001, "default": 0.0001 },
+      "capture_path": {
+        "type": "string",
+        "default": "screenshots/swap-quote.png",
+        "description": "Use a distinct artifact path for each call when composing several quotes in one run."
+      },
       "timeout_ms": { "type": "integer", "minimum": 1000, "default": 60000 }
     }
   },
@@ -40,7 +51,22 @@
         "destination_asset_id": "{{params.destination_asset_id}}",
         "timeout_ms": "{{params.timeout_ms}}",
         "intent": "Select the exact source and destination assets",
-        "next": "enter-amount"
+        "next": "choose-amount"
+      },
+      "choose-amount": {
+        "action": "switch",
+        "value": "{{params.amount_mode}}",
+        "equals": "max",
+        "cases": { "match": "use-max" },
+        "default": "enter-amount",
+        "intent": "Run only the requested amount-entry method"
+      },
+      "use-max": {
+        "action": "metamask.swap_bridge.set_max_amount",
+        "wait_for_quote": true,
+        "timeout_ms": "{{params.timeout_ms}}",
+        "intent": "Use the visible available source balance and wait for its quote",
+        "next": "assert-quote"
       },
       "enter-amount": {
         "action": "metamask.swap_bridge.set_amount",
@@ -62,7 +88,7 @@
       },
       "capture-quote": {
         "action": "ui.screenshot",
-        "path": "screenshots/swap-quote.png",
+        "path": "{{params.capture_path}}",
         "label": "Swap release quote",
         "intent": "Preserve reviewer-visible proof of the live quote",
         "next": "done"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.47.4",
+  "version": "0.48.0",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"
@@ -21,10 +21,10 @@
   },
   "dependencies": {
     "@farmslot/agent-runtime": "0.8.1",
-    "@farmslot/expo-recipe": "0.8.1",
+    "@farmslot/expo-recipe": "0.9.0",
     "@farmslot/handoff": "^0.3.1",
     "@farmslot/protocol": "0.21.0",
-    "@farmslot/recipe-harness": "0.15.1",
+    "@farmslot/recipe-harness": "0.16.0",
     "agent-device": "0.19.3",
     "commander": "^12.0.0",
     "es-module-lexer": "2.3.1",

package/site/assets/help-recipes.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "topic": "recipes",
   "title": "Recipe-backed work",
-  "summary": "Build an executable proof from the closest installed recipe, adapt it to the exact product version, and leave evidence another agent can replay.",
+  "summary": "The harness exposes tools to inspect, interact with, and measure MetaMask. Recipes combine them with starting conditions, branching, and assertions to produce repeatable evidence. Skills organize the task around that proof.",
   "capabilities": "Recipe uses: functional QA, visual checks, analytics and log assertions, and performance measurements during development, PR review, or release testing.",
   "scopeNotice": "Current coverage: mm-harness is heavily optimized for Perps. Other teams can use it by adding composable recipes for their key journeys; contact Arthur for help.",
   "recipeProtocolVersion": "1",
@@ -12,8 +12,9 @@
       "title": "Freeze the proof target",
       "instruction": "Work inside one isolated MetaMask checkout. Name the exact product version and acceptance criteria, repair harness-owned state, then verify or launch that checkout.",
       "details": [
-        "The tested build and current criteria are authoritative. A prior recipe pass is not current proof.",
-        "Choose state, visual, log, or mixed evidence for each criterion before authoring the graph."
+        "The tested build and current criteria are authoritative. A prior recipe pass is not current proof. Freeze source and installed dependencies during execution. Parallel workers need private dependency trees with matching manifests and lockfiles; installing through a shared node_modules symlink can change another run. Mobile catalog compatibility does not establish both iOS and Android runtime support; validate the selected transport.",
+        "Launching Extension preserves its wallet profile. Applying a fixture or resetting that profile is a separate explicit action. A session helper proves only its declared postcondition, not the selected account, provider, network, or funding; verify those separately before trading. Use account-aware balances: Hyperliquid unified accounts can use spot collateral even when clearinghouseState reports zero margin.",
+        "Choose state, visual, log, or performance evidence for each criterion before authoring the graph. A tool returning successfully proves only its own operation, not the task's claim."
       ],
       "commands": [
         "mm-harness doctor --fix",
@@ -25,13 +26,16 @@
       "title": "Discover the strongest starting point",
       "instruction": "Search the installed recipe and action catalogs, inspect exact schemas, and select the closest recipe before writing anything new.",
       "details": [
-        "A bundled recipe, including a Core recipe, is strong composable vocabulary, not authority for every future product version.",
+        "A bundled recipe, including a Core recipe, is strong composable vocabulary, not authority for every future product version. Core actions use isolated controllers: pass account/network into each action instead of adding a no-op initialization node.",
         "Prefer an existing recipe, then existing actions, then read-only CDP or controller inspection. Add shared vocabulary only after repeated need is proven.",
-        "Before declaring a capability unsupported, inspect both catalogs and the closest recipe's composition. A missing dedicated action may already be composed from UI actions. Read the returned schema before filtering fields; do not treat guessed field names as empty capabilities."
+        "Before declaring a capability unsupported, inspect both catalogs and the closest recipe's composition. A missing dedicated action may already be composed from UI actions. Read the returned schema, examples, and result_cases before authoring; do not treat guessed field names as empty capabilities.",
+        "Register a team library with --library team=/path/to/library-root, the directory containing recipes/. Use discovered recipe names in call.ref; the library alias names its source, not a recipe-name prefix. Confirm --describe reports the intended source and platform variant, then plan the complete composition. Discovery alone does not prove that child actions or parameter contracts work on this adapter."
       ],
       "commands": [
         "mm-harness actions --json",
         "mm-harness actions --action app.status --json",
+        "mm-harness actions --action ui.screenshot --json",
+        "mm-harness actions performance --json",
         "mm-harness run --list --json",
         "mm-harness run runner.smoke --describe --json"
       ]
@@ -42,18 +46,34 @@
       "instruction": "Declare genuine caller choices once in paramsSchema and keep invariants required by the postcondition inside the recipe.",
       "details": [
         "Parameterize reusable differences such as market, account, provider, network, amount, side, or lifecycle mode.",
-        "Do not parameterize away safety, assertions, cleanup, or the meaning of success. Never depend on hidden wallet, account, provider, network, page, port, or device state."
+        "Use {{params.name}} for declared inputs and {{outputs.nodeId.path}} for a preceding result. Whole-value templates preserve types; embedded templates become strings. Inspect the action's actual output before selecting a field.",
+        "CLI values are parsed as JSON when possible. For a numeric-looking string parameter, preserve JSON quotes, for example 'amount=\"15\"'; shell quoting 15 alone still produces a number.",
+        "Do not parameterize away safety, assertions, cleanup, or the meaning of success. Never depend on hidden wallet, account, provider, network, page, port, or device state.",
+        "A clean-market postcondition must check both sides. Keep side-specific open-state proof separate, and inspect the actual cancellation payload: filtering by side before canceling by symbol does not protect opposite-side orders. Map client receipt IDs to exchange IDs when they differ, checking account and market. Never infer ownership from any new order or widen cleanup to fix a failed assertion.",
+        "Asset symbols and test IDs may repeat across networks. Require an unambiguous observed row, or use a contract that accepts network/token identity; never infer chain, funding or ownership from a symbol alone.",
+        "For catalog changes, verify membership and lifecycle flags as well as counts. A smaller list can hide valid delisted entries still needed by callers; distinguish unavailable trading metadata from missing historical identity.",
+        "Defaults must agree across callers and children. Keep consent and environment-specific values required when no safe default exists; a missing required input is not recipe drift. The current runtime resolves referenced inputs before branching, so an unselected branch does not hide an undefined parameter. Venue-key registration needs explicit account/key-slot ownership too. Pass account and network explicitly to isolated Core actions rather than assuming a preceding node selected them."
       ],
       "commands": []
     },
     {
       "id": "compose",
       "title": "Compose a readable graph",
-      "instruction": "Use static call references for unchanged sub-journeys. Keep preparation, action, assertion, evidence, and guaranteed teardown visible as separate nodes with human-facing intent.",
+      "instruction": "Use static call references for unchanged sub-journeys. Separate preparation, action, assertions, and evidence; add workflow.teardown when cleanup must run after success or failure.",
       "details": [
-        "Use idempotent ensure actions for required start state and independently assert their postconditions.",
+        "Starting conditions are ordinary nodes at the beginning of workflow, not a preconditions field. Use idempotent ensure actions and independently assert their postconditions. Reopening a route may preserve filters or search state; establish the required view explicitly before sampling, and validate composition after a different journey changes it.",
         "Inspect existing state before creating or cleaning fixtures. Establish only prerequisites required by the claim; a history or display check may already have usable records and need no trade or cleanup. Record the selected records and verify they still satisfy the proof boundary.",
-        "Actions translate stable UI, CDP, or controller operations. Recipes compose them. Product code owns business rules."
+        "Match history-query ranges to the dates of existing visible records before declaring fixtures missing. Sample only sections needed for change detection; fetch one-time corroborating history once, and count background calls as well as graph nodes.",
+        "Actions translate UI, CDP, or controller operations. Recipes compose them. Product code owns business rules. Teams own specialized journeys in their libraries; the harness retains shared capabilities and a small set of composable examples.",
+        "Put identical cross-adapter graphs in recipes/shared/<domain>/ and platform variants in recipes/<adapter>/<domain>/. Both keep the same domain.recipe name; an adapter variant takes precedence. Keep platform differences in actions when the journey is identical. Verify discovery, execution, and callers before removing duplicates.",
+        "Keep lifecycle transitions explicit. Check whether an observation tool activates or foregrounds the app; that behavior can invalidate a lifecycle claim even when the captured screen looks correct.",
+        "On source-dev Mobile, app.lifecycle launch, foreground, and restart already wait for the selected bridge and route. Use runtime_ready_timeout_ms to bound readiness and require_process_continuity for warm-resume claims. settle_ms is an explicit dwell period, not readiness proof. Unlock before a visual proof if the app protects locked-screen capture; never bypass that protection.",
+        "Measure executed nodes and elapsed time across nested calls, including setup and teardown. Include action-internal repetitions such as navigation cycles. Splitting a long graph into child files does not reduce work. Reuse a verified prerequisite within its valid scope, branch around already-satisfied setup, and keep broad coverage suites separate from the small journey a task needs.",
+        "Inspect scripts invoked by command nodes before running them. A read or stream label does not rule out signing, order placement or cleanup. Count the script's operations and verify its actual assertions; callback counts do not establish transport identity. Use a distinct output path for repeated invocations so one phase cannot overwrite another's evidence.",
+        "Merge branch endings when their resolved action inputs and assertions are identical. Preserve the scenario identity in parameters; keep distinct endings when required evidence differs. Compare the selected operation sequences before claiming fewer checks or faster execution.",
+        "Use summary.total for executed node count and summary.durationMs for engine duration. Measure CLI wall time separately when assessing speed; preparation and closeout can dominate a short recipe. The trace includes child nodes and their enclosing call; summing both durations double-counts the child work.",
+        "Keep repository builds, unit suites, and release bookkeeping outside reusable runtime journeys. Run them separately when required and report both results; a runtime pass does not imply package acceptance.",
+        "Main and teardown graphs are disjoint. A cleanup node reached only through next may be skipped on failure. Capture the baseline in a completed read before mutation, guard restoration on that output, and restore only task-owned state. A missing or ambiguous baseline is unknown, not false. A failed mutation may have changed the product without returning output. Teardown cannot guarantee provider acceptance or survive a killed process."
       ],
       "commands": []
     },
@@ -64,6 +84,7 @@
       "details": [
         "Plan after every structural change and preserve the first failing trace.",
         "A plan validates structure only. Probe a reused setup boundary against the current build with a short explicit timeout before a full journey; a bundled journey timeout is not a discovery budget.",
+        "A later update cannot repair a failed initial-seed assertion. Preserve the initial sample and stop that wait instead of spending the remaining budget on a proof that cannot pass.",
         "A CDP observation can help find the current route or selector; it is not final evidence unless the recipe records an allowed action and assertion for that signal."
       ],
       "commands": [
@@ -74,12 +95,13 @@
     {
       "id": "branch",
       "title": "Branch without hiding decisions",
-      "instruction": "Use switch for declared parameter choices. For runtime conditions, call an action that returns a finite declared case, then route every case to explicit assertions and a terminal result.",
+      "instruction": "Branch on a declared input or a preceding observation. switch compares resolved strings with value and equals: cases.match handles equality and default handles the other path.",
       "details": [
-        "Never template a call ref. Pass only declared child parameters and keep child output scoped to the call node.",
-        "Every success path must prove its postcondition. workflow.teardown must remain reachable after main success or failure."
+        "For a runtime decision, value can use {{outputs.inspect.state}} when the preceding inspect node actually returns that string. Actions with result_cases can route directly through cases and default; the recipe supplies destinations, not the action.",
+        "Use either next or cases with default. call always uses next and a static ref; only call.params passes child inputs, and child output stays scoped under the call node.",
+        "Graphs are acyclic. Put bounded polling inside actions, not backward edges. Each success path must prove its promised outcome. end.status supports pass, fail, or unknown; an unknown result is not proof of success."
       ],
-      "commands": []
+      "commands": ["mm-harness actions --action switch --json"]
     },
     {
       "id": "quality",
@@ -87,11 +109,19 @@
       "instruction": "Run the complete graph once into an explicit artifact directory, then apply the built-in quality bar before assigning coverage or a verdict.",
       "details": [
         "Coverage: every criterion needs an executable path and assertion; manual, untestable, and environment-dependent gaps stay explicit.",
+        "Optional proofTargets names claims with id and claim; nodes link evidence with proves: [id]. Coverage labels do not replace assertions.",
         "A blocked required runtime claim is incomplete proof. Passing static checks or closing a checklist cannot make that claim validated or fixed.",
         "Graph: no unconditional pass, generic intent, hidden start state, or opaque node that collapses preparation, action, assertion, evidence, and teardown.",
-        "Evidence: inspect the recipe resolution, summary, trace, manifest, logs, and actual visual evidence. A filename or passing node is not visual proof.",
+        "Assertion modes such as require_unchanged must fail before any corrective action. Verify the negative path leaves the inspected state untouched; an assertion must not repair the behavior it is supposed to test.",
+        "Reuse structured reads with assert_output instead of adding a new domain action for every comparison: source names the earlier node, and assert can select $.matchingCount with operator eq and the expected parameter. A status-report action can succeed while reporting missing prerequisites; assert required values before the dependent action. Checking three rows exist does not prove there are exactly three, or that they belong to this task.",
+        "Evidence: inspect the recipe resolution, summary, trace, manifest, logs, and actual visual evidence. A filename or passing node is not visual proof. A container's presence does not prove its data loaded; tab content does not prove its selection indicator. Verify the values and visible state required by the claim.",
+        "For a change claim, compare the actual before/after values for the same subject. Two captures alone prove neither an update nor freshness. Preserve unchanged observations as unproven rather than retrying to obtain a pass.",
+        "Match capture to the claim. Extension ui.capture_surface records the browser document through Chrome, including below-viewport document content but not hidden nested-scroll contents or native dialogs. Keep viewport assertions separate, inspect every image, and preserve failed captures rather than reconstructing them from HTML.",
+        "Screenshots: establish the claimed state, capture it, and inspect the original file. If a displayed preview looks incomplete, verify stored pixels or local OCR before reporting a capture defect or changing code. Preserve genuine failed captures. Performance: define a measured window, exclude setup, and compare equivalent builds, devices, and lifecycle conditions; action duration alone is not app latency.",
+        "Retain samples and declared limits when a measurement fails. For memory growth, compare an equal-duration idle control before attributing it to navigation; do not raise the budget to make the run pass.",
+        "Analytics: verify the collection destination and existing consent before capture. Changing participation or marketing consent requires operator approval and restoration of the prior settings; a recipe's hardcoded opt-in is not permission. Missing collection prerequisites are not missing product events.",
         "Flake risk: wait on observable state instead of sleeping, keep device and runtime identity explicit, and never overwrite a prior run's artifacts.",
-        "Mutation: require an independent state assertion, identity-bound receipt, and guaranteed cleanup."
+        "Mutation: require an independent state assertion and identity-bound receipt. Schedule authorized cleanup in teardown, verify its result, and report any residue. Testnet cleanup must not cancel another task's orders or close its positions."
       ],
       "commands": [
         "mm-harness run ./proof.recipe.json --artifacts-dir temp/recipe-proof --json",
@@ -102,18 +132,28 @@
     {
       "id": "drift",
       "title": "Repair drift and promote reusable learning",
-      "instruction": "When a shared recipe fails, reproduce once and classify product regression, recipe drift, fixture/runtime drift, harness defect, or live dependency before changing anything.",
+      "instruction": "Treat saved recipes as starting points, not compatibility guarantees. A failure starts diagnosis, not an automatic task stop. Preserve it, compare the current app with the task's acceptance criteria, and distinguish recipe drift from a product, harness, fixture, or live-dependency failure before repairing anything.",
       "details": [
         "The graph and evidence contract can be deterministic while the product, provider, account, or network outcome is not. Honest external rejection remains a valid result, not a reason to seek a green retry.",
-        "Trace the first failure through the exact action source and test the smallest causal explanation before filing or fixing a harness issue. A selector name does not establish its cause. If a proposed fix outgrows the confirmed cause, preserve it separately and return to the minimal fix.",
-        "For blocked runtime proof, retain the target identity, build/app state, and first failing command and error. Reconcile later status snapshots with that evidence; they cannot establish that an earlier device was absent.",
-        "For product-version drift, preserve the failed trace, copy the composed recipe into the task, keep working nodes, and repair the smallest owning node against the tested build.",
-        "Prove the changed node in isolation, re-plan, then rerun the full task-local recipe and affected callers. Never weaken an assertion or change product code merely to turn stale proof green.",
-        "Record the source recipe digest, tested product identity, repair, and fresh evidence. If the defect belongs to reusable harness code or bundled vocabulary, prepare a focused experimental-metamask-harness issue and open it when authorized.",
-        "Promote a repair only after it works on the tested version and current main, or declare and enforce its compatibility boundary."
+        "Trace the first failure through the exact action source and test the smallest causal explanation before filing or fixing a harness issue. Verify the visible screen as well as the route name; an old route identifier may now open a different screen. If a proposed fix outgrows the confirmed cause, preserve it separately and return to the minimal fix.",
+        "For blocked runtime proof, retain the target identity, build/app state, and first failing command and error. Reconcile later status snapshots with that evidence; they cannot establish that an earlier device was absent. Cold XCTest infrastructure belongs in explicit setup: consult agent-device help prepare using the same package, device and state directory. A preparation health check does not prove native snapshot or interaction latency.",
+        "A failed device-discovery probe is unknown availability, not proof that a simulator stopped. Inspect deviceDiscoveryErrors or DEVICE_DISCOVERY_FAILED and run its Next command before changing targets or restarting a runtime.",
+        "An RPC failure is not necessarily a credential or network failure. Distinguish an HTTP rejection from JavaScript execution errors and circuit-breaker cooldowns. Check build capabilities separately from remote rollout flags; do not reset a wallet to repair an unclassified failure.",
+        "For LavaMoat execution errors, inspect the effective bundled policy as well as the calling code. A nested method grant can change receiver binding. Reproduce the mechanism in isolation, then validate the owning product correction with LavaMoat still enabled; never replace fetch in the live worker to manufacture proof.",
+        "Use LaunchDarkly for feature rollout. Do not add local flag overrides to unblock validation. Match compile-time capabilities to the intended product build; if its remote rollout excludes the feature, report that prerequisite or request targeting from its owner.",
+        "For confirmed product-version drift, copy the closest recipe into the task and retain its working nodes. Adapt only the stale selector, route, input contract, or setup condition against current source and observed UI. Keep the task's acceptance criteria; do not rebuild a working journey or relax its proof to obtain a pass.",
+        "Inspect selection before toggling; skip already-satisfied setup. Visibility and a matching locator do not prove click readiness: a menu can move between press and release. Require an uncovered, stable target within the action budget, click once, then assert the result. If it fails, inspect the actual pointer target before changing locators. No fixed sleeps or repeated clicks.",
+        "Use test values distinct from the product's defaults so resets are observable. If an intentional transition reseeds a form, assert its documented reset contract using a recorded baseline; do not claim preservation because the chosen value happened to equal the default.",
+        "A loaded form shell is not a settled quote. Recheck every required preview condition after polling expires; stopping the wait must never turn missing fields into success. Verify this with a real unavailable-preview case and retain the failure.",
+        "After changing quote inputs, bind the returned quote to those inputs. A debounced request may leave the previous positive output and enabled CTA visible briefly; neither proves the new quote is ready. Inspect the capture too, and preserve stale/loading evidence instead of refreshing invisibly.",
+        "Native trees may include controls covered by developer or system overlays. Verify the screenshot before changing a selector; move or dismiss an overlay only as explicit setup and restore it afterward. Gesture path and delta values are offsets from the resolved start, not absolute endpoints; inspect the resolved coordinates and assert the resulting state.",
+        "Reconcile any earlier side effects before repeating a step; an unknown order or transaction outcome must not be resubmitted. Probe the repaired node with call or a small recipe, re-plan, then validate the full task-local recipe and affected callers. Continue the task when the repaired path is proven; report a blocker only when no supported, authorized path remains.",
+        "Record the source recipe digest, tested product identity, repair, and fresh evidence. If the defect belongs to reusable harness code or bundled vocabulary, prepare a focused experimental-metamask-harness issue and open it when authorized. Put verified authoring lessons in version-matched harness help; keep task-specific evidence in the task and skills as thin workflow wrappers.",
+        "Promote a repair only after it works on the tested version and current main, or declare and enforce its compatibility boundary.",
+        "Authoring guide: https://farmslot.io/docs/guides/write-a-recipe/ ; canonical field and graph contract: https://farmslot.io/docs/reference/recipe-protocol-v1/"
       ],
       "commands": []
     }
   ],
-  "safety": "Recipe parameters never bypass mutation consent or live-funds gates. Preserve valid live financial rejections exactly; never tune or retry merely to obtain a pass, and always run guaranteed cleanup."
+  "safety": "Recipe parameters never bypass mutation consent or live-funds gates. Preserve valid live financial rejections; never tune or retry merely to obtain a pass. Run required cleanup and report its actual outcome."
 }

package/library/recipes/assets/release-token-hide-readd.recipe.json

@@ -1,57 +0,0 @@
-{
-  "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
-  "title": "Assets release token hide and re-add",
-  "description": "Hides one imported token and re-enables it through Manage tokens, proving both home-list states.",
-  "paramsSchema": {
-    "type": "object",
-    "additionalProperties": false,
-    "properties": {
-      "query": { "type": "string", "default": "DAI" },
-      "timeout_ms": { "type": "integer", "minimum": 1000, "default": 45000 }
-    }
-  },
-  "workflow": {
-    "entry": "open-wallet",
-    "nodes": {
-      "open-wallet": {
-        "action": "ui.navigate",
-        "page": "home",
-        "intent": "Open the all-network asset list",
-        "next": "hide-token"
-      },
-      "hide-token": {
-        "action": "metamask.assets.set_token_visibility",
-        "query": "{{params.query}}",
-        "visible": false,
-        "require_change": true,
-        "timeout_ms": "{{params.timeout_ms}}",
-        "intent": "Disable the imported token and prove its row disappears",
-        "next": "capture-hidden"
-      },
-      "capture-hidden": {
-        "action": "ui.screenshot",
-        "path": "screenshots/assets-token-hidden.png",
-        "label": "Token hidden",
-        "intent": "Preserve reviewer-visible hidden state",
-        "next": "readd-token"
-      },
-      "readd-token": {
-        "action": "metamask.assets.set_token_visibility",
-        "query": "{{params.query}}",
-        "visible": true,
-        "require_change": true,
-        "timeout_ms": "{{params.timeout_ms}}",
-        "intent": "Re-enable the token and prove its metadata row returns",
-        "next": "capture-restored"
-      },
-      "capture-restored": {
-        "action": "ui.screenshot",
-        "path": "screenshots/assets-token-restored.png",
-        "label": "Token restored",
-        "intent": "Preserve reviewer-visible restored state",
-        "next": "done"
-      },
-      "done": { "action": "end", "status": "pass" }
-    }
-  }
-}