@riddledc/riddle-proof 0.8.72 → 0.8.73

package/README.md

@@ -545,6 +545,10 @@ stable enough for Playwright's default click actionability checks. Use `press`
 with a Playwright key name, such as `Enter`, `Space`, or `ArrowLeft`,
 when a route's intended browser control is keyboard-driven; omit `selector` for
 a page-level key press, or provide `selector` to press against a focused element.
+Target-level `wait_for_selector` runs immediately after navigation and before
+`setup_actions`. If setup creates the ready state, for example by seeding
+localStorage and reloading an authenticated fixture, put the readiness wait in
+`setup_actions` after the state change instead.
 For canvas games that read key state rather than keypress events, add `hold_ms`
 or `holdMs` to keep the key down before releasing it. When the profile needs
 to observe or wait on runtime evidence while a key remains held, use paired

package/dist/{chunk-XIJI62DC.js → chunk-ICIJTEHD.js}

@@ -1259,15 +1259,83 @@ function profileHttpStatusPreflightSummary(result) {
   return `${lines.join("\n")}
 `;
 }
+function profilePlainStatusLabel(status) {
+  if (status === "passed") return "passed";
+  if (status === "product_regression") return "product issue";
+  if (status === "proof_insufficient") return "missing evidence";
+  if (status === "environment_blocked") return "environment blocked";
+  if (status === "configuration_error") return "configuration issue";
+  return "needs review";
+}
+function profilePlainCheckSummary(result) {
+  const total = result.checks.length;
+  const passed = result.checks.filter((check) => check.status === "passed").length;
+  const failed = result.checks.filter((check) => check.status === "failed").length;
+  const review = result.checks.filter((check) => check.status === "needs_human_review").length;
+  const skipped = result.checks.filter((check) => check.status === "skipped").length;
+  const evidenceViewportNames = (result.evidence?.viewports || []).map((viewport) => cliString(viewport.name)).filter((name) => Boolean(name));
+  const setupViewportNames = evidenceViewportNames.length ? [] : profileSetupSummaryViewports(result).map((viewport) => cliString(viewport.name)).filter((name) => Boolean(name));
+  const viewportNames = evidenceViewportNames.length ? evidenceViewportNames : setupViewportNames;
+  const route = result.route?.requested || result.route?.observed;
+  const countText = total === 1 ? "1 check" : `${total} checks`;
+  const viewportText = viewportNames.length ? ` across ${viewportNames.length} viewport${viewportNames.length === 1 ? "" : "s"} (${viewportNames.join(", ")})` : "";
+  const routeText = route ? ` on ${markdownInlineCode(route, 120)}` : "";
+  const outcomes = [
+    passed ? `${passed} passed` : "",
+    failed ? `${failed} failed` : "",
+    review ? `${review} needs review` : "",
+    skipped ? `${skipped} skipped` : ""
+  ].filter(Boolean).join(", ");
+  if (!total) return route ? `No browser checks were recorded for ${markdownInlineCode(route, 120)}.` : "No browser checks were recorded.";
+  return `${countText}${viewportText}${routeText}; ${outcomes || "no completed checks"}.`;
+}
+function profileArtifactRefIsScreenshot(artifact) {
+  const kind = cliString(artifact.kind)?.toLowerCase() || "";
+  const contentType = cliString(artifact.content_type)?.toLowerCase() || "";
+  const text = [artifact.name, artifact.url, artifact.path].map((value) => cliString(value)).filter(Boolean).join(" ");
+  return kind === "screenshot" || contentType.startsWith("image/") || /\.(png|jpe?g|webp)(?:$|[?#])/i.test(text);
+}
+function profileArtifactDisplay(artifact) {
+  const name = artifact.name || artifact.kind || "artifact";
+  const location = artifact.url || artifact.path;
+  return location ? `${name}: ${location}` : name;
+}
+function profilePlainArtifactSummary(result) {
+  const hostedArtifacts = result.artifacts.riddle_artifacts || [];
+  const hostedScreenshot = hostedArtifacts.find(profileArtifactRefIsScreenshot);
+  if (hostedScreenshot) return `Hosted screenshot ${profileArtifactDisplay(hostedScreenshot)}`;
+  const hostedProof = hostedArtifacts.find((artifact) => {
+    const name = (artifact.name || artifact.url || artifact.path || "").toLowerCase();
+    return name.includes("proof.json");
+  });
+  if (hostedProof) return `Hosted proof JSON ${profileArtifactDisplay(hostedProof)}`;
+  if (result.artifacts.screenshots?.length) return `Screenshot ${markdownInlineCode(result.artifacts.screenshots[0])}`;
+  if (result.artifacts.proof_json) return `Proof JSON ${markdownInlineCode(result.artifacts.proof_json)}`;
+  return "profile-result.json and summary.md";
+}
+function profilePlainNextStep(result) {
+  if (result.status === "passed") return "Use this packet as scoped browser evidence, then review the linked artifacts before merge.";
+  if (result.status === "product_regression") return "Fix the failed product check(s), then rerun this profile.";
+  if (result.status === "proof_insufficient") return "Adjust the profile or runner so the required evidence artifacts are produced, then rerun.";
+  if (result.status === "environment_blocked") return "Fix the runner or environment blocker, then rerun.";
+  if (result.status === "configuration_error") return result.error ? `Fix the profile setup: ${result.error}` : "Fix the profile setup, then rerun.";
+  return "Review the artifacts manually, then refine the profile if the verdict should be automated.";
+}
 function profileResultMarkdown(result) {
   const lines = [
     `# Riddle Proof Profile: ${result.profile_name}`,
     "",
-    `Status: ${result.status}`,
-    `Runner: ${result.runner}`,
-    `Captured: ${result.captured_at}`,
+    `Result: ${profilePlainStatusLabel(result.status)}`,
+    `What was checked: ${profilePlainCheckSummary(result)}`,
+    `Artifact that proves it: ${profilePlainArtifactSummary(result)}`,
+    `What to do next: ${profilePlainNextStep(result)}`,
     "",
-    result.summary,
+    "## Details",
+    "",
+    `- Status: ${result.status}`,
+    `- Runner: ${result.runner}`,
+    `- Captured: ${result.captured_at}`,
+    `- Summary: ${result.summary}`,
     ""
   ];
   if (Array.isArray(result.warnings) && result.warnings.length) {

package/dist/cli/index.js

@@ -1,4 +1,4 @@
-import "../chunk-XIJI62DC.js";
+import "../chunk-ICIJTEHD.js";
 import "../chunk-B2DP2LET.js";
 import "../chunk-CWRIXP5H.js";
 import "../chunk-UE4I7RTI.js";

package/dist/cli.cjs

@@ -19821,15 +19821,83 @@ function profileHttpStatusPreflightSummary(result) {
   return `${lines.join("\n")}
 `;
 }
+function profilePlainStatusLabel(status) {
+  if (status === "passed") return "passed";
+  if (status === "product_regression") return "product issue";
+  if (status === "proof_insufficient") return "missing evidence";
+  if (status === "environment_blocked") return "environment blocked";
+  if (status === "configuration_error") return "configuration issue";
+  return "needs review";
+}
+function profilePlainCheckSummary(result) {
+  const total = result.checks.length;
+  const passed = result.checks.filter((check) => check.status === "passed").length;
+  const failed = result.checks.filter((check) => check.status === "failed").length;
+  const review = result.checks.filter((check) => check.status === "needs_human_review").length;
+  const skipped = result.checks.filter((check) => check.status === "skipped").length;
+  const evidenceViewportNames = (result.evidence?.viewports || []).map((viewport) => cliString(viewport.name)).filter((name) => Boolean(name));
+  const setupViewportNames = evidenceViewportNames.length ? [] : profileSetupSummaryViewports(result).map((viewport) => cliString(viewport.name)).filter((name) => Boolean(name));
+  const viewportNames = evidenceViewportNames.length ? evidenceViewportNames : setupViewportNames;
+  const route = result.route?.requested || result.route?.observed;
+  const countText = total === 1 ? "1 check" : `${total} checks`;
+  const viewportText = viewportNames.length ? ` across ${viewportNames.length} viewport${viewportNames.length === 1 ? "" : "s"} (${viewportNames.join(", ")})` : "";
+  const routeText = route ? ` on ${markdownInlineCode(route, 120)}` : "";
+  const outcomes = [
+    passed ? `${passed} passed` : "",
+    failed ? `${failed} failed` : "",
+    review ? `${review} needs review` : "",
+    skipped ? `${skipped} skipped` : ""
+  ].filter(Boolean).join(", ");
+  if (!total) return route ? `No browser checks were recorded for ${markdownInlineCode(route, 120)}.` : "No browser checks were recorded.";
+  return `${countText}${viewportText}${routeText}; ${outcomes || "no completed checks"}.`;
+}
+function profileArtifactRefIsScreenshot2(artifact) {
+  const kind = cliString(artifact.kind)?.toLowerCase() || "";
+  const contentType = cliString(artifact.content_type)?.toLowerCase() || "";
+  const text = [artifact.name, artifact.url, artifact.path].map((value) => cliString(value)).filter(Boolean).join(" ");
+  return kind === "screenshot" || contentType.startsWith("image/") || /\.(png|jpe?g|webp)(?:$|[?#])/i.test(text);
+}
+function profileArtifactDisplay(artifact) {
+  const name = artifact.name || artifact.kind || "artifact";
+  const location = artifact.url || artifact.path;
+  return location ? `${name}: ${location}` : name;
+}
+function profilePlainArtifactSummary(result) {
+  const hostedArtifacts = result.artifacts.riddle_artifacts || [];
+  const hostedScreenshot = hostedArtifacts.find(profileArtifactRefIsScreenshot2);
+  if (hostedScreenshot) return `Hosted screenshot ${profileArtifactDisplay(hostedScreenshot)}`;
+  const hostedProof = hostedArtifacts.find((artifact) => {
+    const name = (artifact.name || artifact.url || artifact.path || "").toLowerCase();
+    return name.includes("proof.json");
+  });
+  if (hostedProof) return `Hosted proof JSON ${profileArtifactDisplay(hostedProof)}`;
+  if (result.artifacts.screenshots?.length) return `Screenshot ${markdownInlineCode(result.artifacts.screenshots[0])}`;
+  if (result.artifacts.proof_json) return `Proof JSON ${markdownInlineCode(result.artifacts.proof_json)}`;
+  return "profile-result.json and summary.md";
+}
+function profilePlainNextStep(result) {
+  if (result.status === "passed") return "Use this packet as scoped browser evidence, then review the linked artifacts before merge.";
+  if (result.status === "product_regression") return "Fix the failed product check(s), then rerun this profile.";
+  if (result.status === "proof_insufficient") return "Adjust the profile or runner so the required evidence artifacts are produced, then rerun.";
+  if (result.status === "environment_blocked") return "Fix the runner or environment blocker, then rerun.";
+  if (result.status === "configuration_error") return result.error ? `Fix the profile setup: ${result.error}` : "Fix the profile setup, then rerun.";
+  return "Review the artifacts manually, then refine the profile if the verdict should be automated.";
+}
 function profileResultMarkdown(result) {
   const lines = [
     `# Riddle Proof Profile: ${result.profile_name}`,
     "",
-    `Status: ${result.status}`,
-    `Runner: ${result.runner}`,
-    `Captured: ${result.captured_at}`,
+    `Result: ${profilePlainStatusLabel(result.status)}`,
+    `What was checked: ${profilePlainCheckSummary(result)}`,
+    `Artifact that proves it: ${profilePlainArtifactSummary(result)}`,
+    `What to do next: ${profilePlainNextStep(result)}`,
     "",
-    result.summary,
+    "## Details",
+    "",
+    `- Status: ${result.status}`,
+    `- Runner: ${result.runner}`,
+    `- Captured: ${result.captured_at}`,
+    `- Summary: ${result.summary}`,
     ""
   ];
   if (Array.isArray(result.warnings) && result.warnings.length) {

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-XIJI62DC.js";
+import "./chunk-ICIJTEHD.js";
 import "./chunk-B2DP2LET.js";
 import "./chunk-CWRIXP5H.js";
 import "./chunk-UE4I7RTI.js";

package/examples/neutral-fixture-site/README.md

@@ -17,3 +17,11 @@ packages/riddle-proof-runner-playwright/bin/riddle-proof-playwright run-profile
 The sibling `neutral-fixture-product-regression.json` profile intentionally
 looks for a missing selector. A correct Riddle Proof run reports
 `product_regression`, not `passed`.
+
+`neutral-fixture-auth-session.json` exercises a stored browser-state handoff by
+writing a deterministic localStorage token, reloading `auth.html`, and proving
+that the authenticated fixture state is visible.
+
+The auth profile keeps its readiness wait inside `setup_actions`, after the
+localStorage write and reload. A target-level `wait_for_selector` would run
+before setup and would block the token handoff.

package/examples/neutral-fixture-site/auth.html

@@ -0,0 +1,45 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Riddle Proof Auth Fixture</title>
+    <link rel="stylesheet" href="./styles.css" />
+  </head>
+  <body>
+    <main class="fixture-shell" data-rp-fixture="auth">
+      <p class="eyebrow">Neutral fixture</p>
+      <h1>Stored Auth Smoke</h1>
+      <p class="lead">
+        This page only exposes the success state when the runner supplies the
+        expected stored browser token.
+      </p>
+      <section class="evidence-panel auth-state" id="auth-state" data-rp-fixture="auth-pending" aria-live="polite">
+        Checking stored browser state.
+      </section>
+    </main>
+    <script>
+      (() => {
+        const expectedToken = "riddle-proof-fixture-token";
+        const observedToken = window.localStorage.getItem("rp_fixture_auth_token") || "";
+        const panel = document.getElementById("auth-state");
+        if (!panel) return;
+        if (observedToken === expectedToken) {
+          document.documentElement.dataset.authState = "passed";
+          panel.dataset.rpFixture = "auth-passed";
+          panel.innerHTML = [
+            "<strong>Authenticated fixture passed</strong>",
+            "<span>Stored browser state reached the page before checks ran.</span>",
+          ].join("");
+          return;
+        }
+        document.documentElement.dataset.authState = "blocked";
+        panel.dataset.rpFixture = "auth-blocked";
+        panel.innerHTML = [
+          "<strong>Sign in required</strong>",
+          "<span>The expected stored browser token was not present.</span>",
+        ].join("");
+      })();
+    </script>
+  </body>
+</html>

package/examples/neutral-fixture-site/index.html

@@ -17,6 +17,7 @@
       </p>
       <nav aria-label="Fixture pages">
         <a href="./pass.html">Passing fixture page</a>
+        <a href="./auth.html">Stored auth fixture page</a>
       </nav>
     </main>
   </body>

package/examples/neutral-fixture-site/styles.css

@@ -22,6 +22,13 @@ a {
   font-weight: 700;
 }
 
+nav {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 14px 18px;
+  margin-top: 28px;
+}
+
 .fixture-shell {
   width: min(100% - 32px, 760px);
   margin: 0 auto;
@@ -90,6 +97,31 @@ dd {
   font-weight: 700;
 }
 
+.auth-state {
+  display: grid;
+  gap: 6px;
+  padding: 18px;
+}
+
+.auth-state strong,
+.auth-state span {
+  display: block;
+}
+
+.auth-state strong {
+  font-size: 1.05rem;
+}
+
+.auth-state[data-rp-fixture="auth-passed"] {
+  border-color: #7bb69c;
+  background: #f1fbf6;
+}
+
+.auth-state[data-rp-fixture="auth-blocked"] {
+  border-color: #c58b8b;
+  background: #fff6f4;
+}
+
 @media (max-width: 640px) {
   h1 {
     font-size: 2.25rem;

package/examples/profiles/neutral-fixture-auth-session.json

@@ -0,0 +1,44 @@
+{
+  "version": "riddle-proof.profile.v1",
+  "name": "neutral-fixture-auth-session",
+  "target": {
+    "route": "/auth.html",
+    "viewports": [
+      { "name": "phone", "width": 390, "height": 844 },
+      { "name": "desktop", "width": 1440, "height": 1000 }
+    ],
+    "auth": "stored-browser-state-fixture",
+    "setup_actions": [
+      {
+        "type": "local_storage",
+        "key": "rp_fixture_auth_token",
+        "value": "riddle-proof-fixture-token",
+        "reload": true
+      },
+      {
+        "type": "wait_for_selector",
+        "selector": "[data-rp-fixture=\"auth-passed\"]",
+        "timeout_ms": 10000
+      },
+      { "type": "wait", "ms": 100 }
+    ]
+  },
+  "checks": [
+    { "type": "route_loaded", "expected_path": "/auth.html" },
+    { "type": "selector_visible", "selector": "[data-rp-fixture=\"auth-passed\"]" },
+    { "type": "selector_text_visible", "selector": "[data-rp-fixture=\"auth-passed\"]", "text": "Authenticated fixture passed" },
+    { "type": "selector_text_absent", "selector": "body", "text": "Sign in required" },
+    { "type": "no_mobile_horizontal_overflow" },
+    { "type": "no_fatal_console_errors" }
+  ],
+  "artifacts": ["screenshot", "console", "dom_summary", "proof_json"],
+  "metadata": {
+    "fixture_kind": "stored_auth_session",
+    "covers": "localStorage auth/session handoff before browser checks"
+  },
+  "failure_policy": {
+    "environment_blocked": "neutral",
+    "proof_insufficient": "fail",
+    "product_regression": "fail"
+  }
+}

package/examples/story-matrices/riddle-proof-bounded-loop.json

@@ -334,6 +334,25 @@
       "existing_coverage": ["docs/riddle-proof-story-matrix-runs/2026-06-22-neutral-fixture-batch.md"],
       "status": "recurring"
     },
+    {
+      "id": "rp-story-neutral-fixture-auth-session-smoke",
+      "batch": "neutral-fixture",
+      "surface": "neutral fixture auth/session profile",
+      "user_story": "As a Riddle Proof user, I can run a browser profile that supplies stored auth/session state before page checks execute.",
+      "expected_behavior": "The profile writes a deterministic localStorage token, reloads the page, reaches the authenticated fixture state, and produces normal proof artifacts locally and hosted.",
+      "primary_runner": "hosted-riddle",
+      "command": "riddle-proof-loop run-profile --profile packages/riddle-proof/examples/profiles/neutral-fixture-auth-session.json --url <preview-url> --runner riddle --output artifacts/riddle-proof/neutral-fixture-auth-session-hosted --result-format compact-json",
+      "expected_verdict": "passed",
+      "evidence_required": [
+        "profile-result.json status is passed",
+        "setup_actions_succeeded records local_storage with reload",
+        "hosted or local screenshots show the authenticated fixture state"
+      ],
+      "receipt_types": ["profile-result.json", "proof.json", "summary.md", "screenshot"],
+      "failure_classes": ["product_regression", "proof_insufficient", "environment_blocked"],
+      "existing_coverage": ["examples/profiles/neutral-fixture-auth-session.json", "examples/neutral-fixture-site/auth.html"],
+      "status": "recurring"
+    },
     {
       "id": "rp-story-neutral-fixture-public-state-blockers",
       "batch": "neutral-fixture",

package/examples/story-matrices/riddle-proof-ux-coverage.csv

@@ -21,8 +21,9 @@ area,user_story_id,user_story,expected_behavior,surface,runner,evidence_required
 "Agent summary","rp-ux-agent-summary-contract-human-review","As an agent consuming Riddle Proof output, I see needs_human_review as a held proof state, not a pass.","Agent summary helper maps needs_human_review to proof_blocked and requires human-review disclosure.","agent summary contract","formal-conformance","needs_human_review packet; disclosure; prohibited proof_passed claim","passed","2026-06-21","packages/riddle-proof/formal-conformance.test.js","Human-review verdicts now stay blocked in public consumer surfaces.","Keep this for evidence packets with subjective or unsupported checks.","P2","contract_gap"
 "Agent summary","rp-ux-agent-summary-product-wiring-uses-contract","As an agent consuming real Riddle Proof output, the emitted summary uses the shared contract rather than raw fields.","Agent-facing summaries import/use the public-state consumer helper for status, handoff, and prohibited claims.","agent-facing summary","manual-review","summary text; contract import or documented gap; negative-control packet","needs_product_hook","","","Package helper is now contract-tested; product wiring still needs an executable consumer check outside PR comments.","Find the actual agent summary renderer/emitter and wire or verify summarizeRiddleProofAgentSummarySurface usage.","P1","contract_gap"
 "Neutral fixture","rp-ux-neutral-fixture-public-state-blockers","As a consumer of Riddle Proof summaries, I can validate status semantics on neutral packets rather than Riddle docs packets.","Neutral public-state fixtures cover passed handoff, product_regression, proof_insufficient, environment_blocked, and checkpoint audit claims.","neutral public-state fixtures","runtime-test","fixture JSON; hosted proof view helper; agent summary helper","passed","2026-06-22","packages/riddle-proof/story-matrix.test.js","Neutral packet fixtures keep public-state semantics separate from Riddle docs dogfood.","Keep this as the fast semantic canary before local, hosted, docs, and real-app sweeps.","P1","contract_gap"
-"Neutral fixture","rp-ux-neutral-fixture-local-pass","As a maintainer, I can run a non-Riddle static fixture page locally and get a normal evidence packet.","Local Playwright pass profile returns passed with proof JSON, console, DOM summary, artifact manifest, and screenshots.","neutral fixture browser profile","local-playwright","profile-result.json; artifact-manifest.json; screenshot; proof.json","passed","2026-06-22","docs/riddle-proof-story-matrix-runs/2026-06-22-neutral-fixture-batch.md","Neutral static fixture produced a passed local evidence packet across phone and desktop.","Keep as the clean non-docs local canary before real-app sweeps.","P1","configuration_error"
-"Neutral fixture","rp-ux-neutral-fixture-negative-control","As a maintainer, I can run a non-Riddle negative-control profile and get product_regression instead of a false pass.","Local Playwright negative-control profile fails only the deliberate missing selector and preserves review artifacts.","neutral fixture browser profile","local-playwright","profile-result.json; failed check; screenshot; proof.json","product_regression_expected","2026-06-22","docs/riddle-proof-story-matrix-runs/2026-06-22-neutral-fixture-batch.md","Neutral negative control stayed red on [data-rp-fixture=""missing-required-control""] while preserving artifacts.","Keep paired with the pass fixture before broader UX sweeps.","P1","contract_gap"
-"Neutral fixture","rp-ux-neutral-fixture-hosted-pass","As a maintainer, I can run a non-Riddle static fixture preview on hosted Riddle and get a normal evidence packet.","Hosted pass profile returns passed with hosted job id, proof JSON, console, DOM summary, and screenshots.","neutral fixture hosted profile","hosted-riddle","profile-result.json; riddle.job_id; screenshot URLs; proof.json","passed","2026-06-22","docs/riddle-proof-story-matrix-runs/2026-06-22-neutral-fixture-batch.md","Hosted neutral pass produced job_2ab0f3f3 after fixture artifact requirements were calibrated.","Keep as the clean hosted canary before docs dogfood and real-app sweeps.","P1","environment_blocked"
-"Neutral fixture","rp-ux-neutral-fixture-hosted-negative-control","As a maintainer, I can run a non-Riddle hosted negative-control profile and get product_regression instead of a false pass.","Hosted negative-control profile reaches the static preview and fails only the deliberate missing selector.","neutral fixture hosted profile","hosted-riddle","profile-result.json; failed check; screenshot URLs; proof.json","product_regression_expected","2026-06-22","docs/riddle-proof-story-matrix-runs/2026-06-22-neutral-fixture-batch.md","Hosted neutral negative control produced job_b308bc57 with product_regression and preserved artifact URLs.","Keep paired with the hosted pass fixture before broader hosted UX sweeps.","P1","contract_gap"
+"Neutral fixture","rp-ux-neutral-fixture-local-pass","As a maintainer, I can run a non-Riddle static fixture page locally and get a normal evidence packet.","Local Playwright pass profile returns passed with proof JSON, console, DOM summary, artifact manifest, and screenshots.","neutral fixture browser profile","local-playwright","profile-result.json; artifact-manifest.json; screenshot; proof.json","passed","2026-06-22","docs/riddle-proof-story-matrix-runs/2026-06-22-auth-session-smoke.md","Neutral static fixture still produced a passed local evidence packet across phone and desktop after auth fixture changes.","Keep as the clean non-docs local canary before real-app sweeps.","P1","configuration_error"
+"Neutral fixture","rp-ux-neutral-fixture-negative-control","As a maintainer, I can run a non-Riddle negative-control profile and get product_regression instead of a false pass.","Local Playwright negative-control profile fails only the deliberate missing selector and preserves review artifacts.","neutral fixture browser profile","local-playwright","profile-result.json; failed check; screenshot; proof.json","product_regression_expected","2026-06-22","docs/riddle-proof-story-matrix-runs/2026-06-22-auth-session-smoke.md","Neutral negative control still stayed red on [data-rp-fixture=""missing-required-control""] while preserving artifacts.","Keep paired with the pass fixture before broader UX sweeps.","P1","contract_gap"
+"Neutral fixture","rp-ux-neutral-fixture-hosted-pass","As a maintainer, I can run a non-Riddle static fixture preview on hosted Riddle and get a normal evidence packet.","Hosted pass profile returns passed with hosted job id, proof JSON, console, DOM summary, and screenshots.","neutral fixture hosted profile","hosted-riddle","profile-result.json; riddle.job_id; screenshot URLs; proof.json","passed","2026-06-22","job_3867a928; docs/riddle-proof-story-matrix-runs/2026-06-22-auth-session-smoke.md","Hosted neutral pass produced job_3867a928 after auth fixture changes.","Keep as the clean hosted canary before docs dogfood and real-app sweeps.","P1","environment_blocked"
+"Neutral fixture","rp-ux-neutral-fixture-hosted-negative-control","As a maintainer, I can run a non-Riddle hosted negative-control profile and get product_regression instead of a false pass.","Hosted negative-control profile reaches the static preview and fails only the deliberate missing selector.","neutral fixture hosted profile","hosted-riddle","profile-result.json; failed check; screenshot URLs; proof.json","product_regression_expected","2026-06-22","job_552de3af; docs/riddle-proof-story-matrix-runs/2026-06-22-auth-session-smoke.md","Hosted neutral negative control produced job_552de3af with product_regression and preserved artifact URLs.","Keep paired with the hosted pass fixture before broader hosted UX sweeps.","P1","contract_gap"
+"Neutral fixture","rp-story-neutral-fixture-auth-session-smoke","As a maintainer, I can run a non-Riddle profile that supplies stored auth/session state before checks execute.","Auth/session profile writes localStorage, reloads the page, reaches the authenticated fixture state, and preserves artifacts.","neutral fixture auth/session profile","hosted-riddle","profile-result.json; setup_actions_succeeded local_storage receipt; screenshot; proof.json","passed","2026-06-22","job_1daf11b4; docs/riddle-proof-story-matrix-runs/2026-06-22-auth-session-smoke.md","Local and hosted auth/session smoke passed; profile-authoring note added for setup-action readiness ordering.","Keep this next to neutral pass and negative controls before real authenticated product sweeps.","P1","environment_blocked"
 "Release and publish","rp-ux-release-publish-flow","As a package maintainer, I can merge a fix, get a version PR, and publish the package without manual status fakery.","Changeset release PR validates, merges, and trusted npm publish updates latest.","changesets release","github-actions","release PR; Release workflow; npm view latest","passed","2026-06-21","@riddledc/riddle-proof@0.8.68","Release path worked for the reporting fix and published with provenance.","Keep GitHub Action noise low and use this as release smoke.","P2","environment_blocked"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riddledc/riddle-proof",
-  "version": "0.8.72",
+  "version": "0.8.73",
   "description": "Reusable Riddle Proof contracts and helpers for evidence-backed agent changes.",
   "license": "MIT",
   "author": "RiddleDC",