prizmkit 1.1.129 → 1.1.131

package/bundled/dev-pipeline/templates/bootstrap-tier3.md

@@ -237,37 +237,43 @@ For each Verification Gate from the Task Contract, write one evidence line to Im
 
 ### Review — Code Review
 
-Review the completed implementation before the scoped feature test gate runs. Use `artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/` so `/prizmkit-code-review` can read the spec, plan, context snapshot, implementation log, and current diff. Do not require or read a prior `/prizmkit-test` report here; test generation and test-fix looping happen in the next phase.
+Review the completed implementation before the full Feature test gate. Run `/prizmkit-code-review artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/` in the current Main Agent; never delegate review directly or indirectly. The current Main Agent is the only Code Review executor. Do not invoke another review skill or review workflow, and do not relabel delegated work as a finder, verifier, audit, compatibility review, verification, or gap sweep.
 
-Run `/prizmkit-code-review` with `artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/`. The skill runs a Main-Agent review loop for up to ten completed rounds. The current Main Agent is the only Code Review executor: it directly reviews, repairs accepted findings, verifies repairs, and converges when accepted and unresolved findings are both zero.
+- `REVIEW_PASS` → record `stage=code-review`, `status=REVIEW_PASS`, `stage_result=PASS`, `next_stage=prizmkit-test`, and `resume_from=prizmkit-test`; then run the test gate.
+- `REVIEW_NEEDS_FIXES` → increment the shared outer `repair_round` and route `prizmkit-implement` → `prizmkit-code-review` → `prizmkit-test`.
+- Stop as `WORKFLOW_BLOCKED` when the outer repair round is already three. The Main-Agent review loop has its separate limit of up to ten completed rounds.
 
-The Code Review execution boundary is absolute: do not delegate review directly or indirectly. Do not invoke another review skill or review workflow. Do not relabel delegated work as a finder, verifier, audit, compatibility review, verification, or gap sweep. Direct reading, searching, editing, and testing by the current Main Agent remain allowed. `review-report.md` is the only persisted review artifact. Missing required evidence, unsafe repair, failed verification, or round-ten non-convergence produces `NEEDS_FIXES`.
+`review-report.md` is the only persisted review artifact; do not append separate Review Notes to `context-snapshot.md`. Missing evidence, unsafe repair, failed verification, or non-convergence produces `REVIEW_NEEDS_FIXES`.
 
 **Gate Check — Final Review Result**:
 ```bash
 {{RUNTIME_HELPER_CMD}} text final-verdict .prizmkit/specs/{{FEATURE_SLUG}}/review-report.md
 ```
-Handle `REVIEW_PASS` and `REVIEW_NEEDS_FIXES` according to task policy. `REVIEW_INCOMPLETE` or `REVIEW_INVALID` means review did not complete: inspect progress once, write `failure-log.md`, and stop. Do not accept old or incidental verdict text or synthesize a passing result through Main-Agent self-review.
 
-**CP-3**: Review has a valid Final Result and the report preserves this execution's progress.
+Only `REVIEW_PASS` can proceed to the structured Feature test gate. `REVIEW_INCOMPLETE` or `REVIEW_INVALID` writes `failure-log.md` and stops.
 
 ### Scoped Feature Test Gate — PrizmKit Test
 
-Run `/prizmkit-test scope=this-change artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/` after review and before commit.
+Create the current-run marker, then invoke the Feature gate:
 
-Before invoking the skill, create a current-run marker so stale reports are ignored:
 ```bash
 {{RUNTIME_HELPER_CMD}} artifact ensure-dir .prizmkit/specs/{{FEATURE_SLUG}}
 {{RUNTIME_HELPER_CMD}} artifact touch .prizmkit/specs/{{FEATURE_SLUG}}/.prizmkit-test-started
 ```
 
-Gate requirements:
-- Generate or update tests only for this feature's changed files, changed public interfaces, and acceptance criteria.
-- Do NOT use `.prizmkit/bugfix/` or `.prizmkit/refactor/` artifact directories.
-- Record unrelated historical gaps under `Out of Scope Gaps`; do not generate tests for them and do not fail this feature because of them.
-- Accept only a current-run `.prizmkit/test/*/test-report.md` whose `Scope` mode is `this-change`, whose `Artifact Dir` matches `.prizmkit/specs/{{FEATURE_SLUG}}/`, whose `Verdict` is `PASS`, whose `Boundary Completion Gate` reports `Completion gate passed: yes` with zero `Boundary-missing` and zero `Happy-path-only`, and whose `Boundary Validation` result is `passed`.
-- Only after a valid `PASS`, write the report path to `.prizmkit/specs/{{FEATURE_SLUG}}/test-report-path.txt` and append a 3-5 bullet `## PrizmKit Test Gate` summary to `context-snapshot.md`.
-- If the report verdict is `NEEDS_FIXES`, fix in-scope implementation/test issues and rerun `/prizmkit-test`. If the report is missing, stale, invalid, or for the wrong scope/artifact dir, write `failure-log.md` and stop for recovery.
+```text
+/prizmkit-test scope=this-change artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/
+```
+
+The Markdown `test-report.md` is a derived view only. Locate its package through `.prizmkit/specs/{{FEATURE_SLUG}}/test-report-path.txt` and consume authoritative `.prizmkit/test/evidence/<evidence-id>/manifest.json`, `verdict.json`, and `validation.json`. Before accepting `TEST_PASS`, verify evidence identity/scope, every manifest file hash, final-verdict agreement, validator result and payload hash, current inventory target hashes, and the compatibility value `legacy-test-report-interface-not-supported`. Never accept a Markdown-only PASS.
+
+Repair routes:
+- `TEST_FAIL` with `repair_scope=test-infrastructure` → implement → test, without speculative production edits.
+- `TEST_FAIL` with production/runtime/schema/dependency/public-interface scope → implement → code-review → test.
+- Unknown unsafe scope → `WORKFLOW_BLOCKED`; do not guess a production edit.
+- `TEST_BLOCKED` → preserve evidence/artifacts, perform bounded environment recovery, then resume from test or finish terminal `WORKFLOW_BLOCKED`; never edit production speculatively.
+
+Record `stage`, `status`, `stage_result`, `repair_scope`, `repair_round`, structured evidence paths, `next_stage`, and `resume_from` in truthful recovery metadata. Keep L1 workflow state separate from L4 `workflow-checkpoint.json`. The outer repair round stops after three and is independent of the internal review loop.
 
 {{IF_BROWSER_INTERACTION}}
 ### Phase 5.5: Browser Verification — MANDATORY

package/bundled/dev-pipeline/templates/bugfix-bootstrap-prompt.md

@@ -132,8 +132,7 @@ Run `/prizmkit-plan` with `artifact_dir=.prizmkit/bugfix/{{BUG_ID}}/`:
 - **Browser Verification**: If the bug is UI-reproducible, plan.md should reference the Browser Verification Protocol above instead of redefining browser steps.
 {{END_IF_BROWSER_INTERACTION}}
 
-**DECISION GATE — Fast Path Check**:
-- If plan.md has ≤ 2 tasks AND root cause is obvious → mark `FAST_PATH=true`, skip Phase 3 (Review) later
+**ATOMIC GATE**: Every committable Bugfix must complete code review and the mandatory post-review `prizmkit-test` stage. Small or obvious fixes do not bypass either gate.
 
 **CP-1**: spec.md and plan.md exist with Tasks section.
 
@@ -177,7 +176,7 @@ After implement completes, verify:
 
 ### Phase 3: Review
 
-If `FAST_PATH=true` (≤ 2 tasks, obvious root cause), skip this phase entirely and mark checkpoint step `prizmkit-code-review` as `skipped` before continuing.
+Code review is mandatory for every committable Bugfix. Do not skip this phase for small or obvious fixes.
 
 Run `/prizmkit-code-review` with `artifact_dir=.prizmkit/bugfix/{{BUG_ID}}/`:
 - The skill runs up to ten Main-Agent review rounds, directly repairs accepted findings, and verifies each repair
@@ -198,7 +197,21 @@ Handle `REVIEW_PASS` and `REVIEW_NEEDS_FIXES` according to task policy. `REVIEW_
 
 **CP-3**: Code review complete, `review-report.md` written, and all tests green.
 
-**Checkpoint update**: Set step `prizmkit-code-review` to `"completed"`.
+**Checkpoint update**: Set step `prizmkit-code-review` to `"completed"` only for an accepted valid Final Result.
+
+---
+
+### Phase 4: Post-Review Test Gate — PrizmKit Test
+
+After a valid code-review PASS, run the mandatory authoritative test gate against the same artifact root:
+
+```text
+/prizmkit-test scope=this-change artifact_dir=.prizmkit/bugfix/{{BUG_ID}}/
+```
+
+Read the current structured `manifest.json`, `verdict.json`, and `validation.json`; Markdown alone is never completion authority. `TEST_FAIL` with `test-infrastructure` returns through implementation directly to test. Production/runtime/schema/dependency/public-interface fixes return through implementation, fresh review, and test. Unknown scope is blocked. `TEST_BLOCKED` permits bounded automatic environment recovery at the test stage or terminal `WORKFLOW_BLOCKED`, never speculative production edits. The shared outer repair cap is three.
+
+Only validated `TEST_PASS` may proceed to commit.
 
 {{IF_VERIFICATION_MANUAL_OR_HYBRID}}
 **MANUAL VERIFICATION GATE**:
@@ -212,6 +225,10 @@ Handle `REVIEW_PASS` and `REVIEW_NEEDS_FIXES` according to task policy. `REVIEW_
 
 ### Phase 4: Commit & Learn
 
+### Headless Commit Authorization
+
+This pipeline launch authorizes one local task commit only after review and authoritative test evidence pass. Never ask a question, wait for input, or request confirmation. Invoke `/prizmkit-committer` with `mode=l4-headless`, `owner=prizmkit-l4`, `local_commit_authorized=true`, and `push_authorized=false`. Never push.
+
 **Bug Fix Documentation Policy**:
 - **DEFAULT**: Run `/prizmkit-retrospective` with structural sync only (Job 1). Skip knowledge injection.
 - **Full retrospective** (Job 1 + Job 2): Only when the fix causes interface signature changes, dependency additions/removals, observable behavior changes, or reveals new TRAPs.

package/bundled/dev-pipeline/templates/refactor-bootstrap-prompt.md

@@ -157,6 +157,20 @@ Handle `REVIEW_PASS` and `REVIEW_NEEDS_FIXES` according to behavior-preservation
 
 ---
 
+### Phase 5: Post-Review Test Gate — PrizmKit Test
+
+After a valid code-review PASS, run the mandatory authoritative test gate against the same artifact root:
+
+```text
+/prizmkit-test scope=this-change artifact_dir=.prizmkit/refactor/{{REFACTOR_ID}}/
+```
+
+Behavior-preservation checks remain supporting evidence and never replace current structured `manifest.json`, `verdict.json`, and `validation.json`. `TEST_FAIL` with `test-infrastructure` returns through implementation directly to test. Production/runtime/schema/dependency/public-interface fixes return through implementation, fresh review, and test. Unknown scope is blocked. `TEST_BLOCKED` permits bounded automatic environment recovery at the test stage or terminal `WORKFLOW_BLOCKED`, never speculative production edits. The shared outer repair cap is three.
+
+Only validated `TEST_PASS` may proceed to browser verification or commit.
+
+---
+
 {{IF_BROWSER_INTERACTION}}
 ### Phase 5: Browser Verification
 
@@ -171,6 +185,10 @@ Record tool choice, URL, steps, screenshot path if available, result, and cleanu
 {{END_IF_BROWSER_INTERACTION}}
 ### Phase 6: Commit, Report & Completion Summary
 
+### Headless Commit Authorization
+
+This pipeline launch authorizes one local task commit only after review, authoritative test evidence, and required behavior-preservation gates pass. Never ask a question, wait for input, or request confirmation. Invoke `/prizmkit-committer` with `mode=l4-headless`, `owner=prizmkit-l4`, `local_commit_authorized=true`, and `push_authorized=false`. Never push.
+
 Run `/prizmkit-retrospective` using the current working tree and staged changes as input context. Do not rely only on `git diff --cached`.
 
 Stage changed files explicitly; never use `git add -A` or `git add .`.

package/bundled/dev-pipeline/templates/sections/bugfix-phase-diagnose-plan.md

@@ -16,7 +16,7 @@
    - Relevant TRAPS/RULES
 4. Run `/prizmkit-plan` with `artifact_dir=.prizmkit/bugfix/{{BUG_ID}}/`.
 5. Ensure `plan.md` starts with a reproduction test task that would fail before the fix.
-6. Decide `FAST_PATH=true` only when root cause is obvious and plan has no more than 2 tasks.
+6. Do not create a FAST_PATH that bypasses code review or the mandatory post-review test gate; all committable Bugfixes use the same atomic stages.
 
 **CP-BF-1**: `spec.md` and `plan.md` exist, and the first plan task is a reproduction test.
 

package/bundled/dev-pipeline/templates/sections/bugfix-phase-review.md

@@ -1,18 +1,8 @@
 ### Phase 3: Review
 
-If `FAST_PATH=true`, skip this phase intentionally:
+Code review is mandatory for every committable Bugfix, including small or obvious fixes. Do not create a FAST_PATH that skips this gate.
 
-```bash
-{{CHECKPOINT_PYTHON_CMD}} \
-  --checkpoint-path {{CHECKPOINT_PATH}} \
-  --step prizmkit-code-review \
-  --status skipped \
-  --note "FAST_PATH: obvious root cause and <=2 tasks"
-```
-
-Then continue to the next checkpoint step.
-
-Otherwise, run `/prizmkit-code-review` with `artifact_dir=.prizmkit/bugfix/{{BUG_ID}}/`. The skill runs a Main-Agent review loop for up to ten completed rounds. The current Main Agent is the only Code Review executor: it reviews the complete current change, rejects unsupported candidate findings, directly repairs accepted findings, verifies repairs, and repeats until `accepted = 0` with no unresolved findings.
+Run `/prizmkit-code-review` with `artifact_dir=.prizmkit/bugfix/{{BUG_ID}}/`. The skill runs a Main-Agent review loop for up to ten completed rounds. The current Main Agent is the only Code Review executor: it reviews the complete current change, rejects unsupported candidate findings, directly repairs accepted findings, verifies repairs, and repeats until `accepted = 0` with no unresolved findings.
 
 The Code Review execution boundary is absolute for this phase:
 
@@ -30,8 +20,8 @@ Missing required evidence, an unsafe repair, a failed verification, or failure t
 {{RUNTIME_HELPER_CMD}} text final-verdict .prizmkit/bugfix/{{BUG_ID}}/review-report.md
 ```
 
-- `REVIEW_PASS` → proceed.
-- `REVIEW_NEEDS_FIXES` → log unresolved findings and proceed only when explicit task policy allows them.
+- `REVIEW_PASS` → proceed to the mandatory post-review test gate.
+- `REVIEW_NEEDS_FIXES` → route through bounded implementation/review/test repair; do not commit.
 - `REVIEW_INCOMPLETE` or `REVIEW_INVALID` → inspect progress once, write `failure-log.md`, and stop. Do not accept old or incidental verdict text and do not synthesize a passing result outside the skill.
 
-**Checkpoint update**: Set step `prizmkit-code-review` to `completed` only for an accepted valid Final Result, or `skipped` for FAST_PATH.
+**Checkpoint update**: Set step `prizmkit-code-review` to `completed` with `stage_result=REVIEW_PASS` only for an accepted valid Final Result.

package/bundled/dev-pipeline/templates/sections/bugfix-phase-test.md

@@ -0,0 +1,21 @@
+### Bugfix Test Gate — PrizmKit Test
+
+After Main-Agent code review returns a valid `PASS`, run the mandatory post-review test stage against the same Bugfix artifact root. Implementation and review completion alone can never classify the task complete.
+
+```text
+/prizmkit-test scope=this-change artifact_dir=.prizmkit/bugfix/{{BUG_ID}}/
+```
+
+Read the current structured evidence package under `.prizmkit/test/evidence/<evidence-id>/`: `manifest.json`, `verdict.json`, and `validation.json`. A derived Markdown report is not completion authority. Confirm scope, hashes, final verdict, and validator result before accepting `TEST_PASS`.
+
+Gate outcomes and authoritative routing:
+
+- `TEST_PASS`: update the checkpoint handoff and continue to retrospective.
+- `TEST_FAIL` with `repair_scope=test-infrastructure`: return to `/prizmkit-implement`, then return directly to this test gate; do not make speculative production edits.
+- `TEST_FAIL` with `repair_scope=production|runtime|schema|dependency|public-interface`: return to implementation, obtain a fresh code-review result, then return to this test gate.
+- `TEST_FAIL` with an unknown or missing `repair_scope`: record `WORKFLOW_BLOCKED` and leave a safe checkpoint at the test stage; do not guess a production edit.
+- `TEST_BLOCKED`: preserve all evidence and artifacts, perform only bounded automatic environment recovery, then terminate as `WORKFLOW_BLOCKED` with `blocked_reason=test_blocked`. Never edit production speculatively and never ask the user.
+
+The `repair_round` counter is shared with review failures and may not exceed three outer rounds. At the limit, leave a truthful blocked terminal result. Internal code-review convergence has its separate ten-round limit.
+
+**Checkpoint update**: Only a validated structured `TEST_PASS` may complete `prizmkit-test` with `stage_result=TEST_PASS` plus `manifest`, `verdict`, and `validation` evidence paths, then proceed to retrospective.

package/bundled/dev-pipeline/templates/sections/checkpoint-system.md

@@ -1,6 +1,6 @@
 ## Workflow Checkpoint System
 
-A checkpoint file tracks your progress through this workflow:
+A checkpoint file tracks this task family's L4 execution. It is not the L1 workflow-state record.
 
 **Path**: `{{CHECKPOINT_PATH}}`
 
@@ -21,12 +21,12 @@ Use this helper to update checkpoint status. Do not hand-edit `workflow-checkpoi
 
 ### Rules
 
-1. **Before each skill**: Read `workflow-checkpoint.json`, verify the previous step has `status: "completed"` or `status: "skipped"`. If it is still `"pending"` or `"in_progress"`, complete it first before moving on.
-
-2. **Starting a skill**: Use the checkpoint update helper to mark the current step as `status: "in_progress"`.
-
-3. **After each skill completes**: Use the checkpoint update helper to mark the current step as `status: "completed"`.
-
-4. **On failure**: Use the checkpoint update helper to mark the step as `status: "failed"`, write `failure-log.md` with the reason, and continue only when the workflow rules allow it.
-
-5. **On session exit**: The checkpoint file reflects your actual progress. Do NOT manually set future steps to `"completed"`.
+1. Before each skill, read the checkpoint and verify the previous step is `completed` or `skipped`. A pending or in-progress predecessor must be completed first.
+2. Starting a skill marks its step `in_progress`; completion marks it `completed`; failures mark it `failed` and write `failure-log.md`.
+3. L4 checkpoint metadata must preserve `current_stage`, `next_stage`, `stage_result`, `repair_scope`, `repair_round`, `authoritative_evidence_paths`, `blocked_reason`, and `terminal_status`.
+4. `authoritative_evidence_paths` may point only to validated structured `manifest.json`, `verdict.json`, and `validation.json`; a Markdown report is never completion authority.
+5. Preserve all evidence and session artifacts on recovery. Never replace the task family's L1 workflow state with this L4 checkpoint or merge their schemas.
+6. The outer repair round is shared across review/test failures and stops at three. The internal Code Review loop has its separate ten-round limit.
+7. `TEST_BLOCKED`, an unknown result, an unsafe repair scope, or an exhausted third repair round records terminal `WORKFLOW_BLOCKED` with a deterministic `blocked_reason`; never speculate on production edits.
+8. `WORKFLOW_COMPLETED` is valid only when the expected family stage sequence is complete, Code Review records `REVIEW_PASS`, and the test stage records `TEST_PASS` with all three authoritative evidence records.
+9. On session exit, leave the checkpoint at the truthful stage. Do not mark future steps completed.

package/bundled/dev-pipeline/templates/sections/headless-commit-authorization.md

@@ -0,0 +1,16 @@
+### Headless Commit Authorization
+
+This pipeline session is non-interactive. Do not ask questions, wait for user input, or request commit confirmation.
+
+The pipeline launch has already authorized local commits for this task. Invoke `/prizmkit-committer` with the L4-managed execution context:
+
+```json
+{
+  "mode": "l4-headless",
+  "owner": "prizmkit-l4",
+  "local_commit_authorized": true,
+  "push_authorized": false
+}
+```
+
+The committer must still verify every lifecycle gate, inspect the intended diff, generate a Conventional Commit message, stage only intended files, create the local commit, and verify it. It must never push. If the execution context is absent or invalid, mark the task blocked and exit; do not ask the user.

package/bundled/dev-pipeline/templates/sections/phase-prizmkit-test.md

@@ -1,6 +1,6 @@
 ### Scoped Feature Test Gate — PrizmKit Test
 
-**Goal**: After code review completes, generate and verify tests for this feature's changed scope through the `/prizmkit-test` skill.
+**Goal**: After Code Review completes, generate and verify tests for this Feature's changed scope through `/prizmkit-test`. Review is a hard precondition for accepting any full test result.
 
 Create a current-run marker immediately before invoking the skill:
 
@@ -9,30 +9,33 @@ Create a current-run marker immediately before invoking the skill:
 {{RUNTIME_HELPER_CMD}} artifact touch .prizmkit/specs/{{FEATURE_SLUG}}/.prizmkit-test-started
 ```
 
-Run `/prizmkit-test` with the feature artifact directory:
+Run `/prizmkit-test` with the Feature artifact directory. This gate is Feature-only: never substitute `.prizmkit/bugfix/` or `.prizmkit/refactor/` artifact roots.
 
 ```text
 /prizmkit-test scope=this-change artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/
 ```
 
-Rules:
-- This gate is feature-pipeline only. Do NOT use `.prizmkit/bugfix/` or `.prizmkit/refactor/` artifact directories here.
-- Generate or update tests only for this feature's changed files, changed public interfaces, and acceptance criteria.
-- Record unrelated historical coverage gaps under `Out of Scope Gaps`; do not generate tests for them and do not fail this feature because of them.
-- If generated tests fail because implementation is wrong, fix implementation within this feature scope and rerun the affected tests.
-- If failures are baseline or unrelated to this feature, document them in the report and continue only when no in-scope failure remains unexplained.
-
-**Gate Check — Test Report**:
-After `/prizmkit-test` returns, read `.prizmkit/specs/{{FEATURE_SLUG}}/test-report-path.txt` if it exists; otherwise locate the newest `.prizmkit/test/*/test-report.md` created by the current test run. Accept the report only when it states:
-- `Scope` mode is `this-change`
-- `Artifact Dir` matches `.prizmkit/specs/{{FEATURE_SLUG}}/`
-- `Verdict` is `PASS`
-- `Boundary Matrix` is present
-- `Boundary Completion Gate` is present and reports `Boundary-missing: 0`, `Happy-path-only: 0`, and `Completion gate passed: yes`
-- `Boundary Validation` is present and reports `Validator result: passed`
-
-Gate outcomes:
-- `PASS` → ensure `.prizmkit/specs/{{FEATURE_SLUG}}/test-report-path.txt` points to the accepted report, append the report path and a 3-5 bullet summary to `context-snapshot.md` under `## PrizmKit Test Gate`, then proceed.
-- `NEEDS_FIXES` → read the report's `In-Scope Failures`, fix the feature implementation or generated tests within this feature scope, rerun `/prizmkit-test`, and repeat the gate check. Do not proceed to retrospective/commit while the verdict is not `PASS`.
-- `BLOCKED`, wrong mode, wrong artifact dir, unreadable report, stale scope, or boundary failure → write `.prizmkit/specs/{{FEATURE_SLUG}}/failure-log.md` with the scoped test failure and stop for recovery.
-- Missing report → perform one bounded status check: inspect `/prizmkit-test` output and `.prizmkit/test/` for a report directory. If no current-run report exists, write `failure-log.md` and stop for recovery.
+## Authoritative Evidence Gate
+
+The report is a derived view only. Its historical Boundary Matrix and Boundary Completion Gate are useful context but never completion authority. A valid derived view may state `Boundary-missing: 0`, `Happy-path-only: 0`, `Completion gate passed: yes`, and `Validator result: passed`, but those Markdown fields cannot establish success. Locate the evidence package through `.prizmkit/specs/{{FEATURE_SLUG}}/test-report-path.txt`, then consume and validate these structured records:
+
+- `.prizmkit/test/evidence/<evidence-id>/manifest.json`
+- `.prizmkit/test/evidence/<evidence-id>/verdict.json`
+- `.prizmkit/test/evidence/<evidence-id>/validation.json`
+
+Before accepting `TEST_PASS`, verify all three records are present, JSON is complete and non-duplicated, the evidence ID and scope match this Feature, every manifest-listed file hash matches, `final_verdict` and `verdict.verdict` agree, `validation.result=passed`, `validation.verdict` agrees, validator/payload hashes are present, the compatibility boundary rejects the legacy report interface, and current inventoried target hashes still match. Never accept a Markdown-only report or a Markdown `PASS` as completion evidence.
+
+## Repair Routing
+
+Preserve the same artifact directory and update the L1 workflow state plus this L4 checkpoint with `current_stage`, `next_stage`, `stage_result`, `repair_scope`, `repair_round`, authoritative evidence paths, `blocked_reason`, and `terminal_status`. L1 workflow state and `workflow-checkpoint.json` are separate contracts; never substitute one for the other.
+
+- `REVIEW_NEEDS_FIXES` → `prizmkit-implement` → `prizmkit-code-review` → `prizmkit-test`.
+- `TEST_FAIL` with `repair_scope=test-infrastructure` → `prizmkit-implement` → `prizmkit-test`; do not make speculative production edits.
+- `TEST_FAIL` with `repair_scope=production|runtime|schema|dependency|public-interface` → `prizmkit-implement` → `prizmkit-code-review` → `prizmkit-test`.
+- `TEST_FAIL` with unknown or unsafe scope → do not guess a production edit; record `WORKFLOW_BLOCKED` and a safe resume entry.
+- `TEST_BLOCKED` → preserve all evidence and artifacts, perform only bounded environment recovery, then finish terminal `WORKFLOW_BLOCKED` with `blocked_reason=test_blocked`; never edit production speculatively.
+- The outer `repair_round` is shared across review/test failures and may not exceed three. The Code Review internal loop limit remains separate and is at most ten completed rounds.
+
+A missing, stale, incomplete, mismatched, tampered, or wrong-scope package is not `TEST_PASS`: preserve the evidence, write `failure-log.md`, and leave the checkpoint resumable or blocked according to headless policy.
+
+**CP-4**: Only a validated structured `TEST_PASS` may complete `prizmkit-test` with `stage_result=TEST_PASS` plus `manifest`, `verdict`, and `validation` evidence paths, then proceed to retrospective. `TEST_FAIL` and `TEST_BLOCKED` remain in the repair/recovery state machine.

package/bundled/dev-pipeline/templates/sections/phase-review-full.md

@@ -1,10 +1,16 @@
 ### Review — Code Review
 
-Review the completed implementation before the scoped feature test gate runs. Use `artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/` so `/prizmkit-code-review` can read the spec, plan, context snapshot, implementation log, and current diff. Do not require a prior `/prizmkit-test` report here; the next phase owns the formal test gate.
+Review the completed implementation before the full Feature test gate runs. A review result is a required predecessor; never accept or route around testing as if a review had passed.
 
-Run `/prizmkit-code-review` with `artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/`. The skill runs a Main-Agent review loop for up to ten completed rounds. The current Main Agent is the only Code Review executor: it reviews the complete current change, rejects unsupported candidate findings, directly repairs accepted findings, verifies repairs, and repeats until `accepted = 0` with no unresolved findings.
+Use `artifact_dir=.prizmkit/specs/{{FEATURE_SLUG}}/` so `/prizmkit-code-review` can read the spec, plan, context snapshot, implementation log, and current diff. The current Main Agent is the only Code Review executor. The skill runs a bounded Main-Agent review loop of at most ten completed internal rounds and writes only `review-report.md`. The Main-Agent review loop permits up to ten completed rounds.
 
-The Code Review execution boundary is absolute for this phase:
+- `REVIEW_PASS` → update checkpoint metadata with `stage=code-review`, `status=REVIEW_PASS`, `stage_result=REVIEW_PASS`, `next_stage=prizmkit-test`, and `resume_from=prizmkit-test`; then run the full test gate.
+- `REVIEW_NEEDS_FIXES` → preserve findings, increment the shared outer `repair_round`, route `prizmkit-implement` → `prizmkit-code-review` → `prizmkit-test`, and do not accept any test result from before the repaired review.
+- If the outer repair round is already three, record `WORKFLOW_BLOCKED`; do not start another repair route.
+
+Missing required evidence, unsafe repair, failed verification, or failure to converge by round ten produces `REVIEW_NEEDS_FIXES`.
+
+The Code Review execution boundary is absolute:
 
 - Do not delegate any review work directly or indirectly.
 - Do not invoke another review skill or review workflow.
@@ -12,8 +18,6 @@ The Code Review execution boundary is absolute for this phase:
 - Direct reading, searching, editing, and testing by the current Main Agent remain allowed.
 - `review-report.md` is the only persisted review artifact; do not append separate Review Notes to `context-snapshot.md`.
 
-Missing required evidence, an unsafe repair, a failed verification, or failure to converge by round ten produces `NEEDS_FIXES`.
-
 **Gate Check — Final Review Result**:
 
 ```bash
@@ -22,9 +26,9 @@ Missing required evidence, an unsafe repair, a failed verification, or failure t
 
 Handle the marker:
 
-- `REVIEW_PASS` → proceed to next phase.
-- `REVIEW_NEEDS_FIXES` → log unresolved findings and follow the task failure policy; do not externally restart the review loop.
-- `REVIEW_INCOMPLETE` or `REVIEW_INVALID` → inspect the append-only progress once, write `failure-log.md`, and stop. Do not treat an old or incidental verdict as completion and do not synthesize a passing result outside the skill.
+- `REVIEW_PASS` → proceed to the structured test gate.
+- `REVIEW_NEEDS_FIXES` → follow the repair route above; do not externally restart the review loop.
+- `REVIEW_INCOMPLETE` or `REVIEW_INVALID` → inspect append-only progress once, write `failure-log.md`, and stop. Do not accept old/incidental verdict text or synthesize a pass.
 
 **CP-3**: Review has a valid Final Result and `review-report.md` preserves this execution's progress.
 

package/bundled/dev-pipeline/templates/sections/refactor-phase-review.md

@@ -24,4 +24,4 @@ Missing required evidence, an unsafe repair, a failed verification, or failure t
 
 Verify directly that the review checks behavior preservation, public API compatibility, imports, tests, and rollback assumptions.
 
-**Checkpoint update**: Set step `prizmkit-code-review` to `completed` only for an accepted valid Final Result. Do not complete the checkpoint for incomplete or invalid reports.
+**Checkpoint update**: Set step `prizmkit-code-review` to `completed` with `stage_result=REVIEW_PASS` only for an accepted valid Final Result. Do not complete the checkpoint for incomplete or invalid reports.

package/bundled/dev-pipeline/templates/sections/refactor-phase-test.md

@@ -0,0 +1,21 @@
+### Refactor Test Gate — PrizmKit Test
+
+After Main-Agent code review returns a valid `PASS`, run the mandatory post-review test stage against the same Refactor artifact root. Behavior-preservation checks collected during planning and implementation remain supporting evidence; they never replace this authoritative evidence gate.
+
+```text
+/prizmkit-test scope=this-change artifact_dir=.prizmkit/refactor/{{REFACTOR_ID}}/
+```
+
+Read the current structured evidence package under `.prizmkit/test/evidence/<evidence-id>/`: `manifest.json`, `verdict.json`, and `validation.json`. A derived Markdown report is not completion authority. Confirm scope, hashes, final verdict, and validator result before accepting `TEST_PASS`.
+
+Gate outcomes and authoritative routing:
+
+- `TEST_PASS`: verify behavior-preservation evidence remains recorded, update the checkpoint handoff, and continue to retrospective.
+- `TEST_FAIL` with `repair_scope=test-infrastructure`: return to `/prizmkit-implement`, preserve the behavior baseline, then return directly to this test gate; do not make speculative production edits.
+- `TEST_FAIL` with `repair_scope=production|runtime|schema|dependency|public-interface`: return to implementation, obtain a fresh code-review result, then return to this test gate.
+- `TEST_FAIL` with an unknown or missing `repair_scope`: record `WORKFLOW_BLOCKED` and leave a safe checkpoint at the test stage; do not guess a production edit.
+- `TEST_BLOCKED`: preserve all evidence and artifacts, perform only bounded automatic environment recovery, then terminate as `WORKFLOW_BLOCKED` with `blocked_reason=test_blocked`. Never edit production speculatively and never ask the user.
+
+The `repair_round` counter is shared with review failures and may not exceed three outer rounds. At the limit, leave a truthful blocked terminal result. Internal code-review convergence has its separate ten-round limit.
+
+**Checkpoint update**: Only a validated structured `TEST_PASS` may complete `prizmkit-test` with `stage_result=TEST_PASS` plus `manifest`, `verdict`, and `validation` evidence paths, then proceed to retrospective.