prizmkit 1.1.131 → 1.1.134

package/bundled/skills/prizmkit-test/SKILL.md

@@ -15,7 +15,31 @@ Choose project-semantic parameters from the target project: framework, commands,
 
 Fix only the protocol mechanisms needed for safe, replayable evidence: project/evidence/request locators, schema-shaped requests, path confinement, real process execution, complete raw capture, runner-generated chained receipts, hash binding, append-only history, differential isolation/cleanup, and resume invalidation. Read `${SKILL_DIR}/references/trusted-evidence-execution.md` before inventory, execution, differential proof, resume, or replay; it defines the trust boundary and builder commands. Read `${SKILL_DIR}/references/evidence-request-protocol.md` when authoring any request or authoritative JSON record; it defines request ownership, structured N/A, and the schema map.
 
-## Formal Lifecycle Position
+## Canonical Evidence Builder Lifecycle
+
+The Main Agent supplies semantic requests only; it does not author authoritative package records. Initialize and drive one evidence directory through the builder in this order:
+
+```text
+init → capture-change → inventory → execute/differential → finalize → render-report → validate --attest → resume
+```
+
+Use `${SKILL_DIR}/scripts/build_test_evidence.py` for every lifecycle command:
+
+- `init`: creates the package directories and immutable baseline identity.
+- `capture-change`: captures the complete canonical change, including untracked, deleted, renamed, and copied files; never substitute plain `git diff`.
+- `inventory`: hashes current source/tests/contracts/lockfiles, rejects category overlap, excludes runtime-only paths, and validates directory roots plus explicit changed-file sets.
+- `execute`: runs native project commands and owns `executions.json`, `receipts/`, and `raw/`.
+- `differential`: records executable proof or a mechanically validated `NOT_APPLICABLE` decision only for genuinely new behavior or textual-contract behavior.
+- `finalize`: owns manifest, stage hashes, verdict, generated-test snapshots, and evidence identity.
+- `render-report`: derives `test-report.md`; it is never authoritative.
+- `resume`: preserves prior receipts and refuses to rebind an identity-changing package; create a new package after scope/source identity changes.
+
+Before testing, inspect and reuse repository-native tests and their runner configuration. Existing tests are the default. Add or modify a project-native test only after recording a concrete behavior gap. Classify each planned test as `existing`, `added`, or `modified`; `generated-tests/` is empty for unchanged existing tests and contains only snapshots of added/modified native test sources.
+
+`test-plan.json` is the only source of test IDs. Execution requests may reference only IDs declared there, and the builder rejects unknown IDs or layer mappings. Assess all five layers explicitly, but set `required=true` only when risk requires it; every omitted layer needs structured N/A evidence. The same binding applies test ↔ behavior ↔ execution ↔ differential proof.
+
+The builder/validator, not the Main Agent, produces or updates `manifest.json`, `executions.json`, `receipts/*`, `validation.json`, `verdict.json`, `test-report.md`, and `source-change.patch`. `validation.json` is produced only by `validate_test_evidence.py --attest`; a package is not a `TEST_PASS` until the second strict validation succeeds.
+
 
 For a formal requirement, `/prizmkit-test` runs after the Main-Agent code-review stage reaches `PASS` and before retrospective:
 

package/bundled/skills/prizmkit-test/assets/authoritative-records.schema.json

@@ -183,12 +183,33 @@
           }
         },
         "changed_files": { "$ref": "#/$defs/stringArray" },
-        "module_roots": { "$ref": "#/$defs/stringArray" },
+        "module_roots": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "oneOf": [
+              { "$ref": "#/$defs/path" },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["path", "changed_files"],
+                "properties": {
+                  "path": { "$ref": "#/$defs/path" },
+                  "changed_files": { "$ref": "#/$defs/stringArray" }
+                }
+              }
+            ]
+          }
+        },
         "module_root_files": {
           "type": "object",
           "minProperties": 1,
           "additionalProperties": { "$ref": "#/$defs/stringArray" }
         },
+        "module_root_changed_files": {
+          "type": "object",
+          "additionalProperties": { "$ref": "#/$defs/stringArray" }
+        },
         "exclusions": { "type": "array", "items": { "$ref": "#/$defs/path" } },
         "discovery_evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/discoveryEvidence" } },
         "plan_inputs": { "type": "object", "minProperties": 1 }
@@ -225,8 +246,9 @@
             "properties": {
               "id": { "type": "string", "minLength": 1 },
               "behavior_ids": { "$ref": "#/$defs/stringArray" },
+              "change_status": { "enum": ["existing", "added", "modified"] },
               "project_path": { "$ref": "#/$defs/path" },
-              "snapshot_path": { "$ref": "#/$defs/path" },
+              "snapshot_path": { "type": ["string", "null"] },
               "inventory_path": { "$ref": "#/$defs/path" },
               "layers": { "$ref": "#/$defs/stringArray" }
             }
@@ -289,19 +311,47 @@
     },
     "executionLog": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/executionReceipt" } },
     "differentialRequest": {
+      "type": "object",
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["request_version", "behavior_id", "method", "execution_request", "baseline_commit", "current_tree_sha256", "mutation_patch_path", "test_overlay_paths", "expected_failure_signals"],
+          "properties": {
+            "request_version": { "const": "1.0" },
+            "behavior_id": { "type": "string", "minLength": 1 },
+            "method": { "enum": ["baseline", "controlled-mutation"] },
+            "execution_request": { "$ref": "#/$defs/executionRequest" },
+            "baseline_commit": { "type": "string", "minLength": 1 },
+            "current_tree_sha256": { "$ref": "#/$defs/sha256" },
+            "mutation_patch_path": { "type": ["string", "null"] },
+            "test_overlay_paths": { "$ref": "#/$defs/stringArray" },
+            "expected_failure_signals": { "$ref": "#/$defs/stringArray" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["request_version", "behavior_id", "method", "not_applicable"],
+          "properties": {
+            "request_version": { "const": "1.0" },
+            "behavior_id": { "type": "string", "minLength": 1 },
+            "method": { "const": "not-applicable" },
+            "not_applicable": { "$ref": "#/$defs/differentialNotApplicable" }
+          }
+        }
+      ]
+    },
+    "differentialNotApplicable": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["request_version", "behavior_id", "method", "execution_request", "baseline_commit", "current_tree_sha256", "mutation_patch_path", "test_overlay_paths", "expected_failure_signals"],
+      "required": ["reason", "rationale", "evidence", "considered_signals", "conflicts"],
       "properties": {
-        "request_version": { "const": "1.0" },
-        "behavior_id": { "type": "string", "minLength": 1 },
-        "method": { "enum": ["baseline", "controlled-mutation"] },
-        "execution_request": { "$ref": "#/$defs/executionRequest" },
-        "baseline_commit": { "type": "string", "minLength": 1 },
-        "current_tree_sha256": { "$ref": "#/$defs/sha256" },
-        "mutation_patch_path": { "type": ["string", "null"] },
-        "test_overlay_paths": { "$ref": "#/$defs/stringArray" },
-        "expected_failure_signals": { "$ref": "#/$defs/stringArray" }
+        "reason": { "enum": ["new-behavior", "textual-contract"] },
+        "rationale": { "type": "string", "minLength": 16 },
+        "evidence": { "$ref": "#/$defs/stringArray" },
+        "considered_signals": { "$ref": "#/$defs/stringArray" },
+        "conflicts": { "type": "array", "items": { "type": "object" } }
       }
     },
     "differentialProof": {
@@ -375,6 +425,7 @@
         "real_environment_validated": { "const": false },
         "repairs_business_defects": { "const": false },
         "code_evidence_replayable": { "type": "boolean" },
+        "repair_scope": { "enum": ["test-infrastructure", "production", "runtime", "schema", "dependency", "public-interface"] },
         "blockers": { "type": "array", "items": { "type": "string", "minLength": 1 } },
         "reproduced_failures": { "type": "array", "items": { "type": "string", "minLength": 1 } }
       }

package/bundled/skills/prizmkit-test/assets/evidence-manifest.schema.json

@@ -56,7 +56,7 @@
     },
     "files": {
       "type": "array",
-      "minItems": 10,
+      "minItems": 1,
       "items": { "$ref": "#/$defs/file" }
     },
     "final_verdict": { "enum": ["TEST_PASS", "TEST_FAIL", "TEST_BLOCKED"] },

package/bundled/skills/prizmkit-test/assets/evidence-package-template.json

@@ -1,5 +1,16 @@
 {
   "protocol_version": "1.0",
+  "lifecycle_commands": [
+    "init",
+    "capture-change",
+    "inventory",
+    "execute",
+    "differential",
+    "finalize",
+    "render-report",
+    "resume"
+  ],
+  "generated_tests_policy": "Only added or modified repository-native tests are snapshotted; existing tests have no generated snapshot.",
   "records": {
     "change_classification": "change-classification.json",
     "scope": "scope.json",
@@ -13,6 +24,8 @@
     "verdict": "verdict.json",
     "validation": "validation.json",
     "source_patch": "source-change.patch",
+    "change_capture": "change-capture.json",
+    "lifecycle": "lifecycle.json",
     "derived_report": "test-report.md"
   },
   "directories": {

package/bundled/skills/prizmkit-test/references/evidence-protocol.md

@@ -23,7 +23,12 @@ Hashes and validator receipts provide byte-level binding and drift detection, no
 
 `source-change.patch` preserves the complete target diff. Snapshot generated/changed tests under `generated-tests/`, contracts under `contracts/`, and raw stdout/stderr under `raw/`. Never replace old execution/output records.
 
-## Ordered State Machine
+## Existing Tests and Package Finalization
+
+The evidence package is an audit of repository behavior, not a request to invent a parallel test suite. Discover and execute the smallest relevant native tests before adding anything. `generated-tests/` is a snapshot area for added or modified repository-native tests only; it may be empty when existing tests cover the behavior.
+
+The canonical package lifecycle is `init → capture-change → inventory → execute/differential → finalize → render-report → validate --attest → resume`. Builder commands own `source-change.patch`, receipts, raw outputs, manifest, verdict, and report. The validator alone owns `validation.json`. Evidence identity is derived from the resolved baseline, canonical patch hash, and scope hash; identity-changing resume creates a new package instead of rewriting the old directory.
+
 
 Run exactly these states in order:
 

package/bundled/skills/prizmkit-test/references/evidence-request-protocol.md

@@ -2,7 +2,14 @@
 
 Load this reference when writing an inventory, execution, differential, resume, or replay request. Validate every authoritative record against `${SKILL_DIR}/assets/authoritative-records.schema.json`; the validator loads the named `$defs` for each file.
 
-## Request Ownership
+## Canonical Lifecycle Ownership
+
+Start every new package with `init`, then run builder-owned `capture-change` before semantic inventory. `capture-change` is the only producer of `source-change.patch`; it records tracked, untracked, deleted, renamed, and copied paths against the resolved baseline. The Main Agent must not create or edit the patch.
+
+Use existing project-native tests first. A test plan must identify each test as `existing`, `added`, or `modified`; only the latter two may receive a `generated-tests/` snapshot. Existing tests are executed from their repository paths and do not need generated snapshots. `test-plan.json` is the sole authority for test IDs, and execution requests with unknown IDs are rejected by the builder.
+
+`finalize` creates the manifest, stage dependency hashes, verdict, evidence identity, and deterministic report inputs. `render-report` only renders the derived Markdown view. The validator alone creates `validation.json` during `--attest`; never hand-author a validation attestation or rebind a finalized package after identity inputs change.
+
 
 The model writes project-semantic requests after inspecting manifests, runner configuration, contracts, test conventions, changed files, and module boundaries. The bundled builder owns process execution, raw output, receipts, isolation, tree hashes, and invalidation calculations.
 

package/bundled/skills/prizmkit-test/references/test-generation-steps.md

@@ -2,7 +2,10 @@
 
 Use this reference during `INFRA_READY`, `TEST_BUILD`, and `EXECUTE_PROVE`. The authoritative scope and completeness inputs are `scope.json`, `behavior-risk-matrix.json`, and `test-plan.json`.
 
-## Scope Guard
+## Existing-Test-First Rule
+
+Before creating a test, inspect the repository's native test files, runner configuration, and existing behavior assertions. Execute the smallest relevant existing tests first. Add or modify a repository-native test only when a concrete behavior gap is identified and recorded in the test plan. Mark each test `existing`, `added`, or `modified`; only `added` and `modified` tests are copied into `generated-tests/`. An unchanged existing test has no generated snapshot.
+
 
 For `scope=this-change`, changed files locate the affected module; they do not restrict tests to changed lines. Fill observable behavior/risk gaps across the whole affected module and execute its Regression Ring. Unrelated modules remain out of scope unless they are direct callers, consumers, shared contracts, or state dependencies.
 

package/bundled/skills/prizmkit-test/references/trusted-evidence-execution.md

@@ -41,6 +41,21 @@ Treat evidence as auditable project-controlled provenance, not a defense against
 
 ## Builder Commands
 
+Drive a new package through the canonical lifecycle. Semantic request files remain model-authored; authoritative package records remain tool-owned:
+
+```bash
+python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> init --baseline <commit>
+python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> capture-change
+python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> inventory --request requests/inventory.json
+python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> execute --request requests/focused.json
+python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> differential --request requests/differential.json
+python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> finalize --request requests/finalize.json
+python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> render-report
+```
+
+`capture-change` includes tracked modifications, untracked files, deletions, renames, and copies. `finalize` owns the manifest, verdict, stage hashes, evidence identity, and generated-test snapshots. The validator is the only producer of `validation.json`.
+
+
 Write requests beneath the evidence directory, then invoke the bundled script:
 
 ```bash

package/bundled/skills/prizmkit-test/references/workflow-state-protocol.md

@@ -157,12 +157,12 @@ Trusted headless execution:
 ```text
 a trusted host explicitly authorizes the current local task commit
 → host injects mode=<host-defined-headless-mode>, owner=<trusted-host-identifier>,
-  local_commit_authorized=true, push_authorized=false
+  local_commit_authorized=true
 → committer verifies gates and commits automatically
-→ no question, wait, or push is permitted
+→ no question or wait is permitted
 ```
 
-A self-declared or otherwise untrusted headless context does not authorize a commit. Push is never implied by either mode.
+A self-declared or otherwise untrusted headless context does not authorize a commit. Remote publication remains a separate host-runtime decision.
 
 ## Recovery