prizmkit 1.1.131 → 1.1.135

package/bundled/skills/prizmkit-test/scripts/validate_test_evidence.py

@@ -38,14 +38,15 @@ LAYER_ORDER = {
     "regression-ring": 4,
 }
 FINAL_RECORDS = {"validation.json", "verdict.json", "test-report.md"}
+ATTESTATION_MUTABLE = {"validation.json"}
 COMMON_RECORDS = {
     "change-classification.json", "scope.json", "target-inventory.json",
     "environment.json", "executions.json", "verdict.json", "validation.json",
     "source-change.patch", "test-report.md",
 }
 BEHAVIOR_RECORDS = {
-    "behavior-risk-matrix.json", "test-plan.json", "infrastructure-changes.json",
-    "differential-proof.json",
+    "behavior-risk-matrix.json", "test-plan.json",
+    "infrastructure-changes.json", "differential-proof.json",
 }
 LIGHTWEIGHT_RECORDS = {"lightweight-verification.json"}
 SHA256_RE = re.compile(r"^[a-f0-9]{64}$")
@@ -54,9 +55,13 @@ BLOCKED_EXTERNAL_CLASSES = {"production", "unknown"}
 SNAPSHOT_VOLATILE_ROOTS = (
     ".prizmkit/state",
     ".prizmkit/test/evidence",
+    ".prizmkit/" + "dev-" + "pipeline",
     ".claude/worktrees",
+    ".agents/worktrees",
+    ".codebuddy/worktrees",
+    ".codex/worktrees",
 )
-SNAPSHOT_VOLATILE_NAMES = {".git", "__pycache__"}
+SNAPSHOT_VOLATILE_NAMES = {".git", "__pycache__", ".pytest_cache", ".mypy_cache"}
 RISK_CONFLICT_PATTERNS = {
     "permission": re.compile(r"auth|tenant|role|permission|access|acl|rbac", re.I),
     "concurrency": re.compile(r"lock|shared[ _-]?state|worker|queue|concurr|parallel|race", re.I),
@@ -219,6 +224,18 @@ def validate_schema(
     """Validate the strict JSON-Schema subset used by skill-owned schemas."""
     schema = resolve_ref(schema, root_schema)
 
+    one_of = schema.get("oneOf")
+    if isinstance(one_of, list):
+        matching = 0
+        for branch in one_of:
+            if not isinstance(branch, dict):
+                continue
+            branch_errors: list[str] = []
+            validate_schema(value, branch, root_schema, location, branch_errors)
+            if not branch_errors:
+                matching += 1
+        require(matching == 1, f"{location}: value must match exactly one schema branch", errors)
+
     for child in schema.get("allOf", []):
         if isinstance(child, dict):
             validate_schema(value, child, root_schema, location, errors)
@@ -341,6 +358,31 @@ def require_manifest_entry(
     return path
 
 
+def validate_differential_na(
+    value: Any,
+    location: str,
+    errors: list[str],
+) -> None:
+    """Validate the differential-only N/A shape without weakening risk-cell N/A."""
+    if not isinstance(value, dict):
+        errors.append(f"{location}: differential N/A must be an object")
+        return
+    required = {"reason", "rationale", "evidence", "considered_signals", "conflicts"}
+    require(set(value) == required, f"{location}: differential N/A fields are incomplete", errors)
+    require(value.get("reason") in {"new-behavior", "textual-contract"}, f"{location}: invalid differential N/A reason", errors)
+    rationale = value.get("rationale")
+    require(isinstance(rationale, str) and len(rationale.strip()) >= 16, f"{location}: differential N/A rationale is too short", errors)
+    if value.get("reason") == "new-behavior" and isinstance(rationale, str):
+        require("no stable pre-change observable" in rationale.lower(), f"{location}: new behavior N/A lacks baseline rationale", errors)
+    if value.get("reason") == "textual-contract" and isinstance(rationale, str):
+        require("textual" in rationale.lower(), f"{location}: textual contract N/A lacks textual rationale", errors)
+    evidence = value.get("evidence")
+    require(isinstance(evidence, list) and bool(evidence) and all(isinstance(item, str) and item.strip() for item in evidence), f"{location}: differential N/A needs evidence strings", errors)
+    signals = value.get("considered_signals")
+    require(isinstance(signals, list) and bool(signals) and all(isinstance(item, str) and item.strip() for item in signals), f"{location}: differential N/A needs considered signals", errors)
+    require(isinstance(value.get("conflicts"), list), f"{location}: differential N/A conflicts must be an array", errors)
+
+
 def structured_na(
     value: Any,
     records_schema: dict[str, Any],
@@ -503,6 +545,25 @@ def validate_manifest(
     return entry_map
 
 
+def get_captured_deleted_paths(root: Path) -> set[str]:
+    capture_path = root / "change-capture.json"
+    if not capture_path.is_file():
+        return set()
+    try:
+        capture = load_json(capture_path)
+    except EvidenceError:
+        return set()
+    if not isinstance(capture, dict):
+        return set()
+    return {
+        item["path"]
+        for item in capture.get("changed_files", [])
+        if isinstance(item, dict)
+        and isinstance(item.get("path"), str)
+        and (item.get("status", "").strip() == "D" or item.get("role") == "source")
+    }
+
+
 def validate_inventory(
     root: Path,
     project_root: Path,
@@ -569,6 +630,7 @@ def validate_inventory(
         require(plan.get("plan_inputs") == plan_inputs, "test plan inputs do not match target inventory", errors)
 
     patch = require_manifest_entry("source-change.patch", entry_map, root, errors, "source-change patch")
+    captured_deleted_paths = get_captured_deleted_paths(root)
     if patch is not None:
         require(manifest.get("working_diff_sha256") == file_sha256(patch), "working_diff_sha256 does not match source-change.patch", errors)
 
@@ -579,7 +641,19 @@ def validate_inventory(
         request = load_json(request_path)
         if isinstance(request, dict):
             require(request.get("changed_files") == inventory.get("changed_files"), "inventory request changed_files mismatch", errors)
-            require(request.get("module_roots") == inventory.get("module_roots"), "inventory request module_roots mismatch", errors)
+            request_roots = request.get("module_roots")
+            normalized_request_roots = []
+            if isinstance(request_roots, list):
+                for item in request_roots:
+                    if isinstance(item, str):
+                        normalized_request_roots.append(item)
+                    elif isinstance(item, dict) and isinstance(item.get("path"), str):
+                        normalized_request_roots.append(item["path"])
+            require(
+                normalized_request_roots == inventory.get("module_roots"),
+                "inventory request module_roots mismatch",
+                errors,
+            )
             require(request.get("exclusions") == scope.get("exclusions"), "inventory request exclusions mismatch", errors)
             require(request.get("plan_inputs") == plan_inputs, "inventory request plan_inputs mismatch", errors)
         else:
@@ -594,6 +668,7 @@ def validate_scope(
     inventory_by_category: dict[str, dict[str, str]],
     project_root: Path,
     evidence_root: Path,
+    captured_deleted_paths: set[str],
     errors: list[str],
 ) -> None:
     changed_files = scope.get("changed_files")
@@ -614,8 +689,14 @@ def validate_scope(
         if relative in exclusion_paths:
             require(relative not in inventory_paths, f"excluded changed file is also inventoried: {relative}", errors)
         else:
-            require(candidate is not None and candidate.is_file(), f"changed file is not live: {relative}", errors)
-            require(relative in inventory_paths, f"changed file is neither inventoried nor excluded: {relative}", errors)
+            candidate = safe_path(project_root, relative, errors, "changed file")
+            deleted = relative in captured_deleted_paths
+            require(
+                deleted or (candidate is not None and candidate.is_file()),
+                f"changed file is not live: {relative}",
+                errors,
+            )
+            require(relative in inventory_paths or deleted, f"changed file is neither inventoried nor excluded: {relative}", errors)
 
     roots = scope.get("module_roots")
     require(isinstance(roots, list) and bool(roots), "scope module_roots is empty", errors)
@@ -695,7 +776,15 @@ def validate_requests_and_receipts(
             if not isinstance(request, dict):
                 errors.append(f"request must be an object: {relative}")
                 continue
-            if "execution_request" in request:
+            if set(request) == {"request_version", "layers", "tests"}:
+                validate_definition(request, "testPreparationRequest", records_schema, relative, errors)
+            elif request.get("method") == "not-applicable":
+                validate_definition(request, "differentialRequest", records_schema, relative, errors)
+                not_applicable = request.get("not_applicable")
+                if isinstance(not_applicable, dict):
+                    validate_differential_na(not_applicable, f"{relative}.not_applicable", errors)
+                differential_requests[relative] = request
+            elif "execution_request" in request:
                 validate_definition(request, "differentialRequest", records_schema, relative, errors)
                 nested = request.get("execution_request")
                 if isinstance(nested, dict):
@@ -707,6 +796,17 @@ def validate_requests_and_receipts(
                 validate_execution_request_semantics(request, relative, errors)
                 validate_external_targets(request.get("external_targets"), f"{relative}.external_targets", errors)
                 execution_requests[relative] = request
+            elif set(request) == {
+                "request_version", "change_class", "artifact_dir",
+            } or (
+                "request_version" in request
+                and "change_class" in request
+                and set(request) <= {
+                    "request_version", "change_class", "baseline_commit", "scope_path",
+                    "environment_path", "artifact_dir", "blockers", "repair_scope",
+                }
+            ):
+                require(request.get("request_version", "1.0") == "1.0", f"unsupported finalize request version: {relative}", errors)
             elif set(request) == {
                 "request_version", "categories", "changed_files", "module_roots",
                 "exclusions", "discovery_evidence", "plan_inputs",
@@ -837,13 +937,103 @@ def validate_execution_request_semantics(
     environment = value.get("environment")
     require(isinstance(environment, dict) and all(isinstance(key, str) and isinstance(item, str) for key, item in environment.items()), f"{location}: environment must contain complete string values", errors)
     test_ids = value.get("test_ids")
-    require(isinstance(test_ids, list) and all(isinstance(item, str) and item for item in test_ids), f"{location}: test_ids must be string IDs", errors)
+    test_paths = value.get("test_paths")
+    auto_bind = value.get("auto_bind") is True
+    require(
+        (isinstance(test_ids, list) and all(isinstance(item, str) and item for item in test_ids))
+        or (isinstance(test_paths, list) and all(isinstance(item, str) and item for item in test_paths))
+        or auto_bind,
+        f"{location}: execution must provide test_ids, test_paths, or auto_bind",
+        errors,
+    )
     if receipt:
         require(type(value.get("selected_execution")) is bool, f"{location}: selected_execution must be boolean", errors)
         require(type(value.get("reliable")) is bool, f"{location}: reliable must be boolean", errors)
         require(type(value.get("exit_code")) is int and not isinstance(value.get("exit_code"), bool), f"{location}: exit_code must be an integer", errors)
 
 
+def changed_test_statuses(root: Path) -> dict[str, str]:
+    capture_path = root / "change-capture.json"
+    if not capture_path.is_file():
+        return {}
+    try:
+        capture = load_json(capture_path)
+    except EvidenceError:
+        return {}
+    statuses: dict[str, str] = {}
+    for item in capture.get("changed_files", []) if isinstance(capture, dict) else []:
+        if not isinstance(item, dict) or not isinstance(item.get("path"), str) or item.get("role") == "source":
+            continue
+        status = str(item.get("status", "")).strip()
+        if status == "??" or status.startswith("A"):
+            statuses[item["path"]] = "added"
+        elif status.startswith("M") or status.endswith("M") or status.startswith(("R", "C")):
+            statuses[item["path"]] = "modified"
+    return statuses
+
+
+def validate_canonical_capture(
+    root: Path,
+    project_root: Path,
+    capture: dict[str, Any],
+    inventory: dict[str, Any],
+    scope: dict[str, Any],
+    errors: list[str],
+) -> None:
+    patch_relative = capture.get("patch_path")
+    patch = safe_path(root, patch_relative, errors, "canonical change patch") if isinstance(patch_relative, str) else None
+    require(patch_relative == "source-change.patch", "canonical capture patch_path must be source-change.patch", errors)
+    if patch is not None:
+        require(file_sha256(patch) == capture.get("patch_sha256"), "canonical capture patch hash mismatch", errors)
+    require(
+        capture.get("source_tree_sha256") == tree_sha256(project_root, root),
+        "canonical change capture source tree is stale",
+        errors,
+    )
+    captured_paths = {
+        item.get("path")
+        for item in capture.get("changed_files", [])
+        if isinstance(item, dict) and isinstance(item.get("path"), str)
+    }
+    inventory_changed = set(inventory.get("changed_files", [])) if isinstance(inventory.get("changed_files"), list) else set()
+    scope_changed = set(scope.get("changed_files", [])) if isinstance(scope.get("changed_files"), list) else set()
+    require(captured_paths == inventory_changed, "canonical capture and inventory changed_files do not match", errors)
+    require(captured_paths == scope_changed, "canonical capture and scope changed_files do not match", errors)
+
+
+def validate_test_preparation(
+    root: Path,
+    project_root: Path,
+    preparation: dict[str, Any],
+    plan: dict[str, Any],
+    inventory_by_category: dict[str, dict[str, str]],
+    entry_map: dict[str, dict[str, Any]],
+    records_schema: dict[str, Any],
+    errors: list[str],
+) -> None:
+    validate_definition(preparation, "testPreparation", records_schema, "test-preparation", errors)
+    request_relative = preparation.get("request_path")
+    request_path = require_manifest_entry(request_relative, entry_map, root, errors, "test preparation request") if isinstance(request_relative, str) else None
+    if request_path is not None:
+        require(file_sha256(request_path) == preparation.get("request_sha256"), "test preparation request hash mismatch", errors)
+    prepared_tests = preparation.get("tests")
+    require(prepared_tests == plan.get("tests"), "test preparation tests do not match test plan", errors)
+    statuses = preparation.get("changed_test_statuses")
+    require(isinstance(statuses, dict), "test preparation changed_test_statuses must be an object", errors)
+    if not isinstance(statuses, dict):
+        return
+    for relative, status in statuses.items():
+        require(relative in inventory_by_category.get("tests", {}), f"test preparation status is not in test inventory: {relative}", errors)
+        require(status in {"added", "modified"}, f"test preparation has invalid changed test status: {relative}", errors)
+    for test in prepared_tests if isinstance(prepared_tests, list) else []:
+        if not isinstance(test, dict):
+            continue
+        relative = test.get("project_path")
+        if isinstance(relative, str):
+            expected = statuses.get(relative, "existing")
+            require(test.get("change_status") == expected, f"test preparation status mismatch: {relative}", errors)
+
+
 def validate_plan_and_scope_bindings(
     root: Path,
     project_root: Path,
@@ -905,6 +1095,8 @@ def validate_plan_and_scope_bindings(
             for test_id in receipt.get("test_ids", []):
                 if isinstance(test_id, str):
                     selected_by_test.setdefault(test_id, []).append(receipt)
+    changed_tests = changed_test_statuses(root)
+    planned_test_paths: set[str] = set()
     known_behavior_ids = {item.get("id") for item in matrix.get("behaviors", []) if isinstance(item, dict)}
     for test in tests:
         if not isinstance(test, dict):
@@ -920,14 +1112,24 @@ def validate_plan_and_scope_bindings(
         for behavior_id in behavior_ids if isinstance(behavior_ids, list) else []:
             require(behavior_id in known_behavior_ids, f"planned test maps unknown behavior: {test_id}/{behavior_id}", errors)
         project_relative = test.get("project_path")
+        planned_test_paths.add(project_relative)
         inventory_relative = test.get("inventory_path")
         snapshot_relative = test.get("snapshot_path")
+        inferred_status = changed_tests.get(project_relative, "existing")
+        change_status = test.get("change_status", "modified" if isinstance(snapshot_relative, str) else "existing")
+        if changed_tests:
+            require(change_status == inferred_status, f"planned test change_status does not match canonical capture: {test_id}", errors)
+        require(change_status in {"existing", "added", "modified"}, f"planned test has invalid change_status: {test_id}", errors)
         project_path = safe_path(project_root, project_relative, errors, f"planned test {test_id} project_path")
         require(project_path is not None and project_path.is_file(), f"planned test live path is missing: {test_id}", errors)
         require(inventory_relative == project_relative, f"planned test inventory path differs from live project path: {test_id}", errors)
         require(inventory_relative in inventory_by_category.get("tests", {}), f"planned test is not in the test inventory: {test_id}", errors)
-        snapshot_path = require_manifest_entry(snapshot_relative, entry_map, root, errors, f"planned test snapshot {test_id}") if isinstance(snapshot_relative, str) else None
-        require(isinstance(snapshot_relative, str) and path_under(snapshot_relative, "generated-tests"), f"planned test snapshot must be under generated-tests/: {test_id}", errors)
+        if change_status == "existing":
+            require(snapshot_relative is None, f"existing test must not have a generated snapshot: {test_id}", errors)
+            snapshot_path = None
+        else:
+            snapshot_path = require_manifest_entry(snapshot_relative, entry_map, root, errors, f"planned test snapshot {test_id}") if isinstance(snapshot_relative, str) else None
+            require(isinstance(snapshot_relative, str) and path_under(snapshot_relative, "generated-tests"), f"planned test snapshot must be under generated-tests/: {test_id}", errors)
         if project_path is not None and project_path.is_file() and snapshot_path is not None and snapshot_path.is_file():
             require(file_sha256(project_path) == file_sha256(snapshot_path), f"generated test snapshot differs from live test: {test_id}", errors)
         test_layers = test.get("layers")
@@ -939,6 +1141,19 @@ def validate_plan_and_scope_bindings(
         for receipt in matching_receipts:
             require(receipt.get("layer") in test_layers, f"planned test receipt uses an unplanned layer: {test_id}", errors)
 
+    for relative, status in changed_tests.items():
+        if relative in inventory_by_category.get("tests", {}) and relative not in planned_test_paths:
+            errors.append(f"changed native test is not bound by test plan: {relative}")
+    generated_dir = root / "generated-tests"
+    referenced_snapshots = {
+        test.get("snapshot_path") for test in tests if isinstance(test, dict) and isinstance(test.get("snapshot_path"), str)
+    }
+    if generated_dir.is_dir():
+        actual_snapshots = {
+            path.relative_to(root).as_posix() for path in generated_dir.rglob("*") if path.is_file()
+        }
+        for relative in sorted(actual_snapshots - referenced_snapshots):
+            errors.append(f"generated test snapshot is not bound by test plan: {relative}")
     for ring in scope.get("regression_ring", []):
         if not isinstance(ring, dict):
             continue
@@ -1082,7 +1297,7 @@ def validate_differential_proofs(
             proof_by_behavior[behavior_id] = item
         classification = item.get("classification")
         if classification == "NOT_APPLICABLE":
-            structured_na(item.get("not_applicable"), records_schema, f"differential proof {behavior_id} not_applicable", errors)
+            validate_differential_na(item.get("not_applicable"), f"differential proof {behavior_id} not_applicable", errors)
             for key in (
                 "method", "differential_request_path", "differential_request_sha256", "baseline_commit",
                 "current_tree_sha256", "baseline_execution_id", "mutation_execution_id", "current_execution_id",
@@ -1245,6 +1460,13 @@ def validate_verdict_and_attestation(
         require(bool(verdict_record.get("blockers")), "TEST_BLOCKED lacks blocker reasons", errors)
     elif verdict == "TEST_FAIL":
         require(bool(verdict_record.get("reproduced_failures")), "TEST_FAIL lacks reproduced failures", errors)
+        require(
+            verdict_record.get("repair_scope") in {
+                "test-infrastructure", "production", "runtime", "schema", "dependency", "public-interface",
+            },
+            "TEST_FAIL lacks a valid evidence-backed repair_scope",
+            errors,
+        )
 
     if verify_attestation:
         validate_definition(validation, "validation", records_schema, "validation", errors)
@@ -1264,6 +1486,10 @@ def validate_verdict_and_attestation(
         require(validation.get("semantics") == "integrity-and-protocol-validation-not-hostile-producer-proof", "validation attestation semantics exceed integrity/protocol validation", errors)
         require(validation.get("replay_receipt_ids") == replayed_ids, "validation replay receipt IDs do not match actual replay executions", errors)
 
+    if root.joinpath("lifecycle.json").is_file():
+        expected_report = render_report_text(root, manifest, verdict_record, validation)
+        require(report == expected_report, "derived report does not match canonical rendering", errors)
+
     fragments = [
         f"Verdict: {verdict}", f"Evidence ID: {manifest.get('evidence_id')}",
         "Derived from structured evidence", "sensitivity=project-controlled",
@@ -1299,9 +1525,26 @@ def validate_evidence(
 
     entry_map = validate_manifest(root, manifest, manifest_schema, records_schema, errors, ignored_hash_paths)
     change_class = manifest.get("change_class")
-    required = COMMON_RECORDS | (BEHAVIOR_RECORDS if change_class == "behavior" else LIGHTWEIGHT_RECORDS)
+    final_verdict = manifest.get("final_verdict")
+    canonical_lifecycle = (root / "lifecycle.json").is_file()
+    required = COMMON_RECORDS
+    if canonical_lifecycle:
+        required = required | {"change-capture.json"}
+    if final_verdict != "TEST_BLOCKED":
+        required = required | (BEHAVIOR_RECORDS if change_class == "behavior" else LIGHTWEIGHT_RECORDS)
+        if canonical_lifecycle and change_class == "behavior":
+            required = required | {"test-preparation.json"}
     for relative in required:
         require(relative in entry_map, f"required evidence record not hashed: {relative}", errors)
+    if canonical_lifecycle:
+        capture_path = root / "change-capture.json"
+        if capture_path.is_file():
+            try:
+                capture = load_json(capture_path)
+                validate_definition(capture, "changeCapture", records_schema, "change-capture", errors)
+                validate_canonical_capture(root, project_root, capture, inventory, scope, errors)
+            except EvidenceError as exc:
+                errors.append(str(exc))
     validate_definition(classification, "changeClassification", records_schema, "change-classification", errors)
     validate_definition(scope, "scope", records_schema, "scope", errors)
     validate_definition(inventory, "targetInventory", records_schema, "target-inventory", errors)
@@ -1309,20 +1552,37 @@ def validate_evidence(
     require(classification.get("full_protocol_required") is (change_class == "behavior"), "change classification protocol decision is inconsistent", errors)
 
     plan: dict[str, Any] | None = None
+    preparation: dict[str, Any] | None = None
     if change_class == "behavior":
         try:
             plan = load_json(root / "test-plan.json")
+            if canonical_lifecycle:
+                preparation = load_json(root / "test-preparation.json")
         except EvidenceError as exc:
             errors.append(str(exc))
+            plan = preparation = None
         if isinstance(plan, dict):
             validate_definition(plan, "testPlan", records_schema, "test-plan", errors)
         else:
             errors.append("test-plan.json must be an object")
             plan = None
+        if canonical_lifecycle:
+            if isinstance(preparation, dict):
+                pass
+            else:
+                errors.append("test-preparation.json must be an object")
 
     inventory_by_category, _ = validate_inventory(root, project_root, manifest, inventory, scope, plan, entry_map, errors)
+    if canonical_lifecycle and change_class == "behavior" and isinstance(preparation, dict):
+        validate_test_preparation(
+            root, project_root, preparation, plan or {}, inventory_by_category,
+            entry_map, records_schema, errors,
+        )
     require(manifest.get("evidence_id_inputs", {}).get("scope_sha256") == canonical_sha256(scope), "scope identity hash mismatch", errors)
-    validate_scope(scope, inventory, inventory_by_category, project_root, root, errors)
+    validate_scope(
+        scope, inventory, inventory_by_category, project_root, root,
+        get_captured_deleted_paths(root), errors,
+    )
     execution_requests, differential_requests, executions = validate_requests_and_receipts(root, entry_map, records_schema, errors)
 
     if change_class == "behavior":
@@ -1373,6 +1633,64 @@ def validate_evidence(
     return errors
 
 
+def atomic_write_text(path: Path, value: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary_name = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=path.parent)
+    try:
+        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+            handle.write(value)
+        os.replace(temporary_name, path)
+    except BaseException:
+        try:
+            os.unlink(temporary_name)
+        except FileNotFoundError:
+            pass
+        raise
+
+
+def render_report_text(
+    root: Path,
+    manifest: dict[str, Any],
+    verdict: dict[str, Any],
+    validation: dict[str, Any],
+) -> str:
+    lifecycle_path = root / "lifecycle.json"
+    lifecycle = load_json(lifecycle_path) if lifecycle_path.exists() else {}
+    proof_path = root / "differential-proof.json"
+    proof_record = load_json(proof_path) if proof_path.exists() else {}
+    executions_record = load_json(root / "executions.json")
+    proofs = proof_record.get("proofs", []) if isinstance(proof_record, dict) else []
+    executions = executions_record if isinstance(executions_record, list) else []
+    artifact_dir = lifecycle.get("artifact_dir") if isinstance(lifecycle, dict) else None
+    lines = [
+        "# Test Evidence Report",
+        "",
+        "Derived from structured evidence",
+        f"Evidence ID: {manifest.get('evidence_id')}",
+        f"Verdict: {verdict.get('verdict')}",
+        f"Validator result: {validation.get('result', 'pending')}",
+        "sensitivity=project-controlled",
+        "The project owns access control, retention, and upload policy.",
+        "Mocked code-level evidence does not verify a real deployed environment.",
+        "",
+        "## Scope",
+        f"- Artifact Dir: {artifact_dir or 'not provided'}",
+        "",
+        f"Execution receipts: {len(executions)}",
+        f"Differential proofs: {len(proofs) if isinstance(proofs, list) else 0}",
+        "The legacy test-report interface is not supported.",
+        "",
+    ]
+    return "\n".join(lines)
+
+
+def refresh_final_record_hashes(root: Path, manifest: dict[str, Any]) -> None:
+    for entry in manifest.get("files", []):
+        if isinstance(entry, dict) and entry.get("path") in FINAL_RECORDS:
+            entry["sha256"] = file_sha256(root / entry["path"])
+    atomic_write_json(root / "manifest.json", manifest)
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description="Validate a PrizmKit test evidence package")
     parser.add_argument("--evidence-dir", required=True, help="Path to .prizmkit/test/evidence/<evidence-id>")
@@ -1388,7 +1706,7 @@ def main() -> int:
     except IndexError:
         print("Test evidence validation: FAIL\n- cannot infer project root from evidence directory")
         return 1
-    errors = validate_evidence(root, project_root, FINAL_RECORDS if args.attest else None)
+    errors = validate_evidence(root, project_root, ATTESTATION_MUTABLE if args.attest else None)
     if errors:
         print("Test evidence validation: FAIL")
         for error in errors:
@@ -1396,6 +1714,7 @@ def main() -> int:
         return 1
 
     manifest = load_json(root / "manifest.json")
+    verdict_record = load_json(root / "verdict.json")
     if args.attest:
         executions = load_json(root / "executions.json")
         replayed_ids = [
@@ -1421,10 +1740,9 @@ def main() -> int:
             "replay_receipt_ids": replayed_ids,
         }
         atomic_write_json(root / "validation.json", validation)
-        for entry in manifest["files"]:
-            if entry["path"] in FINAL_RECORDS:
-                entry["sha256"] = file_sha256(root / entry["path"])
-        atomic_write_json(root / "manifest.json", manifest)
+        report_text = render_report_text(root, manifest, verdict_record, validation)
+        atomic_write_text(root / "test-report.md", report_text)
+        refresh_final_record_hashes(root, manifest)
         errors = validate_evidence(root, project_root)
         if errors:
             print("Test evidence validation: FAIL")

package/bundled/skills/prizmkit-workflow/SKILL.md

@@ -199,7 +199,7 @@ Interactive execution requires the committer to:
 4. wait for explicit user confirmation from the current user;
 5. create and verify the local commit only after confirmation.
 
-Trusted headless execution is a separate atomic-stage path. It requires a host-defined non-interactive `mode`, a trusted `owner` identifier, `local_commit_authorized=true`, and `push_authorized=false`; it does not ask or wait and never pushes. Unknown headless contexts are blocked. Remote push is never part of this composite workflow's automatic path.
+Trusted headless execution is a separate atomic-stage path. It requires a host-defined non-interactive `mode`, a trusted `owner` identifier, and `local_commit_authorized=true`; it does not ask or wait. Unknown headless contexts are blocked. Remote publication is a separate host-runtime operation and is never decided by this composite workflow.
 
 ## Automatic Handoff and Manual Fallback
 

package/bundled/skills/prizmkit-workflow/references/workflow-state-protocol.md

@@ -157,12 +157,12 @@ Trusted headless execution:
 ```text
 a trusted host explicitly authorizes the current local task commit
 → host injects mode=<host-defined-headless-mode>, owner=<trusted-host-identifier>,
-  local_commit_authorized=true, push_authorized=false
+  local_commit_authorized=true
 → committer verifies gates and commits automatically
-→ no question, wait, or push is permitted
+→ no question or wait is permitted
 ```
 
-A self-declared or otherwise untrusted headless context does not authorize a commit. Push is never implied by either mode.
+A self-declared or otherwise untrusted headless context does not authorize a commit. Remote publication remains a separate host-runtime decision.
 
 ## Recovery
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prizmkit",
-  "version": "1.1.131",
+  "version": "1.1.135",
   "description": "Create a new PrizmKit-powered project with clean initialization — no framework dev files, just what you need.",
   "type": "module",
   "bin": {