prizmkit 1.1.134 → 1.1.135

package/bundled/VERSION.json

@@ -1,5 +1,5 @@
 {
-  "frameworkVersion": "1.1.134",
-  "bundledAt": "2026-07-19T00:56:53.854Z",
-  "bundledFrom": "09d7b00"
+  "frameworkVersion": "1.1.135",
+  "bundledAt": "2026-07-19T07:16:08.201Z",
+  "bundledFrom": "9dfbbdb"
 }

package/bundled/skills/_metadata.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.134",
+  "version": "1.1.135",
   "skills": {
     "prizmkit": {
       "description": "Framework introduction and navigation for the formal single-requirement lifecycle, project initialization, Prizm docs, and independent deployment.",

package/bundled/skills/prizmkit-test/SKILL.md

@@ -20,23 +20,22 @@ Fix only the protocol mechanisms needed for safe, replayable evidence: project/e
 The Main Agent supplies semantic requests only; it does not author authoritative package records. Initialize and drive one evidence directory through the builder in this order:
 
 ```text
-init → capture-change → inventory → execute/differential → finalize → render-report → validate --attest → resume
+init → capture-change → inventory → prepare-tests → execute/differential → finalize → render-report → validate --attest → resume
 ```
 
 Use `${SKILL_DIR}/scripts/build_test_evidence.py` for every lifecycle command:
 
 - `init`: creates the package directories and immutable baseline identity.
-- `capture-change`: captures the complete canonical change, including untracked, deleted, renamed, and copied files; never substitute plain `git diff`.
-- `inventory`: hashes current source/tests/contracts/lockfiles, rejects category overlap, excludes runtime-only paths, and validates directory roots plus explicit changed-file sets.
-- `execute`: runs native project commands and owns `executions.json`, `receipts/`, and `raw/`.
+- `capture-change`: captures the complete canonical change, including untracked, deleted, renamed, and copied files; never substitute plain `git diff`. `inventory` then requires its changed-file set to match the capture exactly and rejects stale captures or unaccounted live paths.
+- `inventory`: hashes current source/tests/contracts/lockfiles, rejects category overlap, excludes runtime-only paths, and validates directory roots plus the complete capture-derived changed-file set.
+- `prepare-tests`: discovers repository-native test files from the canonical capture and inventory, generates stable builder-owned test IDs, derives existing/added/modified status, and snapshots only added/modified live test sources.
+- `execute`: runs native project commands and owns `executions.json`, `receipts/`, and `raw/`. For `auto_bind=true`, the builder resolves recognized package-wide commands or explicit file/directory/glob arguments to the prepared tests they cover; ambiguous commands are blocked and must use `test_paths`.
 - `differential`: records executable proof or a mechanically validated `NOT_APPLICABLE` decision only for genuinely new behavior or textual-contract behavior.
 - `finalize`: owns manifest, stage hashes, verdict, generated-test snapshots, and evidence identity.
 - `render-report`: derives `test-report.md`; it is never authoritative.
 - `resume`: preserves prior receipts and refuses to rebind an identity-changing package; create a new package after scope/source identity changes.
 
-Before testing, inspect and reuse repository-native tests and their runner configuration. Existing tests are the default. Add or modify a project-native test only after recording a concrete behavior gap. Classify each planned test as `existing`, `added`, or `modified`; `generated-tests/` is empty for unchanged existing tests and contains only snapshots of added/modified native test sources.
-
-`test-plan.json` is the only source of test IDs. Execution requests may reference only IDs declared there, and the builder rejects unknown IDs or layer mappings. Assess all five layers explicitly, but set `required=true` only when risk requires it; every omitted layer needs structured N/A evidence. The same binding applies test ↔ behavior ↔ execution ↔ differential proof.
+`test-plan.json` is the only source of builder-generated test IDs. Execution requests may provide native `test_paths`, `auto_bind=true`, or legacy IDs; the builder resolves paths to IDs before execution and rejects unknown/unbound tests or layer mappings. Assess all five layers explicitly, but set `required=true` only when risk requires it; every omitted layer needs structured N/A evidence. The same binding applies test ↔ behavior ↔ execution ↔ differential proof.
 
 The builder/validator, not the Main Agent, produces or updates `manifest.json`, `executions.json`, `receipts/*`, `validation.json`, `verdict.json`, `test-report.md`, and `source-change.patch`. `validation.json` is produced only by `validate_test_evidence.py --attest`; a package is not a `TEST_PASS` until the second strict validation succeeds.
 
@@ -149,7 +148,7 @@ Coverage metrics are diagnostic signals only and never substitute for this matri
 
 ### 4. TEST_PLAN
 
-Write `test-plan.json`. Select necessary unit, module/component, contract, integration, and code-level E2E tests by risk. Assess the ordered execution layers:
+Write the semantic preparation request under `requests/` and invoke `prepare-tests`; do not hand-author the resulting `test-plan.json`. Provide only repository-native `project_path` values, behavior mappings, selectors/runner hints, and the five layer decisions. The builder derives test IDs, status, snapshots, and hashes from inventory and canonical Git capture. Assess the ordered execution layers:
 
 1. focused;
 2. module/component;
@@ -175,7 +174,7 @@ If a valid test reveals a business/contract defect, do not fix production behavi
 
 ### 7. EXECUTE_PROVE
 
-Run required layers in plan order through `${SKILL_DIR}/scripts/build_test_evidence.py execute`. The model selects project-native argv, cwd, timeout, attempts, concurrency, layer, environment classification, and tool probes in schema-shaped requests. The runner performs the actual process execution and appends complete environment/tool versions, raw stdout/stderr hashes, request hash, runner hash, unique receipt, and receipt-chain binding to `executions.json`. Do not accept caller-authored execution JSON and do not retry until green.
+Run required layers in plan order through `${SKILL_DIR}/scripts/build_test_evidence.py execute`. Use `test_paths` or `auto_bind=true` for new requests; the builder resolves and persists canonical test IDs before the native command runs. The model selects project-native argv, cwd, timeout, attempts, concurrency, layer, environment classification, and tool probes in schema-shaped requests. The runner performs the actual process execution and appends complete environment/tool versions, raw stdout/stderr hashes, request hash, runner hash, unique receipt, and receipt-chain binding to `executions.json`. Do not accept caller-authored execution JSON and do not retry until green.
 
 Differentially prove each added/changed necessary behavior test:
 

package/bundled/skills/prizmkit-test/assets/authoritative-records.schema.json

@@ -215,6 +215,32 @@
         "plan_inputs": { "type": "object", "minProperties": 1 }
       }
     },
+    "changeCapture": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["capture_format", "baseline_commit", "patch_path", "patch_sha256", "changed_files", "source_tree_sha256"],
+      "properties": {
+        "capture_format": { "const": "prizmkit-canonical-change-v1" },
+        "baseline_commit": { "type": "string", "minLength": 1 },
+        "patch_path": { "$ref": "#/$defs/path" },
+        "patch_sha256": { "$ref": "#/$defs/sha256" },
+        "changed_files": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["path", "status", "old_path"],
+            "properties": {
+              "path": { "$ref": "#/$defs/path" },
+              "status": { "type": "string", "minLength": 1 },
+              "old_path": { "type": ["string", "null"] },
+              "role": { "const": "source" }
+            }
+          }
+        },
+        "source_tree_sha256": { "$ref": "#/$defs/sha256" }
+      }
+    },
     "testPlan": {
       "type": "object",
       "additionalProperties": false,
@@ -250,16 +276,68 @@
               "project_path": { "$ref": "#/$defs/path" },
               "snapshot_path": { "type": ["string", "null"] },
               "inventory_path": { "$ref": "#/$defs/path" },
-              "layers": { "$ref": "#/$defs/stringArray" }
+              "layers": { "$ref": "#/$defs/stringArray" },
+              "selector": { "type": "string", "minLength": 1 },
+              "runner": { "type": "string", "minLength": 1 }
             }
           }
         }
       }
     },
+    "testPreparationRequest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["request_version", "layers", "tests"],
+      "properties": {
+        "request_version": { "const": "1.0" },
+        "layers": {
+          "type": "array",
+          "minItems": 5,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "required", "not_applicable"],
+            "properties": {
+              "name": { "enum": ["focused", "module-component", "contract-integration", "affected-module-regression", "regression-ring"] },
+              "required": { "type": "boolean" },
+              "not_applicable": { "type": ["object", "null"] }
+            }
+          }
+        },
+        "tests": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["project_path", "behavior_ids", "layers"],
+            "properties": {
+              "project_path": { "$ref": "#/$defs/path" },
+              "behavior_ids": { "$ref": "#/$defs/stringArray" },
+              "layers": { "$ref": "#/$defs/stringArray" },
+              "selector": { "type": "string", "minLength": 1 },
+              "runner": { "type": "string", "minLength": 1 }
+            }
+          }
+        }
+      }
+    },
+    "testPreparation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["format", "request_path", "request_sha256", "tests", "changed_test_statuses"],
+      "properties": {
+        "format": { "const": "prizmkit-native-test-preparation-v1" },
+        "request_path": { "$ref": "#/$defs/path" },
+        "request_sha256": { "$ref": "#/$defs/sha256" },
+        "tests": { "type": "array", "minItems": 1, "items": { "type": "object" } },
+        "changed_test_statuses": { "type": "object", "additionalProperties": { "enum": ["added", "modified"] } }
+      }
+    },
     "executionRequest": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["request_version", "purpose", "command", "cwd", "environment", "tool_version_commands", "layer", "test_ids", "external_targets"],
+      "required": ["request_version", "purpose", "command", "cwd", "environment", "tool_version_commands", "layer", "external_targets"],
       "properties": {
         "request_version": { "const": "1.0" },
         "purpose": { "type": "string", "minLength": 1 },
@@ -269,6 +347,8 @@
         "tool_version_commands": { "type": "object" },
         "layer": { "enum": ["focused", "module-component", "contract-integration", "affected-module-regression", "regression-ring", "lightweight"] },
         "test_ids": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+        "test_paths": { "type": "array", "items": { "$ref": "#/$defs/path" } },
+        "auto_bind": { "type": "boolean" },
         "external_targets": { "type": "array", "items": { "$ref": "#/$defs/externalTarget" } },
         "timeout_seconds": { "type": "number", "exclusiveMinimum": 0 },
         "attempt_policy": { "type": "object" },
@@ -294,6 +374,8 @@
         "tool_versions": { "type": "object" },
         "layer": { "enum": ["focused", "module-component", "contract-integration", "affected-module-regression", "regression-ring", "lightweight"] },
         "test_ids": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+        "test_paths": { "type": "array", "items": { "$ref": "#/$defs/path" } },
+        "auto_bind": { "type": "boolean" },
         "external_targets": { "type": "array", "items": { "$ref": "#/$defs/externalTarget" } },
         "exit_code": { "type": "integer" },
         "stdout_path": { "$ref": "#/$defs/path" },

package/bundled/skills/prizmkit-test/assets/evidence-package-template.json

@@ -4,6 +4,7 @@
     "init",
     "capture-change",
     "inventory",
+    "prepare-tests",
     "execute",
     "differential",
     "finalize",
@@ -18,6 +19,7 @@
     "environment": "environment.json",
     "behavior_risk_matrix": "behavior-risk-matrix.json",
     "test_plan": "test-plan.json",
+    "test_preparation": "test-preparation.json",
     "infrastructure_changes": "infrastructure-changes.json",
     "differential_proof": "differential-proof.json",
     "executions": "executions.json",

package/bundled/skills/prizmkit-test/references/evidence-protocol.md

@@ -25,9 +25,9 @@ Hashes and validator receipts provide byte-level binding and drift detection, no
 
 ## Existing Tests and Package Finalization
 
-The evidence package is an audit of repository behavior, not a request to invent a parallel test suite. Discover and execute the smallest relevant native tests before adding anything. `generated-tests/` is a snapshot area for added or modified repository-native tests only; it may be empty when existing tests cover the behavior.
+The evidence package is an audit of repository behavior, not a request to invent a parallel test suite. Discover and execute the smallest relevant native tests before adding anything. Add, modify, or delete tests only in the target repository. The builder's `prepare-tests` command derives stable test IDs and change status from canonical Git capture, and snapshots only added or modified repository-native tests. `generated-tests/` is an evidence archive, never an execution workspace; it may be empty when existing tests cover the behavior.
 
-The canonical package lifecycle is `init → capture-change → inventory → execute/differential → finalize → render-report → validate --attest → resume`. Builder commands own `source-change.patch`, receipts, raw outputs, manifest, verdict, and report. The validator alone owns `validation.json`. Evidence identity is derived from the resolved baseline, canonical patch hash, and scope hash; identity-changing resume creates a new package instead of rewriting the old directory.
+The canonical package lifecycle is `init → capture-change → inventory → prepare-tests → execute/differential → finalize → render-report → validate --attest → resume`. Builder commands own `source-change.patch`, native test preparation, receipts, raw outputs, manifest, verdict, and report. The validator alone owns `validation.json`. Inventory must consume a fresh capture and exactly preserve its complete changed-file set. Canonical behavior packages require a schema-valid `test-preparation.json` bound byte-for-byte to the builder-generated `test-plan.json` and its hashed semantic request. Evidence identity is derived from the resolved baseline, canonical patch hash, and scope hash; identity-changing resume creates a new package instead of rewriting the old directory.
 
 
 Run exactly these states in order:

package/bundled/skills/prizmkit-test/references/evidence-request-protocol.md

@@ -6,7 +6,7 @@ Load this reference when writing an inventory, execution, differential, resume,
 
 Start every new package with `init`, then run builder-owned `capture-change` before semantic inventory. `capture-change` is the only producer of `source-change.patch`; it records tracked, untracked, deleted, renamed, and copied paths against the resolved baseline. The Main Agent must not create or edit the patch.
 
-Use existing project-native tests first. A test plan must identify each test as `existing`, `added`, or `modified`; only the latter two may receive a `generated-tests/` snapshot. Existing tests are executed from their repository paths and do not need generated snapshots. `test-plan.json` is the sole authority for test IDs, and execution requests with unknown IDs are rejected by the builder.
+Use existing project-native tests first. The Main Agent supplies only semantic test paths, behavior mappings, selectors, runner hints, and layer decisions. Run `prepare-tests` after inventory: it derives stable file/test-unit IDs and existing/added/modified status from canonical capture, snapshots added/modified repository tests, and writes normalized `test-plan.json`. The Main Agent must not hand-author IDs, status, snapshot paths, hashes, or receipt fields. Inventory `changed_files` must exactly match the fresh canonical capture, and every live captured path must be inventoried or explicitly excluded. Execution requests may use `test_paths`, `auto_bind: true`, or legacy IDs; `auto_bind` resolves only recognized package-wide commands or explicit file/directory/glob command scope, while ambiguous commands must provide `test_paths`. The builder records canonical test IDs before running. Every changed native test must be bound, and package-wide commands must not silently hide added or modified tests.
 
 `finalize` creates the manifest, stage dependency hashes, verdict, evidence identity, and deterministic report inputs. `render-report` only renders the derived Markdown view. The validator alone creates `validation.json` during `--attest`; never hand-author a validation attestation or rebind a finalized package after identity inputs change.
 

package/bundled/skills/prizmkit-test/references/test-generation-steps.md

@@ -4,7 +4,7 @@ Use this reference during `INFRA_READY`, `TEST_BUILD`, and `EXECUTE_PROVE`. The
 
 ## Existing-Test-First Rule
 
-Before creating a test, inspect the repository's native test files, runner configuration, and existing behavior assertions. Execute the smallest relevant existing tests first. Add or modify a repository-native test only when a concrete behavior gap is identified and recorded in the test plan. Mark each test `existing`, `added`, or `modified`; only `added` and `modified` tests are copied into `generated-tests/`. An unchanged existing test has no generated snapshot.
+Before creating a test, inspect the repository's native test files, runner configuration, and existing behavior assertions. Execute the smallest relevant existing tests first. Add, modify, or delete a repository-native test only when a concrete behavior gap is identified and recorded in the semantic preparation request. Supply project paths and behavior/layer mappings only; `prepare-tests` derives IDs, status, snapshots, and hashes from the repository and canonical Git capture. An unchanged existing test has no generated snapshot, and `generated-tests/` is never an execution workspace.
 
 
 For `scope=this-change`, changed files locate the affected module; they do not restrict tests to changed lines. Fill observable behavior/risk gaps across the whole affected module and execute its Regression Ring. Unrelated modules remain out of scope unless they are direct callers, consumers, shared contracts, or state dependencies.
@@ -32,7 +32,7 @@ For every behavior row:
 1. Read the public interface, contract source, preconditions, inputs/boundaries, outputs, side effects, transitions, and errors.
 2. Inspect existing test assertions—not names—to find proven cells.
 3. Assess all eight risks: functional, boundary, permission, concurrency, idempotency, time, dependency, and consumer.
-4. For every applicable risk, create a distinct test ID and expected execution layer.
+4. For every applicable risk, map one or more builder-generated test units and expected execution layer; do not invent a separate AI-maintained ID for every test function.
 5. For every non-applicable risk, record a concrete rationale tied to this behavior.
 6. Keep unresolved truth or untestable necessary behavior explicit; it blocks rather than becoming guessed expected behavior.
 

package/bundled/skills/prizmkit-test/scripts/build_test_evidence.py

@@ -5,6 +5,7 @@ Usage:
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR init [--baseline COMMIT]
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR capture-change
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR inventory --request REQUEST
+  python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR prepare-tests --request REQUEST
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR execute --request REQUEST
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR execute --replay-receipt RECEIPT
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR differential --request REQUEST
@@ -21,6 +22,7 @@ from __future__ import annotations
 
 import argparse
 import datetime as dt
+import fnmatch
 import hashlib
 import json
 import os
@@ -326,6 +328,50 @@ def validate_external_targets(value: Any) -> list[dict[str, Any]]:
     return value
 
 
+def load_change_capture(
+    project_root: Path,
+    evidence_dir: Path,
+    *,
+    require_fresh: bool = False,
+) -> dict[str, Any]:
+    capture_path = evidence_dir / "change-capture.json"
+    if not capture_path.is_file():
+        raise RequestError("canonical change capture is required; run capture-change first")
+    capture = ensure_object(load_json(capture_path), "change capture")
+    baseline = capture.get("baseline_commit")
+    patch_path = evidence_dir / "source-change.patch"
+    if (
+        capture.get("capture_format") != "prizmkit-canonical-change-v1"
+        or not isinstance(baseline, str)
+        or not patch_path.is_file()
+        or capture.get("patch_path") != "source-change.patch"
+        or capture.get("patch_sha256") != file_sha256(patch_path)
+        or not isinstance(capture.get("changed_files"), list)
+    ):
+        raise RequestError("canonical change capture is incomplete or inconsistent")
+    if require_fresh:
+        live_patch, live_entries = canonical_change_patch(project_root, baseline)
+        live_patch_sha256 = hashlib.sha256(live_patch).hexdigest()
+        if (
+            live_patch_sha256 != capture["patch_sha256"]
+            or live_entries != capture["changed_files"]
+            or tree_sha256(project_root, [evidence_dir]) != capture.get("source_tree_sha256")
+        ):
+            raise RequestError(
+                "canonical change capture is stale; rerun capture-change and inventory after repository changes"
+            )
+    return capture
+
+
+def captured_changed_paths(capture: dict[str, Any]) -> list[str]:
+    paths = {
+        item["path"]
+        for item in capture.get("changed_files", [])
+        if isinstance(item, dict) and isinstance(item.get("path"), str)
+    }
+    return sorted(paths)
+
+
 def plan_for_execution(evidence_dir: Path) -> dict[str, Any] | None:
     path = evidence_dir / "test-plan.json"
     if not path.exists():
@@ -333,13 +379,22 @@ def plan_for_execution(evidence_dir: Path) -> dict[str, Any] | None:
     return ensure_object(load_json(path), "test plan")
 
 
+def test_plan_entries(plan: dict[str, Any] | None) -> list[dict[str, Any]]:
+    if not isinstance(plan, dict) or not isinstance(plan.get("tests"), list):
+        raise RequestError("builder-generated test plan is required before execution")
+    entries = [item for item in plan["tests"] if isinstance(item, dict)]
+    if len(entries) != len(plan["tests"]):
+        raise RequestError("test plan contains a non-object test entry")
+    return entries
+
+
 def validate_execution_request(request: Any, *, plan: dict[str, Any] | None = None) -> dict[str, Any]:
     request = ensure_object(request, "execution request")
     required = {
         "request_version", "purpose", "command", "cwd", "environment",
-        "tool_version_commands", "layer", "test_ids", "external_targets",
+        "tool_version_commands", "layer", "external_targets",
     }
-    optional = {"timeout_seconds", "attempt_policy", "concurrency"}
+    optional = {"timeout_seconds", "attempt_policy", "concurrency", "test_ids", "test_paths", "auto_bind"}
     if not required <= set(request) or set(request) - required - optional:
         raise RequestError(f"execution request fields must contain {sorted(required)} and only supported optional fields")
     if request["request_version"] != "1.0":
@@ -357,20 +412,32 @@ def validate_execution_request(request: Any, *, plan: dict[str, Any] | None = No
         if not isinstance(name, str):
             raise RequestError("tool probe names must be strings")
         ensure_string_list(probe, f"tool probe {name}", allow_empty=False)
-    test_ids = ensure_string_list(request["test_ids"], "test_ids", allow_empty=False)
-    if len(set(test_ids)) != len(test_ids):
-        raise RequestError("execution request test_ids contains duplicates")
+    has_ids = "test_ids" in request
+    has_paths = "test_paths" in request
+    auto_bind = request.get("auto_bind") is True
+    if not has_ids and not has_paths and not auto_bind:
+        raise RequestError("execution request must provide test_ids, test_paths, or auto_bind=true")
+    if has_ids:
+        test_ids = ensure_string_list(request["test_ids"], "test_ids", allow_empty=False)
+        if len(set(test_ids)) != len(test_ids):
+            raise RequestError("execution request test_ids contains duplicates")
+    if has_paths:
+        test_paths = ensure_string_list(request["test_paths"], "test_paths", allow_empty=False)
+        if len(set(test_paths)) != len(test_paths):
+            raise RequestError("execution request test_paths contains duplicates")
+    if "auto_bind" in request and not isinstance(request["auto_bind"], bool):
+        raise RequestError("execution request auto_bind must be boolean")
     if request["layer"] not in LAYERS and request["layer"] != "lightweight":
         raise RequestError(f"unknown execution layer: {request['layer']}")
-    if plan is not None:
-        tests = plan.get("tests") if isinstance(plan, dict) else None
-        known = {item.get("id") for item in tests if isinstance(item, dict)} if isinstance(tests, list) else set()
-        unknown = sorted(set(test_ids) - known)
+    if plan is not None and has_ids:
+        tests = test_plan_entries(plan)
+        known = {item.get("id") for item in tests}
+        unknown = sorted(set(request["test_ids"]) - known)
         if unknown:
             raise RequestError(f"execution request references unknown test IDs: {', '.join(unknown)}")
-        test_map = {item.get("id"): item for item in tests if isinstance(item, dict)} if isinstance(tests, list) else {}
+        test_map = {item.get("id"): item for item in tests}
         invalid_layer = sorted(
-            test_id for test_id in test_ids
+            test_id for test_id in request["test_ids"]
             if request["layer"] not in (test_map.get(test_id, {}).get("layers") or [])
         )
         if invalid_layer:
@@ -381,6 +448,116 @@ def validate_execution_request(request: Any, *, plan: dict[str, Any] | None = No
     return request
 
 
+def normalize_command_scope_path(project_root: Path, cwd: Path, value: str) -> str | None:
+    if not isinstance(value, str) or not value or value.startswith("-"):
+        return None
+    candidate = Path(value)
+    resolved = candidate.resolve() if candidate.is_absolute() else (cwd / candidate).resolve()
+    try:
+        return resolved.relative_to(project_root.resolve()).as_posix()
+    except ValueError:
+        return None
+
+
+def command_scope_test_ids(project_root: Path, request: dict[str, Any], tests: list[dict[str, Any]]) -> list[str]:
+    cwd = confined(project_root, request["cwd"] or ".", must_exist=True, directory=True)
+    command = request["command"]
+    executable = Path(command[0]).name.lower()
+    subcommands = {item for item in command[1:] if not item.startswith("-")}
+    path_tokens: list[str] = []
+    after_separator = False
+    skip_option_value = False
+    options_with_values = {
+        "-C", "--config", "--config-file", "--project", "--package", "-p",
+        "--root", "--rootdir", "--cwd", "--testPathPattern", "--testNamePattern",
+    }
+    for token in command[1:]:
+        if skip_option_value:
+            skip_option_value = False
+            continue
+        if token == "--":
+            after_separator = True
+            continue
+        if token in options_with_values:
+            skip_option_value = True
+            continue
+        if token.startswith("-"):
+            continue
+        if token in {"test", "run", "watch", "coverage", "all", "serial", "parallel"} and not after_separator:
+            continue
+        if after_separator or token.startswith((".", "/")) or "/" in token or any(mark in token for mark in "*?[]"):
+            path_tokens.append(token)
+
+    package_wide = (
+        executable in {"pytest", "vitest", "jest", "mocha", "busted"}
+        or (executable in {"python", "python3", "py.test"} and "pytest" in command)
+        or (executable in {"npm", "npm.cmd", "pnpm", "pnpm.cmd", "yarn", "yarn.cmd"} and "test" in subcommands)
+        or (executable in {"go", "cargo", "mvn", "gradle", "gradlew"} and "test" in subcommands)
+    )
+    if not path_tokens:
+        if package_wide:
+            return sorted({item["id"] for item in tests})
+        raise RequestError(
+            "auto_bind cannot infer native test scope from command; provide test_paths or use a recognized package-wide test command"
+        )
+
+    matched_paths: set[str] = set()
+    for token in path_tokens:
+        recursive_scope = token == "..." or token.endswith("/...")
+        scope_token = token[:-3].rstrip("/") if recursive_scope else token
+        normalized = normalize_command_scope_path(project_root, cwd, scope_token or ".")
+        if normalized is None:
+            continue
+        has_glob = any(mark in normalized for mark in "*?[]")
+        for test in tests:
+            test_path = test["project_path"]
+            within_scope = normalized in {"", "."} or test_path == normalized or path_is_below_or_equal(test_path, normalized)
+            if (has_glob and fnmatch.fnmatch(test_path, normalized)) or (recursive_scope and within_scope) or (
+                not has_glob and not recursive_scope and within_scope
+            ):
+                matched_paths.add(test_path)
+    if not matched_paths:
+        raise RequestError(
+            "auto_bind command scope does not cover any prepared native test; provide test_paths explicitly"
+        )
+    return [item["id"] for item in tests if item["project_path"] in matched_paths]
+
+
+def resolve_execution_test_ids(project_root: Path, evidence_dir: Path, request: dict[str, Any]) -> dict[str, Any]:
+    plan = plan_for_execution(evidence_dir)
+    if plan is None:
+        if "test_ids" not in request:
+            raise RequestError("builder-generated test plan is required before path-based or auto-bound execution")
+        return request
+    if (evidence_dir / "lifecycle.json").is_file() and not (evidence_dir / "test-preparation.json").is_file():
+        raise RequestError("canonical lifecycle requires prepare-tests before execute or differential")
+    tests = test_plan_entries(plan)
+    by_id = {item["id"]: item for item in tests}
+    by_path = {item["project_path"]: item for item in tests}
+    if "test_ids" in request:
+        resolved = list(request["test_ids"])
+    elif "test_paths" in request:
+        unknown_paths = sorted(set(request["test_paths"]) - set(by_path))
+        if unknown_paths:
+            raise RequestError(f"execution request references unknown test paths: {', '.join(unknown_paths)}")
+        resolved = [by_path[path]["id"] for path in request["test_paths"]]
+    else:
+        resolved = command_scope_test_ids(project_root, request, tests)
+    if not resolved:
+        raise RequestError("execution request resolved no prepared tests")
+    unknown = sorted(set(resolved) - set(by_id))
+    if unknown:
+        raise RequestError(f"execution request references unknown test IDs: {', '.join(unknown)}")
+    invalid_layer = sorted(
+        test_id for test_id in resolved
+        if request["layer"] not in (by_id[test_id].get("layers") or [])
+    )
+    if invalid_layer:
+        raise RequestError(f"execution layer is not planned for test IDs: {', '.join(invalid_layer)}")
+    request["test_ids"] = resolved
+    return request
+
+
 def is_volatile_snapshot_path(root: Path, candidate: Path, excluded: list[Path] | None = None) -> bool:
     try:
         relative = candidate.relative_to(root)
@@ -404,6 +581,7 @@ def tree_sha256(root: Path, excluded: list[Path] | None = None) -> str:
 
 
 def collect_matches(project_root: Path, patterns: list[str], exclusions: set[str]) -> list[dict[str, str]]:
+    project_resolved = project_root.resolve()
     paths: set[Path] = set()
     for pattern in patterns:
         if Path(pattern).is_absolute() or ".." in Path(pattern).parts:
@@ -413,7 +591,7 @@ def collect_matches(project_root: Path, patterns: list[str], exclusions: set[str
                 paths.add(candidate.resolve())
     entries = []
     for candidate in sorted(paths):
-        relative = candidate.relative_to(project_root).as_posix()
+        relative = candidate.relative_to(project_resolved).as_posix()
         if relative not in exclusions and not is_reserved_inventory_path(relative):
             entries.append({"path": relative, "sha256": file_sha256(candidate)})
     return entries
@@ -473,6 +651,7 @@ def enumerate_module_root_files(
     evidence_dir: Path,
     module_roots: list[str],
 ) -> dict[str, list[str]]:
+    project_resolved = project_root.resolve()
     evidence_resolved = evidence_dir.resolve()
     result: dict[str, list[str]] = {}
     for relative in module_roots:
@@ -485,7 +664,7 @@ def enumerate_module_root_files(
             resolved = candidate.resolve()
             if resolved == evidence_resolved or evidence_resolved in resolved.parents:
                 continue
-            files.append(resolved.relative_to(project_root).as_posix())
+            files.append(resolved.relative_to(project_resolved).as_posix())
         result[relative] = sorted(files)
     return result
 
@@ -548,6 +727,39 @@ def run_inventory(project_root: Path, evidence_dir: Path, request_path: Path, ou
         for entries in output_categories.values()
         for entry in entries
     }
+    capture_path = evidence_dir / "change-capture.json"
+    if capture_path.is_file():
+        capture = load_change_capture(project_root, evidence_dir, require_fresh=True)
+        captured_paths = set(captured_changed_paths(capture))
+        if captured_paths != set(changed_files):
+            missing = sorted(captured_paths - set(changed_files))
+            extra = sorted(set(changed_files) - captured_paths)
+            details = []
+            if missing:
+                details.append("missing from inventory request: " + ", ".join(missing))
+            if extra:
+                details.append("not present in canonical capture: " + ", ".join(extra))
+            raise RequestError("inventory changed_files must exactly match canonical capture (" + "; ".join(details) + ")")
+        captured_deleted = {
+            item["path"]
+            for item in capture.get("changed_files", [])
+            if isinstance(item, dict)
+            and isinstance(item.get("path"), str)
+            and (str(item.get("status", "")).strip() == "D" or item.get("role") == "source")
+        }
+        unaccounted = sorted(
+            captured_paths
+            - inventoried_paths
+            - exclusion_paths
+            - captured_deleted
+        )
+        if unaccounted:
+            raise RequestError(
+                "canonical changed files are neither inventoried nor explicitly excluded: "
+                + ", ".join(unaccounted)
+            )
+    elif (evidence_dir / "lifecycle.json").is_file():
+        raise RequestError("canonical lifecycle requires capture-change before inventory")
     missing_from_inventory = sorted({
         relative
         for files in module_root_files.values()
@@ -663,7 +875,12 @@ def execute_request(
     isolation: dict[str, Any] | None = None,
     selected_execution: bool = True,
 ) -> dict[str, Any]:
-    request = validate_execution_request(load_json(request_path), plan=plan_for_execution(evidence_dir))
+    request_value = load_json(request_path)
+    original_test_ids = list(request_value["test_ids"]) if isinstance(request_value, dict) and isinstance(request_value.get("test_ids"), list) else None
+    request = validate_execution_request(request_value, plan=plan_for_execution(evidence_dir))
+    request = resolve_execution_test_ids(project_root, evidence_dir, request)
+    if original_test_ids != request["test_ids"]:
+        write_json_atomic(request_path, request)
     root = execution_root or project_root
     cwd = confined(root, request["cwd"] or ".", must_exist=True, directory=True)
     complete_environment = {"PATH": os.environ.get("PATH", os.defpath)}
@@ -826,9 +1043,15 @@ def run_differential(project_root: Path, evidence_dir: Path, request_path: Path)
         return proof
     if set(request) != required or request["request_version"] != "1.0":
         raise RequestError(f"differential request fields must be exactly {sorted(required)} with version 1.0")
-    execution_request = validate_execution_request(
-        request["execution_request"], plan=plan_for_execution(evidence_dir),
+    execution_request = resolve_execution_test_ids(
+        project_root,
+        evidence_dir,
+        validate_execution_request(
+            request["execution_request"], plan=plan_for_execution(evidence_dir),
+        ),
     )
+    request["execution_request"] = execution_request
+    write_json_atomic(request_path, request)
     expected_failure_signals = ensure_string_list(request["expected_failure_signals"], "expected_failure_signals", allow_empty=False)
     overlay_paths = ensure_string_list(request["test_overlay_paths"], "test_overlay_paths")
     for relative in overlay_paths:
@@ -1047,10 +1270,171 @@ def aggregate_inventory(entries: list[dict[str, str]]) -> str:
     return canonical_sha256(sorted(entries, key=lambda item: item["path"]))
 
 
+def changed_test_statuses(evidence_dir: Path) -> dict[str, str]:
+    capture = load_change_capture(Path("."), evidence_dir)
+    inventory = ensure_object(load_json(evidence_dir / "target-inventory.json"), "target inventory")
+    test_paths = {
+        item.get("path")
+        for item in inventory.get("categories", {}).get("tests", [])
+        if isinstance(item, dict) and isinstance(item.get("path"), str)
+    }
+    statuses: dict[str, str] = {}
+    for entry in capture.get("changed_files", []):
+        if not isinstance(entry, dict) or not isinstance(entry.get("path"), str):
+            continue
+        relative = entry["path"]
+        if relative not in test_paths or entry.get("role") == "source":
+            continue
+        status = str(entry.get("status", "")).strip()
+        if status == "??" or status.startswith("A"):
+            statuses[relative] = "added"
+        elif status.startswith("M") or status.endswith("M"):
+            statuses[relative] = "modified"
+        elif status.startswith("R") or status.startswith("C"):
+            statuses[relative] = "modified"
+    return statuses
+
+
+def stable_test_id(project_path: str, selector: str | None = None) -> str:
+    identity = project_path if not selector else f"{project_path}::{selector}"
+    return f"native-test-{canonical_sha256(identity)[:16]}"
+
+
+def prepare_test_layers(request: dict[str, Any], existing_plan: dict[str, Any] | None = None) -> list[dict[str, Any]]:
+    layers = request.get("layers")
+    if layers is None and isinstance(existing_plan, dict):
+        layers = existing_plan.get("layers")
+    if not isinstance(layers, list) or len(layers) != len(LAYERS):
+        raise RequestError("test preparation must assess all five layers exactly once")
+    normalized: list[dict[str, Any]] = []
+    seen: set[str] = set()
+    for item in layers:
+        if not isinstance(item, dict) or set(item) != {"name", "required", "not_applicable"}:
+            raise RequestError("test preparation layer entries require name, required, and not_applicable")
+        name = item.get("name")
+        if name not in LAYERS or name in seen:
+            raise RequestError(f"invalid or duplicate test preparation layer: {name}")
+        seen.add(name)
+        if not isinstance(item.get("required"), bool):
+            raise RequestError(f"test preparation layer required must be boolean: {name}")
+        if item["required"] is True and item.get("not_applicable") is not None:
+            raise RequestError(f"required test preparation layer cannot be N/A: {name}")
+        if item["required"] is False and not isinstance(item.get("not_applicable"), dict):
+            raise RequestError(f"omitted test preparation layer needs structured N/A: {name}")
+        normalized.append(item)
+    return normalized
+
+
+def run_prepare_tests(project_root: Path, evidence_dir: Path, request_path: Path, output_name: str) -> Path:
+    request = ensure_object(load_json(request_path), "test preparation request")
+    allowed = {"request_version", "layers", "tests"}
+    if set(request) != allowed or request.get("request_version") != "1.0":
+        raise RequestError("test preparation request must contain request_version, layers, and tests only")
+    requested = request.get("tests")
+    if not isinstance(requested, list) or not requested:
+        raise RequestError("test preparation request tests must be a non-empty array")
+    existing_plan_path = evidence_dir / "test-plan.json"
+    existing_plan = ensure_object(load_json(existing_plan_path), "existing test plan") if existing_plan_path.is_file() else None
+    prepared_layers = prepare_test_layers(request, existing_plan)
+    inventory = ensure_object(load_json(evidence_dir / "target-inventory.json"), "target inventory")
+    inventory_paths = {
+        item.get("path") for item in inventory.get("categories", {}).get("tests", [])
+        if isinstance(item, dict) and isinstance(item.get("path"), str)
+    }
+    changed = changed_test_statuses(evidence_dir)
+    changed_native_tests = set(changed) & inventory_paths
+    selected_paths: set[str] = set()
+    normalized: list[dict[str, Any]] = []
+    for item in requested:
+        if not isinstance(item, dict):
+            raise RequestError("test preparation entries must be objects")
+        allowed_item = {"project_path", "behavior_ids", "layers", "selector", "runner"}
+        if set(item) - allowed_item:
+            raise RequestError("test preparation entries may not contain IDs, status, snapshot, or hash fields")
+        project_path = normalize_relative(item.get("project_path", ""))
+        if project_path in selected_paths:
+            raise RequestError(f"duplicate native test path: {project_path}")
+        selected_paths.add(project_path)
+        if project_path not in inventory_paths:
+            raise RequestError(f"native test is not in the test inventory: {project_path}")
+        source = confined(project_root, project_path, must_exist=True)
+        behavior_ids = ensure_string_list(item.get("behavior_ids"), f"test {project_path} behavior_ids", allow_empty=False)
+        layers = ensure_string_list(item.get("layers"), f"test {project_path} layers", allow_empty=False)
+        unknown_layers = sorted(set(layers) - set(LAYERS))
+        if unknown_layers:
+            raise RequestError(f"test {project_path} uses unknown layers: {', '.join(unknown_layers)}")
+        if len(layers) != len(set(layers)):
+            raise RequestError(f"test {project_path} contains duplicate layers")
+        selector = item.get("selector")
+        if selector is not None and not isinstance(selector, str):
+            raise RequestError(f"test {project_path} selector must be a string")
+        status = changed.get(project_path, "existing")
+        entry = {
+            "id": stable_test_id(project_path, selector),
+            "behavior_ids": behavior_ids,
+            "change_status": status,
+            "project_path": project_path,
+            "snapshot_path": None,
+            "inventory_path": project_path,
+            "layers": layers,
+        }
+        if selector is not None:
+            entry["selector"] = selector
+        if isinstance(item.get("runner"), str):
+            entry["runner"] = item["runner"]
+        normalized.append(entry)
+    unbound = sorted(changed_native_tests - selected_paths)
+    if unbound:
+        raise RequestError("changed native tests are not bound by test preparation: " + ", ".join(unbound))
+    generated = evidence_dir / "generated-tests"
+    generated.mkdir(parents=True, exist_ok=True)
+    used_snapshots: set[str] = set()
+    for entry in normalized:
+        if entry["change_status"] in {"added", "modified"}:
+            destination_relative = f"generated-tests/{Path(entry['project_path']).name}"
+            if destination_relative in used_snapshots:
+                destination_relative = f"generated-tests/{entry['id']}-{Path(entry['project_path']).name}"
+            destination = confined(evidence_dir, destination_relative)
+            destination.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(project_root / entry["project_path"], destination)
+            entry["snapshot_path"] = destination_relative
+            used_snapshots.add(destination_relative)
+    plan = {
+        "target_hashes": {},
+        "plan_inputs": inventory.get("plan_inputs", {}),
+        "layers": prepared_layers,
+        "tests": normalized,
+    }
+    existing_plan = evidence_dir / "test-plan.json"
+    if existing_plan.is_file():
+        prior = ensure_object(load_json(existing_plan), "existing test plan")
+        plan["target_hashes"] = prior.get("target_hashes", {})
+        plan["layers"] = prior.get("layers", prepared_layers)
+    write_json_atomic(evidence_dir / "test-plan.json", plan)
+    write_json_atomic(evidence_dir / output_name, {
+        "format": "prizmkit-native-test-preparation-v1",
+        "request_path": evidence_relative(evidence_dir, request_path),
+        "request_sha256": file_sha256(request_path),
+        "tests": normalized,
+        "changed_test_statuses": changed,
+    })
+    return evidence_dir / output_name
+
+
 def normalize_test_snapshots(project_root: Path, evidence_dir: Path, plan: dict[str, Any]) -> None:
     tests = plan.get("tests")
     if not isinstance(tests, list):
         return
+    captured_statuses = changed_test_statuses(evidence_dir) if (evidence_dir / "change-capture.json").is_file() else {}
+    inventory = load_json(evidence_dir / "target-inventory.json") if (evidence_dir / "target-inventory.json").is_file() else {}
+    inventory_paths = {
+        item.get("path") for item in inventory.get("categories", {}).get("tests", [])
+        if isinstance(item, dict) and isinstance(item.get("path"), str)
+    }
+    selected_paths = {test.get("project_path") for test in tests if isinstance(test, dict)}
+    unbound = sorted((set(captured_statuses) & inventory_paths) - selected_paths)
+    if unbound:
+        raise RequestError("changed native tests are not bound by test plan: " + ", ".join(unbound))
     generated = evidence_dir / "generated-tests"
     generated.mkdir(parents=True, exist_ok=True)
     for test in tests:
@@ -1059,9 +1443,10 @@ def normalize_test_snapshots(project_root: Path, evidence_dir: Path, plan: dict[
         project_path = test.get("project_path")
         if not isinstance(project_path, str):
             continue
-        status = test.get("change_status", test.get("origin", "existing"))
+        status = captured_statuses.get(project_path, "existing") if captured_statuses else test.get("change_status", test.get("origin", "existing"))
         if status not in {"existing", "added", "modified"}:
             raise RequestError(f"unknown test change_status: {test.get('id')}")
+        test["change_status"] = status
         if status == "existing":
             test["snapshot_path"] = None
             continue
@@ -1083,7 +1468,7 @@ def stage_output_owner(relative: str, change_class: str) -> str:
         return "SCOPE_DISCOVER"
     if relative in {"behavior-risk-matrix.json"}:
         return "CONTRACT_MODEL"
-    if relative in {"test-plan.json"}:
+    if relative in {"test-plan.json"} or relative == "test-preparation.json":
         return "TEST_PLAN"
     if relative in {"infrastructure-changes.json"} or relative.startswith("contracts/"):
         return "INFRA_READY"
@@ -1199,6 +1584,10 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
     }
     target_hashes["environment"] = canonical_sha256(environment)
     target_hashes["plan"] = canonical_sha256(inventory.get("plan_inputs", {}))
+    if isinstance(plan, dict):
+        plan["target_hashes"] = target_hashes
+        plan["plan_inputs"] = inventory.get("plan_inputs", {})
+        write_json_atomic(evidence_dir / "test-plan.json", plan)
     scope["target_hashes"] = target_hashes
     write_json_atomic(evidence_dir / scope_relative, scope)
     identity = {
@@ -1215,8 +1604,8 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
     }
     if change_class == "behavior":
         required_records.update({
-            "behavior-risk-matrix.json", "test-plan.json", "infrastructure-changes.json",
-            "differential-proof.json",
+            "behavior-risk-matrix.json", "test-plan.json", "test-preparation.json",
+            "infrastructure-changes.json", "differential-proof.json",
         })
     else:
         required_records.add("lightweight-verification.json")
@@ -1383,6 +1772,9 @@ def main() -> int:
     inventory = subparsers.add_parser("inventory")
     inventory.add_argument("--request", required=True)
     inventory.add_argument("--output", default="target-inventory.json")
+    prepare = subparsers.add_parser("prepare-tests")
+    prepare.add_argument("--request", required=True)
+    prepare.add_argument("--output", default="test-preparation.json")
     execute = subparsers.add_parser("execute")
     group = execute.add_mutually_exclusive_group(required=True)
     group.add_argument("--request")
@@ -1416,6 +1808,10 @@ def main() -> int:
             require_mutable_lifecycle(evidence_dir)
             output = run_inventory(project_root, evidence_dir, request_file(evidence_dir, args.request), args.output)
             print(f"Inventory written: {output}")
+        elif args.subcommand == "prepare-tests":
+            require_mutable_lifecycle(evidence_dir)
+            output = run_prepare_tests(project_root, evidence_dir, request_file(evidence_dir, args.request), args.output)
+            print(f"Native tests prepared: {output}")
         elif args.subcommand == "execute":
             require_mutable_lifecycle(evidence_dir)
             if args.request:

package/bundled/skills/prizmkit-test/scripts/validate_test_evidence.py

@@ -45,8 +45,8 @@ COMMON_RECORDS = {
     "source-change.patch", "test-report.md",
 }
 BEHAVIOR_RECORDS = {
-    "behavior-risk-matrix.json", "test-plan.json", "infrastructure-changes.json",
-    "differential-proof.json",
+    "behavior-risk-matrix.json", "test-plan.json",
+    "infrastructure-changes.json", "differential-proof.json",
 }
 LIGHTWEIGHT_RECORDS = {"lightweight-verification.json"}
 SHA256_RE = re.compile(r"^[a-f0-9]{64}$")
@@ -776,7 +776,9 @@ def validate_requests_and_receipts(
             if not isinstance(request, dict):
                 errors.append(f"request must be an object: {relative}")
                 continue
-            if request.get("method") == "not-applicable":
+            if set(request) == {"request_version", "layers", "tests"}:
+                validate_definition(request, "testPreparationRequest", records_schema, relative, errors)
+            elif request.get("method") == "not-applicable":
                 validate_definition(request, "differentialRequest", records_schema, relative, errors)
                 not_applicable = request.get("not_applicable")
                 if isinstance(not_applicable, dict):
@@ -935,13 +937,103 @@ def validate_execution_request_semantics(
     environment = value.get("environment")
     require(isinstance(environment, dict) and all(isinstance(key, str) and isinstance(item, str) for key, item in environment.items()), f"{location}: environment must contain complete string values", errors)
     test_ids = value.get("test_ids")
-    require(isinstance(test_ids, list) and all(isinstance(item, str) and item for item in test_ids), f"{location}: test_ids must be string IDs", errors)
+    test_paths = value.get("test_paths")
+    auto_bind = value.get("auto_bind") is True
+    require(
+        (isinstance(test_ids, list) and all(isinstance(item, str) and item for item in test_ids))
+        or (isinstance(test_paths, list) and all(isinstance(item, str) and item for item in test_paths))
+        or auto_bind,
+        f"{location}: execution must provide test_ids, test_paths, or auto_bind",
+        errors,
+    )
     if receipt:
         require(type(value.get("selected_execution")) is bool, f"{location}: selected_execution must be boolean", errors)
         require(type(value.get("reliable")) is bool, f"{location}: reliable must be boolean", errors)
         require(type(value.get("exit_code")) is int and not isinstance(value.get("exit_code"), bool), f"{location}: exit_code must be an integer", errors)
 
 
+def changed_test_statuses(root: Path) -> dict[str, str]:
+    capture_path = root / "change-capture.json"
+    if not capture_path.is_file():
+        return {}
+    try:
+        capture = load_json(capture_path)
+    except EvidenceError:
+        return {}
+    statuses: dict[str, str] = {}
+    for item in capture.get("changed_files", []) if isinstance(capture, dict) else []:
+        if not isinstance(item, dict) or not isinstance(item.get("path"), str) or item.get("role") == "source":
+            continue
+        status = str(item.get("status", "")).strip()
+        if status == "??" or status.startswith("A"):
+            statuses[item["path"]] = "added"
+        elif status.startswith("M") or status.endswith("M") or status.startswith(("R", "C")):
+            statuses[item["path"]] = "modified"
+    return statuses
+
+
+def validate_canonical_capture(
+    root: Path,
+    project_root: Path,
+    capture: dict[str, Any],
+    inventory: dict[str, Any],
+    scope: dict[str, Any],
+    errors: list[str],
+) -> None:
+    patch_relative = capture.get("patch_path")
+    patch = safe_path(root, patch_relative, errors, "canonical change patch") if isinstance(patch_relative, str) else None
+    require(patch_relative == "source-change.patch", "canonical capture patch_path must be source-change.patch", errors)
+    if patch is not None:
+        require(file_sha256(patch) == capture.get("patch_sha256"), "canonical capture patch hash mismatch", errors)
+    require(
+        capture.get("source_tree_sha256") == tree_sha256(project_root, root),
+        "canonical change capture source tree is stale",
+        errors,
+    )
+    captured_paths = {
+        item.get("path")
+        for item in capture.get("changed_files", [])
+        if isinstance(item, dict) and isinstance(item.get("path"), str)
+    }
+    inventory_changed = set(inventory.get("changed_files", [])) if isinstance(inventory.get("changed_files"), list) else set()
+    scope_changed = set(scope.get("changed_files", [])) if isinstance(scope.get("changed_files"), list) else set()
+    require(captured_paths == inventory_changed, "canonical capture and inventory changed_files do not match", errors)
+    require(captured_paths == scope_changed, "canonical capture and scope changed_files do not match", errors)
+
+
+def validate_test_preparation(
+    root: Path,
+    project_root: Path,
+    preparation: dict[str, Any],
+    plan: dict[str, Any],
+    inventory_by_category: dict[str, dict[str, str]],
+    entry_map: dict[str, dict[str, Any]],
+    records_schema: dict[str, Any],
+    errors: list[str],
+) -> None:
+    validate_definition(preparation, "testPreparation", records_schema, "test-preparation", errors)
+    request_relative = preparation.get("request_path")
+    request_path = require_manifest_entry(request_relative, entry_map, root, errors, "test preparation request") if isinstance(request_relative, str) else None
+    if request_path is not None:
+        require(file_sha256(request_path) == preparation.get("request_sha256"), "test preparation request hash mismatch", errors)
+    prepared_tests = preparation.get("tests")
+    require(prepared_tests == plan.get("tests"), "test preparation tests do not match test plan", errors)
+    statuses = preparation.get("changed_test_statuses")
+    require(isinstance(statuses, dict), "test preparation changed_test_statuses must be an object", errors)
+    if not isinstance(statuses, dict):
+        return
+    for relative, status in statuses.items():
+        require(relative in inventory_by_category.get("tests", {}), f"test preparation status is not in test inventory: {relative}", errors)
+        require(status in {"added", "modified"}, f"test preparation has invalid changed test status: {relative}", errors)
+    for test in prepared_tests if isinstance(prepared_tests, list) else []:
+        if not isinstance(test, dict):
+            continue
+        relative = test.get("project_path")
+        if isinstance(relative, str):
+            expected = statuses.get(relative, "existing")
+            require(test.get("change_status") == expected, f"test preparation status mismatch: {relative}", errors)
+
+
 def validate_plan_and_scope_bindings(
     root: Path,
     project_root: Path,
@@ -1003,6 +1095,8 @@ def validate_plan_and_scope_bindings(
             for test_id in receipt.get("test_ids", []):
                 if isinstance(test_id, str):
                     selected_by_test.setdefault(test_id, []).append(receipt)
+    changed_tests = changed_test_statuses(root)
+    planned_test_paths: set[str] = set()
     known_behavior_ids = {item.get("id") for item in matrix.get("behaviors", []) if isinstance(item, dict)}
     for test in tests:
         if not isinstance(test, dict):
@@ -1018,9 +1112,13 @@ def validate_plan_and_scope_bindings(
         for behavior_id in behavior_ids if isinstance(behavior_ids, list) else []:
             require(behavior_id in known_behavior_ids, f"planned test maps unknown behavior: {test_id}/{behavior_id}", errors)
         project_relative = test.get("project_path")
+        planned_test_paths.add(project_relative)
         inventory_relative = test.get("inventory_path")
         snapshot_relative = test.get("snapshot_path")
+        inferred_status = changed_tests.get(project_relative, "existing")
         change_status = test.get("change_status", "modified" if isinstance(snapshot_relative, str) else "existing")
+        if changed_tests:
+            require(change_status == inferred_status, f"planned test change_status does not match canonical capture: {test_id}", errors)
         require(change_status in {"existing", "added", "modified"}, f"planned test has invalid change_status: {test_id}", errors)
         project_path = safe_path(project_root, project_relative, errors, f"planned test {test_id} project_path")
         require(project_path is not None and project_path.is_file(), f"planned test live path is missing: {test_id}", errors)
@@ -1043,6 +1141,19 @@ def validate_plan_and_scope_bindings(
         for receipt in matching_receipts:
             require(receipt.get("layer") in test_layers, f"planned test receipt uses an unplanned layer: {test_id}", errors)
 
+    for relative, status in changed_tests.items():
+        if relative in inventory_by_category.get("tests", {}) and relative not in planned_test_paths:
+            errors.append(f"changed native test is not bound by test plan: {relative}")
+    generated_dir = root / "generated-tests"
+    referenced_snapshots = {
+        test.get("snapshot_path") for test in tests if isinstance(test, dict) and isinstance(test.get("snapshot_path"), str)
+    }
+    if generated_dir.is_dir():
+        actual_snapshots = {
+            path.relative_to(root).as_posix() for path in generated_dir.rglob("*") if path.is_file()
+        }
+        for relative in sorted(actual_snapshots - referenced_snapshots):
+            errors.append(f"generated test snapshot is not bound by test plan: {relative}")
     for ring in scope.get("regression_ring", []):
         if not isinstance(ring, dict):
             continue
@@ -1415,11 +1526,25 @@ def validate_evidence(
     entry_map = validate_manifest(root, manifest, manifest_schema, records_schema, errors, ignored_hash_paths)
     change_class = manifest.get("change_class")
     final_verdict = manifest.get("final_verdict")
+    canonical_lifecycle = (root / "lifecycle.json").is_file()
     required = COMMON_RECORDS
+    if canonical_lifecycle:
+        required = required | {"change-capture.json"}
     if final_verdict != "TEST_BLOCKED":
         required = required | (BEHAVIOR_RECORDS if change_class == "behavior" else LIGHTWEIGHT_RECORDS)
+        if canonical_lifecycle and change_class == "behavior":
+            required = required | {"test-preparation.json"}
     for relative in required:
         require(relative in entry_map, f"required evidence record not hashed: {relative}", errors)
+    if canonical_lifecycle:
+        capture_path = root / "change-capture.json"
+        if capture_path.is_file():
+            try:
+                capture = load_json(capture_path)
+                validate_definition(capture, "changeCapture", records_schema, "change-capture", errors)
+                validate_canonical_capture(root, project_root, capture, inventory, scope, errors)
+            except EvidenceError as exc:
+                errors.append(str(exc))
     validate_definition(classification, "changeClassification", records_schema, "change-classification", errors)
     validate_definition(scope, "scope", records_schema, "scope", errors)
     validate_definition(inventory, "targetInventory", records_schema, "target-inventory", errors)
@@ -1427,18 +1552,32 @@ def validate_evidence(
     require(classification.get("full_protocol_required") is (change_class == "behavior"), "change classification protocol decision is inconsistent", errors)
 
     plan: dict[str, Any] | None = None
+    preparation: dict[str, Any] | None = None
     if change_class == "behavior":
         try:
             plan = load_json(root / "test-plan.json")
+            if canonical_lifecycle:
+                preparation = load_json(root / "test-preparation.json")
         except EvidenceError as exc:
             errors.append(str(exc))
+            plan = preparation = None
         if isinstance(plan, dict):
             validate_definition(plan, "testPlan", records_schema, "test-plan", errors)
         else:
             errors.append("test-plan.json must be an object")
             plan = None
+        if canonical_lifecycle:
+            if isinstance(preparation, dict):
+                pass
+            else:
+                errors.append("test-preparation.json must be an object")
 
     inventory_by_category, _ = validate_inventory(root, project_root, manifest, inventory, scope, plan, entry_map, errors)
+    if canonical_lifecycle and change_class == "behavior" and isinstance(preparation, dict):
+        validate_test_preparation(
+            root, project_root, preparation, plan or {}, inventory_by_category,
+            entry_map, records_schema, errors,
+        )
     require(manifest.get("evidence_id_inputs", {}).get("scope_sha256") == canonical_sha256(scope), "scope identity hash mismatch", errors)
     validate_scope(
         scope, inventory, inventory_by_category, project_root, root,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prizmkit",
-  "version": "1.1.134",
+  "version": "1.1.135",
   "description": "Create a new PrizmKit-powered project with clean initialization — no framework dev files, just what you need.",
   "type": "module",
   "bin": {