prizmkit 1.1.136 → 1.1.138

package/bundled/skills/prizmkit-test/scripts/build_test_evidence.py

@@ -8,7 +8,6 @@ Usage:
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR prepare-tests --request REQUEST
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR execute --request REQUEST
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR execute --replay-receipt RECEIPT
-  python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR differential --request REQUEST
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR finalize --request REQUEST
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR render-report
   python3 build_test_evidence.py --project-root ROOT --evidence-dir DIR resume --manifest MANIFEST --inventory INVENTORY
@@ -30,7 +29,6 @@ import shutil
 import signal
 import subprocess
 import sys
-import tempfile
 import uuid
 from pathlib import Path
 from typing import Any
@@ -46,6 +44,9 @@ LAYERS = (
     "affected-module-regression", "regression-ring",
 )
 BLOCKED_EXTERNAL_CLASSES = {"production", "unknown"}
+REPAIR_SCOPES = {
+    "test-infrastructure", "production", "runtime", "schema", "dependency", "public-interface",
+}
 INVENTORY_RESERVED_ROOTS = (
     ".prizmkit/state",
     ".prizmkit/test/evidence",
@@ -413,9 +414,14 @@ def validate_execution_request(request: Any, *, plan: dict[str, Any] | None = No
         ensure_string_list(probe, f"tool probe {name}", allow_empty=False)
     has_ids = "test_ids" in request
     has_paths = "test_paths" in request
-    auto_bind = request.get("auto_bind") is True
-    if not has_ids and not has_paths and not auto_bind:
+    has_auto_bind = "auto_bind" in request
+    if has_auto_bind and not isinstance(request["auto_bind"], bool):
+        raise RequestError("execution request auto_bind must be boolean")
+    binding_modes = int(has_ids) + int(has_paths) + int(request.get("auto_bind") is True)
+    if binding_modes == 0:
         raise RequestError("execution request must provide test_ids, test_paths, or auto_bind=true")
+    if binding_modes != 1 or (has_auto_bind and request["auto_bind"] is False):
+        raise RequestError("execution request binding modes test_ids, test_paths, and auto_bind=true are mutually exclusive")
     if has_ids:
         test_ids = ensure_string_list(request["test_ids"], "test_ids", allow_empty=False)
         if len(set(test_ids)) != len(test_ids):
@@ -424,8 +430,6 @@ def validate_execution_request(request: Any, *, plan: dict[str, Any] | None = No
         test_paths = ensure_string_list(request["test_paths"], "test_paths", allow_empty=False)
         if len(set(test_paths)) != len(test_paths):
             raise RequestError("execution request test_paths contains duplicates")
-    if "auto_bind" in request and not isinstance(request["auto_bind"], bool):
-        raise RequestError("execution request auto_bind must be boolean")
     if request["layer"] not in LAYERS and request["layer"] != "lightweight":
         raise RequestError(f"unknown execution layer: {request['layer']}")
     if plan is not None and has_ids:
@@ -470,7 +474,17 @@ def command_scope_test_ids(project_root: Path, request: dict[str, Any], tests: l
         "-C", "--config", "--config-file", "--project", "--package", "-p",
         "--root", "--rootdir", "--cwd", "--testPathPattern", "--testNamePattern",
     }
+    scope_affecting_options = {
+        "-C", "--config", "--config-file", "--project", "--package", "--root", "--rootdir",
+        "--cwd", "--testPathPattern", "--testNamePattern", "--grep", "-k", "--filter", "-t",
+    }
     for token in command[1:]:
+        option_name = token.split("=", 1)[0]
+        if option_name in scope_affecting_options:
+            raise RequestError(
+                "command scope cannot be inferred when the native command uses a test-selection "
+                f"option: {option_name}"
+            )
         if skip_option_value:
             skip_option_value = False
             continue
@@ -497,7 +511,7 @@ def command_scope_test_ids(project_root: Path, request: dict[str, Any], tests: l
         if package_wide:
             return sorted({item["id"] for item in tests})
         raise RequestError(
-            "auto_bind cannot infer native test scope from command; provide test_paths or use a recognized package-wide test command"
+            "command scope cannot be inferred from the native command; use a recognized package-wide command or an explicit test path in the command"
         )
 
     matched_paths: set[str] = set()
@@ -517,7 +531,7 @@ def command_scope_test_ids(project_root: Path, request: dict[str, Any], tests: l
                 matched_paths.add(test_path)
     if not matched_paths:
         raise RequestError(
-            "auto_bind command scope does not cover any prepared native test; provide test_paths explicitly"
+            "native command scope does not cover any prepared test"
         )
     return [item["id"] for item in tests if item["project_path"] in matched_paths]
 
@@ -529,19 +543,26 @@ def resolve_execution_test_ids(project_root: Path, evidence_dir: Path, request:
             raise RequestError("builder-generated test plan is required before path-based or auto-bound execution")
         return request
     if (evidence_dir / "lifecycle.json").is_file() and not (evidence_dir / "test-preparation.json").is_file():
-        raise RequestError("canonical lifecycle requires prepare-tests before execute or differential")
+        raise RequestError("canonical lifecycle requires prepare-tests before execute")
     tests = test_plan_entries(plan)
     by_id = {item["id"]: item for item in tests}
     by_path = {item["project_path"]: item for item in tests}
     if "test_ids" in request:
-        resolved = list(request["test_ids"])
+        declared = list(request["test_ids"])
     elif "test_paths" in request:
         unknown_paths = sorted(set(request["test_paths"]) - set(by_path))
         if unknown_paths:
             raise RequestError(f"execution request references unknown test paths: {', '.join(unknown_paths)}")
-        resolved = [by_path[path]["id"] for path in request["test_paths"]]
+        declared = [by_path[path]["id"] for path in request["test_paths"]]
     else:
-        resolved = command_scope_test_ids(project_root, request, tests)
+        declared = None
+    inferred = command_scope_test_ids(project_root, request, tests)
+    if declared is not None and set(declared) != set(inferred):
+        raise RequestError(
+            "execution request binding does not exactly match native command scope "
+            f"(declared: {', '.join(sorted(declared))}; inferred: {', '.join(sorted(inferred))})"
+        )
+    resolved = inferred
     if not resolved:
         raise RequestError("execution request resolved no prepared tests")
     unknown = sorted(set(resolved) - set(by_id))
@@ -553,6 +574,8 @@ def resolve_execution_test_ids(project_root: Path, evidence_dir: Path, request:
     )
     if invalid_layer:
         raise RequestError(f"execution layer is not planned for test IDs: {', '.join(invalid_layer)}")
+    request.pop("test_paths", None)
+    request.pop("auto_bind", None)
     request["test_ids"] = resolved
     return request
 
@@ -821,9 +844,6 @@ def append_receipt(evidence_dir: Path, receipt: dict[str, Any]) -> None:
     existing: Any = load_json(path) if path.exists() else []
     if not isinstance(existing, list):
         raise RequestError("executions.json must remain an array")
-    previous = canonical_sha256(existing[-1]) if existing else None
-    if receipt["previous_receipt_sha256"] != previous:
-        raise RequestError("receipt chain mismatch")
     existing.append(receipt)
     write_json_atomic(path, existing)
 
@@ -847,19 +867,20 @@ def execute_request(
     evidence_dir: Path,
     request_path: Path,
     *,
-    execution_root: Path | None = None,
     replay_of: str | None = None,
-    isolation: dict[str, Any] | None = None,
     selected_execution: bool = True,
 ) -> dict[str, Any]:
     request_value = load_json(request_path)
     original_test_ids = list(request_value["test_ids"]) if isinstance(request_value, dict) and isinstance(request_value.get("test_ids"), list) else None
+    original_binding_fields = {
+        key for key in ("test_ids", "test_paths", "auto_bind")
+        if isinstance(request_value, dict) and key in request_value
+    }
     request = validate_execution_request(request_value, plan=plan_for_execution(evidence_dir))
     request = resolve_execution_test_ids(project_root, evidence_dir, request)
-    if original_test_ids != request["test_ids"]:
+    if original_binding_fields != {"test_ids"} or original_test_ids != request["test_ids"]:
         write_json_atomic(request_path, request)
-    root = execution_root or project_root
-    cwd = confined(root, request["cwd"] or ".", must_exist=True, directory=True)
+    cwd = confined(project_root, request["cwd"] or ".", must_exist=True, directory=True)
     complete_environment = {"PATH": os.environ.get("PATH", os.defpath)}
     if os.name == "nt" and os.environ.get("SYSTEMROOT"):
         complete_environment["SYSTEMROOT"] = os.environ["SYSTEMROOT"]
@@ -900,7 +921,6 @@ def execute_request(
     existing = load_json(evidence_dir / "executions.json") if (evidence_dir / "executions.json").exists() else []
     if not isinstance(existing, list):
         raise RequestError("executions.json must remain an array")
-    previous = canonical_sha256(existing[-1]) if existing else None
     same_request_attempts = sum(1 for item in existing if isinstance(item, dict) and item.get("request_sha256") == file_sha256(request_path))
     receipt = {
         "receipt_format": "prizmkit-runner-generated-v1",
@@ -927,213 +947,13 @@ def execute_request(
         "reliable": probes_reliable and not timed_out and not execution_error,
         "started_at": started,
         "finished_at": finished,
-        "previous_receipt_sha256": previous,
         "replay_of": replay_of,
-        "isolation": isolation,
+        "isolation": {"kind": "project-direct"},
     }
     append_receipt(evidence_dir, receipt)
     return receipt
 
 
-def copy_project_tree(project_root: Path, destination: Path, evidence_dir: Path) -> None:
-    def ignore(directory: str, names: list[str]) -> set[str]:
-        directory_relative = Path(directory).resolve().relative_to(project_root.resolve())
-        ignored: set[str] = set()
-        for name in names:
-            relative = directory_relative / name
-            if any(part in _IGNORED_DIR_NAMES for part in relative.parts):
-                ignored.add(name)
-                continue
-            if any(relative == Path(prefix) or Path(prefix) in relative.parents for prefix in INVENTORY_RESERVED_ROOTS):
-                ignored.add(name)
-            elif (project_root / relative).resolve() == evidence_dir.resolve() or evidence_dir.resolve() in (project_root / relative).resolve().parents:
-                ignored.add(name)
-        return ignored
-
-    shutil.copytree(project_root, destination, ignore=ignore)
-
-
-def _iso_tree_sha256(root: Path) -> str:
-    """Hash an isolated temp tree (not the live project)."""
-    entries: list[dict[str, str]] = []
-    for candidate in sorted(root.rglob("*")):
-        if not candidate.is_file():
-            continue
-        entries.append({"path": candidate.relative_to(root).as_posix(), "sha256": file_sha256(candidate)})
-    return canonical_sha256(entries)
-
-
-def git_archive_baseline(project_root: Path, baseline_commit: str, destination: Path) -> None:
-    result = subprocess.run(
-        ["git", "-C", str(project_root), "archive", "--format=tar", baseline_commit],
-        capture_output=True, check=False,
-    )
-    if result.returncode != 0:
-        raise RequestError(f"cannot archive baseline commit {baseline_commit}: {result.stderr.decode(errors='replace')}")
-    destination.mkdir(parents=True)
-    extracted = subprocess.run(["tar", "-xf", "-", "-C", str(destination)], input=result.stdout, capture_output=True, check=False)
-    if extracted.returncode != 0:
-        raise RequestError(f"cannot extract baseline archive: {extracted.stderr.decode(errors='replace')}")
-
-
-def materialize_request(evidence_dir: Path, name: str, request: dict[str, Any]) -> Path:
-    path = evidence_dir / "requests" / name
-    write_json_atomic(path, request)
-    return path
-
-
-def validate_not_applicable(value: Any) -> dict[str, Any]:
-    value = ensure_object(value, "differential N/A decision")
-    required = {"reason", "rationale", "evidence", "considered_signals", "conflicts"}
-    if set(value) != required:
-        raise RequestError(f"differential N/A fields must be exactly {sorted(required)}")
-    if value["reason"] not in {"new-behavior", "textual-contract"}:
-        raise RequestError("differential N/A reason must be new-behavior or textual-contract")
-    if not isinstance(value["rationale"], str) or len(value["rationale"].strip()) < 16:
-        raise RequestError("differential N/A rationale is too short")
-    ensure_string_list(value["evidence"], "differential N/A evidence", allow_empty=False)
-    ensure_string_list(value["considered_signals"], "differential N/A considered_signals", allow_empty=False)
-    if not isinstance(value["conflicts"], list):
-        raise RequestError("differential N/A conflicts must be an array")
-    if value["reason"] == "new-behavior" and "no stable pre-change observable" not in value["rationale"].lower():
-        raise RequestError("new-behavior differential N/A must explain that no stable pre-change observable exists")
-    if value["reason"] == "textual-contract" and "textual" not in value["rationale"].lower():
-        raise RequestError("textual-contract differential N/A must explain why behavior is textual")
-    return value
-
-
-def append_proof(evidence_dir: Path, proof: dict[str, Any]) -> None:
-    proof_path = evidence_dir / "differential-proof.json"
-    proof_record = load_json(proof_path) if proof_path.exists() else {"proofs": []}
-    if not isinstance(proof_record, dict) or not isinstance(proof_record.get("proofs"), list):
-        raise RequestError("differential-proof.json has invalid append target")
-    if any(item.get("behavior_id") == proof.get("behavior_id") for item in proof_record["proofs"] if isinstance(item, dict)):
-        raise RequestError(f"duplicate differential proof: {proof.get('behavior_id')}")
-    proof_record["proofs"].append(proof)
-    write_json_atomic(proof_path, proof_record)
-
-
-def run_differential(project_root: Path, evidence_dir: Path, request_path: Path) -> dict[str, Any]:
-    request = ensure_object(load_json(request_path), "differential request")
-    required = {"request_version", "behavior_id", "method", "execution_request", "baseline_commit", "mutation_patch_path", "test_overlay_paths", "expected_failure_signals"}
-    na_required = {"request_version", "behavior_id", "method", "not_applicable"}
-    if set(request) == na_required:
-        if request["request_version"] != "1.0" or request["method"] != "not-applicable":
-            raise RequestError("invalid differential N/A request")
-        not_applicable = validate_not_applicable(request["not_applicable"])
-        proof = {
-            "behavior_id": request["behavior_id"], "classification": "NOT_APPLICABLE",
-            "method": None, "differential_request_path": evidence_relative(evidence_dir, request_path),
-            "differential_request_sha256": file_sha256(request_path), "baseline_commit": None,
-            "baseline_execution_id": None, "mutation_execution_id": None,
-            "current_execution_id": None, "failure_reason_matched": False, "cleanup_succeeded": True,
-            "isolation_tree_sha256": None, "mutation_apply_sha256": None, "mutation_restore_sha256": None,
-            "not_applicable": not_applicable,
-        }
-        append_proof(evidence_dir, proof)
-        return proof
-    if set(request) != required or request["request_version"] != "1.0":
-        raise RequestError(f"differential request fields must be exactly {sorted(required)} with version 1.0")
-    execution_request = resolve_execution_test_ids(
-        project_root,
-        evidence_dir,
-        validate_execution_request(
-            request["execution_request"], plan=plan_for_execution(evidence_dir),
-        ),
-    )
-    request["execution_request"] = execution_request
-    write_json_atomic(request_path, request)
-    expected_failure_signals = ensure_string_list(request["expected_failure_signals"], "expected_failure_signals", allow_empty=False)
-    overlay_paths = ensure_string_list(request["test_overlay_paths"], "test_overlay_paths")
-    for relative in overlay_paths:
-        confined(project_root, relative, must_exist=True)
-    current_request_path = materialize_request(evidence_dir, f"differential-{uuid.uuid4().hex}.execution.json", execution_request)
-    baseline_receipt = None
-    mutation_receipt = None
-    current_receipt = None
-    isolation_tree = None
-    mutation_apply_sha = None
-    mutation_restore_sha = None
-    cleanup_succeeded = False
-    try:
-        with tempfile.TemporaryDirectory(prefix="prizmkit-differential-") as temporary:
-            temporary_root = Path(temporary)
-            current_root = temporary_root / "current"
-            copy_project_tree(project_root, current_root, evidence_dir)
-            isolation_tree = _iso_tree_sha256(current_root)
-            if request["method"] == "baseline":
-                failing_root = temporary_root / "baseline"
-                git_archive_baseline(project_root, request["baseline_commit"], failing_root)
-                for relative in overlay_paths:
-                    source = confined(project_root, relative, must_exist=True)
-                    destination = confined(failing_root, relative)
-                    destination.parent.mkdir(parents=True, exist_ok=True)
-                    shutil.copy2(source, destination)
-                baseline_receipt = execute_request(
-                    project_root, evidence_dir, current_request_path, execution_root=failing_root,
-                    isolation={"kind": "baseline", "tree_sha256": _iso_tree_sha256(failing_root), "baseline_commit": request["baseline_commit"]},
-                    selected_execution=False,
-                )
-            elif request["method"] == "controlled-mutation":
-                failing_root = temporary_root / "mutation"
-                shutil.copytree(current_root, failing_root)
-                patch_value = request["mutation_patch_path"]
-                if not isinstance(patch_value, str) or not patch_value:
-                    raise RequestError("controlled mutation requires mutation_patch_path")
-                patch_path = request_file(evidence_dir, patch_value)
-                applied = subprocess.run(["git", "apply", "--whitespace=nowarn", str(patch_path)], cwd=failing_root, capture_output=True, check=False)
-                if applied.returncode != 0:
-                    raise RequestError(f"controlled mutation could not be applied: {applied.stderr.decode(errors='replace')}")
-                mutation_apply_sha = _iso_tree_sha256(failing_root)
-                mutation_receipt = execute_request(
-                    project_root, evidence_dir, current_request_path, execution_root=failing_root,
-                    isolation={"kind": "controlled-mutation", "tree_sha256": _iso_tree_sha256(failing_root), "patch_sha256": file_sha256(patch_path)},
-                    selected_execution=False,
-                )
-                mutation_restore_sha = isolation_tree
-            else:
-                raise RequestError("differential method must be baseline or controlled-mutation")
-            current_receipt = execute_request(
-                project_root, evidence_dir, current_request_path, execution_root=current_root,
-                isolation={"kind": "current", "tree_sha256": isolation_tree},
-            )
-        cleanup_succeeded = True
-    finally:
-        # tempfile.TemporaryDirectory handles cleanup automatically;
-        # cleanup_succeeded is set above because the context manager exited
-        # without exception, meaning isolation was preserved
-        pass
-    failing_receipt = baseline_receipt or mutation_receipt
-    failing_output = b""
-    if failing_receipt:
-        failing_output = (evidence_dir / failing_receipt["stdout_path"]).read_bytes() + (evidence_dir / failing_receipt["stderr_path"]).read_bytes()
-    failure_reason_matched = any(signal.encode() in failing_output for signal in expected_failure_signals)
-    proven = bool(
-        failing_receipt and current_receipt and failing_receipt["exit_code"] != 0
-        and current_receipt["exit_code"] == 0 and failure_reason_matched
-        and cleanup_succeeded
-    )
-    proof = {
-        "behavior_id": request["behavior_id"],
-        "classification": "PROVEN" if proven else "UNPROVEN",
-        "method": request["method"],
-        "differential_request_path": evidence_relative(evidence_dir, request_path),
-        "differential_request_sha256": file_sha256(request_path),
-        "baseline_commit": request["baseline_commit"],
-        "baseline_execution_id": baseline_receipt["execution_id"] if baseline_receipt else None,
-        "mutation_execution_id": mutation_receipt["execution_id"] if mutation_receipt else None,
-        "current_execution_id": current_receipt["execution_id"] if current_receipt else None,
-        "failure_reason_matched": failure_reason_matched,
-        "cleanup_succeeded": cleanup_succeeded,
-        "isolation_tree_sha256": isolation_tree,
-        "mutation_apply_sha256": mutation_apply_sha,
-        "mutation_restore_sha256": mutation_restore_sha,
-        "not_applicable": None,
-    }
-    append_proof(evidence_dir, proof)
-    return proof
-
-
 def run_capture_change(
     project_root: Path,
     evidence_dir: Path,
@@ -1166,7 +986,6 @@ def run_init(project_root: Path, evidence_dir: Path, baseline: str | None, outpu
     for directory in ("requests", "receipts", "raw", "generated-tests", "contracts", "runner"):
         (evidence_dir / directory).mkdir(parents=True, exist_ok=True)
     write_json_atomic(evidence_dir / "executions.json", [])
-    write_json_atomic(evidence_dir / "differential-proof.json", {"proofs": []})
     write_json_atomic(evidence_dir / "lifecycle.json", {
         "lifecycle_format": "prizmkit-canonical-lifecycle-v1",
         "status": "initialized",
@@ -1217,8 +1036,6 @@ def run_render_report(evidence_dir: Path, output_name: str) -> Path:
     validation = ensure_object(load_json(validation_path), "validation") if validation_path.exists() else None
     lifecycle_path = evidence_dir / "lifecycle.json"
     lifecycle = ensure_object(load_json(lifecycle_path), "lifecycle") if lifecycle_path.exists() else {}
-    proofs_path = evidence_dir / "differential-proof.json"
-    proofs = load_json(proofs_path).get("proofs", []) if proofs_path.exists() else []
     executions = load_json(evidence_dir / "executions.json")
     artifact_dir = lifecycle.get("artifact_dir")
     lines = [
@@ -1236,7 +1053,6 @@ def run_render_report(evidence_dir: Path, output_name: str) -> Path:
         f"- Artifact Dir: {artifact_dir or 'not provided'}",
         "",
         f"Execution receipts: {len(executions) if isinstance(executions, list) else 0}",
-        f"Differential proofs: {len(proofs) if isinstance(proofs, list) else 0}",
         "The legacy test-report interface is not supported.",
         "",
     ]
@@ -1461,7 +1277,7 @@ def stage_output_owner(relative: str, change_class: str) -> str:
         return "INFRA_READY"
     if relative.startswith("generated-tests/"):
         return "TEST_BUILD"
-    if relative in {"executions.json", "differential-proof.json"} or relative.startswith("receipts/") or relative.startswith("raw/") or relative.startswith("runner/"):
+    if relative == "executions.json" or relative.startswith("receipts/") or relative.startswith("raw/") or relative.startswith("runner/"):
         return "EXECUTE_PROVE"
     if relative in FINAL_RECORDS or relative == "lifecycle.json" or relative == "init.json" or relative == "finalize.json":
         return "EVIDENCE_PACKAGE"
@@ -1481,25 +1297,15 @@ def build_manifest(evidence_dir: Path, *, evidence_id: str, identity: dict[str,
     outputs_by_stage = {stage: [] for stage in STAGES}
     for entry in files:
         outputs_by_stage.setdefault(entry["produced_by"], []).append(entry["path"])
-    predecessor_files: list[dict[str, str]] = []
     stages = []
     for stage in STAGES:
         outputs = sorted(outputs_by_stage.get(stage, []))
         stages.append({
             "name": stage,
             "status": "complete",
-            "input_sha256": canonical_sha256({
-                "stage": stage,
-                "target_hashes": target_hashes,
-                "predecessor_outputs": sorted(predecessor_files, key=lambda item: item["path"]),
-            }),
             "outputs": outputs,
             "not_applicable": None,
         })
-        predecessor_files.extend(
-            {"path": output, "sha256": next(item["sha256"] for item in files if item["path"] == output)}
-            for output in outputs if output not in FINAL_RECORDS
-        )
     return {
         "protocol_version": "1.0",
         "evidence_id": evidence_id,
@@ -1536,13 +1342,15 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         raise RequestError(f"finalize request contains unsupported fields: {sorted(set(request) - allowed)}")
     if request.get("request_version", "1.0") != "1.0":
         raise RequestError("unsupported finalize request version")
+    if request.get("repair_scope") is not None and request.get("repair_scope") not in REPAIR_SCOPES:
+        raise RequestError("repair_scope must identify an evidence-backed repair domain")
     lifecycle = load_lifecycle(evidence_dir, required=True)
     if lifecycle.get("finalized") is True:
         raise RequestError("evidence identity is finalized; re-init a new package before changing scope or source")
     capture_path = evidence_dir / "change-capture.json"
     if not capture_path.exists():
         run_capture_change(project_root, evidence_dir, request.get("baseline_commit"), "change-capture.json")
-    capture = ensure_object(load_json(capture_path), "change capture")
+    capture = load_change_capture(project_root, evidence_dir, require_fresh=True)
     baseline = capture.get("baseline_commit")
     patch_path = evidence_dir / "source-change.patch"
     if not isinstance(baseline, str) or not patch_path.is_file():
@@ -1592,7 +1400,7 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
     if change_class == "behavior":
         required_records.update({
             "behavior-risk-matrix.json", "test-plan.json", "test-preparation.json",
-            "infrastructure-changes.json", "differential-proof.json",
+            "infrastructure-changes.json",
         })
     else:
         required_records.add("lightweight-verification.json")
@@ -1604,10 +1412,31 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         blockers.append(
             "required evidence records are missing: " + ", ".join(missing_records)
         )
-    selected_failures = [item for item in executions if isinstance(item, dict) and item.get("selected_execution") is True and item.get("reliable") is True and item.get("exit_code") != 0]
+    selected_unreliable = [
+        item for item in executions
+        if isinstance(item, dict)
+        and item.get("selected_execution") is True
+        and item.get("reliable") is not True
+    ]
+    for execution in selected_unreliable:
+        blockers.append(
+            "selected execution is unreliable: "
+            + str(execution.get("execution_id", "unknown-execution"))
+        )
+    selected_failures = [
+        item for item in executions
+        if isinstance(item, dict)
+        and item.get("selected_execution") is True
+        and item.get("reliable") is True
+        and item.get("exit_code") != 0
+    ]
     if selected_failures and not request.get("repair_scope"):
         blockers.append("reliable failure exists but repair_scope is not evidence-backed")
-    verdict = "TEST_FAIL" if selected_failures and request.get("repair_scope") else ("TEST_BLOCKED" if blockers else "TEST_PASS")
+    verdict = (
+        "TEST_BLOCKED" if blockers
+        else "TEST_FAIL" if selected_failures and request.get("repair_scope")
+        else "TEST_PASS"
+    )
     verdict_record: dict[str, Any] = {
         "verdict": verdict,
         "testing_domain_only": True,
@@ -1775,8 +1604,6 @@ def main() -> int:
     group = execute.add_mutually_exclusive_group(required=True)
     group.add_argument("--request")
     group.add_argument("--replay-receipt")
-    differential = subparsers.add_parser("differential")
-    differential.add_argument("--request", required=True)
     finalize = subparsers.add_parser("finalize")
     finalize.add_argument("--request", required=True, help="semantic finalization request")
     finalize.add_argument("--output", default="finalize.json")
@@ -1825,10 +1652,6 @@ def main() -> int:
                     raise RequestError("recorded request hash no longer matches replay source")
                 receipt = execute_request(project_root, evidence_dir, original_request, replay_of=prior.get("execution_id"))
             print(json.dumps(receipt, ensure_ascii=False))
-        elif args.subcommand == "differential":
-            require_mutable_lifecycle(evidence_dir)
-            proof = run_differential(project_root, evidence_dir, request_file(evidence_dir, args.request))
-            print(json.dumps(proof, ensure_ascii=False))
         elif args.subcommand == "render-report":
             load_lifecycle(evidence_dir)
             output = run_render_report(evidence_dir, args.output)