prizmkit 1.1.136 → 1.1.138

package/bundled/skills/prizmkit-test/scripts/validate_test_evidence.py

@@ -14,6 +14,7 @@ import json
 import math
 import os
 import re
+import subprocess
 import sys
 import tempfile
 from pathlib import Path
@@ -46,12 +47,22 @@ COMMON_RECORDS = {
 }
 BEHAVIOR_RECORDS = {
     "behavior-risk-matrix.json", "test-plan.json",
-    "infrastructure-changes.json", "differential-proof.json",
+    "infrastructure-changes.json",
 }
 LIGHTWEIGHT_RECORDS = {"lightweight-verification.json"}
 SHA256_RE = re.compile(r"^[a-f0-9]{64}$")
 UUID_RE = re.compile(r"^[a-f0-9-]{36}$")
 BLOCKED_EXTERNAL_CLASSES = {"production", "unknown"}
+INVENTORY_RESERVED_ROOTS = (
+    ".prizmkit/state",
+    ".prizmkit/test/evidence",
+    ".prizmkit/" + "dev-" + "pipeline",
+    ".claude/worktrees",
+    ".agents/worktrees",
+    ".codebuddy/worktrees",
+    ".codex/worktrees",
+)
+_IGNORED_DIR_NAMES = {".git", "__pycache__", ".pytest_cache", ".mypy_cache"}
 RISK_CONFLICT_PATTERNS = {
     "permission": re.compile(r"auth|tenant|role|permission|access|acl|rbac", re.I),
     "concurrency": re.compile(r"lock|shared[ _-]?state|worker|queue|concurr|parallel|race", re.I),
@@ -161,6 +172,152 @@ def path_below_or_equal(path: str, root: str) -> bool:
     return normalized_path == normalized_root or normalized_path.startswith(f"{normalized_root}/")
 
 
+def normalize_project_relative(value: str) -> str:
+    normalized = Path(value).as_posix()
+    if normalized == "." or normalized.startswith("../") or "/../" in normalized:
+        raise EvidenceError(f"Git returned a non-project-relative path: {value}")
+    return normalized
+
+
+def is_reserved_inventory_path(relative: str) -> bool:
+    path = Path(relative)
+    if any(part in _IGNORED_DIR_NAMES for part in path.parts):
+        return True
+    return any(path == Path(prefix) or Path(prefix) in path.parents for prefix in INVENTORY_RESERVED_ROOTS)
+
+
+def project_git(project_root: Path, *args: str) -> subprocess.CompletedProcess[bytes]:
+    result = subprocess.run(
+        ["git", "-C", str(project_root), *args],
+        capture_output=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        raise EvidenceError(f"git {' '.join(args)} failed: {result.stderr.decode(errors='replace')}")
+    return result
+
+
+def git_status_entries(project_root: Path) -> list[dict[str, Any]]:
+    raw = project_git(
+        project_root, "status", "--porcelain=v1", "-z", "--untracked-files=all",
+    ).stdout
+    entries: list[dict[str, Any]] = []
+    tokens = raw.split(b"\0")
+    index = 0
+    while index < len(tokens):
+        token = tokens[index]
+        index += 1
+        if not token:
+            continue
+        status = token[:2].decode(errors="replace")
+        relative = normalize_project_relative(token[3:].decode(errors="replace"))
+        old_path = None
+        if "R" in status or "C" in status:
+            if index >= len(tokens):
+                raise EvidenceError("git status returned an incomplete rename/copy record")
+            old_path = tokens[index].decode(errors="replace")
+            index += 1
+        if not is_reserved_inventory_path(relative):
+            entries.append({"path": relative, "status": status, "old_path": old_path})
+        if old_path is not None:
+            old_relative = normalize_project_relative(old_path)
+            if not is_reserved_inventory_path(old_relative):
+                entries.append({"path": old_relative, "status": status, "old_path": old_relative, "role": "source"})
+    return sorted(entries, key=lambda item: (item["path"], item.get("old_path") or ""))
+
+
+def git_diff_entries(project_root: Path, baseline: str) -> list[dict[str, Any]]:
+    raw = project_git(
+        project_root, "diff", "--name-status", "-z", "--find-renames", "--find-copies",
+        baseline, "--", ".",
+        ":!.prizmkit/state/**", ":!.prizmkit/test/evidence/**", ":!.prizmkit/" + "dev-" + "pipeline/**",
+        ":!.claude/worktrees/**", ":!.agents/worktrees/**", ":!.codebuddy/worktrees/**", ":!.codex/worktrees/**",
+    ).stdout
+    tokens = raw.split(b"\0")
+    entries: list[dict[str, Any]] = []
+    index = 0
+    while index < len(tokens):
+        status_token = tokens[index].decode(errors="replace")
+        index += 1
+        if not status_token:
+            continue
+        if index >= len(tokens):
+            raise EvidenceError("git diff returned an incomplete changed-file record")
+        first = normalize_project_relative(tokens[index].decode(errors="replace"))
+        index += 1
+        status = status_token[0]
+        old_path = None
+        if status in {"R", "C"}:
+            if index >= len(tokens):
+                raise EvidenceError("git diff returned an incomplete rename/copy record")
+            old_path = first
+            first = normalize_project_relative(tokens[index].decode(errors="replace"))
+            index += 1
+        if not is_reserved_inventory_path(first):
+            entries.append({"path": first, "status": status, "old_path": old_path})
+        if old_path and not is_reserved_inventory_path(old_path):
+            entries.append({"path": old_path, "status": status, "old_path": old_path, "role": "source"})
+    return entries
+
+
+def merge_changed_file_entries(
+    baseline_entries: list[dict[str, Any]],
+    working_entries: list[dict[str, Any]],
+) -> list[dict[str, Any]]:
+    merged: dict[tuple[str, str | None, str | None], dict[str, Any]] = {}
+    for entry in baseline_entries + working_entries:
+        key = (entry["path"], entry.get("old_path"), entry.get("role"))
+        existing = merged.get(key)
+        if existing is None:
+            merged[key] = dict(entry)
+            continue
+        statuses = {existing.get("status", "").strip(), entry.get("status", "").strip()}
+        if "D" in statuses:
+            existing["status"] = "D"
+        elif "R" in statuses:
+            existing["status"] = "R"
+        elif "C" in statuses:
+            existing["status"] = "C"
+        elif statuses:
+            existing["status"] = "M"
+    return sorted(merged.values(), key=lambda item: (item["path"], item.get("old_path") or "", item.get("role") or ""))
+
+
+def canonical_change_patch(project_root: Path, baseline: str) -> tuple[bytes, list[dict[str, Any]]]:
+    status_entries = merge_changed_file_entries(
+        git_diff_entries(project_root, baseline),
+        git_status_entries(project_root),
+    )
+    tracked = project_git(
+        project_root, "diff", "--binary", "--full-index", "--find-renames", "--find-copies",
+        baseline, "--", ".",
+        ":!.prizmkit/state/**", ":!.prizmkit/test/evidence/**", ":!.prizmkit/" + "dev-" + "pipeline/**",
+        ":!.claude/worktrees/**", ":!.agents/worktrees/**", ":!.codebuddy/worktrees/**", ":!.codex/worktrees/**",
+    ).stdout
+    chunks = [tracked]
+    untracked = [
+        item["path"] for item in status_entries
+        if item["status"].strip() == "??" and item.get("old_path") is None
+    ]
+    for relative in sorted(untracked):
+        candidate = (project_root / relative).resolve()
+        try:
+            candidate.relative_to(project_root.resolve())
+        except ValueError as exc:
+            raise EvidenceError(f"untracked path escapes project root: {relative}") from exc
+        if candidate.is_file():
+            result = subprocess.run(
+                ["git", "diff", "--no-index", "--binary", "/dev/null", "--", relative],
+                cwd=project_root,
+                capture_output=True,
+                check=False,
+            )
+            if result.returncode not in (0, 1):
+                raise EvidenceError(f"cannot capture untracked file: {relative}")
+            chunks.append(result.stdout)
+    return b"".join(chunk for chunk in chunks if chunk), status_entries
+
+
 def resolve_ref(schema: dict[str, Any], root_schema: dict[str, Any]) -> dict[str, Any]:
     reference = schema.get("$ref")
     if not reference:
@@ -225,6 +382,11 @@ def validate_schema(
             if not branch_errors:
                 matching += 1
         require(matching == 1, f"{location}: value must match exactly one schema branch", errors)
+    prohibited = schema.get("not")
+    if isinstance(prohibited, dict):
+        prohibited_errors: list[str] = []
+        validate_schema(value, prohibited, root_schema, location, prohibited_errors)
+        require(bool(prohibited_errors), f"{location}: value matches a prohibited schema branch", errors)
 
     for child in schema.get("allOf", []):
         if isinstance(child, dict):
@@ -348,31 +510,6 @@ def require_manifest_entry(
     return path
 
 
-def validate_differential_na(
-    value: Any,
-    location: str,
-    errors: list[str],
-) -> None:
-    """Validate the differential-only N/A shape without weakening risk-cell N/A."""
-    if not isinstance(value, dict):
-        errors.append(f"{location}: differential N/A must be an object")
-        return
-    required = {"reason", "rationale", "evidence", "considered_signals", "conflicts"}
-    require(set(value) == required, f"{location}: differential N/A fields are incomplete", errors)
-    require(value.get("reason") in {"new-behavior", "textual-contract"}, f"{location}: invalid differential N/A reason", errors)
-    rationale = value.get("rationale")
-    require(isinstance(rationale, str) and len(rationale.strip()) >= 16, f"{location}: differential N/A rationale is too short", errors)
-    if value.get("reason") == "new-behavior" and isinstance(rationale, str):
-        require("no stable pre-change observable" in rationale.lower(), f"{location}: new behavior N/A lacks baseline rationale", errors)
-    if value.get("reason") == "textual-contract" and isinstance(rationale, str):
-        require("textual" in rationale.lower(), f"{location}: textual contract N/A lacks textual rationale", errors)
-    evidence = value.get("evidence")
-    require(isinstance(evidence, list) and bool(evidence) and all(isinstance(item, str) and item.strip() for item in evidence), f"{location}: differential N/A needs evidence strings", errors)
-    signals = value.get("considered_signals")
-    require(isinstance(signals, list) and bool(signals) and all(isinstance(item, str) and item.strip() for item in signals), f"{location}: differential N/A needs considered signals", errors)
-    require(isinstance(value.get("conflicts"), list), f"{location}: differential N/A conflicts must be an array", errors)
-
-
 def structured_na(
     value: Any,
     records_schema: dict[str, Any],
@@ -445,14 +582,6 @@ def validate_external_targets(value: Any, location: str, errors: list[str]) -> N
         require(isinstance(deny_evidence, list) and not deny_evidence, f"{target_location}: external target has deny evidence", errors)
 
 
-def stage_input_sha(stage_name: str, target_hashes: dict[str, str], predecessor_files: list[dict[str, str]]) -> str:
-    return canonical_sha256({
-        "stage": stage_name,
-        "target_hashes": target_hashes,
-        "predecessor_outputs": sorted(predecessor_files, key=lambda item: item["path"]),
-    })
-
-
 def validate_manifest(
     root: Path,
     manifest: dict[str, Any],
@@ -507,7 +636,6 @@ def validate_manifest(
         return entry_map
     names = [stage.get("name") for stage in stages if isinstance(stage, dict)]
     require(names == STAGES, "stages are missing or out of order", errors)
-    predecessor_files: list[dict[str, str]] = []
     for stage in stages:
         if not isinstance(stage, dict):
             continue
@@ -525,13 +653,6 @@ def validate_manifest(
             require(entry is not None, f"stage output is not a hashed evidence file: {name}/{output}", errors)
             if entry is not None:
                 require(entry.get("produced_by") == name, f"stage output producer mismatch: {name}/{output}", errors)
-        if isinstance(name, str) and isinstance(manifest.get("target_hashes"), dict):
-            expected_input = stage_input_sha(name, manifest["target_hashes"], predecessor_files)
-            require(stage.get("input_sha256") == expected_input, f"stage input dependency hash mismatch: {name}", errors)
-        predecessor_files.extend(
-            {"path": output, "sha256": entry_map[output]["sha256"]}
-            for output in outputs if isinstance(outputs, list) and output in entry_map and output not in FINAL_RECORDS
-        )
     return entry_map
 
 
@@ -750,9 +871,8 @@ def validate_requests_and_receipts(
     entry_map: dict[str, dict[str, Any]],
     records_schema: dict[str, Any],
     errors: list[str],
-) -> tuple[dict[str, dict[str, Any]], dict[str, dict[str, Any]], list[dict[str, Any]]]:
+) -> tuple[dict[str, dict[str, Any]], list[dict[str, Any]]]:
     execution_requests: dict[str, dict[str, Any]] = {}
-    differential_requests: dict[str, dict[str, Any]] = {}
     requests_root = root / "requests"
     if requests_root.exists():
         for path in sorted(requests_root.rglob("*.json")):
@@ -768,19 +888,6 @@ def validate_requests_and_receipts(
                 continue
             if set(request) == {"request_version", "layers", "tests"}:
                 validate_definition(request, "testPreparationRequest", records_schema, relative, errors)
-            elif request.get("method") == "not-applicable":
-                validate_definition(request, "differentialRequest", records_schema, relative, errors)
-                not_applicable = request.get("not_applicable")
-                if isinstance(not_applicable, dict):
-                    validate_differential_na(not_applicable, f"{relative}.not_applicable", errors)
-                differential_requests[relative] = request
-            elif "execution_request" in request:
-                validate_definition(request, "differentialRequest", records_schema, relative, errors)
-                nested = request.get("execution_request")
-                if isinstance(nested, dict):
-                    validate_definition(nested, "executionRequest", records_schema, f"{relative}.execution_request", errors)
-                    validate_external_targets(nested.get("external_targets"), f"{relative}.execution_request.external_targets", errors)
-                differential_requests[relative] = request
             elif "command" in request and "layer" in request:
                 validate_definition(request, "executionRequest", records_schema, relative, errors)
                 validate_execution_request_semantics(request, relative, errors)
@@ -814,15 +921,14 @@ def validate_requests_and_receipts(
         executions = load_json(executions_path)
     except EvidenceError as exc:
         errors.append(str(exc))
-        return execution_requests, differential_requests, []
+        return execution_requests, []
     validate_definition(executions, "executionLog", records_schema, "executions", errors)
     if not isinstance(executions, list):
-        return execution_requests, differential_requests, []
+        return execution_requests, []
 
     receipt_by_id: dict[str, dict[str, Any]] = {}
     seen_receipt_paths: set[str] = set()
     attempts_by_request: dict[str, int] = {}
-    previous_receipt: dict[str, Any] | None = None
     for index, receipt in enumerate(executions):
         location = f"executions[{index}]"
         if not isinstance(receipt, dict):
@@ -874,6 +980,12 @@ def validate_requests_and_receipts(
                         require("exit_code" in probe or "error" in probe, f"{location}: tool probe has no result: {probe_name}", errors)
 
         validate_execution_request_semantics(receipt, location, errors, receipt=True)
+        isolation = receipt.get("isolation")
+        require(
+            isinstance(isolation, dict) and isolation.get("kind") == "project-direct",
+            f"{location}: receipt did not execute in the current project workspace",
+            errors,
+        )
         validate_external_targets(receipt.get("external_targets"), f"{location}.external_targets", errors)
         for raw_key, hash_key in (("stdout_path", "stdout_sha256"), ("stderr_path", "stderr_sha256")):
             relative = receipt.get(raw_key)
@@ -894,8 +1006,6 @@ def validate_requests_and_receipts(
                 errors.append(str(exc))
         seen_receipt_paths.add(recorded_receipt_path)
 
-        expected_previous = canonical_sha256(previous_receipt) if previous_receipt is not None else None
-        require(receipt.get("previous_receipt_sha256") == expected_previous, f"{location}: receipt chain mismatch", errors)
         request_hash = receipt.get("request_sha256")
         if isinstance(request_hash, str):
             attempts_by_request[request_hash] = attempts_by_request.get(request_hash, 0) + 1
@@ -906,14 +1016,13 @@ def validate_requests_and_receipts(
             require(previous is not None, f"{location}: replay source is missing", errors)
             if previous is not None:
                 require(previous.get("request_sha256") == request_hash, f"{location}: replay request differs from source", errors)
-        previous_receipt = receipt
 
     receipt_files = {
         path.relative_to(root).as_posix()
         for path in (root / "receipts").rglob("*.json")
     } if (root / "receipts").is_dir() else set()
     require(receipt_files == seen_receipt_paths, "receipt directory does not exactly match executions.json", errors)
-    return execution_requests, differential_requests, executions
+    return execution_requests, executions
 
 
 def validate_execution_request_semantics(
@@ -926,17 +1035,36 @@ def validate_execution_request_semantics(
     require(isinstance(command, list) and bool(command) and all(isinstance(item, str) and item for item in command), f"{location}: command must be a non-empty string argv", errors)
     environment = value.get("environment")
     require(isinstance(environment, dict) and all(isinstance(key, str) and isinstance(item, str) for key, item in environment.items()), f"{location}: environment must contain complete string values", errors)
-    test_ids = value.get("test_ids")
-    test_paths = value.get("test_paths")
+    has_ids = "test_ids" in value
+    has_paths = "test_paths" in value
+    has_auto_bind = "auto_bind" in value
     auto_bind = value.get("auto_bind") is True
+    binding_modes = int(has_ids) + int(has_paths) + int(auto_bind)
     require(
-        (isinstance(test_ids, list) and all(isinstance(item, str) and item for item in test_ids))
-        or (isinstance(test_paths, list) and all(isinstance(item, str) and item for item in test_paths))
-        or auto_bind,
-        f"{location}: execution must provide test_ids, test_paths, or auto_bind",
+        binding_modes == 1 and not (has_auto_bind and not auto_bind),
+        f"{location}: binding modes test_ids, test_paths, and auto_bind=true must be mutually exclusive",
         errors,
     )
+    if has_ids:
+        test_ids = value.get("test_ids")
+        require(
+            isinstance(test_ids, list) and bool(test_ids)
+            and all(isinstance(item, str) and item for item in test_ids)
+            and len(set(test_ids)) == len(test_ids),
+            f"{location}: test_ids must be a non-empty unique string array",
+            errors,
+        )
+    if has_paths:
+        test_paths = value.get("test_paths")
+        require(
+            isinstance(test_paths, list) and bool(test_paths)
+            and all(isinstance(item, str) and item for item in test_paths)
+            and len(set(test_paths)) == len(test_paths),
+            f"{location}: test_paths must be a non-empty unique string array",
+            errors,
+        )
     if receipt:
+        require(has_ids and not has_paths and not has_auto_bind, f"{location}: receipt binding must use canonical test_ids only", errors)
         require(type(value.get("selected_execution")) is bool, f"{location}: selected_execution must be boolean", errors)
         require(type(value.get("reliable")) is bool, f"{location}: reliable must be boolean", errors)
         require(type(value.get("exit_code")) is int and not isinstance(value.get("exit_code"), bool), f"{location}: exit_code must be an integer", errors)
@@ -984,6 +1112,25 @@ def validate_canonical_capture(
     scope_changed = set(scope.get("changed_files", [])) if isinstance(scope.get("changed_files"), list) else set()
     require(captured_paths == inventory_changed, "canonical capture and inventory changed_files do not match", errors)
     require(captured_paths == scope_changed, "canonical capture and scope changed_files do not match", errors)
+    baseline = capture.get("baseline_commit")
+    if not isinstance(baseline, str) or not baseline:
+        errors.append("canonical capture baseline_commit is missing")
+        return
+    try:
+        live_patch, live_entries = canonical_change_patch(project_root, baseline)
+    except EvidenceError as exc:
+        errors.append(f"cannot verify live canonical change: {exc}")
+        return
+    require(
+        hashlib.sha256(live_patch).hexdigest() == capture.get("patch_sha256"),
+        "canonical change capture is stale: live patch hash differs",
+        errors,
+    )
+    require(
+        live_entries == capture.get("changed_files"),
+        "canonical change capture is stale: live changed-file entries differ",
+        errors,
+    )
 
 
 def validate_test_preparation(
@@ -1122,7 +1269,14 @@ def validate_plan_and_scope_bindings(
         for layer in test_layers if isinstance(test_layers, list) else []:
             require(layer in LAYER_ORDER, f"planned test uses unknown layer: {test_id}/{layer}", errors)
         matching_receipts = selected_by_test.get(test_id, [])
-        require(bool(matching_receipts), f"planned test has no selected receipt: {test_id}", errors)
+        if manifest.get("final_verdict") == "TEST_PASS":
+            passing_receipts = [
+                receipt for receipt in matching_receipts
+                if receipt.get("reliable") is True and receipt.get("exit_code") == 0
+            ]
+            require(bool(passing_receipts), f"planned test has no selected reliable zero-exit receipt: {test_id}", errors)
+        else:
+            require(bool(matching_receipts), f"planned test has no selected receipt: {test_id}", errors)
         for receipt in matching_receipts:
             require(receipt.get("layer") in test_layers, f"planned test receipt uses an unplanned layer: {test_id}", errors)
 
@@ -1184,6 +1338,12 @@ def validate_matrix_risks(
     )
     if verdict == "TEST_FAIL":
         require(reliably_failed, "TEST_FAIL lacks a reliable reproduced failing execution", errors)
+    elif verdict == "TEST_PASS":
+        require(
+            not reliably_failed,
+            "TEST_PASS contains a reliable selected failing execution",
+            errors,
+        )
 
     for behavior in matrix.get("behaviors", []):
         if not isinstance(behavior, dict):
@@ -1225,123 +1385,6 @@ def validate_matrix_risks(
                     errors.append(f"TEST_PASS has unresolved behavior risk: {behavior_id}/{risk_name}")
 
 
-def require_sha_or_null(value: Any, location: str, errors: list[str]) -> None:
-    require(value is None or is_sha256(value), f"{location} must be a sha256 or null", errors)
-
-
-def validate_differential_proofs(
-    root: Path,
-    project_root: Path,
-    manifest: dict[str, Any],
-    matrix: dict[str, Any],
-    proof: dict[str, Any],
-    differential_requests: dict[str, dict[str, Any]],
-    executions: list[dict[str, Any]],
-    entry_map: dict[str, dict[str, Any]],
-    records_schema: dict[str, Any],
-    errors: list[str],
-) -> None:
-    verdict = manifest.get("final_verdict")
-    receipts = {item.get("execution_id"): item for item in executions if isinstance(item.get("execution_id"), str)}
-    behavior_ids = {item.get("id") for item in matrix.get("behaviors", []) if isinstance(item, dict)}
-    proof_by_behavior: dict[str, dict[str, Any]] = {}
-    proofs = proof.get("proofs")
-    if not isinstance(proofs, list):
-        return
-    for item in proofs:
-        if not isinstance(item, dict):
-            continue
-        behavior_id = item.get("behavior_id")
-        require(behavior_id in behavior_ids, f"differential proof maps unknown behavior: {behavior_id}", errors)
-        require(behavior_id not in proof_by_behavior, f"duplicate differential proof: {behavior_id}", errors)
-        if isinstance(behavior_id, str):
-            proof_by_behavior[behavior_id] = item
-        classification = item.get("classification")
-        if classification == "NOT_APPLICABLE":
-            validate_differential_na(item.get("not_applicable"), f"differential proof {behavior_id} not_applicable", errors)
-            for key in (
-                "method", "differential_request_path", "differential_request_sha256", "baseline_commit",
-                "baseline_execution_id", "mutation_execution_id", "current_execution_id",
-                "isolation_tree_sha256", "mutation_apply_sha256", "mutation_restore_sha256",
-            ):
-                require(item.get(key) is None, f"N/A differential proof must clear {key}: {behavior_id}", errors)
-            require(item.get("failure_reason_matched") is False, f"N/A differential proof cannot claim a failure match: {behavior_id}", errors)
-            continue
-
-        request_relative = item.get("differential_request_path")
-        request = differential_requests.get(request_relative) if isinstance(request_relative, str) else None
-        require(request is not None, f"differential proof has no matching request: {behavior_id}", errors)
-        request_path = require_manifest_entry(request_relative, entry_map, root, errors, "differential request") if isinstance(request_relative, str) else None
-        if request_path is not None:
-            require(file_sha256(request_path) == item.get("differential_request_sha256"), f"differential request hash mismatch: {behavior_id}", errors)
-        if not isinstance(request, dict):
-            continue
-        require(request.get("behavior_id") == behavior_id, f"differential request behavior mismatch: {behavior_id}", errors)
-        method = item.get("method")
-        require(method == request.get("method") and method in {"baseline", "controlled-mutation"}, f"differential method mismatch: {behavior_id}", errors)
-        require(item.get("baseline_commit") == request.get("baseline_commit") == manifest.get("baseline_commit"), f"differential baseline commit mismatch: {behavior_id}", errors)
-        for key in (
-            "differential_request_sha256", "isolation_tree_sha256", "mutation_apply_sha256", "mutation_restore_sha256",
-        ):
-            require_sha_or_null(item.get(key), f"differential proof {behavior_id}.{key}", errors)
-        require(item.get("cleanup_succeeded") is True, f"differential cleanup failed: {behavior_id}", errors)
-
-        current = receipts.get(item.get("current_execution_id"))
-        require(current is not None, f"differential current receipt is missing: {behavior_id}", errors)
-        failing_id = item.get("baseline_execution_id") if method == "baseline" else item.get("mutation_execution_id")
-        failing = receipts.get(failing_id)
-        require(failing is not None, f"differential failing receipt is missing: {behavior_id}", errors)
-        if current is not None and failing is not None:
-            require(current.get("request_sha256") == failing.get("request_sha256"), f"differential sides use different execution requests: {behavior_id}", errors)
-            nested = request.get("execution_request")
-            current_request_path = current.get("request_path")
-            current_request = load_json(root / current_request_path) if isinstance(current_request_path, str) and safe_path(root, current_request_path, errors, "differential receipt request") else None
-            require(current_request == nested, f"differential current receipt request does not match request: {behavior_id}", errors)
-            require(current.get("selected_execution") is True and current.get("reliable") is True and current.get("exit_code") == 0, f"differential current side is not a reliable success: {behavior_id}", errors)
-            require(failing.get("selected_execution") is False and failing.get("reliable") is True and failing.get("exit_code") != 0, f"differential failing side is not a reliable failure: {behavior_id}", errors)
-            current_isolation = current.get("isolation")
-            failing_isolation = failing.get("isolation")
-            require(isinstance(current_isolation, dict) and current_isolation.get("kind") == "current", f"differential current receipt lacks current isolation: {behavior_id}", errors)
-            require(isinstance(failing_isolation, dict) and failing_isolation.get("kind") == method, f"differential failing receipt isolation mismatch: {behavior_id}", errors)
-            if isinstance(current_isolation, dict):
-                require(current_isolation.get("tree_sha256") == item.get("isolation_tree_sha256"), f"differential current isolation hash mismatch: {behavior_id}", errors)
-            if method == "baseline" and isinstance(failing_isolation, dict):
-                require(failing_isolation.get("baseline_commit") == request.get("baseline_commit"), f"baseline receipt commit mismatch: {behavior_id}", errors)
-            if method == "controlled-mutation" and isinstance(failing_isolation, dict):
-                patch_relative = request.get("mutation_patch_path")
-                patch_path = require_manifest_entry(patch_relative, entry_map, root, errors, "controlled mutation patch") if isinstance(patch_relative, str) else None
-                require(patch_path is not None, f"controlled mutation patch is missing: {behavior_id}", errors)
-                if patch_path is not None:
-                    patch_hash = file_sha256(patch_path)
-                    require(failing_isolation.get("patch_sha256") == patch_hash, f"controlled mutation receipt patch hash mismatch: {behavior_id}", errors)
-                require(item.get("mutation_apply_sha256") == failing_isolation.get("tree_sha256"), f"controlled mutation apply hash mismatch: {behavior_id}", errors)
-                require(item.get("mutation_restore_sha256") == item.get("isolation_tree_sha256"), f"controlled mutation restore hash mismatch: {behavior_id}", errors)
-        if method == "baseline":
-            require(item.get("mutation_execution_id") is None, f"baseline proof has mutation receipt: {behavior_id}", errors)
-            require(request.get("mutation_patch_path") is None, f"baseline request has mutation patch: {behavior_id}", errors)
-            require(item.get("mutation_apply_sha256") is None and item.get("mutation_restore_sha256") is None, f"baseline proof has mutation hashes: {behavior_id}", errors)
-        elif method == "controlled-mutation":
-            require(item.get("baseline_execution_id") is None, f"mutation proof has baseline receipt: {behavior_id}", errors)
-            require(isinstance(request.get("mutation_patch_path"), str) and bool(request.get("mutation_patch_path")), f"mutation request lacks patch: {behavior_id}", errors)
-        if classification == "PROVEN":
-            require(item.get("failure_reason_matched") is True, f"differential failure reason was not matched: {behavior_id}", errors)
-            if failing is not None:
-                output = b""
-                for key in ("stdout_path", "stderr_path"):
-                    relative = failing.get(key)
-                    path = safe_path(root, relative, errors, "differential raw output") if isinstance(relative, str) else None
-                    if path is not None and path.is_file():
-                        output += path.read_bytes()
-                signals = request.get("expected_failure_signals")
-                require(isinstance(signals, list) and any(isinstance(signal, str) and signal.encode() in output for signal in signals), f"differential expected failure signal is absent: {behavior_id}", errors)
-        elif classification == "UNPROVEN" and verdict == "TEST_PASS":
-            errors.append(f"TEST_PASS has unproven necessary behavior: {behavior_id}")
-
-    if verdict == "TEST_PASS":
-        for behavior_id in behavior_ids:
-            require(behavior_id in proof_by_behavior, f"behavior lacks differential proof: {behavior_id}", errors)
-
-
 def validate_infrastructure(
     manifest: dict[str, Any],
     infrastructure: dict[str, Any],
@@ -1409,6 +1452,23 @@ def validate_verdict_and_attestation(
     require(verdict_record.get("real_environment_validated") is False, "code evidence must not claim real-environment validation", errors)
     require(verdict_record.get("repairs_business_defects") is False, "test skill must not repair business defects", errors)
     if verdict == "TEST_PASS":
+        selected = [
+            item for item in executions
+            if isinstance(item, dict) and item.get("selected_execution") is True
+        ]
+        require(bool(selected), "TEST_PASS has no selected executions", errors)
+        for item in selected:
+            execution_id = item.get("execution_id", "unknown-execution")
+            require(
+                item.get("reliable") is True,
+                f"TEST_PASS contains a selected unreliable execution: {execution_id}",
+                errors,
+            )
+            require(
+                item.get("exit_code") == 0,
+                f"TEST_PASS contains a selected failing execution: {execution_id}",
+                errors,
+            )
         require(verdict_record.get("code_evidence_replayable") is True, "TEST_PASS must declare replayable code evidence", errors)
         require(not verdict_record.get("blockers"), "TEST_PASS contains blockers", errors)
         require(not verdict_record.get("reproduced_failures"), "TEST_PASS contains reproduced failures", errors)
@@ -1539,20 +1599,18 @@ def validate_evidence(
         scope, inventory, inventory_by_category, project_root, root,
         get_captured_deleted_paths(root), errors,
     )
-    execution_requests, differential_requests, executions = validate_requests_and_receipts(root, entry_map, records_schema, errors)
+    execution_requests, executions = validate_requests_and_receipts(root, entry_map, records_schema, errors)
 
     if change_class == "behavior":
         try:
             matrix = load_json(root / "behavior-risk-matrix.json")
             infrastructure = load_json(root / "infrastructure-changes.json")
-            proof = load_json(root / "differential-proof.json")
         except EvidenceError as exc:
             errors.append(str(exc))
-            matrix = infrastructure = proof = None
-        if all(isinstance(item, dict) for item in (matrix, infrastructure, proof, plan)):
+            matrix = infrastructure = None
+        if all(isinstance(item, dict) for item in (matrix, infrastructure, plan)):
             validate_schema(matrix, matrix_schema, matrix_schema, "behavior-risk-matrix", errors)
             validate_definition(infrastructure, "infrastructureChanges", records_schema, "infrastructure-changes", errors)
-            validate_definition(proof, "differentialProof", records_schema, "differential-proof", errors)
             stages = {item.get("name"): item for item in manifest.get("stages", []) if isinstance(item, dict)}
             for stage_name in CORE_BEHAVIOR_STAGES:
                 require(stages.get(stage_name, {}).get("status") == "complete", f"behavior protocol stage cannot be N/A: {stage_name}", errors)
@@ -1561,10 +1619,6 @@ def validate_evidence(
                 executions, records_schema, errors,
             )
             validate_matrix_risks(manifest, matrix, test_map, executions, records_schema, errors)
-            validate_differential_proofs(
-                root, project_root, manifest, matrix, proof, differential_requests, executions,
-                entry_map, records_schema, errors,
-            )
             validate_infrastructure(manifest, infrastructure, executions, entry_map, root, errors)
         else:
             errors.append("behavior evidence records must be JSON objects")
@@ -1612,10 +1666,7 @@ def render_report_text(
 ) -> str:
     lifecycle_path = root / "lifecycle.json"
     lifecycle = load_json(lifecycle_path) if lifecycle_path.exists() else {}
-    proof_path = root / "differential-proof.json"
-    proof_record = load_json(proof_path) if proof_path.exists() else {}
     executions_record = load_json(root / "executions.json")
-    proofs = proof_record.get("proofs", []) if isinstance(proof_record, dict) else []
     executions = executions_record if isinstance(executions_record, list) else []
     artifact_dir = lifecycle.get("artifact_dir") if isinstance(lifecycle, dict) else None
     lines = [
@@ -1633,7 +1684,6 @@ def render_report_text(
         f"- Artifact Dir: {artifact_dir or 'not provided'}",
         "",
         f"Execution receipts: {len(executions)}",
-        f"Differential proofs: {len(proofs) if isinstance(proofs, list) else 0}",
         "The legacy test-report interface is not supported.",
         "",
     ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prizmkit",
-  "version": "1.1.136",
+  "version": "1.1.138",
   "description": "Create a new PrizmKit-powered project with clean initialization — no framework dev files, just what you need.",
   "type": "module",
   "bin": {