prizmkit 1.1.138 → 1.1.140

package/bundled/VERSION.json

@@ -1,5 +1,5 @@
 {
-  "frameworkVersion": "1.1.138",
-  "bundledAt": "2026-07-20T06:21:15.560Z",
-  "bundledFrom": "9c4025a"
+  "frameworkVersion": "1.1.140",
+  "bundledAt": "2026-07-20T13:39:17.949Z",
+  "bundledFrom": "9a25298"
 }

package/bundled/dev-pipeline/prizmkit_runtime/checkpoint_state.py

@@ -668,10 +668,10 @@ def _evidence_validator_passes(
 
 def _resolve_evidence_validator(project_root: Path) -> Path | None:
     candidates = (
+        project_root / "core" / "skills" / "prizmkit-skill" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
         project_root / ".claude" / "command-assets" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
         project_root / ".agents" / "skills" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
         project_root / ".codebuddy" / "skills" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
-        project_root / "core" / "skills" / "prizmkit-skill" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
     )
     return next((path for path in candidates if path.is_file()), None)
 

package/bundled/dev-pipeline/scripts/prompt_framework.py

@@ -117,6 +117,14 @@ def pipeline_checkpoint_metadata(artifact_dir, evidence=None, stage="plan",
                                  blocked_reason=None, terminal_status=None):
     """Build family-neutral semantic L4 metadata without replacing L1 state."""
     evidence = evidence or {}
+    if evidence:
+        evidence_paths = {
+            "manifest": evidence.get("manifest_path"),
+            "verdict": evidence.get("verdict_path"),
+            "validation": evidence.get("validation_path"),
+        }
+    else:
+        evidence_paths = {"manifest": None, "verdict": None, "validation": None}
     current_stage = None if terminal_status else stage
     semantic_next_stage = None if terminal_status else next_stage
     return {
@@ -129,11 +137,7 @@ def pipeline_checkpoint_metadata(artifact_dir, evidence=None, stage="plan",
         "stage_result": stage_result,
         "repair_scope": repair_scope,
         "repair_round": repair_round,
-        "authoritative_evidence_paths": {
-            "manifest": evidence.get("manifest_path"),
-            "verdict": evidence.get("verdict_path"),
-            "validation": evidence.get("validation_path"),
-        },
+        "authoritative_evidence_paths": evidence_paths,
         "next_stage": semantic_next_stage,
         "resume_from": resume_from,
         "blocked_reason": blocked_reason,

package/bundled/dev-pipeline/scripts/update-checkpoint.py

@@ -213,6 +213,70 @@ def _checkpoint_project_root(checkpoint_path):
             return str(parent.parent)
     return str(path.parent)
 
+def _discover_test_evidence_paths(checkpoint_path, data):
+    """Discover the latest finalized test package from the artifact handoff pointer."""
+    project_root = Path(_checkpoint_project_root(checkpoint_path))
+    candidates = []
+    artifact_dir = data.get("artifact_dir")
+    if isinstance(artifact_dir, str) and artifact_dir:
+        candidates.append(project_root / artifact_dir)
+    for state_key in ("feature_state", "bugfix_state", "refactor_state"):
+        state = data.get(state_key)
+        if isinstance(state, dict) and isinstance(state.get("artifact_dir"), str):
+            candidates.append(project_root / state["artifact_dir"])
+    item_slug = data.get("item_slug")
+    if isinstance(item_slug, str) and item_slug:
+        candidates.append(project_root / ".prizmkit" / "specs" / item_slug)
+        candidates.append(project_root / ".prizmkit" / "bugfix" / item_slug)
+        candidates.append(project_root / ".prizmkit" / "refactor" / item_slug)
+
+    for artifact in candidates:
+        pointer = artifact / "test-report-path.txt"
+        try:
+            report = Path(pointer.read_text(encoding="utf-8").strip()).resolve()
+        except (OSError, ValueError):
+            continue
+        evidence_dir = report.parent
+        evidence_root = (project_root / ".prizmkit" / "test" / "evidence").resolve()
+        try:
+            relative_evidence = evidence_dir.resolve().relative_to(evidence_root)
+        except (OSError, ValueError):
+            continue
+        if len(relative_evidence.parts) != 1:
+            continue
+        paths = {
+            "manifest": evidence_dir / "manifest.json",
+            "verdict": evidence_dir / "verdict.json",
+            "validation": evidence_dir / "validation.json",
+        }
+        if not all(path.is_file() for path in paths.values()):
+            continue
+        try:
+            manifest = json.loads(paths["manifest"].read_text(encoding="utf-8"))
+            verdict = json.loads(paths["verdict"].read_text(encoding="utf-8"))
+            validation = json.loads(paths["validation"].read_text(encoding="utf-8"))
+        except (OSError, UnicodeDecodeError, json.JSONDecodeError):
+            continue
+        if not all(isinstance(record, dict) for record in (manifest, verdict, validation)):
+            continue
+        if (
+            manifest.get("evidence_id") != evidence_dir.name
+            or manifest.get("final_verdict") != "TEST_BLOCKED"
+            or verdict.get("verdict") != "TEST_BLOCKED"
+            or validation.get("result") != "passed"
+            or validation.get("verdict") != "TEST_BLOCKED"
+        ):
+            continue
+        try:
+            return {
+                key: str(path.resolve().relative_to(project_root.resolve()))
+                for key, path in paths.items()
+            }
+        except (OSError, ValueError):
+            continue
+    return None
+
+
 def _finalize_semantics(checkpoint_path, data, state_key):
     """Derive a deterministic terminal status after an atomic mutation."""
     candidate = validate_checkpoint_data(
@@ -286,11 +350,24 @@ def update_checkpoint(
             return {"ok": False, "error": verdict_error}
 
     semantic_update = _normalize_semantic_update(semantic_update)
+    if semantic_update.get("stage_result") == "TEST_BLOCKED" and not semantic_update.get("authoritative_evidence_paths"):
+        discovered = _discover_test_evidence_paths(checkpoint_path, data)
+        if discovered:
+            semantic_update["authoritative_evidence_paths"] = discovered
     semantic_error = _validate_semantic_update(step, semantic_update)
     if semantic_error:
         return {"ok": False, "error": semantic_error}
 
     stage_result = semantic_update.get("stage_result")
+    if step.get("skill") == "prizmkit-test" and stage_result in TEST_RESULTS:
+        evidence = semantic_update.get("authoritative_evidence_paths") or step.get("authoritative_evidence_paths")
+        if stage_result != "TEST_BLOCKED" and (
+            not isinstance(evidence, dict) or set(evidence) != {"manifest", "verdict", "validation"}
+        ):
+            return {
+                "ok": False,
+                "error": "Every terminal test verdict requires manifest, verdict, and validation evidence paths",
+            }
     if new_status == "completed" and step.get("skill") == "prizmkit-code-review":
         stage_result = stage_result or step.get("stage_result")
         if stage_result != "REVIEW_PASS":

package/bundled/dev-pipeline/templates/sections/phase-prizmkit-test.md

@@ -33,7 +33,8 @@ Preserve the same artifact directory and update the L1 workflow state plus this
 - `TEST_FAIL` with `repair_scope=test-infrastructure` → `prizmkit-implement` → `prizmkit-test`; do not make speculative production edits.
 - `TEST_FAIL` with `repair_scope=production|runtime|schema|dependency|public-interface` → `prizmkit-implement` → `prizmkit-code-review` → `prizmkit-test`.
 - `TEST_FAIL` with unknown or unsafe scope → do not guess a production edit; record `WORKFLOW_BLOCKED` and a safe resume entry.
-- `TEST_BLOCKED` → preserve all evidence and artifacts, perform only bounded environment recovery, then finish terminal `WORKFLOW_BLOCKED` with `blocked_reason=test_blocked`; never edit production speculatively.
+- `TEST_BLOCKED` → preserve all evidence and artifacts, perform only bounded environment recovery, then finish terminal `WORKFLOW_BLOCKED` with `blocked_reason=test_blocked`; never edit production speculatively. When a finalized blocked package exists, pass its validated `manifest`, `verdict`, and `validation` paths to the checkpoint; do not leave these paths null.
+- The builder's evidence-protocol recovery budget is separate from the outer `repair_round`: after bounded preflight/package attempts, stop creating evidence versions and return `TEST_BLOCKED`.
 - The outer `repair_round` is shared across review/test failures and may not exceed three. The Code Review internal loop limit remains separate and is at most ten completed rounds.
 
 A missing, stale, incomplete, mismatched, tampered, or wrong-scope package is not `TEST_PASS`: preserve the evidence, write `failure-log.md`, and leave the checkpoint resumable or blocked according to headless policy.

package/bundled/dev-pipeline/tests/test_checkpoint_state.py

@@ -440,6 +440,106 @@ def test_declared_final_artifact_must_exist_for_semantic_completion(tmp_path, mo
 
 
 
+def test_blocked_test_handoff_discovers_finalized_evidence_paths(tmp_path):
+    artifact = tmp_path / ".prizmkit" / "specs" / "feature"
+    artifact.mkdir(parents=True)
+    evidence = tmp_path / ".prizmkit" / "test" / "evidence" / "evidence-1"
+    evidence.mkdir(parents=True)
+    (evidence / "manifest.json").write_text(
+        json.dumps({"evidence_id": "evidence-1", "final_verdict": "TEST_BLOCKED"}),
+        encoding="utf-8",
+    )
+    (evidence / "verdict.json").write_text(
+        json.dumps({"verdict": "TEST_BLOCKED"}),
+        encoding="utf-8",
+    )
+    (evidence / "validation.json").write_text(
+        json.dumps({"result": "passed", "verdict": "TEST_BLOCKED"}),
+        encoding="utf-8",
+    )
+    (evidence / "lifecycle.json").write_text(
+        json.dumps({"status": "sealed", "finalized": True}),
+        encoding="utf-8",
+    )
+    report = evidence / "test-report.md"
+    report.write_text("blocked", encoding="utf-8")
+    (artifact / "test-report-path.txt").write_text(str(report), encoding="utf-8")
+
+    payload = _family_checkpoint(
+        "feature-pipeline",
+        [
+            "prizmkit-implement", "prizmkit-code-review", "prizmkit-test",
+            "prizmkit-retrospective", "prizmkit-committer", "completion-summary",
+        ],
+        semantic={"artifact_dir": ".prizmkit/specs/feature"},
+    )
+    payload["feature_state"]["artifact_dir"] = ".prizmkit/specs/feature"
+    payload["steps"][1]["stage_result"] = "REVIEW_PASS"
+    payload["steps"][2]["status"] = "in_progress"
+    payload["steps"][2].pop("stage_result")
+    for step in payload["steps"][3:]:
+        step["status"] = "pending"
+        step.pop("stage_result", None)
+    checkpoint = _write(tmp_path / ".prizmkit" / "specs" / "feature" / "workflow-checkpoint.json", payload)
+
+    result = update_checkpoint(
+        str(checkpoint),
+        "prizmkit-test",
+        "failed",
+        semantic_update={
+            "stage_result": "TEST_BLOCKED",
+            "blocked_reason": "test_blocked",
+            "terminal_status": "WORKFLOW_BLOCKED",
+        },
+    )
+
+    assert result["ok"] is True
+    paths = json.loads(checkpoint.read_text(encoding="utf-8"))["steps"][2]["authoritative_evidence_paths"]
+    assert paths["manifest"] == ".prizmkit/test/evidence/evidence-1/manifest.json"
+    assert paths["verdict"] == ".prizmkit/test/evidence/evidence-1/verdict.json"
+    assert paths["validation"] == ".prizmkit/test/evidence/evidence-1/validation.json"
+
+
+
+def test_blocked_test_handoff_without_finalized_evidence_preserves_test_result(tmp_path):
+    artifact = tmp_path / ".prizmkit" / "specs" / "feature"
+    artifact.mkdir(parents=True)
+    payload = _family_checkpoint(
+        "feature-pipeline",
+        [
+            "prizmkit-implement", "prizmkit-code-review", "prizmkit-test",
+            "prizmkit-retrospective", "prizmkit-committer", "completion-summary",
+        ],
+        semantic={"artifact_dir": ".prizmkit/specs/feature"},
+    )
+    payload["feature_state"]["artifact_dir"] = ".prizmkit/specs/feature"
+    payload["steps"][1]["stage_result"] = "REVIEW_PASS"
+    payload["steps"][2]["status"] = "in_progress"
+    payload["steps"][2].pop("stage_result")
+    for step in payload["steps"][3:]:
+        step["status"] = "pending"
+        step.pop("stage_result", None)
+    checkpoint = _write(artifact / "workflow-checkpoint.json", payload)
+
+    result = update_checkpoint(
+        str(checkpoint),
+        "prizmkit-test",
+        "failed",
+        semantic_update={
+            "stage_result": "TEST_BLOCKED",
+            "blocked_reason": "test_blocked",
+            "terminal_status": "WORKFLOW_BLOCKED",
+        },
+    )
+
+    persisted = json.loads(checkpoint.read_text(encoding="utf-8"))
+    assert result["ok"] is True
+    assert result["semantic"]["stage_result"] == "TEST_BLOCKED"
+    assert persisted["steps"][2]["stage_result"] == "TEST_BLOCKED"
+    assert persisted["feature_state"]["stage_result"] == "TEST_BLOCKED"
+    assert "authoritative_evidence_paths" not in persisted["steps"][2]
+
+
 def test_update_checkpoint_rejects_test_pass_when_validator_replay_fails(tmp_path, monkeypatch):
     paths = _write_test_evidence(tmp_path)
     payload = _family_checkpoint(

package/bundled/skills/_metadata.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.138",
+  "version": "1.1.140",
   "skills": {
     "prizmkit": {
       "description": "Framework introduction and navigation for the formal single-requirement lifecycle, project initialization, Prizm docs, and independent deployment.",

package/bundled/skills/prizmkit-test/SKILL.md

@@ -20,23 +20,23 @@ Fix only the protocol mechanisms needed for safe, replayable evidence: project/e
 The Main Agent supplies semantic requests only; it does not author authoritative package records. Initialize and drive one evidence directory through the builder in this order:
 
 ```text
-init → capture-change → inventory → prepare-tests → execute → finalize → render-report → validate --attest → resume
+init → capture-change → inventory → prepare-tests → execute → finalize → validate --attest → resume
 ```
 
 Use `${SKILL_DIR}/scripts/build_test_evidence.py` for every lifecycle command:
 
-- `init`: creates the package directories and immutable baseline identity.
+- `init`: creates the package directories and pins the baseline identity.
 - `capture-change`: captures the complete canonical change, including untracked, deleted, renamed, and copied files; never substitute plain `git diff`. `inventory` then requires its changed-file set to match the capture exactly and rejects stale captures or unaccounted live paths.
 - `inventory`: hashes current source/tests/contracts/lockfiles, rejects category overlap, excludes runtime-only paths, and validates directory roots plus the complete capture-derived changed-file set.
 - `prepare-tests`: discovers repository-native test files from the canonical capture and inventory, generates stable builder-owned test IDs, derives existing/added/modified status, and snapshots only added/modified live test sources.
 - `execute`: runs native project commands and owns `executions.json`, `receipts/`, and `raw/`. Each request uses exactly one binding mode: `test_ids`, `test_paths`, or `auto_bind=true`. The builder infers recognized package-wide or explicit file/directory/glob command scope, blocks opaque commands or mismatched declarations, and persists verified canonical `test_ids` only.
-- `finalize`: rechecks canonical capture freshness, blocks every selected unreliable execution, and owns manifest, stage hashes, verdict, generated-test snapshots, and evidence identity.
-- `render-report`: derives `test-report.md`; it is never authoritative.
+- `finalize`: derives builder-owned target hashes, runs semantic-record and required-layer checks, rechecks canonical capture freshness, blocks every selected unreliable execution, and owns the payload manifest, verdict, generated-test snapshots, and evidence identity. It leaves the package in a mutable `payload-finalized` state until validator attestation; malformed semantic records fail before package relocation.
+- `render-report`: recovery/debugging command that derives `test-report.md`; normal finalization and attestation render it automatically, and it is never authoritative.
 - `resume`: preserves prior receipts and refuses to rebind an identity-changing package; create a new package after scope/source identity changes.
 
 `test-plan.json` is the only source of builder-generated test IDs. An execution request provides exactly one of native `test_paths`, `auto_bind=true`, or canonical `test_ids`; the actual command must expose the same deterministic scope, including all prepared tests for recognized package-wide commands. The builder blocks opaque or mismatched command scope and rewrites verified requests to canonical `test_ids` only before execution. Assess all five layers explicitly, but set `required=true` only when risk requires it; every omitted layer needs structured N/A evidence. The same binding applies test ↔ behavior ↔ execution; current-workspace receipts are the execution evidence.
 
-The builder/validator, not the Main Agent, produces or updates `manifest.json`, `executions.json`, `receipts/*`, `validation.json`, `verdict.json`, `test-report.md`, and `source-change.patch`. `validation.json` is produced only by `validate_test_evidence.py --attest`; a package is not a `TEST_PASS` until the second strict validation succeeds.
+The builder/validator, not the Main Agent, produces or updates `manifest.json`, `executions.json`, `receipts/*`, `validation.json`, `verdict.json`, `test-report.md`, and `source-change.patch`. Semantic records are authored through schema-shaped requests and must pass the builder preflight before finalization. `validation.json` is produced only by `validate_test_evidence.py --attest`; a package is not a `TEST_PASS` until the second strict validation succeeds.
 
 
 For a formal requirement, `/prizmkit-test` runs after the Main-Agent code-review stage reaches `PASS` and before retrospective:
@@ -68,7 +68,8 @@ Documentation, comment, and formatting-only scopes use deterministic lightweight
 3. Preserve complete command/environment/output values as requested. Mark the package `sensitivity=project-controlled`; the project owns access control, retention, and upload policy.
 4. Treat code-level dependencies as mock-first. Real deployed test-environment validation is a separate authorized activity.
 5. Never delete existing tests.
-6. For `TEST_FAIL`, classify and persist an evidence-backed `repair_scope` of `test-infrastructure`, `production`, `runtime`, `schema`, `dependency`, `public-interface`, or `unknown`. Test-infrastructure scope routes to implement then test; production-family scope routes to implement, code-review, then test. If evidence cannot support a safe classification, return `TEST_BLOCKED`.
+6. Evidence-protocol recovery is separately bounded: allow at most two package initializations and two semantic preflight failures for one canonical change identity. After the budget is exhausted, return `TEST_BLOCKED`; do not create another versioned package or hand-edit finalized evidence.
+7. For `TEST_FAIL`, classify and persist an evidence-backed `repair_scope` of `test-infrastructure`, `production`, `runtime`, `schema`, `dependency`, `public-interface`, or `unknown`. Test-infrastructure scope routes to implement then test; production-family scope routes to implement, code-review, then test. If evidence cannot support a safe classification, return `TEST_BLOCKED`.
 
 If test infrastructure is missing, the infrastructure preparation state establishes only the necessary project-native infrastructure autonomously. Do not ask the user to install routine test dependencies in a headless run; verify dependency versions before editing manifests.
 
@@ -216,9 +217,11 @@ python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
   --project-root <target-project-root>
 ```
 
-If this pre-check finds errors, fix them in the package before the second pass. The validator checks every authoritative record against its shipped schema, live target inventories, patch/diff binding, changed-file/module-root/exclusion/Regression Ring cross-links, generated-test snapshots, planned-test execution links, runner-generated receipts/request/raw-output hashes, successful behavior-risk mappings, production/unknown external-target safety, and package integrity.
+The first pass validates the payload while the package remains `payload-finalized`; `validation.json` is intentionally empty until attestation. Builder-derived target hashes and lifecycle records are generated before this check. If this pass finds semantic errors, repair the mutable staging package and rerun finalize; never repair a sealed package.
 
-**Second pass (attestation, with `--attest`):**
+The validator checks every authoritative record against its shipped schema, live target inventories, patch/diff binding, changed-file/module-root/exclusion/Regression Ring cross-links, generated-test snapshots, planned-test execution links, runner-generated receipts/request/raw-output hashes, successful behavior-risk mappings, production/unknown external-target safety, and package integrity.
+
+### Second pass (attestation)
 
 ```bash
 python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
@@ -227,7 +230,7 @@ python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
   --attest
 ```
 
-`--attest` writes an integrity/protocol attestation into `validation.json`, re-derives `test-report.md`, re-hashes final records in `manifest.json`, then runs a **second** strict validation against the refreshed package. A package is not a `TEST_PASS` until this second strict validation succeeds. Use builder replay when feasible to rerun recorded requests and create new linked receipts. Store validation output. Tampering, schema/identity/hash mismatch, source/test/lockfile drift, missing matrix mappings, wrong execution order, unjustified structured N/A, unresolved risk, or a false real-environment claim fails validation.
+`--attest` writes an integrity/protocol attestation into `validation.json`, marks `EVIDENCE_VALIDATE` complete, re-derives `test-report.md`, re-hashes final records in `manifest.json`, seals the package, and then runs a **second** strict validation against the refreshed package. A package is not a `TEST_PASS` until this second strict validation succeeds. Use builder replay when feasible to rerun recorded requests and create new linked receipts. Store validation output. Tampering, schema/identity/hash mismatch, source/test/lockfile drift, missing matrix mappings, wrong execution order, unjustified structured N/A, unresolved risk, or a false real-environment claim fails validation.
 
 ## Resume and Idempotency
 
@@ -255,7 +258,7 @@ No conditional pass exists.
 
 Before writing state, read `${SKILL_DIR}/references/workflow-state-protocol.md`.
 
-On `TEST_PASS`, update the active workflow state with `status=TEST_PASS`, `stage_result=TEST_PASS`, and `next_stage=retrospective`. On `TEST_FAIL`, persist the evidence-backed `repair_scope`, set `status=TEST_FAIL` and `stage_result=TEST_FAIL`, and return to implementation; test-infrastructure scope selects `next_stage=implement` with a direct test resume, while production-family scope selects `next_stage=implement` and requires code review before testing again. On `TEST_BLOCKED`, preserve the blocker, do not modify production code speculatively, and return a blocked result. The authoritative verdict is the validated evidence record; the derived Markdown report is only a compatibility view. If an active orchestrator exists, return the terminal result and `next_stage` to it; do not invoke the next skill independently.
+On `TEST_PASS`, update the active workflow state with `status=TEST_PASS`, `stage_result=TEST_PASS`, and `next_stage=retrospective`. On `TEST_FAIL`, persist the evidence-backed `repair_scope`, set `status=TEST_FAIL` and `stage_result=TEST_FAIL`, and return to implementation; test-infrastructure scope selects `next_stage=implement` with a direct test resume, while production-family scope selects `next_stage=implement` and requires code review before testing again. On `TEST_BLOCKED`, preserve the blocker and any validated finalized evidence paths, do not modify production code speculatively, and return a blocked result. A validator `PASS` means only that the evidence package is structurally valid; it does not mean the testing verdict passed. The authoritative verdict is the validated evidence record; the derived Markdown report is only a compatibility view. If an active orchestrator exists, return the terminal result and `next_stage` to it; do not invoke the next skill independently.
 
 ## Derived Report and Handoff
 

package/bundled/skills/prizmkit-test/assets/authoritative-records.schema.json

@@ -362,7 +362,7 @@
     "executionReceipt": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["receipt_format", "runner_path", "runner_sha256", "execution_id", "attempt_index", "request_path", "request_sha256", "purpose", "command", "cwd", "environment", "tool_versions", "layer", "test_ids", "external_targets", "exit_code", "stdout_path", "stderr_path", "stdout_sha256", "stderr_sha256", "selected_execution", "reliable", "started_at", "finished_at"],
+      "required": ["receipt_format", "runner_path", "runner_sha256", "execution_id", "attempt_index", "request_path", "request_sha256", "purpose", "command", "cwd", "environment", "tool_versions", "layer", "test_ids", "external_targets", "timeout_seconds", "exit_code", "stdout_path", "stderr_path", "stdout_sha256", "stderr_sha256", "selected_execution", "reliable", "started_at", "finished_at"],
       "properties": {
         "receipt_format": { "const": "prizmkit-runner-generated-v1" },
         "runner_path": { "$ref": "#/$defs/path" },
@@ -381,6 +381,7 @@
         "test_paths": { "type": "array", "items": { "$ref": "#/$defs/path" } },
         "auto_bind": { "type": "boolean" },
         "external_targets": { "type": "array", "items": { "$ref": "#/$defs/externalTarget" } },
+        "timeout_seconds": { "type": "number", "exclusiveMinimum": 0 },
         "exit_code": { "type": "integer" },
         "stdout_path": { "$ref": "#/$defs/path" },
         "stderr_path": { "$ref": "#/$defs/path" },

package/bundled/skills/prizmkit-test/assets/evidence-manifest.schema.json

@@ -82,7 +82,7 @@
             "EVIDENCE_VALIDATE"
           ]
         },
-        "status": { "enum": ["complete", "not_applicable"] },
+        "status": { "enum": ["complete", "pending", "not_applicable"] },
         "outputs": { "type": "array", "items": { "type": "string", "minLength": 1 } },
         "not_applicable": {
           "type": ["object", "null"],

package/bundled/skills/prizmkit-test/assets/evidence-package-template.json

@@ -8,6 +8,7 @@
     "execute",
     "finalize",
     "render-report",
+    "validate --attest",
     "resume"
   ],
   "generated_tests_policy": "Only added or modified repository-native tests are snapshotted; existing tests have no generated snapshot.",

package/bundled/skills/prizmkit-test/references/evidence-protocol.md

@@ -22,11 +22,14 @@ Hashes and validator receipts provide byte-level binding and drift detection, no
 
 `source-change.patch` preserves the complete target diff. Snapshot generated/changed tests under `generated-tests/`, contracts under `contracts/`, and raw stdout/stderr under `raw/`. Never replace old execution/output records.
 
-## Existing Tests and Package Finalization
+## Bounded Protocol Recovery
+
+Evidence-protocol repair is separate from production/test repair. The builder permits only a bounded recovery budget for semantic-record preflight and package initialization. After the budget is exhausted, return `TEST_BLOCKED`; do not create another versioned evidence package or hand-edit authoritative records. A payload-finalized package remains mutable only until validator attestation; after attestation it is sealed and immutable. `Evidence validation: PASS` means only that the package is structurally valid; the testing verdict must be read separately from `Testing verdict: TEST_PASS | TEST_FAIL | TEST_BLOCKED`.
+
 
 The evidence package is an audit of repository behavior, not a request to invent a parallel test suite. Discover and execute the smallest relevant native tests before adding anything. Add, modify, or delete tests only in the target repository. The builder's `prepare-tests` command derives stable test IDs and change status from canonical Git capture, and snapshots only added or modified repository-native tests. `generated-tests/` is an evidence archive, never an execution workspace; it may be empty when existing tests cover the behavior.
 
-The canonical package lifecycle is `init → capture-change → inventory → prepare-tests → execute → finalize → render-report → validate --attest → resume`. Builder commands own `source-change.patch`, native test preparation, receipts, raw outputs, manifest, verdict, and report. The validator alone owns `validation.json`. Inventory must consume a fresh capture and exactly preserve its complete changed-file set. Canonical behavior packages require a schema-valid `test-preparation.json` bound byte-for-byte to the builder-generated `test-plan.json` and its hashed semantic request. Evidence identity is derived from the resolved baseline, canonical patch hash, and scope hash; identity-changing resume creates a new package instead of rewriting the old directory.
+The canonical package lifecycle is `init → capture-change → inventory → prepare-tests → execute → finalize → validate --attest → resume`. Builder commands own `source-change.patch`, native test preparation, receipts, raw outputs, manifest, verdict, and initial report. The validator alone owns `validation.json` and refreshes the report during attestation. Inventory must consume a fresh capture and exactly preserve its complete changed-file set. Canonical behavior packages require a schema-valid `test-preparation.json` bound byte-for-byte to the builder-generated `test-plan.json` and its hashed semantic request. Evidence identity is derived from the resolved baseline, canonical patch hash, and scope hash; identity-changing resume creates a new package instead of rewriting the old directory.
 
 
 Run exactly these states in order:
@@ -164,12 +167,12 @@ python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
   --attest
 ```
 
-`--attest` first validates the immutable payload while excluding only the final attestation/view records, atomically writes `validation.json`, refreshes final file hashes, then immediately performs a complete second validation. Subsequent checks omit `--attest` and verify the stored attestation. This avoids trusting a caller-authored `passed` marker or creating a self-referential manifest. The attestation proves package integrity and protocol consistency only; it is not proof against a same-permission producer.
-
-When feasible, replay recorded requests through `build_test_evidence.py execute --replay-receipt ...`. Replay performs a new real execution and emits a new linked receipt; it does not pretend the attestation establishes what historically ran.
+`--attest` first validates the mutable `payload-finalized` package while excluding only validator-owned attestation/view records, atomically writes `validation.json`, marks validation complete, refreshes final file hashes, seals the lifecycle, then immediately performs a complete second validation. Subsequent checks omit `--attest` and verify the stored attestation. This avoids trusting a caller-authored `passed` marker or creating a self-referential manifest. The attestation proves package integrity and protocol consistency only; it is not proof against a same-permission producer.
 
 The validator checks all shipped JSON schemas, evidence-directory identity, live target-project inventories and aggregate hashes, changed-file/module-root/exclusion/Regression Ring cross-links, patch/diff binding, stage ordering and output ownership, generated-test snapshot existence, planned test/inventory/execution linkage, module/matrix completeness, successful selected runner receipts with request/raw-output binding, structured N/A and obvious signal conflicts, production/unknown external-target safety, strict verdict semantics, and honest mocked-versus-real claims. `TEST_PASS` requires deterministic validator success.
 
+When feasible, replay recorded requests through `build_test_evidence.py execute --replay-receipt ...`. Replay performs a new real execution and emits a new linked receipt; it does not pretend the attestation establishes what historically ran.
+
 ## Resume and Invalidation
 
 On invocation for an existing evidence target:

package/bundled/skills/prizmkit-test/references/evidence-request-protocol.md

@@ -15,7 +15,10 @@ The model writes project-semantic requests after inspecting manifests, runner co
 
 Never hand-author `executions.json` receipt fields. Never copy a command's claimed output into `raw/`. Invoke the builder so provenance is linked to the actual process.
 
-## Inventory Request
+## Producer Boundary and Recovery
+
+The model supplies schema-shaped semantic requests and mutable semantic records only before payload finalization. The builder performs structural and derived-field preflight before creating a payload-finalized package. Validator attestation then seals it. Once sealed, the returned `evidence_dir`, `manifest_path`, `verdict_path`, and `validation_path` are the only valid handoff paths; do not continue using the old staging directory. A validator pass is not a testing pass: read the testing verdict separately.
+
 
 Place a request under `requests/` with:
 
@@ -38,7 +41,7 @@ Use an argv array so the runner does not interpret a shell string. Required fiel
 - selected `layer` and exactly one canonical binding (`test_ids`, `test_paths`, or `auto_bind: true`);
 - structured `external_targets`.
 
-Optional `timeout_seconds`, `attempt_policy`, and `concurrency` remain model-chosen. The builder records them through request binding but does not invent values or silently retry.
+Optional `timeout_seconds`, `attempt_policy`, and `concurrency` remain model-chosen. The builder applies a bounded default and maximum timeout; it does not silently retry or claim concurrency that it did not execute.
 
 The request path must be beneath the evidence directory. `cwd` resolves beneath the selected execution root. Missing commands produce an actual exit 127 receipt; missing cwd or escaped paths block before execution.
 

package/bundled/skills/prizmkit-test/references/trusted-evidence-execution.md

@@ -41,7 +41,7 @@ Treat evidence as auditable project-controlled provenance, not a defense against
 
 ## Builder Commands
 
-Drive a new package through the canonical lifecycle. Semantic request files remain model-authored; authoritative package records remain tool-owned:
+Drive a new package through the canonical lifecycle. Semantic request files remain model-authored; authoritative package records remain tool-owned. The builder applies a bounded default timeout when the request omits one, preserves common native cache variables, and returns a bounded unreliable receipt on timeout. The normal user path should author one semantic request and one execution plan; use individual lifecycle commands only for recovery or protocol debugging.
 
 ```bash
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> init --baseline <commit>
@@ -49,14 +49,11 @@ python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evid
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> inventory --request requests/inventory.json
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> execute --request requests/focused.json
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> finalize --request requests/finalize.json
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> render-report
 ```
 
-`capture-change` includes tracked modifications, untracked files, deletions, renames, and copies. `finalize` owns the manifest, verdict, stage hashes, evidence identity, and generated-test snapshots. The validator is the only producer of `validation.json`.
+`<staging>` must be a child of `.prizmkit/test/evidence/`. After `finalize`, the package is `payload-finalized`; run the validator pre-check and then `validate_test_evidence.py --attest` to seal it. Do not treat the pre-attestation staging package as immutable or invoke `render-report` after sealing.
 
 
-Write requests beneath the evidence directory, then invoke the bundled script:
-
 ```bash
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py \
   --project-root <target-project-root> \

package/bundled/skills/prizmkit-test/scripts/build_test_evidence.py

@@ -59,6 +59,12 @@ INVENTORY_RESERVED_ROOTS = (
 
 _IGNORED_DIR_NAMES = {".git", "__pycache__", ".pytest_cache", ".mypy_cache"}
 FINAL_RECORDS = {"manifest.json", "validation.json", "verdict.json", "test-report.md"}
+MAX_PROTOCOL_PACKAGE_ATTEMPTS = 2
+PROTOCOL_STATE_NAME = ".protocol-recovery.json"
+DEFAULT_EXECUTION_TIMEOUT_SECONDS = 300.0
+MAX_EXECUTION_TIMEOUT_SECONDS = 1800.0
+MAX_EXECUTION_OUTPUT_BYTES = 16 * 1024 * 1024
+CANONICAL_EVIDENCE_ROOT = (".prizmkit", "test", "evidence")
 
 
 class RequestError(Exception):
@@ -112,6 +118,34 @@ def confined(root: Path, value: str, *, must_exist: bool = False, directory: boo
     return candidate
 
 
+def canonical_evidence_root(project_root: Path) -> Path:
+    return project_root.joinpath(*CANONICAL_EVIDENCE_ROOT).resolve()
+
+
+def require_canonical_evidence_dir(project_root: Path, evidence_dir: Path) -> None:
+    root = canonical_evidence_root(project_root)
+    try:
+        evidence_dir.resolve().relative_to(root)
+    except ValueError as exc:
+        raise RequestError(
+            "evidence directory must be under .prizmkit/test/evidence"
+        ) from exc
+    if evidence_dir.resolve() == root:
+        raise RequestError("evidence directory must be a package child of .prizmkit/test/evidence")
+
+
+def max_timeout(value: Any) -> float:
+    if value is None:
+        return DEFAULT_EXECUTION_TIMEOUT_SECONDS
+    if isinstance(value, bool) or not isinstance(value, (int, float)) or value <= 0:
+        raise RequestError("timeout_seconds must be a positive number")
+    if value > MAX_EXECUTION_TIMEOUT_SECONDS:
+        raise RequestError(
+            f"timeout_seconds must not exceed {MAX_EXECUTION_TIMEOUT_SECONDS:g} seconds"
+        )
+    return float(value)
+
+
 def evidence_relative(evidence_dir: Path, path: Path) -> str:
     try:
         return path.resolve().relative_to(evidence_dir.resolve()).as_posix()
@@ -792,6 +826,7 @@ def run_inventory(project_root: Path, evidence_dir: Path, request_path: Path, ou
 
 
 def run_process(argv: list[str], cwd: Path, environment: dict[str, str], timeout: float | None) -> tuple[int, bytes, bytes]:
+    timeout_value = max_timeout(timeout)
     creationflags = 0
     process_kwargs: dict[str, Any] = {}
     if os.name == "nt":
@@ -803,7 +838,7 @@ def run_process(argv: list[str], cwd: Path, environment: dict[str, str], timeout
         creationflags=creationflags, **process_kwargs,
     )
     try:
-        stdout, stderr = process.communicate(timeout=timeout)
+        stdout, stderr = process.communicate(timeout=timeout_value)
         return process.returncode, stdout, stderr
     except subprocess.TimeoutExpired:
         if os.name == "nt":
@@ -821,7 +856,14 @@ def run_process(argv: list[str], cwd: Path, environment: dict[str, str], timeout
                 except ProcessLookupError:
                     pass
         stdout, stderr = process.communicate()
-        return 124, stdout, stderr + f"\nPrizmKit runner timeout after {timeout} seconds\n".encode()
+        return 124, stdout, stderr + f"\nPrizmKit runner timeout after {timeout_value:g} seconds\n".encode()
+
+
+def limit_output(value: bytes, label: str) -> bytes:
+    if len(value) <= MAX_EXECUTION_OUTPUT_BYTES:
+        return value
+    marker = f"\nPrizmKit runner {label} truncated after {MAX_EXECUTION_OUTPUT_BYTES} bytes\n".encode()
+    return value[:MAX_EXECUTION_OUTPUT_BYTES - len(marker)] + marker
 
 
 def run_probe(argv: list[str], cwd: Path, environment: dict[str, str], timeout: float | None) -> dict[str, Any]:
@@ -829,7 +871,8 @@ def run_probe(argv: list[str], cwd: Path, environment: dict[str, str], timeout:
         exit_code, stdout, stderr = run_process(argv, cwd, environment, timeout)
         return {
             "command": argv, "exit_code": exit_code,
-            "stdout": stdout.decode(errors="replace"), "stderr": stderr.decode(errors="replace"),
+            "stdout": limit_output(stdout, "probe stdout").decode(errors="replace"),
+            "stderr": limit_output(stderr, "probe stderr").decode(errors="replace"),
         }
     except OSError as exc:
         return {"command": argv, "error": str(exc)}
@@ -881,11 +924,15 @@ def execute_request(
     if original_binding_fields != {"test_ids"} or original_test_ids != request["test_ids"]:
         write_json_atomic(request_path, request)
     cwd = confined(project_root, request["cwd"] or ".", must_exist=True, directory=True)
-    complete_environment = {"PATH": os.environ.get("PATH", os.defpath)}
+    complete_environment = {
+        key: value for key, value in os.environ.items()
+        if key in {"PATH", "HOME", "TMPDIR", "TMP", "TEMP", "GOMODCACHE", "GOPATH", "GOCACHE", "NPM_CONFIG_CACHE", "PIP_CACHE_DIR"}
+    }
+    complete_environment.setdefault("PATH", os.defpath)
     if os.name == "nt" and os.environ.get("SYSTEMROOT"):
         complete_environment["SYSTEMROOT"] = os.environ["SYSTEMROOT"]
     complete_environment.update(request["environment"])
-    timeout = request.get("timeout_seconds")
+    timeout = max_timeout(request.get("timeout_seconds"))
     tools = {
         name: run_probe(argv, cwd, complete_environment, timeout)
         for name, argv in request["tool_version_commands"].items()
@@ -904,19 +951,24 @@ def execute_request(
     stderr_path = raw_dir / f"{execution_id}.stderr"
     started = dt.datetime.now(dt.timezone.utc).isoformat()
     timed_out = False
+    output_limited = False
     execution_error = False
     try:
         exit_code, stdout, stderr = run_process(
             request["command"], cwd, complete_environment, timeout,
         )
         timed_out = exit_code == 124 and b"PrizmKit runner timeout" in stderr
+        output_limited = (
+            len(stdout) > MAX_EXECUTION_OUTPUT_BYTES
+            or len(stderr) > MAX_EXECUTION_OUTPUT_BYTES
+        )
     except OSError as exc:
         exit_code = 127
         stdout = b""
         stderr = f"PrizmKit runner execution error: {exc}\n".encode()
         execution_error = True
-    stdout_path.write_bytes(stdout)
-    stderr_path.write_bytes(stderr)
+    stdout_path.write_bytes(limit_output(stdout, "stdout"))
+    stderr_path.write_bytes(limit_output(stderr, "stderr"))
     finished = dt.datetime.now(dt.timezone.utc).isoformat()
     existing = load_json(evidence_dir / "executions.json") if (evidence_dir / "executions.json").exists() else []
     if not isinstance(existing, list):
@@ -938,13 +990,14 @@ def execute_request(
         "layer": request["layer"],
         "test_ids": request["test_ids"],
         "external_targets": request["external_targets"],
+        "timeout_seconds": timeout,
         "exit_code": exit_code,
         "stdout_path": evidence_relative(evidence_dir, stdout_path),
         "stderr_path": evidence_relative(evidence_dir, stderr_path),
         "stdout_sha256": file_sha256(stdout_path),
         "stderr_sha256": file_sha256(stderr_path),
         "selected_execution": selected_execution,
-        "reliable": probes_reliable and not timed_out and not execution_error,
+        "reliable": probes_reliable and not timed_out and not output_limited and not execution_error,
         "started_at": started,
         "finished_at": finished,
         "replay_of": replay_of,
@@ -960,7 +1013,13 @@ def run_capture_change(
     baseline: str | None,
     output_name: str,
 ) -> Path:
+    lifecycle = load_lifecycle(evidence_dir, required=True)
+    expected_baseline = lifecycle.get("baseline_commit")
     resolved_baseline = git_baseline(project_root, baseline)
+    if isinstance(expected_baseline, str) and resolved_baseline != expected_baseline:
+        raise RequestError(
+            "capture baseline does not match the baseline pinned during init"
+        )
     patch, status_entries = canonical_change_patch(project_root, resolved_baseline)
     patch_path = confined(evidence_dir, "source-change.patch")
     patch_path.parent.mkdir(parents=True, exist_ok=True)
@@ -978,18 +1037,23 @@ def run_capture_change(
 
 
 def run_init(project_root: Path, evidence_dir: Path, baseline: str | None, output_name: str) -> Path:
+    require_canonical_evidence_dir(project_root, evidence_dir)
+    align_protocol_state(project_root, protocol_run_key(project_root, baseline))
+    require_protocol_budget(project_root, package_initialization=True)
     if evidence_dir.exists() and any(evidence_dir.iterdir()):
         if (evidence_dir / "manifest.json").exists():
             raise RequestError("evidence package is finalized; initialize a new evidence directory")
         raise RequestError("evidence directory is not empty; initialize a new evidence directory")
     evidence_dir.mkdir(parents=True, exist_ok=True)
+    resolved_baseline = git_baseline(project_root, baseline)
+    update_protocol_state(project_root, event="package-initialized", increment="package_initializations")
     for directory in ("requests", "receipts", "raw", "generated-tests", "contracts", "runner"):
         (evidence_dir / directory).mkdir(parents=True, exist_ok=True)
     write_json_atomic(evidence_dir / "executions.json", [])
     write_json_atomic(evidence_dir / "lifecycle.json", {
         "lifecycle_format": "prizmkit-canonical-lifecycle-v1",
         "status": "initialized",
-        "baseline_commit": git_baseline(project_root, baseline),
+        "baseline_commit": resolved_baseline,
         "artifact_dir": None,
         "finalized": False,
         "immutable_identity": None,
@@ -998,12 +1062,147 @@ def run_init(project_root: Path, evidence_dir: Path, baseline: str | None, outpu
     write_json_atomic(output, {
         "command": "init",
         "evidence_dir": ".",
-        "baseline_commit": git_baseline(project_root, baseline),
+        "baseline_commit": resolved_baseline,
         "next": "capture-change",
     })
     return output
 
 
+def protocol_state_path(project_root: Path) -> Path:
+    return canonical_evidence_root(project_root) / PROTOCOL_STATE_NAME
+
+
+def align_protocol_state(project_root: Path, run_key: str) -> None:
+    state_path = protocol_state_path(project_root)
+    if state_path.exists():
+        state = ensure_object(load_json(state_path), "protocol recovery state")
+        if state.get("run_key") == run_key:
+            return
+    write_json_atomic(state_path, {"run_key": run_key})
+
+
+def update_protocol_state(
+    project_root: Path,
+    *,
+    event: str,
+    error: str | None = None,
+    increment: str | None = None,
+) -> dict[str, Any]:
+    state_path = protocol_state_path(project_root)
+    state: dict[str, Any] = {}
+    if state_path.exists():
+        state = ensure_object(load_json(state_path), "protocol recovery state")
+    if increment is not None:
+        count = state.get(increment, 0)
+        if not isinstance(count, int) or isinstance(count, bool):
+            count = 0
+        state[increment] = count + 1
+    state["last_event"] = event
+    state["last_error"] = error
+    state["max_package_initializations"] = MAX_PROTOCOL_PACKAGE_ATTEMPTS
+    state["max_preflight_failures"] = MAX_PROTOCOL_PACKAGE_ATTEMPTS
+    state["blocked"] = (
+        state.get("package_initializations", 0) >= MAX_PROTOCOL_PACKAGE_ATTEMPTS
+        or state.get("preflight_failures", 0) >= MAX_PROTOCOL_PACKAGE_ATTEMPTS
+    )
+    write_json_atomic(state_path, state)
+    return state
+
+
+def require_protocol_budget(project_root: Path, *, package_initialization: bool = False) -> None:
+    state_path = protocol_state_path(project_root)
+    if not state_path.exists():
+        return
+    state = ensure_object(load_json(state_path), "protocol recovery state")
+    if package_initialization and state.get("package_initializations", 0) >= MAX_PROTOCOL_PACKAGE_ATTEMPTS:
+        raise RequestError(
+            "evidence protocol package budget exhausted; stop and return TEST_BLOCKED "
+            "instead of creating another evidence package"
+        )
+    if state.get("preflight_failures", 0) >= MAX_PROTOCOL_PACKAGE_ATTEMPTS:
+        raise RequestError(
+            "evidence protocol preflight budget exhausted; return TEST_BLOCKED "
+            "instead of continuing semantic record repair"
+        )
+
+
+def protocol_run_key(project_root: Path, baseline: str | None) -> str:
+    resolved_baseline = git_baseline(project_root, baseline)
+    patch, _ = canonical_change_patch(project_root, resolved_baseline)
+    return canonical_sha256({
+        "baseline_commit": resolved_baseline,
+        "working_diff_sha256": hashlib.sha256(patch).hexdigest(),
+    })
+
+
+def semantic_record_paths(change_class: str) -> set[str]:
+    common = {"change-classification.json", "scope.json"}
+    if change_class == "behavior":
+        return common | {"behavior-risk-matrix.json", "infrastructure-changes.json"}
+    return common | {"lightweight-verification.json"}
+
+
+def require_semantic_record_files(evidence_dir: Path, change_class: str) -> None:
+    missing = sorted(
+        relative for relative in semantic_record_paths(change_class)
+        if not (evidence_dir / relative).is_file()
+    )
+    if missing:
+        raise RequestError(
+            "pre-finalize semantic records are incomplete: " + ", ".join(missing)
+            + "; keep this package mutable and repair it before finalize"
+        )
+
+
+def preflight_semantic_records(evidence_dir: Path, change_class: str) -> None:
+    require_semantic_record_files(evidence_dir, change_class)
+    validator_path = Path(__file__).resolve().with_name("validate_test_evidence.py")
+    try:
+        import importlib.util
+        spec = importlib.util.spec_from_file_location("prizmkit_test_validator_preflight", validator_path)
+        if spec is None or spec.loader is None:
+            raise RequestError("cannot load semantic preflight validator")
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        records_schema = module.load_schema("authoritative-records.schema.json")
+        matrix_schema = module.load_schema("behavior-risk-matrix.schema.json")
+        errors: list[str] = []
+        definitions = {
+            "change-classification.json": "changeClassification",
+            "scope.json": "scope",
+            "infrastructure-changes.json": "infrastructureChanges",
+            "lightweight-verification.json": "lightweightVerification",
+        }
+        for relative in sorted(semantic_record_paths(change_class)):
+            value = load_json(evidence_dir / relative)
+            if relative == "behavior-risk-matrix.json":
+                module.validate_schema(value, matrix_schema, matrix_schema, "behavior-risk-matrix", errors)
+            else:
+                module.validate_definition(value, definitions[relative], records_schema, relative, errors)
+        if errors:
+            raise RequestError("semantic preflight failed: " + "; ".join(errors[:20]))
+    except ImportError as exc:
+        raise RequestError(f"cannot run semantic preflight: {exc}") from exc
+
+
+def selected_layer_blockers(plan: dict[str, Any] | None, executions: list[Any]) -> list[str]:
+    if not isinstance(plan, dict):
+        return []
+    selected_layers = {
+        item.get("layer")
+        for item in executions
+        if isinstance(item, dict) and item.get("selected_execution") is True
+    }
+    blockers: list[str] = []
+    for layer in plan.get("layers", []):
+        if not isinstance(layer, dict) or layer.get("required") is not True:
+            continue
+        name = layer.get("name")
+        if name not in selected_layers:
+            blockers.append(f"required layer has no selected execution: {name}")
+    return blockers
+
+
 def load_lifecycle(evidence_dir: Path, *, required: bool = False) -> dict[str, Any]:
     path = evidence_dir / "lifecycle.json"
     if not path.exists():
@@ -1284,7 +1483,7 @@ def stage_output_owner(relative: str, change_class: str) -> str:
     return "EVIDENCE_PACKAGE"
 
 
-def build_manifest(evidence_dir: Path, *, evidence_id: str, identity: dict[str, Any], target_hashes: dict[str, str], change_class: str, baseline_commit: str, final_verdict: str) -> dict[str, Any]:
+def build_manifest(evidence_dir: Path, *, evidence_id: str, identity: dict[str, Any], target_hashes: dict[str, str], change_class: str, baseline_commit: str, final_verdict: str, attested: bool = False) -> dict[str, Any]:
     file_paths = sorted(
         path.relative_to(evidence_dir).as_posix()
         for path in evidence_dir.rglob("*")
@@ -1302,7 +1501,7 @@ def build_manifest(evidence_dir: Path, *, evidence_id: str, identity: dict[str,
         outputs = sorted(outputs_by_stage.get(stage, []))
         stages.append({
             "name": stage,
-            "status": "complete",
+            "status": "complete" if stage != "EVIDENCE_VALIDATE" or attested else "pending",
             "outputs": outputs,
             "not_applicable": None,
         })
@@ -1337,6 +1536,8 @@ def write_handoff_pointer(evidence_dir: Path, artifact_dir: str | None, project_
 
 
 def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any], output_name: str) -> Path:
+    require_canonical_evidence_dir(project_root, evidence_dir)
+    require_protocol_budget(project_root)
     allowed = {"request_version", "change_class", "baseline_commit", "scope_path", "environment_path", "artifact_dir", "blockers", "repair_scope"}
     if set(request) - allowed:
         raise RequestError(f"finalize request contains unsupported fields: {sorted(set(request) - allowed)}")
@@ -1351,13 +1552,32 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
     if not capture_path.exists():
         run_capture_change(project_root, evidence_dir, request.get("baseline_commit"), "change-capture.json")
     capture = load_change_capture(project_root, evidence_dir, require_fresh=True)
+    lifecycle_baseline = lifecycle.get("baseline_commit")
     baseline = capture.get("baseline_commit")
+    if not isinstance(lifecycle_baseline, str) or baseline != lifecycle_baseline:
+        raise RequestError("canonical change capture baseline does not match init baseline")
     patch_path = evidence_dir / "source-change.patch"
     if not isinstance(baseline, str) or not patch_path.is_file():
         raise RequestError("canonical change capture is incomplete")
     change_class = request.get("change_class", "behavior")
     if change_class not in {"behavior", "lightweight"}:
         raise RequestError("change_class must be behavior or lightweight")
+    try:
+        require_semantic_record_files(evidence_dir, change_class)
+    except RequestError as exc:
+        state = update_protocol_state(
+            project_root,
+            event="preflight-failed",
+            error=str(exc),
+            increment="preflight_failures",
+        )
+        if state.get("blocked"):
+            raise RequestError(
+                str(exc) + "; evidence protocol recovery budget exhausted; return TEST_BLOCKED "
+                "and do not initialize another package"
+            ) from exc
+        raise
+
     artifact_dir = request.get("artifact_dir")
     if artifact_dir is not None and not isinstance(artifact_dir, str):
         raise RequestError("artifact_dir must be a project-relative directory")
@@ -1385,14 +1605,31 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         write_json_atomic(evidence_dir / "test-plan.json", plan)
     scope["target_hashes"] = target_hashes
     write_json_atomic(evidence_dir / scope_relative, scope)
+    try:
+        preflight_semantic_records(evidence_dir, change_class)
+    except RequestError as exc:
+        state = update_protocol_state(
+            project_root,
+            event="preflight-failed",
+            error=str(exc),
+            increment="preflight_failures",
+        )
+        if state.get("blocked"):
+            raise RequestError(
+                str(exc) + "; evidence protocol recovery budget exhausted; return TEST_BLOCKED "
+                "and do not initialize another package"
+            ) from exc
+        raise
     identity = {
         "baseline_commit": baseline,
         "working_diff_sha256": file_sha256(patch_path),
         "scope_sha256": canonical_sha256(scope),
     }
     evidence_id = canonical_sha256(identity)
+    destination = evidence_dir.parent / evidence_id
     executions = load_json(evidence_dir / "executions.json") if (evidence_dir / "executions.json").exists() else []
     blockers = list(request.get("blockers", [])) if isinstance(request.get("blockers", []), list) else []
+    blockers.extend(selected_layer_blockers(plan, executions if isinstance(executions, list) else []))
     required_records = {
         "change-classification.json", "scope.json", "target-inventory.json", "environment.json",
         "source-change.patch",
@@ -1409,8 +1646,17 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         if not (evidence_dir / relative).is_file()
     )
     if missing_records:
-        blockers.append(
-            "required evidence records are missing: " + ", ".join(missing_records)
+        state = update_protocol_state(
+            project_root,
+            event="finalize-precondition-failed",
+            error="required evidence records are missing: " + ", ".join(missing_records),
+            increment="preflight_failures",
+        )
+        suffix = ""
+        if state.get("blocked"):
+            suffix = "; evidence protocol recovery budget exhausted; return TEST_BLOCKED"
+        raise RequestError(
+            "pre-finalize package records are incomplete: " + ", ".join(missing_records) + suffix
         )
     selected_unreliable = [
         item for item in executions
@@ -1462,23 +1708,26 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         evidence_dir, evidence_id=evidence_id, identity=identity,
         target_hashes=target_hashes, change_class=change_class,
         baseline_commit=baseline, final_verdict=verdict,
+        attested=False,
     )
     write_json_atomic(evidence_dir / "manifest.json", manifest)
     run_render_report(evidence_dir, "test-report.md")
     write_json_atomic(evidence_dir / "lifecycle.json", {
         **lifecycle,
-        "status": "finalized",
-        "finalized": True,
+        "status": "payload-finalized",
+        "finalized": False,
         "immutable_identity": identity,
     })
     output = confined(evidence_dir, output_name)
+    final_evidence_relative = destination.relative_to(project_root).as_posix()
     write_json_atomic(output, {
         "command": "finalize",
         "evidence_id": evidence_id,
-        "manifest_path": "manifest.json",
-        "verdict_path": "verdict.json",
-        "report_path": "test-report.md",
-        "validation_path": "validation.json",
+        "evidence_dir": final_evidence_relative,
+        "manifest_path": f"{final_evidence_relative}/manifest.json",
+        "verdict_path": f"{final_evidence_relative}/verdict.json",
+        "report_path": f"{final_evidence_relative}/test-report.md",
+        "validation_path": f"{final_evidence_relative}/validation.json",
         "next": "validate_test_evidence.py --attest",
     })
     # Second manifest: re-hashes after render-report produces test-report.md.
@@ -1486,9 +1735,9 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         evidence_dir, evidence_id=evidence_id, identity=identity,
         target_hashes=target_hashes, change_class=change_class,
         baseline_commit=baseline, final_verdict=verdict,
+        attested=False,
     )
     write_json_atomic(evidence_dir / "manifest.json", manifest)
-    destination = evidence_dir.parent / evidence_id
     if destination != evidence_dir:
         if destination.exists():
             try:
@@ -1502,8 +1751,14 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
                 f"evidence identity already exists at {destination}; re-init a new package"
             )
         os.replace(evidence_dir, destination)
-    write_handoff_pointer(destination, lifecycle.get("artifact_dir"), project_root)
-    return destination / output_name
+    final_evidence_dir = destination if destination != evidence_dir else evidence_dir
+    write_handoff_pointer(final_evidence_dir, lifecycle.get("artifact_dir"), project_root)
+    update_protocol_state(
+        project_root,
+        event="finalized",
+        error="; ".join(verdict_record.get("blockers", [])) if verdict == "TEST_BLOCKED" else None,
+    )
+    return final_evidence_dir / output_name
 
 
 def run_resume(
@@ -1619,10 +1874,7 @@ def main() -> int:
     try:
         if not project_root.is_dir():
             raise RequestError(f"project root does not exist: {project_root}")
-        try:
-            evidence_dir.relative_to(project_root)
-        except ValueError:
-            raise RequestError(f"evidence directory must be under project root: {evidence_dir}")
+        require_canonical_evidence_dir(project_root, evidence_dir)
         if args.subcommand == "init":
             output = run_init(project_root, evidence_dir, args.baseline, args.output)
             print(f"Evidence initialized: {output}")

package/bundled/skills/prizmkit-test/scripts/validate_test_evidence.py

@@ -39,6 +39,7 @@ LAYER_ORDER = {
     "regression-ring": 4,
 }
 FINAL_RECORDS = {"validation.json", "verdict.json", "test-report.md"}
+ATTESTATION_EXCLUDED_RECORDS = FINAL_RECORDS | {"lifecycle.json"}
 ATTESTATION_MUTABLE = {"validation.json"}
 COMMON_RECORDS = {
     "change-classification.json", "scope.json", "target-inventory.json",
@@ -646,8 +647,12 @@ def validate_manifest(
         if status == "not_applicable":
             structured_na(na, records_schema, f"stage {name} not_applicable", errors)
             require(outputs == [], f"not-applicable stage must not claim outputs: {name}", errors)
+        elif status == "pending":
+            require(na is None, f"pending stage must have null not_applicable: {name}", errors)
         elif status == "complete":
             require(na is None, f"complete stage must have null not_applicable: {name}", errors)
+        else:
+            require(False, f"stage has unknown status: {name}", errors)
         for output in outputs if isinstance(outputs, list) else []:
             entry = entry_map.get(output)
             require(entry is not None, f"stage output is not a hashed evidence file: {name}/{output}", errors)
@@ -961,6 +966,16 @@ def validate_requests_and_receipts(
         if isinstance(request, dict):
             for key in ("purpose", "command", "cwd", "layer", "test_ids", "external_targets"):
                 require(receipt.get(key) == request.get(key), f"{location}: receipt {key} does not match request", errors)
+            requested_timeout = request.get("timeout_seconds")
+            require(
+                isinstance(receipt.get("timeout_seconds"), (int, float))
+                and not isinstance(receipt.get("timeout_seconds"), bool)
+                and receipt["timeout_seconds"] > 0,
+                f"{location}: receipt lacks a bounded execution timeout",
+                errors,
+            )
+            if requested_timeout is not None:
+                require(receipt.get("timeout_seconds") == requested_timeout, f"{location}: receipt timeout does not match request", errors)
             expected_environment = request.get("environment")
             actual_environment = receipt.get("environment")
             require(isinstance(actual_environment, dict) and isinstance(actual_environment.get("PATH"), str), f"{location}: receipt lacks complete PATH environment", errors)
@@ -1179,9 +1194,32 @@ def validate_plan_and_scope_bindings(
     records_schema: dict[str, Any],
     errors: list[str],
 ) -> dict[str, dict[str, Any]]:
-    require(scope.get("affected_module") == matrix.get("affected_module", {}).get("name"), "matrix affected module does not match scope", errors)
-    require(scope.get("boundary_source") == matrix.get("affected_module", {}).get("boundary_source"), "matrix boundary source does not match scope", errors)
-    require(scope.get("primary_scope") == matrix.get("primary_scope"), "matrix primary scope does not match scope", errors)
+    if not isinstance(scope, dict):
+        errors.append("scope must be an object")
+    if not isinstance(matrix, dict):
+        errors.append("behavior-risk-matrix must be an object")
+    scope_module = scope.get("affected_module") if isinstance(scope, dict) else None
+    matrix_module = matrix.get("affected_module") if isinstance(matrix, dict) else None
+    matrix_module_name = matrix_module.get("name") if isinstance(matrix_module, dict) else None
+    matrix_boundary_source = matrix_module.get("boundary_source") if isinstance(matrix_module, dict) else None
+    require(
+        isinstance(scope_module, str) and scope_module == matrix_module_name,
+        "matrix affected module does not match scope",
+        errors,
+    )
+    require(
+        isinstance(scope.get("boundary_source") if isinstance(scope, dict) else None, str)
+        and scope.get("boundary_source") == matrix_boundary_source,
+        "matrix boundary source does not match scope",
+        errors,
+    )
+    require(
+        scope.get("primary_scope") == matrix.get("primary_scope") if isinstance(scope, dict) and isinstance(matrix, dict) else False,
+        "matrix primary scope does not match scope",
+        errors,
+    )
+    if not isinstance(scope, dict) or not isinstance(matrix, dict) or not isinstance(matrix_module, dict):
+        return {}
     scope_ring = sorted((item.get("name"), item.get("kind")) for item in scope.get("regression_ring", []) if isinstance(item, dict))
     matrix_ring = sorted((item.get("name"), item.get("kind")) for item in matrix.get("regression_ring", []) if isinstance(item, dict))
     require(scope_ring == matrix_ring, "scope and matrix regression rings do not agree", errors)
@@ -1484,10 +1522,33 @@ def validate_verdict_and_attestation(
             errors,
         )
 
+    if not verify_attestation:
+        lifecycle = load_json(root / "lifecycle.json") if (root / "lifecycle.json").is_file() else {}
+        if (root / "lifecycle.json").is_file():
+            require(
+                lifecycle.get("status") == "payload-finalized" and lifecycle.get("finalized") is False,
+                "pre-attestation validation requires a payload-finalized mutable package",
+                errors,
+            )
+            require(
+                not validation,
+                "pre-attestation package must not contain validator-owned validation data",
+                errors,
+            )
+
     if verify_attestation:
         validate_definition(validation, "validation", records_schema, "validation", errors)
+        lifecycle = load_json(root / "lifecycle.json") if (root / "lifecycle.json").is_file() else {}
+        if (root / "lifecycle.json").is_file():
+            require(
+                lifecycle.get("status") in {"payload-finalized", "sealed"},
+                "attested package has an invalid lifecycle state",
+                errors,
+            )
+            if lifecycle.get("status") == "sealed":
+                require(lifecycle.get("finalized") is True, "sealed package must be finalized", errors)
         payload = sorted(
-            ({"path": path, "sha256": entry["sha256"]} for path, entry in entry_map.items() if path not in FINAL_RECORDS),
+            ({"path": path, "sha256": entry["sha256"]} for path, entry in entry_map.items() if path not in ATTESTATION_EXCLUDED_RECORDS),
             key=lambda item: item["path"],
         )
         replayed_ids = [
@@ -1609,17 +1670,21 @@ def validate_evidence(
             errors.append(str(exc))
             matrix = infrastructure = None
         if all(isinstance(item, dict) for item in (matrix, infrastructure, plan)):
+            matrix_error_count = len(errors)
             validate_schema(matrix, matrix_schema, matrix_schema, "behavior-risk-matrix", errors)
             validate_definition(infrastructure, "infrastructureChanges", records_schema, "infrastructure-changes", errors)
-            stages = {item.get("name"): item for item in manifest.get("stages", []) if isinstance(item, dict)}
-            for stage_name in CORE_BEHAVIOR_STAGES:
-                require(stages.get(stage_name, {}).get("status") == "complete", f"behavior protocol stage cannot be N/A: {stage_name}", errors)
-            test_map = validate_plan_and_scope_bindings(
-                root, project_root, manifest, scope, matrix, plan, inventory_by_category, entry_map,
-                executions, records_schema, errors,
-            )
-            validate_matrix_risks(manifest, matrix, test_map, executions, records_schema, errors)
-            validate_infrastructure(manifest, infrastructure, executions, entry_map, root, errors)
+            if len(errors) > matrix_error_count:
+                errors.append("behavior semantic cross-link validation skipped because behavior-risk-matrix schema validation failed")
+            else:
+                stages = {item.get("name"): item for item in manifest.get("stages", []) if isinstance(item, dict)}
+                for stage_name in CORE_BEHAVIOR_STAGES:
+                    require(stages.get(stage_name, {}).get("status") == "complete", f"behavior protocol stage cannot be N/A: {stage_name}", errors)
+                test_map = validate_plan_and_scope_bindings(
+                    root, project_root, manifest, scope, matrix, plan, inventory_by_category, entry_map,
+                    executions, records_schema, errors,
+                )
+                validate_matrix_risks(manifest, matrix, test_map, executions, records_schema, errors)
+                validate_infrastructure(manifest, infrastructure, executions, entry_map, root, errors)
         else:
             errors.append("behavior evidence records must be JSON objects")
     elif change_class == "lightweight":
@@ -1722,6 +1787,16 @@ def main() -> int:
     manifest = load_json(root / "manifest.json")
     verdict_record = load_json(root / "verdict.json")
     if args.attest:
+        lifecycle_path = root / "lifecycle.json"
+        lifecycle = load_json(lifecycle_path) if lifecycle_path.is_file() else {}
+        if lifecycle_path.is_file() and (lifecycle.get("status") != "payload-finalized" or lifecycle.get("finalized") is not False):
+            print("Test evidence validation: FAIL\n- attestation requires a payload-finalized mutable package")
+            return 1
+        manifest = load_json(root / "manifest.json")
+        for stage in manifest.get("stages", []):
+            if isinstance(stage, dict) and stage.get("name") == "EVIDENCE_VALIDATE":
+                stage["status"] = "complete"
+        atomic_write_json(root / "manifest.json", manifest)
         executions = load_json(root / "executions.json")
         replayed_ids = [
             item.get("execution_id") for item in executions
@@ -1732,7 +1807,7 @@ def main() -> int:
         payload = sorted(
             (
                 {"path": entry["path"], "sha256": entry["sha256"]}
-                for entry in manifest["files"] if entry["path"] not in FINAL_RECORDS
+                for entry in manifest["files"] if entry["path"] not in ATTESTATION_EXCLUDED_RECORDS
             ),
             key=lambda item: item["path"],
         )
@@ -1755,10 +1830,16 @@ def main() -> int:
             for error in errors:
                 print(f"- {error}")
             return 1
-
-    print("Test evidence validation: PASS")
+        if lifecycle_path.is_file():
+            atomic_write_json(root / "lifecycle.json", {
+                **lifecycle,
+                "status": "sealed",
+                "finalized": True,
+            })
+
+    print("Evidence validation: PASS")
+    print(f"Testing verdict: {manifest['final_verdict']}")
     print(f"Evidence ID: {manifest['evidence_id']}")
-    print(f"Verdict: {manifest['final_verdict']}")
     return 0
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prizmkit",
-  "version": "1.1.138",
+  "version": "1.1.140",
   "description": "Create a new PrizmKit-powered project with clean initialization — no framework dev files, just what you need.",
   "type": "module",
   "bin": {