prizmkit 1.1.139 → 1.1.140

package/bundled/VERSION.json

@@ -1,5 +1,5 @@
 {
-  "frameworkVersion": "1.1.139",
-  "bundledAt": "2026-07-20T10:59:24.300Z",
-  "bundledFrom": "a055a29"
+  "frameworkVersion": "1.1.140",
+  "bundledAt": "2026-07-20T13:39:17.949Z",
+  "bundledFrom": "9a25298"
 }

package/bundled/dev-pipeline/prizmkit_runtime/checkpoint_state.py

@@ -668,10 +668,10 @@ def _evidence_validator_passes(
 
 def _resolve_evidence_validator(project_root: Path) -> Path | None:
     candidates = (
+        project_root / "core" / "skills" / "prizmkit-skill" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
         project_root / ".claude" / "command-assets" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
         project_root / ".agents" / "skills" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
         project_root / ".codebuddy" / "skills" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
-        project_root / "core" / "skills" / "prizmkit-skill" / "prizmkit-test" / "scripts" / "validate_test_evidence.py",
     )
     return next((path for path in candidates if path.is_file()), None)
 

package/bundled/dev-pipeline/scripts/update-checkpoint.py

@@ -237,16 +237,43 @@ def _discover_test_evidence_paths(checkpoint_path, data):
         except (OSError, ValueError):
             continue
         evidence_dir = report.parent
+        evidence_root = (project_root / ".prizmkit" / "test" / "evidence").resolve()
+        try:
+            relative_evidence = evidence_dir.resolve().relative_to(evidence_root)
+        except (OSError, ValueError):
+            continue
+        if len(relative_evidence.parts) != 1:
+            continue
         paths = {
-            "manifest": str(evidence_dir / "manifest.json"),
-            "verdict": str(evidence_dir / "verdict.json"),
-            "validation": str(evidence_dir / "validation.json"),
+            "manifest": evidence_dir / "manifest.json",
+            "verdict": evidence_dir / "verdict.json",
+            "validation": evidence_dir / "validation.json",
         }
-        if all(Path(value).is_file() for value in paths.values()):
+        if not all(path.is_file() for path in paths.values()):
+            continue
+        try:
+            manifest = json.loads(paths["manifest"].read_text(encoding="utf-8"))
+            verdict = json.loads(paths["verdict"].read_text(encoding="utf-8"))
+            validation = json.loads(paths["validation"].read_text(encoding="utf-8"))
+        except (OSError, UnicodeDecodeError, json.JSONDecodeError):
+            continue
+        if not all(isinstance(record, dict) for record in (manifest, verdict, validation)):
+            continue
+        if (
+            manifest.get("evidence_id") != evidence_dir.name
+            or manifest.get("final_verdict") != "TEST_BLOCKED"
+            or verdict.get("verdict") != "TEST_BLOCKED"
+            or validation.get("result") != "passed"
+            or validation.get("verdict") != "TEST_BLOCKED"
+        ):
+            continue
+        try:
             return {
-                key: str(Path(value).relative_to(project_root))
-                for key, value in paths.items()
+                key: str(path.resolve().relative_to(project_root.resolve()))
+                for key, path in paths.items()
             }
+        except (OSError, ValueError):
+            continue
     return None
 
 
@@ -323,10 +350,7 @@ def update_checkpoint(
             return {"ok": False, "error": verdict_error}
 
     semantic_update = _normalize_semantic_update(semantic_update)
-    if (
-        semantic_update.get("stage_result") == "TEST_BLOCKED"
-        and not semantic_update.get("authoritative_evidence_paths")
-    ):
+    if semantic_update.get("stage_result") == "TEST_BLOCKED" and not semantic_update.get("authoritative_evidence_paths"):
         discovered = _discover_test_evidence_paths(checkpoint_path, data)
         if discovered:
             semantic_update["authoritative_evidence_paths"] = discovered
@@ -337,7 +361,9 @@ def update_checkpoint(
     stage_result = semantic_update.get("stage_result")
     if step.get("skill") == "prizmkit-test" and stage_result in TEST_RESULTS:
         evidence = semantic_update.get("authoritative_evidence_paths") or step.get("authoritative_evidence_paths")
-        if not isinstance(evidence, dict) or set(evidence) != {"manifest", "verdict", "validation"}:
+        if stage_result != "TEST_BLOCKED" and (
+            not isinstance(evidence, dict) or set(evidence) != {"manifest", "verdict", "validation"}
+        ):
             return {
                 "ok": False,
                 "error": "Every terminal test verdict requires manifest, verdict, and validation evidence paths",

package/bundled/dev-pipeline/tests/test_checkpoint_state.py

@@ -445,8 +445,22 @@ def test_blocked_test_handoff_discovers_finalized_evidence_paths(tmp_path):
     artifact.mkdir(parents=True)
     evidence = tmp_path / ".prizmkit" / "test" / "evidence" / "evidence-1"
     evidence.mkdir(parents=True)
-    for name in ("manifest.json", "verdict.json", "validation.json"):
-        (evidence / name).write_text("{}", encoding="utf-8")
+    (evidence / "manifest.json").write_text(
+        json.dumps({"evidence_id": "evidence-1", "final_verdict": "TEST_BLOCKED"}),
+        encoding="utf-8",
+    )
+    (evidence / "verdict.json").write_text(
+        json.dumps({"verdict": "TEST_BLOCKED"}),
+        encoding="utf-8",
+    )
+    (evidence / "validation.json").write_text(
+        json.dumps({"result": "passed", "verdict": "TEST_BLOCKED"}),
+        encoding="utf-8",
+    )
+    (evidence / "lifecycle.json").write_text(
+        json.dumps({"status": "sealed", "finalized": True}),
+        encoding="utf-8",
+    )
     report = evidence / "test-report.md"
     report.write_text("blocked", encoding="utf-8")
     (artifact / "test-report-path.txt").write_text(str(report), encoding="utf-8")
@@ -487,6 +501,45 @@ def test_blocked_test_handoff_discovers_finalized_evidence_paths(tmp_path):
 
 
 
+def test_blocked_test_handoff_without_finalized_evidence_preserves_test_result(tmp_path):
+    artifact = tmp_path / ".prizmkit" / "specs" / "feature"
+    artifact.mkdir(parents=True)
+    payload = _family_checkpoint(
+        "feature-pipeline",
+        [
+            "prizmkit-implement", "prizmkit-code-review", "prizmkit-test",
+            "prizmkit-retrospective", "prizmkit-committer", "completion-summary",
+        ],
+        semantic={"artifact_dir": ".prizmkit/specs/feature"},
+    )
+    payload["feature_state"]["artifact_dir"] = ".prizmkit/specs/feature"
+    payload["steps"][1]["stage_result"] = "REVIEW_PASS"
+    payload["steps"][2]["status"] = "in_progress"
+    payload["steps"][2].pop("stage_result")
+    for step in payload["steps"][3:]:
+        step["status"] = "pending"
+        step.pop("stage_result", None)
+    checkpoint = _write(artifact / "workflow-checkpoint.json", payload)
+
+    result = update_checkpoint(
+        str(checkpoint),
+        "prizmkit-test",
+        "failed",
+        semantic_update={
+            "stage_result": "TEST_BLOCKED",
+            "blocked_reason": "test_blocked",
+            "terminal_status": "WORKFLOW_BLOCKED",
+        },
+    )
+
+    persisted = json.loads(checkpoint.read_text(encoding="utf-8"))
+    assert result["ok"] is True
+    assert result["semantic"]["stage_result"] == "TEST_BLOCKED"
+    assert persisted["steps"][2]["stage_result"] == "TEST_BLOCKED"
+    assert persisted["feature_state"]["stage_result"] == "TEST_BLOCKED"
+    assert "authoritative_evidence_paths" not in persisted["steps"][2]
+
+
 def test_update_checkpoint_rejects_test_pass_when_validator_replay_fails(tmp_path, monkeypatch):
     paths = _write_test_evidence(tmp_path)
     payload = _family_checkpoint(

package/bundled/skills/_metadata.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.139",
+  "version": "1.1.140",
   "skills": {
     "prizmkit": {
       "description": "Framework introduction and navigation for the formal single-requirement lifecycle, project initialization, Prizm docs, and independent deployment.",

package/bundled/skills/prizmkit-test/SKILL.md

@@ -20,18 +20,18 @@ Fix only the protocol mechanisms needed for safe, replayable evidence: project/e
 The Main Agent supplies semantic requests only; it does not author authoritative package records. Initialize and drive one evidence directory through the builder in this order:
 
 ```text
-init → capture-change → inventory → prepare-tests → execute → finalize → render-report → validate --attest → resume
+init → capture-change → inventory → prepare-tests → execute → finalize → validate --attest → resume
 ```
 
 Use `${SKILL_DIR}/scripts/build_test_evidence.py` for every lifecycle command:
 
-- `init`: creates the package directories and immutable baseline identity.
+- `init`: creates the package directories and pins the baseline identity.
 - `capture-change`: captures the complete canonical change, including untracked, deleted, renamed, and copied files; never substitute plain `git diff`. `inventory` then requires its changed-file set to match the capture exactly and rejects stale captures or unaccounted live paths.
 - `inventory`: hashes current source/tests/contracts/lockfiles, rejects category overlap, excludes runtime-only paths, and validates directory roots plus the complete capture-derived changed-file set.
 - `prepare-tests`: discovers repository-native test files from the canonical capture and inventory, generates stable builder-owned test IDs, derives existing/added/modified status, and snapshots only added/modified live test sources.
 - `execute`: runs native project commands and owns `executions.json`, `receipts/`, and `raw/`. Each request uses exactly one binding mode: `test_ids`, `test_paths`, or `auto_bind=true`. The builder infers recognized package-wide or explicit file/directory/glob command scope, blocks opaque commands or mismatched declarations, and persists verified canonical `test_ids` only.
-- `finalize`: runs the pre-finalize semantic-record and required-layer checks, rechecks canonical capture freshness, blocks every selected unreliable execution, and owns manifest, stage hashes, verdict, generated-test snapshots, and evidence identity. If semantic records are incomplete or malformed, finalize fails before creating an immutable package; do not hand-edit a finalized package or start another package after a protocol budget is exhausted.
-- `render-report`: derives `test-report.md`; it is never authoritative.
+- `finalize`: derives builder-owned target hashes, runs semantic-record and required-layer checks, rechecks canonical capture freshness, blocks every selected unreliable execution, and owns the payload manifest, verdict, generated-test snapshots, and evidence identity. It leaves the package in a mutable `payload-finalized` state until validator attestation; malformed semantic records fail before package relocation.
+- `render-report`: recovery/debugging command that derives `test-report.md`; normal finalization and attestation render it automatically, and it is never authoritative.
 - `resume`: preserves prior receipts and refuses to rebind an identity-changing package; create a new package after scope/source identity changes.
 
 `test-plan.json` is the only source of builder-generated test IDs. An execution request provides exactly one of native `test_paths`, `auto_bind=true`, or canonical `test_ids`; the actual command must expose the same deterministic scope, including all prepared tests for recognized package-wide commands. The builder blocks opaque or mismatched command scope and rewrites verified requests to canonical `test_ids` only before execution. Assess all five layers explicitly, but set `required=true` only when risk requires it; every omitted layer needs structured N/A evidence. The same binding applies test ↔ behavior ↔ execution; current-workspace receipts are the execution evidence.
@@ -217,9 +217,11 @@ python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
   --project-root <target-project-root>
 ```
 
-If this pre-check finds errors, fix them only while the package remains mutable and before `finalize` relocates it to its content-addressed immutable directory. Never edit `manifest.json`, `verdict.json`, `validation.json`, or any semantic record after finalization. The validator checks every authoritative record against its shipped schema, live target inventories, patch/diff binding, changed-file/module-root/exclusion/Regression Ring cross-links, generated-test snapshots, planned-test execution links, runner-generated receipts/request/raw-output hashes, successful behavior-risk mappings, production/unknown external-target safety, and package integrity.
+The first pass validates the payload while the package remains `payload-finalized`; `validation.json` is intentionally empty until attestation. Builder-derived target hashes and lifecycle records are generated before this check. If this pass finds semantic errors, repair the mutable staging package and rerun finalize; never repair a sealed package.
 
-**Second pass (attestation, with `--attest`):**
+The validator checks every authoritative record against its shipped schema, live target inventories, patch/diff binding, changed-file/module-root/exclusion/Regression Ring cross-links, generated-test snapshots, planned-test execution links, runner-generated receipts/request/raw-output hashes, successful behavior-risk mappings, production/unknown external-target safety, and package integrity.
+
+### Second pass (attestation)
 
 ```bash
 python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
@@ -228,7 +230,7 @@ python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
   --attest
 ```
 
-`--attest` writes an integrity/protocol attestation into `validation.json`, re-derives `test-report.md`, re-hashes final records in `manifest.json`, then runs a **second** strict validation against the refreshed package. A package is not a `TEST_PASS` until this second strict validation succeeds. Use builder replay when feasible to rerun recorded requests and create new linked receipts. Store validation output. Tampering, schema/identity/hash mismatch, source/test/lockfile drift, missing matrix mappings, wrong execution order, unjustified structured N/A, unresolved risk, or a false real-environment claim fails validation.
+`--attest` writes an integrity/protocol attestation into `validation.json`, marks `EVIDENCE_VALIDATE` complete, re-derives `test-report.md`, re-hashes final records in `manifest.json`, seals the package, and then runs a **second** strict validation against the refreshed package. A package is not a `TEST_PASS` until this second strict validation succeeds. Use builder replay when feasible to rerun recorded requests and create new linked receipts. Store validation output. Tampering, schema/identity/hash mismatch, source/test/lockfile drift, missing matrix mappings, wrong execution order, unjustified structured N/A, unresolved risk, or a false real-environment claim fails validation.
 
 ## Resume and Idempotency
 

package/bundled/skills/prizmkit-test/assets/authoritative-records.schema.json

@@ -362,7 +362,7 @@
     "executionReceipt": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["receipt_format", "runner_path", "runner_sha256", "execution_id", "attempt_index", "request_path", "request_sha256", "purpose", "command", "cwd", "environment", "tool_versions", "layer", "test_ids", "external_targets", "exit_code", "stdout_path", "stderr_path", "stdout_sha256", "stderr_sha256", "selected_execution", "reliable", "started_at", "finished_at"],
+      "required": ["receipt_format", "runner_path", "runner_sha256", "execution_id", "attempt_index", "request_path", "request_sha256", "purpose", "command", "cwd", "environment", "tool_versions", "layer", "test_ids", "external_targets", "timeout_seconds", "exit_code", "stdout_path", "stderr_path", "stdout_sha256", "stderr_sha256", "selected_execution", "reliable", "started_at", "finished_at"],
       "properties": {
         "receipt_format": { "const": "prizmkit-runner-generated-v1" },
         "runner_path": { "$ref": "#/$defs/path" },
@@ -381,6 +381,7 @@
         "test_paths": { "type": "array", "items": { "$ref": "#/$defs/path" } },
         "auto_bind": { "type": "boolean" },
         "external_targets": { "type": "array", "items": { "$ref": "#/$defs/externalTarget" } },
+        "timeout_seconds": { "type": "number", "exclusiveMinimum": 0 },
         "exit_code": { "type": "integer" },
         "stdout_path": { "$ref": "#/$defs/path" },
         "stderr_path": { "$ref": "#/$defs/path" },

package/bundled/skills/prizmkit-test/assets/evidence-manifest.schema.json

@@ -82,7 +82,7 @@
             "EVIDENCE_VALIDATE"
           ]
         },
-        "status": { "enum": ["complete", "not_applicable"] },
+        "status": { "enum": ["complete", "pending", "not_applicable"] },
         "outputs": { "type": "array", "items": { "type": "string", "minLength": 1 } },
         "not_applicable": {
           "type": ["object", "null"],

package/bundled/skills/prizmkit-test/references/evidence-protocol.md

@@ -24,12 +24,12 @@ Hashes and validator receipts provide byte-level binding and drift detection, no
 
 ## Bounded Protocol Recovery
 
-Evidence-protocol repair is separate from production/test repair. The builder permits only a bounded recovery budget for semantic-record preflight and package initialization. After the budget is exhausted, return `TEST_BLOCKED`; do not create another versioned evidence package, copy requests from a finalized package, or hand-edit `manifest.json`, `verdict.json`, `validation.json`, receipts, hashes, or evidence IDs. A finalized package is immutable. `Evidence validation: PASS` means only that the package is structurally valid; the testing verdict must be read separately from `Testing verdict: TEST_PASS | TEST_FAIL | TEST_BLOCKED`.
+Evidence-protocol repair is separate from production/test repair. The builder permits only a bounded recovery budget for semantic-record preflight and package initialization. After the budget is exhausted, return `TEST_BLOCKED`; do not create another versioned evidence package or hand-edit authoritative records. A payload-finalized package remains mutable only until validator attestation; after attestation it is sealed and immutable. `Evidence validation: PASS` means only that the package is structurally valid; the testing verdict must be read separately from `Testing verdict: TEST_PASS | TEST_FAIL | TEST_BLOCKED`.
 
 
 The evidence package is an audit of repository behavior, not a request to invent a parallel test suite. Discover and execute the smallest relevant native tests before adding anything. Add, modify, or delete tests only in the target repository. The builder's `prepare-tests` command derives stable test IDs and change status from canonical Git capture, and snapshots only added or modified repository-native tests. `generated-tests/` is an evidence archive, never an execution workspace; it may be empty when existing tests cover the behavior.
 
-The canonical package lifecycle is `init → capture-change → inventory → prepare-tests → execute → finalize → render-report → validate --attest → resume`. Builder commands own `source-change.patch`, native test preparation, receipts, raw outputs, manifest, verdict, and report. The validator alone owns `validation.json`. Inventory must consume a fresh capture and exactly preserve its complete changed-file set. Canonical behavior packages require a schema-valid `test-preparation.json` bound byte-for-byte to the builder-generated `test-plan.json` and its hashed semantic request. Evidence identity is derived from the resolved baseline, canonical patch hash, and scope hash; identity-changing resume creates a new package instead of rewriting the old directory.
+The canonical package lifecycle is `init → capture-change → inventory → prepare-tests → execute → finalize → validate --attest → resume`. Builder commands own `source-change.patch`, native test preparation, receipts, raw outputs, manifest, verdict, and initial report. The validator alone owns `validation.json` and refreshes the report during attestation. Inventory must consume a fresh capture and exactly preserve its complete changed-file set. Canonical behavior packages require a schema-valid `test-preparation.json` bound byte-for-byte to the builder-generated `test-plan.json` and its hashed semantic request. Evidence identity is derived from the resolved baseline, canonical patch hash, and scope hash; identity-changing resume creates a new package instead of rewriting the old directory.
 
 
 Run exactly these states in order:
@@ -167,12 +167,12 @@ python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
   --attest
 ```
 
-`--attest` first validates the immutable payload while excluding only the final attestation/view records, atomically writes `validation.json`, refreshes final file hashes, then immediately performs a complete second validation. Subsequent checks omit `--attest` and verify the stored attestation. This avoids trusting a caller-authored `passed` marker or creating a self-referential manifest. The attestation proves package integrity and protocol consistency only; it is not proof against a same-permission producer.
-
-When feasible, replay recorded requests through `build_test_evidence.py execute --replay-receipt ...`. Replay performs a new real execution and emits a new linked receipt; it does not pretend the attestation establishes what historically ran.
+`--attest` first validates the mutable `payload-finalized` package while excluding only validator-owned attestation/view records, atomically writes `validation.json`, marks validation complete, refreshes final file hashes, seals the lifecycle, then immediately performs a complete second validation. Subsequent checks omit `--attest` and verify the stored attestation. This avoids trusting a caller-authored `passed` marker or creating a self-referential manifest. The attestation proves package integrity and protocol consistency only; it is not proof against a same-permission producer.
 
 The validator checks all shipped JSON schemas, evidence-directory identity, live target-project inventories and aggregate hashes, changed-file/module-root/exclusion/Regression Ring cross-links, patch/diff binding, stage ordering and output ownership, generated-test snapshot existence, planned test/inventory/execution linkage, module/matrix completeness, successful selected runner receipts with request/raw-output binding, structured N/A and obvious signal conflicts, production/unknown external-target safety, strict verdict semantics, and honest mocked-versus-real claims. `TEST_PASS` requires deterministic validator success.
 
+When feasible, replay recorded requests through `build_test_evidence.py execute --replay-receipt ...`. Replay performs a new real execution and emits a new linked receipt; it does not pretend the attestation establishes what historically ran.
+
 ## Resume and Invalidation
 
 On invocation for an existing evidence target:

package/bundled/skills/prizmkit-test/references/evidence-request-protocol.md

@@ -17,7 +17,7 @@ Never hand-author `executions.json` receipt fields. Never copy a command's claim
 
 ## Producer Boundary and Recovery
 
-The model supplies schema-shaped semantic requests and mutable semantic records only before finalization. The builder performs preflight validation before creating an immutable package. Once `finalize` relocates a package to its content-addressed evidence ID, the returned `evidence_dir`, `manifest_path`, `verdict_path`, and `validation_path` are the only valid handoff paths; do not continue using the old staging directory. A validator pass is not a testing pass: read the testing verdict separately.
+The model supplies schema-shaped semantic requests and mutable semantic records only before payload finalization. The builder performs structural and derived-field preflight before creating a payload-finalized package. Validator attestation then seals it. Once sealed, the returned `evidence_dir`, `manifest_path`, `verdict_path`, and `validation_path` are the only valid handoff paths; do not continue using the old staging directory. A validator pass is not a testing pass: read the testing verdict separately.
 
 
 Place a request under `requests/` with:
@@ -41,7 +41,7 @@ Use an argv array so the runner does not interpret a shell string. Required fiel
 - selected `layer` and exactly one canonical binding (`test_ids`, `test_paths`, or `auto_bind: true`);
 - structured `external_targets`.
 
-Optional `timeout_seconds`, `attempt_policy`, and `concurrency` remain model-chosen. The builder records them through request binding but does not invent values or silently retry.
+Optional `timeout_seconds`, `attempt_policy`, and `concurrency` remain model-chosen. The builder applies a bounded default and maximum timeout; it does not silently retry or claim concurrency that it did not execute.
 
 The request path must be beneath the evidence directory. `cwd` resolves beneath the selected execution root. Missing commands produce an actual exit 127 receipt; missing cwd or escaped paths block before execution.
 

package/bundled/skills/prizmkit-test/references/trusted-evidence-execution.md

@@ -41,7 +41,7 @@ Treat evidence as auditable project-controlled provenance, not a defense against
 
 ## Builder Commands
 
-Drive a new package through the canonical lifecycle. Semantic request files remain model-authored; authoritative package records remain tool-owned:
+Drive a new package through the canonical lifecycle. Semantic request files remain model-authored; authoritative package records remain tool-owned. The builder applies a bounded default timeout when the request omits one, preserves common native cache variables, and returns a bounded unreliable receipt on timeout. The normal user path should author one semantic request and one execution plan; use individual lifecycle commands only for recovery or protocol debugging.
 
 ```bash
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> init --baseline <commit>
@@ -49,14 +49,11 @@ python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evid
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> inventory --request requests/inventory.json
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> execute --request requests/focused.json
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> finalize --request requests/finalize.json
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> render-report
 ```
 
-`capture-change` includes tracked modifications, untracked files, deletions, renames, and copies. `finalize` owns the manifest, verdict, stage hashes, evidence identity, and generated-test snapshots. The validator is the only producer of `validation.json`.
+`<staging>` must be a child of `.prizmkit/test/evidence/`. After `finalize`, the package is `payload-finalized`; run the validator pre-check and then `validate_test_evidence.py --attest` to seal it. Do not treat the pre-attestation staging package as immutable or invoke `render-report` after sealing.
 
 
-Write requests beneath the evidence directory, then invoke the bundled script:
-
 ```bash
 python3 ${SKILL_DIR}/scripts/build_test_evidence.py \
   --project-root <target-project-root> \

package/bundled/skills/prizmkit-test/scripts/build_test_evidence.py

@@ -61,6 +61,10 @@ _IGNORED_DIR_NAMES = {".git", "__pycache__", ".pytest_cache", ".mypy_cache"}
 FINAL_RECORDS = {"manifest.json", "validation.json", "verdict.json", "test-report.md"}
 MAX_PROTOCOL_PACKAGE_ATTEMPTS = 2
 PROTOCOL_STATE_NAME = ".protocol-recovery.json"
+DEFAULT_EXECUTION_TIMEOUT_SECONDS = 300.0
+MAX_EXECUTION_TIMEOUT_SECONDS = 1800.0
+MAX_EXECUTION_OUTPUT_BYTES = 16 * 1024 * 1024
+CANONICAL_EVIDENCE_ROOT = (".prizmkit", "test", "evidence")
 
 
 class RequestError(Exception):
@@ -114,6 +118,34 @@ def confined(root: Path, value: str, *, must_exist: bool = False, directory: boo
     return candidate
 
 
+def canonical_evidence_root(project_root: Path) -> Path:
+    return project_root.joinpath(*CANONICAL_EVIDENCE_ROOT).resolve()
+
+
+def require_canonical_evidence_dir(project_root: Path, evidence_dir: Path) -> None:
+    root = canonical_evidence_root(project_root)
+    try:
+        evidence_dir.resolve().relative_to(root)
+    except ValueError as exc:
+        raise RequestError(
+            "evidence directory must be under .prizmkit/test/evidence"
+        ) from exc
+    if evidence_dir.resolve() == root:
+        raise RequestError("evidence directory must be a package child of .prizmkit/test/evidence")
+
+
+def max_timeout(value: Any) -> float:
+    if value is None:
+        return DEFAULT_EXECUTION_TIMEOUT_SECONDS
+    if isinstance(value, bool) or not isinstance(value, (int, float)) or value <= 0:
+        raise RequestError("timeout_seconds must be a positive number")
+    if value > MAX_EXECUTION_TIMEOUT_SECONDS:
+        raise RequestError(
+            f"timeout_seconds must not exceed {MAX_EXECUTION_TIMEOUT_SECONDS:g} seconds"
+        )
+    return float(value)
+
+
 def evidence_relative(evidence_dir: Path, path: Path) -> str:
     try:
         return path.resolve().relative_to(evidence_dir.resolve()).as_posix()
@@ -794,6 +826,7 @@ def run_inventory(project_root: Path, evidence_dir: Path, request_path: Path, ou
 
 
 def run_process(argv: list[str], cwd: Path, environment: dict[str, str], timeout: float | None) -> tuple[int, bytes, bytes]:
+    timeout_value = max_timeout(timeout)
     creationflags = 0
     process_kwargs: dict[str, Any] = {}
     if os.name == "nt":
@@ -805,7 +838,7 @@ def run_process(argv: list[str], cwd: Path, environment: dict[str, str], timeout
         creationflags=creationflags, **process_kwargs,
     )
     try:
-        stdout, stderr = process.communicate(timeout=timeout)
+        stdout, stderr = process.communicate(timeout=timeout_value)
         return process.returncode, stdout, stderr
     except subprocess.TimeoutExpired:
         if os.name == "nt":
@@ -823,7 +856,14 @@ def run_process(argv: list[str], cwd: Path, environment: dict[str, str], timeout
                 except ProcessLookupError:
                     pass
         stdout, stderr = process.communicate()
-        return 124, stdout, stderr + f"\nPrizmKit runner timeout after {timeout} seconds\n".encode()
+        return 124, stdout, stderr + f"\nPrizmKit runner timeout after {timeout_value:g} seconds\n".encode()
+
+
+def limit_output(value: bytes, label: str) -> bytes:
+    if len(value) <= MAX_EXECUTION_OUTPUT_BYTES:
+        return value
+    marker = f"\nPrizmKit runner {label} truncated after {MAX_EXECUTION_OUTPUT_BYTES} bytes\n".encode()
+    return value[:MAX_EXECUTION_OUTPUT_BYTES - len(marker)] + marker
 
 
 def run_probe(argv: list[str], cwd: Path, environment: dict[str, str], timeout: float | None) -> dict[str, Any]:
@@ -831,7 +871,8 @@ def run_probe(argv: list[str], cwd: Path, environment: dict[str, str], timeout:
         exit_code, stdout, stderr = run_process(argv, cwd, environment, timeout)
         return {
             "command": argv, "exit_code": exit_code,
-            "stdout": stdout.decode(errors="replace"), "stderr": stderr.decode(errors="replace"),
+            "stdout": limit_output(stdout, "probe stdout").decode(errors="replace"),
+            "stderr": limit_output(stderr, "probe stderr").decode(errors="replace"),
         }
     except OSError as exc:
         return {"command": argv, "error": str(exc)}
@@ -883,11 +924,15 @@ def execute_request(
     if original_binding_fields != {"test_ids"} or original_test_ids != request["test_ids"]:
         write_json_atomic(request_path, request)
     cwd = confined(project_root, request["cwd"] or ".", must_exist=True, directory=True)
-    complete_environment = {"PATH": os.environ.get("PATH", os.defpath)}
+    complete_environment = {
+        key: value for key, value in os.environ.items()
+        if key in {"PATH", "HOME", "TMPDIR", "TMP", "TEMP", "GOMODCACHE", "GOPATH", "GOCACHE", "NPM_CONFIG_CACHE", "PIP_CACHE_DIR"}
+    }
+    complete_environment.setdefault("PATH", os.defpath)
     if os.name == "nt" and os.environ.get("SYSTEMROOT"):
         complete_environment["SYSTEMROOT"] = os.environ["SYSTEMROOT"]
     complete_environment.update(request["environment"])
-    timeout = request.get("timeout_seconds")
+    timeout = max_timeout(request.get("timeout_seconds"))
     tools = {
         name: run_probe(argv, cwd, complete_environment, timeout)
         for name, argv in request["tool_version_commands"].items()
@@ -906,19 +951,24 @@ def execute_request(
     stderr_path = raw_dir / f"{execution_id}.stderr"
     started = dt.datetime.now(dt.timezone.utc).isoformat()
     timed_out = False
+    output_limited = False
     execution_error = False
     try:
         exit_code, stdout, stderr = run_process(
             request["command"], cwd, complete_environment, timeout,
         )
         timed_out = exit_code == 124 and b"PrizmKit runner timeout" in stderr
+        output_limited = (
+            len(stdout) > MAX_EXECUTION_OUTPUT_BYTES
+            or len(stderr) > MAX_EXECUTION_OUTPUT_BYTES
+        )
     except OSError as exc:
         exit_code = 127
         stdout = b""
         stderr = f"PrizmKit runner execution error: {exc}\n".encode()
         execution_error = True
-    stdout_path.write_bytes(stdout)
-    stderr_path.write_bytes(stderr)
+    stdout_path.write_bytes(limit_output(stdout, "stdout"))
+    stderr_path.write_bytes(limit_output(stderr, "stderr"))
     finished = dt.datetime.now(dt.timezone.utc).isoformat()
     existing = load_json(evidence_dir / "executions.json") if (evidence_dir / "executions.json").exists() else []
     if not isinstance(existing, list):
@@ -940,13 +990,14 @@ def execute_request(
         "layer": request["layer"],
         "test_ids": request["test_ids"],
         "external_targets": request["external_targets"],
+        "timeout_seconds": timeout,
         "exit_code": exit_code,
         "stdout_path": evidence_relative(evidence_dir, stdout_path),
         "stderr_path": evidence_relative(evidence_dir, stderr_path),
         "stdout_sha256": file_sha256(stdout_path),
         "stderr_sha256": file_sha256(stderr_path),
         "selected_execution": selected_execution,
-        "reliable": probes_reliable and not timed_out and not execution_error,
+        "reliable": probes_reliable and not timed_out and not output_limited and not execution_error,
         "started_at": started,
         "finished_at": finished,
         "replay_of": replay_of,
@@ -962,7 +1013,13 @@ def run_capture_change(
     baseline: str | None,
     output_name: str,
 ) -> Path:
+    lifecycle = load_lifecycle(evidence_dir, required=True)
+    expected_baseline = lifecycle.get("baseline_commit")
     resolved_baseline = git_baseline(project_root, baseline)
+    if isinstance(expected_baseline, str) and resolved_baseline != expected_baseline:
+        raise RequestError(
+            "capture baseline does not match the baseline pinned during init"
+        )
     patch, status_entries = canonical_change_patch(project_root, resolved_baseline)
     patch_path = confined(evidence_dir, "source-change.patch")
     patch_path.parent.mkdir(parents=True, exist_ok=True)
@@ -980,21 +1037,23 @@ def run_capture_change(
 
 
 def run_init(project_root: Path, evidence_dir: Path, baseline: str | None, output_name: str) -> Path:
-    align_protocol_state(evidence_dir, protocol_run_key(project_root, baseline))
-    require_protocol_budget(evidence_dir, package_initialization=True)
+    require_canonical_evidence_dir(project_root, evidence_dir)
+    align_protocol_state(project_root, protocol_run_key(project_root, baseline))
+    require_protocol_budget(project_root, package_initialization=True)
     if evidence_dir.exists() and any(evidence_dir.iterdir()):
         if (evidence_dir / "manifest.json").exists():
             raise RequestError("evidence package is finalized; initialize a new evidence directory")
         raise RequestError("evidence directory is not empty; initialize a new evidence directory")
     evidence_dir.mkdir(parents=True, exist_ok=True)
-    update_protocol_state(evidence_dir, event="package-initialized", increment="package_initializations")
+    resolved_baseline = git_baseline(project_root, baseline)
+    update_protocol_state(project_root, event="package-initialized", increment="package_initializations")
     for directory in ("requests", "receipts", "raw", "generated-tests", "contracts", "runner"):
         (evidence_dir / directory).mkdir(parents=True, exist_ok=True)
     write_json_atomic(evidence_dir / "executions.json", [])
     write_json_atomic(evidence_dir / "lifecycle.json", {
         "lifecycle_format": "prizmkit-canonical-lifecycle-v1",
         "status": "initialized",
-        "baseline_commit": git_baseline(project_root, baseline),
+        "baseline_commit": resolved_baseline,
         "artifact_dir": None,
         "finalized": False,
         "immutable_identity": None,
@@ -1003,29 +1062,18 @@ def run_init(project_root: Path, evidence_dir: Path, baseline: str | None, outpu
     write_json_atomic(output, {
         "command": "init",
         "evidence_dir": ".",
-        "baseline_commit": git_baseline(project_root, baseline),
+        "baseline_commit": resolved_baseline,
         "next": "capture-change",
     })
     return output
 
 
-def protocol_state_path(evidence_dir: Path) -> Path:
-    # Keep recovery accounting outside each package so reinitializing v2/v3
-    # cannot reset the budget by choosing another evidence directory.
-    return evidence_dir.parent / PROTOCOL_STATE_NAME
-
-
-def protocol_run_key(project_root: Path, baseline: str | None) -> str:
-    resolved_baseline = git_baseline(project_root, baseline)
-    patch, _ = canonical_change_patch(project_root, resolved_baseline)
-    return canonical_sha256({
-        "baseline_commit": resolved_baseline,
-        "working_diff_sha256": hashlib.sha256(patch).hexdigest(),
-    })
+def protocol_state_path(project_root: Path) -> Path:
+    return canonical_evidence_root(project_root) / PROTOCOL_STATE_NAME
 
 
-def align_protocol_state(evidence_dir: Path, run_key: str) -> None:
-    state_path = protocol_state_path(evidence_dir)
+def align_protocol_state(project_root: Path, run_key: str) -> None:
+    state_path = protocol_state_path(project_root)
     if state_path.exists():
         state = ensure_object(load_json(state_path), "protocol recovery state")
         if state.get("run_key") == run_key:
@@ -1034,13 +1082,13 @@ def align_protocol_state(evidence_dir: Path, run_key: str) -> None:
 
 
 def update_protocol_state(
-    evidence_dir: Path,
+    project_root: Path,
     *,
     event: str,
     error: str | None = None,
     increment: str | None = None,
 ) -> dict[str, Any]:
-    state_path = protocol_state_path(evidence_dir)
+    state_path = protocol_state_path(project_root)
     state: dict[str, Any] = {}
     if state_path.exists():
         state = ensure_object(load_json(state_path), "protocol recovery state")
@@ -1061,8 +1109,8 @@ def update_protocol_state(
     return state
 
 
-def require_protocol_budget(evidence_dir: Path, *, package_initialization: bool = False) -> None:
-    state_path = protocol_state_path(evidence_dir)
+def require_protocol_budget(project_root: Path, *, package_initialization: bool = False) -> None:
+    state_path = protocol_state_path(project_root)
     if not state_path.exists():
         return
     state = ensure_object(load_json(state_path), "protocol recovery state")
@@ -1078,6 +1126,15 @@ def require_protocol_budget(evidence_dir: Path, *, package_initialization: bool
         )
 
 
+def protocol_run_key(project_root: Path, baseline: str | None) -> str:
+    resolved_baseline = git_baseline(project_root, baseline)
+    patch, _ = canonical_change_patch(project_root, resolved_baseline)
+    return canonical_sha256({
+        "baseline_commit": resolved_baseline,
+        "working_diff_sha256": hashlib.sha256(patch).hexdigest(),
+    })
+
+
 def semantic_record_paths(change_class: str) -> set[str]:
     common = {"change-classification.json", "scope.json"}
     if change_class == "behavior":
@@ -1085,7 +1142,7 @@ def semantic_record_paths(change_class: str) -> set[str]:
     return common | {"lightweight-verification.json"}
 
 
-def preflight_semantic_records(evidence_dir: Path, change_class: str) -> None:
+def require_semantic_record_files(evidence_dir: Path, change_class: str) -> None:
     missing = sorted(
         relative for relative in semantic_record_paths(change_class)
         if not (evidence_dir / relative).is_file()
@@ -1096,6 +1153,9 @@ def preflight_semantic_records(evidence_dir: Path, change_class: str) -> None:
             + "; keep this package mutable and repair it before finalize"
         )
 
+
+def preflight_semantic_records(evidence_dir: Path, change_class: str) -> None:
+    require_semantic_record_files(evidence_dir, change_class)
     validator_path = Path(__file__).resolve().with_name("validate_test_evidence.py")
     try:
         import importlib.util
@@ -1423,7 +1483,7 @@ def stage_output_owner(relative: str, change_class: str) -> str:
     return "EVIDENCE_PACKAGE"
 
 
-def build_manifest(evidence_dir: Path, *, evidence_id: str, identity: dict[str, Any], target_hashes: dict[str, str], change_class: str, baseline_commit: str, final_verdict: str) -> dict[str, Any]:
+def build_manifest(evidence_dir: Path, *, evidence_id: str, identity: dict[str, Any], target_hashes: dict[str, str], change_class: str, baseline_commit: str, final_verdict: str, attested: bool = False) -> dict[str, Any]:
     file_paths = sorted(
         path.relative_to(evidence_dir).as_posix()
         for path in evidence_dir.rglob("*")
@@ -1441,7 +1501,7 @@ def build_manifest(evidence_dir: Path, *, evidence_id: str, identity: dict[str,
         outputs = sorted(outputs_by_stage.get(stage, []))
         stages.append({
             "name": stage,
-            "status": "complete",
+            "status": "complete" if stage != "EVIDENCE_VALIDATE" or attested else "pending",
             "outputs": outputs,
             "not_applicable": None,
         })
@@ -1476,7 +1536,8 @@ def write_handoff_pointer(evidence_dir: Path, artifact_dir: str | None, project_
 
 
 def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any], output_name: str) -> Path:
-    require_protocol_budget(evidence_dir)
+    require_canonical_evidence_dir(project_root, evidence_dir)
+    require_protocol_budget(project_root)
     allowed = {"request_version", "change_class", "baseline_commit", "scope_path", "environment_path", "artifact_dir", "blockers", "repair_scope"}
     if set(request) - allowed:
         raise RequestError(f"finalize request contains unsupported fields: {sorted(set(request) - allowed)}")
@@ -1491,7 +1552,10 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
     if not capture_path.exists():
         run_capture_change(project_root, evidence_dir, request.get("baseline_commit"), "change-capture.json")
     capture = load_change_capture(project_root, evidence_dir, require_fresh=True)
+    lifecycle_baseline = lifecycle.get("baseline_commit")
     baseline = capture.get("baseline_commit")
+    if not isinstance(lifecycle_baseline, str) or baseline != lifecycle_baseline:
+        raise RequestError("canonical change capture baseline does not match init baseline")
     patch_path = evidence_dir / "source-change.patch"
     if not isinstance(baseline, str) or not patch_path.is_file():
         raise RequestError("canonical change capture is incomplete")
@@ -1499,10 +1563,10 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
     if change_class not in {"behavior", "lightweight"}:
         raise RequestError("change_class must be behavior or lightweight")
     try:
-        preflight_semantic_records(evidence_dir, change_class)
+        require_semantic_record_files(evidence_dir, change_class)
     except RequestError as exc:
         state = update_protocol_state(
-            evidence_dir,
+            project_root,
             event="preflight-failed",
             error=str(exc),
             increment="preflight_failures",
@@ -1513,6 +1577,7 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
                 "and do not initialize another package"
             ) from exc
         raise
+
     artifact_dir = request.get("artifact_dir")
     if artifact_dir is not None and not isinstance(artifact_dir, str):
         raise RequestError("artifact_dir must be a project-relative directory")
@@ -1540,6 +1605,21 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         write_json_atomic(evidence_dir / "test-plan.json", plan)
     scope["target_hashes"] = target_hashes
     write_json_atomic(evidence_dir / scope_relative, scope)
+    try:
+        preflight_semantic_records(evidence_dir, change_class)
+    except RequestError as exc:
+        state = update_protocol_state(
+            project_root,
+            event="preflight-failed",
+            error=str(exc),
+            increment="preflight_failures",
+        )
+        if state.get("blocked"):
+            raise RequestError(
+                str(exc) + "; evidence protocol recovery budget exhausted; return TEST_BLOCKED "
+                "and do not initialize another package"
+            ) from exc
+        raise
     identity = {
         "baseline_commit": baseline,
         "working_diff_sha256": file_sha256(patch_path),
@@ -1567,7 +1647,7 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
     )
     if missing_records:
         state = update_protocol_state(
-            evidence_dir,
+            project_root,
             event="finalize-precondition-failed",
             error="required evidence records are missing: " + ", ".join(missing_records),
             increment="preflight_failures",
@@ -1628,13 +1708,14 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         evidence_dir, evidence_id=evidence_id, identity=identity,
         target_hashes=target_hashes, change_class=change_class,
         baseline_commit=baseline, final_verdict=verdict,
+        attested=False,
     )
     write_json_atomic(evidence_dir / "manifest.json", manifest)
     run_render_report(evidence_dir, "test-report.md")
     write_json_atomic(evidence_dir / "lifecycle.json", {
         **lifecycle,
-        "status": "finalized",
-        "finalized": True,
+        "status": "payload-finalized",
+        "finalized": False,
         "immutable_identity": identity,
     })
     output = confined(evidence_dir, output_name)
@@ -1654,6 +1735,7 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
         evidence_dir, evidence_id=evidence_id, identity=identity,
         target_hashes=target_hashes, change_class=change_class,
         baseline_commit=baseline, final_verdict=verdict,
+        attested=False,
     )
     write_json_atomic(evidence_dir / "manifest.json", manifest)
     if destination != evidence_dir:
@@ -1672,7 +1754,7 @@ def run_finalize(project_root: Path, evidence_dir: Path, request: dict[str, Any]
     final_evidence_dir = destination if destination != evidence_dir else evidence_dir
     write_handoff_pointer(final_evidence_dir, lifecycle.get("artifact_dir"), project_root)
     update_protocol_state(
-        final_evidence_dir,
+        project_root,
         event="finalized",
         error="; ".join(verdict_record.get("blockers", [])) if verdict == "TEST_BLOCKED" else None,
     )
@@ -1792,10 +1874,7 @@ def main() -> int:
     try:
         if not project_root.is_dir():
             raise RequestError(f"project root does not exist: {project_root}")
-        try:
-            evidence_dir.relative_to(project_root)
-        except ValueError:
-            raise RequestError(f"evidence directory must be under project root: {evidence_dir}")
+        require_canonical_evidence_dir(project_root, evidence_dir)
         if args.subcommand == "init":
             output = run_init(project_root, evidence_dir, args.baseline, args.output)
             print(f"Evidence initialized: {output}")

package/bundled/skills/prizmkit-test/scripts/validate_test_evidence.py

@@ -39,6 +39,7 @@ LAYER_ORDER = {
     "regression-ring": 4,
 }
 FINAL_RECORDS = {"validation.json", "verdict.json", "test-report.md"}
+ATTESTATION_EXCLUDED_RECORDS = FINAL_RECORDS | {"lifecycle.json"}
 ATTESTATION_MUTABLE = {"validation.json"}
 COMMON_RECORDS = {
     "change-classification.json", "scope.json", "target-inventory.json",
@@ -646,8 +647,12 @@ def validate_manifest(
         if status == "not_applicable":
             structured_na(na, records_schema, f"stage {name} not_applicable", errors)
             require(outputs == [], f"not-applicable stage must not claim outputs: {name}", errors)
+        elif status == "pending":
+            require(na is None, f"pending stage must have null not_applicable: {name}", errors)
         elif status == "complete":
             require(na is None, f"complete stage must have null not_applicable: {name}", errors)
+        else:
+            require(False, f"stage has unknown status: {name}", errors)
         for output in outputs if isinstance(outputs, list) else []:
             entry = entry_map.get(output)
             require(entry is not None, f"stage output is not a hashed evidence file: {name}/{output}", errors)
@@ -961,6 +966,16 @@ def validate_requests_and_receipts(
         if isinstance(request, dict):
             for key in ("purpose", "command", "cwd", "layer", "test_ids", "external_targets"):
                 require(receipt.get(key) == request.get(key), f"{location}: receipt {key} does not match request", errors)
+            requested_timeout = request.get("timeout_seconds")
+            require(
+                isinstance(receipt.get("timeout_seconds"), (int, float))
+                and not isinstance(receipt.get("timeout_seconds"), bool)
+                and receipt["timeout_seconds"] > 0,
+                f"{location}: receipt lacks a bounded execution timeout",
+                errors,
+            )
+            if requested_timeout is not None:
+                require(receipt.get("timeout_seconds") == requested_timeout, f"{location}: receipt timeout does not match request", errors)
             expected_environment = request.get("environment")
             actual_environment = receipt.get("environment")
             require(isinstance(actual_environment, dict) and isinstance(actual_environment.get("PATH"), str), f"{location}: receipt lacks complete PATH environment", errors)
@@ -1507,10 +1522,33 @@ def validate_verdict_and_attestation(
             errors,
         )
 
+    if not verify_attestation:
+        lifecycle = load_json(root / "lifecycle.json") if (root / "lifecycle.json").is_file() else {}
+        if (root / "lifecycle.json").is_file():
+            require(
+                lifecycle.get("status") == "payload-finalized" and lifecycle.get("finalized") is False,
+                "pre-attestation validation requires a payload-finalized mutable package",
+                errors,
+            )
+            require(
+                not validation,
+                "pre-attestation package must not contain validator-owned validation data",
+                errors,
+            )
+
     if verify_attestation:
         validate_definition(validation, "validation", records_schema, "validation", errors)
+        lifecycle = load_json(root / "lifecycle.json") if (root / "lifecycle.json").is_file() else {}
+        if (root / "lifecycle.json").is_file():
+            require(
+                lifecycle.get("status") in {"payload-finalized", "sealed"},
+                "attested package has an invalid lifecycle state",
+                errors,
+            )
+            if lifecycle.get("status") == "sealed":
+                require(lifecycle.get("finalized") is True, "sealed package must be finalized", errors)
         payload = sorted(
-            ({"path": path, "sha256": entry["sha256"]} for path, entry in entry_map.items() if path not in FINAL_RECORDS),
+            ({"path": path, "sha256": entry["sha256"]} for path, entry in entry_map.items() if path not in ATTESTATION_EXCLUDED_RECORDS),
             key=lambda item: item["path"],
         )
         replayed_ids = [
@@ -1749,6 +1787,16 @@ def main() -> int:
     manifest = load_json(root / "manifest.json")
     verdict_record = load_json(root / "verdict.json")
     if args.attest:
+        lifecycle_path = root / "lifecycle.json"
+        lifecycle = load_json(lifecycle_path) if lifecycle_path.is_file() else {}
+        if lifecycle_path.is_file() and (lifecycle.get("status") != "payload-finalized" or lifecycle.get("finalized") is not False):
+            print("Test evidence validation: FAIL\n- attestation requires a payload-finalized mutable package")
+            return 1
+        manifest = load_json(root / "manifest.json")
+        for stage in manifest.get("stages", []):
+            if isinstance(stage, dict) and stage.get("name") == "EVIDENCE_VALIDATE":
+                stage["status"] = "complete"
+        atomic_write_json(root / "manifest.json", manifest)
         executions = load_json(root / "executions.json")
         replayed_ids = [
             item.get("execution_id") for item in executions
@@ -1759,7 +1807,7 @@ def main() -> int:
         payload = sorted(
             (
                 {"path": entry["path"], "sha256": entry["sha256"]}
-                for entry in manifest["files"] if entry["path"] not in FINAL_RECORDS
+                for entry in manifest["files"] if entry["path"] not in ATTESTATION_EXCLUDED_RECORDS
             ),
             key=lambda item: item["path"],
         )
@@ -1782,6 +1830,12 @@ def main() -> int:
             for error in errors:
                 print(f"- {error}")
             return 1
+        if lifecycle_path.is_file():
+            atomic_write_json(root / "lifecycle.json", {
+                **lifecycle,
+                "status": "sealed",
+                "finalized": True,
+            })
 
     print("Evidence validation: PASS")
     print(f"Testing verdict: {manifest['final_verdict']}")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prizmkit",
-  "version": "1.1.139",
+  "version": "1.1.140",
   "description": "Create a new PrizmKit-powered project with clean initialization — no framework dev files, just what you need.",
   "type": "module",
   "bin": {