prizmkit 1.1.140 → 1.1.142

package/bundled/skills/prizmkit-test/references/examples.md

@@ -1,100 +0,0 @@
-# Test Evidence Examples
-
-## 1. Normally Tested Module Change — TEST_PASS
-
-Input:
-
-```text
-/prizmkit-test scope=this-change artifact_dir=<change-artifact>
-```
-
-A library parser changes one accepted input form. Scope discovery selects the complete parser module and two direct consumers. Existing module tests already cover most behaviors.
-
-The run:
-
-1. Classifies `behavior`.
-2. Adds the changed parser behavior plus existing observable parser behavior to the matrix.
-3. Selects focused, affected-module regression, and Regression Ring layers; module-component and contract-integration are N/A with concrete pure-library rationale.
-4. Adds missing malformed-input and consumer-shape tests.
-5. Proves changed tests fail on baseline and pass currently.
-6. Packages all command/environment/output history.
-7. Deterministically validates.
-
-Handoff:
-
-```text
-TEST_PASS
-Evidence: .prizmkit/test/evidence/<evidence-id>/
-Validator: passed
-Mocked code-level evidence does not verify a real deployed environment.
-```
-
-## 2. Incompletely Tested Legacy Module — Whole-Module Gap Filling
-
-A queue worker retry change touches a legacy worker with one happy-path test. Changed lines identify the module, but Primary Scope includes parsing, claim, processing, retry, dead-letter, acknowledgment, idempotency, and dependency-failure behavior.
-
-`TEST_BUILD` fills observable gaps across the module, not unrelated private utility lines. It adds deterministic fake-clock and contract-backed queue tests for retry just below/at/above maximum, duplicate delivery, malformed payload, lock failure, no partial side effect, ack/nack calls, and dead-letter transition. Regression Ring runs the scheduler and producer contract checks. Coverage percentage is recorded only as a diagnostic signal.
-
-The run cannot pass until every applicable behavior-risk cell and Regression Ring execution is mapped and covered by reliable current-workspace execution.
-
-## 3. Contract-Coupled Modules — Contract-Driven Mocks
-
-An API client and consumer share OpenAPI. The run snapshots the OpenAPI document into `contracts/`, records its source/hash, and generates mock responses for success, schema error, 429, timeout, malformed body, and pagination token boundaries.
-
-The mock is rejected if it invents an incompatible field or cannot trace behavior to the contract. Contract and consumer executions pass, and the report states `environment_claim=mocked-code-level-only`; it makes no claim about a deployed SaaS environment.
-
-## 4. Reliable Business Defect — TEST_FAIL
-
-Resolved specification and OpenAPI require a negative amount to return a validation error without a write. A generated contract test reliably observes success plus a database-adapter call.
-
-The test is valid, current and affected-module executions reproduce the failure, and raw output is preserved. `/prizmkit-test` does not change production business behavior. It packages:
-
-```text
-TEST_FAIL
-Reproduced failure: amount-boundary-negative
-Evidence: .prizmkit/test/evidence/<evidence-id>/
-```
-
-## 5. Unknown Coupling or Conflicting Truth — TEST_BLOCKED
-
-A dynamically loaded plugin may consume the changed result shape, but its registry is generated remotely and unavailable. The edge can change the verdict, so it remains verdict-capable and unresolved.
-
-Alternatively, specification and shared schema disagree on nullability with no authoritative resolution. The skill does not freeze current behavior into a characterization test.
-
-Both produce:
-
-```text
-TEST_BLOCKED
-Blocker: verdict-capable unresolved edge or conflicting truth
-Evidence: .prizmkit/test/evidence/<evidence-id>/
-```
-
-## 6. Current-State New Behavior
-
-A newly added CLI command has no pre-change interface, so the skill adds a focused native command test and runs it against the current project implementation. The test passes, its behavior-risk and test-plan mappings are complete, and the runner receipt and raw output are preserved. The evidence claims current code-level conformance; it does not claim that the test failed on a historical implementation.
-
-## 7. Interrupted or Budgeted Run
-
-On recovery, the skill validates stage outputs and target hashes. A changed lockfile invalidates `INFRA_READY` and every downstream stage but preserves earlier execution history immutably. The run resumes there.
-
-If the budget ends after half a large module's required matrix is tested, progress persists and the result is `TEST_BLOCKED`; no scope is silently truncated.
-
-## 8. Tampering
-
-After packaging, changing `raw/execution-003.stdout`, a contract snapshot, generated test, source patch, or derived report produces a content-hash mismatch. Changing identity inputs without recomputing the canonical evidence ID also fails.
-
-```bash
-python3 ${SKILL_DIR}/scripts/validate_test_evidence.py \
-  --evidence-dir .prizmkit/test/evidence/<evidence-id> \
-  --project-root <target-project-root>
-```
-
-Result: non-zero with `Test evidence validation: FAIL`. A tampered package cannot retain `TEST_PASS`.
-
-## 9. Lightweight Change
-
-A comments-only diff is deterministically classified and parser/format/generated-output checks pass. Behavior-only stages are marked not applicable with reasons. `TEST_PASS` means the lightweight claim is proven; the report explicitly does not claim full runtime test evidence.
-
-## Compatibility Notice
-
-The testing-domain verdict remains `TEST_PASS | TEST_FAIL | TEST_BLOCKED`. Consumers must use validated authoritative evidence and may use `test-report.md` only as a derived compatibility view. The formal lifecycle does not reinterpret a testing result as a review or commit verdict.

package/bundled/skills/prizmkit-test/references/service-boundary-test-catalog.md

@@ -1,228 +0,0 @@
-# Service Behavior-Risk Catalog
-
-Use this catalog during `CONTRACT_MODEL` and `TEST_BUILD` to discover domain-specific observable risks. It supplies questions, not truth: every expected value must come from the recorded truth precedence and every external dependency double must follow `references/contract-mock-protocol.md`.
-
-## How to Use This Catalog
-
-1. Classify the affected module by its public behavior, dependencies, state changes, and resolved contracts.
-2. Select every service type that applies; one behavior can combine several types.
-3. Add applicable cases to `behavior-risk-matrix.json` and map them to test/execution IDs.
-4. Derive mock requests/responses from shared machine-readable or locally snapshotted contracts. Never independently invent provider/database/queue behavior.
-5. Record a concrete rationale for every non-applicable risk.
-6. Treat coverage metrics as diagnostic only; complete observable behavior and risk rather than private lines.
-
-Code-level tests are mock-first and must state that they do not verify a real deployed environment. Production credentials, services, and data are prohibited.
-
-## Service Type Detection
-
-| Signal | Likely Service Type |
-|--------|---------------------|
-| login, logout, signup, password, session, token, jwt, oauth, refresh | Auth / Session / Token |
-| role, permission, policy, access, entitlement, plan, quota, ownership | Authorization / Permission / Entitlement |
-| payment, wallet, billing, subscription, invoice, refund, balance, currency | Payment / Wallet / Billing / Refund |
-| repository, model, dao, create, read, update, delete, insert, save, remove | CRUD / Repository / Database |
-| search, list, page, cursor, filter, sort, query, limit, offset | Search / List / Pagination |
-| validate, parse, normalize, transform, schema, sanitize, format | Validation / Parser / Normalizer |
-| upload, download, storage, file, blob, s3, image, mime, path | File Upload / Storage |
-| notify, email, sms, webhook, template, recipient, provider | Notification / Email / Webhook |
-| job, queue, worker, scheduler, cron, retry, backoff, task | Job / Queue / Scheduler |
-| cache, ttl, rate limit, throttle, idempotency, dedupe, lock | Cache / Rate Limit / Idempotency |
-| client, sdk, request, fetch, provider, api key, endpoint, response | API Client / Third-Party Integration |
-| date, time, expiry, expiration, ttl, schedule, window, timezone | Date / Time / Expiration |
-
-When names and behavior disagree, trust behavior and dependencies over names. For example, `createCheckoutSession()` is payment-related even if it lives in a controller module.
-
-## Universal Boundary Matrix
-
-Apply these categories to every public function/class method before adding service-specific cases:
-
-- **Valid input**: typical valid input, minimal valid input, and complex valid input when supported.
-- **Empty input**: `null` / `undefined` / `None`, empty string, empty array/object, whitespace-only string.
-- **Numeric boundaries**: zero, one, minimum allowed value, maximum allowed value, just below/above limits.
-- **Collection boundaries**: zero items, one item, many items, duplicate items, first/last element behavior.
-- **Type and format errors**: wrong type, malformed string, unsupported enum, missing required parameter.
-- **Branch paths**: each `if/else`, `switch/case/default`, ternary side, and loop path with zero/one/many iterations.
-- **State and side effects**: before/after state, writes, emitted events, dependency method calls, call count/order/arguments.
-- **Dependency failures**: mocked database errors, network timeouts, storage failures, provider errors, clock/randomness behavior.
-
-## Service-Specific Boundary Cases
-
-### Auth / Session / Token Services
-
-Generate applicable cases for:
-
-- Missing identifier, missing password, empty credentials, malformed email/username.
-- Identifier normalization: uppercase/lowercase email, leading/trailing whitespace, Unicode usernames when supported.
-- User not found, wrong password, unverified account, disabled account, locked account.
-- Failed login count just below/at/above lock threshold.
-- Successful login creates exactly one session/token with expected expiry and persisted state.
-- Token missing, malformed, invalid signature, wrong algorithm, expired, not-yet-valid, revoked.
-- Refresh token rotation: old refresh token reuse, missing refresh token, expired refresh token, revoked refresh token.
-- Logout idempotency: logout with valid token, already logged-out token, missing token.
-- OAuth/callback flows: missing code, missing state, state mismatch, provider error, provider returns incomplete profile.
-- Dependency failures: user store error, password hasher error, token signer/verifier error, clock skew.
-
-### Authorization / Permission / Entitlement Services
-
-Generate applicable cases for:
-
-- Missing principal, anonymous principal, principal without roles/permissions.
-- Default-deny behavior when no policy matches.
-- Role hierarchy: basic role, elevated role, admin override, deny rule precedence.
-- Resource ownership: owner, non-owner, tenant mismatch, organization mismatch.
-- Entitlement states: active, expired, canceled, trial, disabled feature, missing plan.
-- Quota boundaries: usage below limit, exactly at limit, one over limit, reset window boundary.
-- Duplicate or conflicting permissions.
-- Policy conditions with missing attributes, malformed attributes, unknown action/resource.
-- Dependency failures: policy store error, entitlement lookup error, quota service timeout.
-
-### Payment / Wallet / Billing / Refund Services
-
-Generate applicable cases for:
-
-- Amount zero, negative amount, minimum billable unit, maximum allowed amount, just above maximum.
-- Currency precision: too many decimal places, integer minor units, rounding at half-unit boundaries.
-- Balance boundaries: balance exactly equals debit amount, balance one minor unit below amount, zero balance.
-- Currency mismatch between wallet, invoice, and payment request.
-- Idempotency: missing key, duplicate key with same payload, duplicate key with different payload.
-- Transaction states: pending, succeeded, failed, canceled, already paid, already refunded.
-- Refund boundaries: zero refund, partial refund, full refund, cumulative refunds equal original amount, cumulative refunds exceed original amount.
-- Concurrent debit/refund attempts against the same account or transaction.
-- Subscription/billing cycles: trial start/end, expired subscription, canceled subscription, renewal at boundary time.
-- Provider failures: timeout, 4xx/5xx, malformed response, duplicate provider event, out-of-order webhook.
-- Side effects: ledger entry count, balance mutation, webhook/event emission, provider call arguments.
-
-### CRUD / Repository / Database Services
-
-Generate applicable cases for:
-
-- Create with missing required fields, nullable fields set to `null`, optional fields omitted.
-- Duplicate unique key, generated ID collision, invalid foreign key, unknown enum value.
-- Read/update/delete with nonexistent ID, malformed ID, deleted/soft-deleted ID.
-- Partial update semantics: omitted field vs `undefined` vs `null`, empty patch object.
-- Optimistic locking: expected version, stale version, missing version.
-- Soft delete behavior: excluded by default, included only when requested, double delete idempotency.
-- Transaction behavior: rollback when one write fails, no partial side effects after failure.
-- Database dependency errors: connection failure, constraint violation, timeout.
-- Repository side effects: correct query arguments, write count, returned entity shape.
-
-### Search / List / Pagination / Sorting Services
-
-Generate applicable cases for:
-
-- Empty query, whitespace query, special characters, Unicode query, injection-like strings treated as data.
-- No results, one result, many results, duplicate ranking/sort values.
-- Page/offset pagination: page 0, page 1, last page, beyond last page, negative page/offset.
-- Cursor pagination: missing cursor, malformed cursor, expired cursor, cursor at final item.
-- Limit boundaries: omitted limit, limit 0, limit 1, maximum limit, maximum + 1.
-- Sorting: default sort, invalid sort field, invalid direction, stable ordering with ties.
-- Filters: empty filter set, unknown filter, conflicting filters, inclusive/exclusive date ranges.
-- Total count and hasNext/hasPrevious flags at page boundaries.
-- Dependency failures: search index unavailable, database query error, stale index response.
-
-### Validation / Parser / Normalizer Services
-
-Generate applicable cases for:
-
-- Missing input, `null` / `undefined` / `None`, empty string, whitespace-only string.
-- Minimum and maximum length; just below/above configured length boundaries.
-- Special characters, Unicode, emoji, newline/control characters, normalization-sensitive characters.
-- Wrong type, mixed-type arrays, numeric strings vs numbers, booleans represented as strings.
-- Unknown fields in strict mode, extra fields in permissive mode, duplicate keys/items.
-- Invalid formats: email, URL, date, UUID, JSON, CSV, phone number, currency.
-- Normalization idempotency: applying the normalizer twice yields the same result.
-- Error shape: path/field name, code, message, and aggregation of multiple errors.
-- Parser failures: malformed payload, truncated payload, unsupported version/schema.
-
-### File Upload / Storage Services
-
-Generate applicable cases for:
-
-- Zero-byte file, one-byte file, just below max size, exactly max size, just above max size.
-- MIME/type mismatch between content, extension, and declared header.
-- Unsupported file type, missing extension, uppercase extension, compound extension.
-- Filename boundaries: empty name, very long name, Unicode name, duplicate name, path traversal characters.
-- Storage key collisions and deterministic key generation.
-- Checksum/hash mismatch, corrupted stream, interrupted upload, storage write failure.
-- Image/media metadata boundaries: dimensions too small/large, unsupported codec, malformed metadata.
-- Delete/read behavior for missing object, already-deleted object, permission-denied object.
-- Side effects: storage provider call arguments, metadata record creation, cleanup on failure.
-
-### Notification / Email / Webhook Services
-
-Generate applicable cases for:
-
-- Missing recipient, invalid email/phone/URL, empty recipient list, duplicate recipients.
-- Recipient preferences: unsubscribed, disabled channel, quiet hours, blocked user.
-- Template variables: missing required variable, extra variable, `null` variable, special characters/HTML escaping.
-- Provider selection: unsupported channel, fallback provider, disabled provider.
-- Deduplication: duplicate notification key, repeated webhook event, retry with same id.
-- Provider responses: success, rate limit, timeout, 4xx/5xx, malformed response, partial multi-recipient failure.
-- Webhook security: missing signature, invalid signature, timestamp outside tolerance, replayed event.
-- Side effects: event status persisted, retry scheduled or suppressed, provider called with expected payload.
-
-### Job / Queue / Scheduler Services
-
-Generate applicable cases for:
-
-- Missing payload, empty payload, malformed payload, unsupported job type/version.
-- Duplicate job ID, idempotent processing of already-completed job, requeue behavior.
-- Retry boundaries: first failure, retry count just below max, at max, over max, poison/dead-letter path.
-- Backoff calculation: zero delay, minimum delay, maximum delay, jitter bounds when deterministic/mocked.
-- Schedule boundaries: run in past, run now, run in future, invalid cron, daylight-saving transition.
-- Concurrency: two workers claim same job, lock acquisition failure, stale lock recovery.
-- Cancellation: before start, during processing, after completion.
-- Side effects: ack/nack calls, status transitions, retry scheduling, emitted events.
-
-### Cache / Rate Limit / Idempotency Services
-
-Generate applicable cases for:
-
-- Cache miss, hit, stale hit, expired entry, invalidation, key collision.
-- TTL boundaries: zero TTL, negative TTL, one unit TTL, exact expiry instant, just before/after expiry.
-- Serialization/deserialization failure, corrupted cached value, unsupported value type.
-- Cache stampede: concurrent misses for the same key should not duplicate expensive work when guarded.
-- Rate limit boundaries: count below limit, exactly at limit, one above limit, window rollover.
-- Missing actor key: anonymous user, missing IP, shared tenant/global scope.
-- Idempotency key: missing, malformed, reused with same payload, reused with different payload, expired record.
-- Lock behavior: lock unavailable, lock timeout, release on success, release on failure.
-- Backing store failures: Redis/cache down, slow response, partial write.
-
-### API Client / Third-Party Integration Services
-
-Generate applicable cases for:
-
-- Missing base URL, missing API key, malformed configuration, unsupported region/environment.
-- Request building: query encoding, header inclusion, body serialization, path parameter escaping.
-- Response handling: 200 with valid body, 204/no body, malformed JSON, missing required field, unknown extra field.
-- Error responses: 400, 401/403, 404, 409, 429, 500/503; retryable vs non-retryable classification.
-- Timeout, network error, DNS/connect failure, aborted request.
-- Retry boundaries: zero retries, one retry then success, max retries exhausted, backoff capped.
-- Pagination: empty page, last page, next token missing/malformed, duplicate page token.
-- Auth refresh/signing: expired access token, refresh failure, invalid signature, clock skew.
-- Circuit breaker or fallback behavior when present.
-
-### Date / Time / Expiration Services
-
-Generate applicable cases for:
-
-- Exact boundary: `now == startsAt`, `now == expiresAt`, one millisecond/second before and after.
-- Inclusive vs exclusive interval ends according to the contract.
-- Start after end, zero-length interval, negative duration, missing timezone.
-- Time zones: UTC vs local time, DST jump forward/back, leap day, month end, year end.
-- Clock skew tolerance for tokens, webhooks, scheduled jobs, and signed requests.
-- Recurring schedules: first occurrence, last occurrence, skipped occurrence, invalid cron/expression.
-- TTL/window calculations: zero TTL, negative TTL, max TTL, rollover between windows.
-
-## When Multiple Service Types Apply
-
-Combine the relevant sections and remove duplicate cases. Prioritize tests that exercise business invariants over tests that only repeat generic invalid input handling. For example, a wallet debit function should cover payment amount boundaries, idempotency replay, and date/expiration behavior if it also accepts an expiring authorization.
-
-## N/A Rules
-
-Mark a category `N/A` when the unit has no corresponding input, state, or dependency. Include a short reason:
-
-- `N/A — no external provider dependency`
-- `N/A — function is pure and has no stateful side effects`
-- `N/A — pagination is handled by caller, not this unit`
-- `N/A — concurrency safety belongs to integration test because unit has no shared mutable state`

package/bundled/skills/prizmkit-test/references/test-generation-steps.md

@@ -1,118 +0,0 @@
-# Test Generation and Infrastructure Steps
-
-Use this reference during `INFRA_READY`, `TEST_BUILD`, and `EXECUTE_PROVE`. The authoritative scope and completeness inputs are `scope.json`, `behavior-risk-matrix.json`, and `test-plan.json`.
-
-## Existing-Test-First Rule
-
-Before creating a test, inspect the repository's native test files, runner configuration, and existing behavior assertions. Execute the smallest relevant existing tests first. Add, modify, or delete a repository-native test only when a concrete behavior gap is identified and recorded in the semantic preparation request. Supply project paths and behavior/layer mappings only; `prepare-tests` derives IDs, status, snapshots, and hashes from the repository and canonical Git capture. An unchanged existing test has no generated snapshot, and `generated-tests/` is never an execution workspace.
-
-
-For `scope=this-change`, changed files locate the affected module; they do not restrict tests to changed lines. Fill observable behavior/risk gaps across the whole affected module and execute its Regression Ring. Unrelated modules remain out of scope unless they are direct callers, consumers, shared contracts, or state dependencies.
-
-Do not infer current-change scope from a directory name alone. Unknown scope is `TEST_BLOCKED`.
-
-## Native Infrastructure Discovery
-
-Before writing tests:
-
-1. Inspect manifests, lockfiles, existing test files, runner configuration, scripts, fixtures, and CI commands.
-2. Select the existing adequate runner and naming/import/mock conventions.
-3. Let the target project's semantics determine framework, argv, cwd, timeout, attempts, concurrency, Mock tooling, layers, module roots, inventory patterns; do not import fixed ecosystem defaults from this skill.
-4. If no adequate infrastructure exists, add only the smallest project-native runner/config/dependencies required for the planned layers.
-5. Verify dependency versions against the package registry before writing manifests.
-6. Record every file/dependency/command change and verification in `infrastructure-changes.json`.
-7. Never delete existing tests or add a second framework when the current one is adequate.
-
-Create fixtures, fakes, contract-backed mock servers, browser harnesses, or isolated services only when required by `test-plan.json`. Every disposable resource needs a unique ID, bounded lifetime, and verified cleanup.
-
-## Matrix-First Test Construction
-
-For every behavior row:
-
-1. Read the public interface, contract source, preconditions, inputs/boundaries, outputs, side effects, transitions, and errors.
-2. Inspect existing test assertions—not names—to find proven cells.
-3. Assess all eight risks: functional, boundary, permission, concurrency, idempotency, time, dependency, and consumer.
-4. For every applicable risk, map one or more builder-generated test units and expected execution layer; do not invent a separate AI-maintained ID for every test function.
-5. For every non-applicable risk, record a concrete rationale tied to this behavior.
-6. Keep unresolved truth or untestable necessary behavior explicit; it blocks rather than becoming guessed expected behavior.
-
-A module is complete when all observable behaviors and applicable risks have mapped, proven tests and the Regression Ring passes. Line/branch/function coverage may reveal an omission and trigger another matrix review, but a percentage cannot complete a cell.
-
-## Risk-Adaptive Layers
-
-Choose only necessary test types, then assess all ordered layers in `test-plan.json`:
-
-- **Unit/focused:** pure behavior, boundaries, errors, deterministic collaborators, and fast defect localization.
-- **Module/component:** public module behavior with internal collaborators composed as production uses them.
-- **Contract:** producer/consumer or adapter compatibility against a shared/snapshotted machine-readable contract.
-- **Integration:** multiple local modules or isolated infrastructure when mocks cannot establish the relevant property.
-- **Code-level E2E:** CLI/UI/API flow through code-level boundaries when user-visible composition is at risk and a native harness is available.
-- **Affected-module regression:** every required test for the complete affected module.
-- **Regression Ring:** direct callers, consumers, shared contracts, and state dependencies.
-
-Do not require every layer mechanically. An omitted layer needs a specific reason such as “pure library has no UI or process boundary; module tests prove its public composition.” “Not tested” is not a rationale.
-
-## Contract-Driven Doubles
-
-Read `${SKILL_DIR}/references/contract-mock-protocol.md` for external databases, queues, filesystems, SaaS, browser backends, and cross-module endpoints.
-
-Prefer shared OpenAPI/schema/types/generated models. Otherwise snapshot a locally derived contract and record derivation source. Generate success, boundary, malformed, timeout, and failure variants from that contract. Reject independently invented fields or a mock that cannot be traced to a snapshot.
-
-Code-level evidence is mock-first and always reports `environment_claim=mocked-code-level-only`. Do not connect production or a user-linked deployed test database.
-
-## Whole-Module Legacy Gap Filling
-
-When a changed module has incomplete tests:
-
-- enumerate every observable public behavior, not only changed exports;
-- cover valid/minimal/complex inputs and contract-defined boundaries;
-- cover outputs and response shape;
-- assert side effects and absence of partial effects on failure;
-- cover state transitions and idempotency where applicable;
-- cover permissions, concurrency, clocks, external dependency failures, and consumer assumptions where applicable;
-- avoid tests for unrelated private implementation lines.
-
-Use `${SKILL_DIR}/references/service-boundary-test-catalog.md` to discover domain-specific risks, then map only contract-supported expectations.
-
-## Testability Seams
-
-If production code cannot be controlled:
-
-1. Prefer injecting an existing dependency abstraction.
-2. Otherwise extract a pure function, add an internal adapter, or make state/clock/randomness controllable.
-3. Keep the public contract and observable behavior unchanged.
-4. Record the production patch and behavior-preservation evidence.
-
-If a public production contract must change, do not proceed autonomously; return `TEST_BLOCKED`.
-
-## Valid Failures
-
-Distinguish:
-
-- **Test construction defect:** wrong import, syntax, fixture, mock contract, or runner usage. Fix the test/infrastructure within bounded attempts.
-- **Reliable implementation/contract failure:** valid test against resolved truth repeatedly fails. Preserve the failure and return `TEST_FAIL`; do not repair business behavior here.
-- **Uncertain/flaky/unavailable:** truth unresolved, required test unreliable, infrastructure unavailable, or cleanup fails. Return `TEST_BLOCKED`.
-
-Never retry until green or silently weaken an assertion/scope.
-
-## Current-State Execution Evidence
-
-Run selected tests in order through the bundled evidence builder: focused, module/component, contract/integration, affected-module regression, Regression Ring. The model writes schema-shaped requests; the builder performs the process and appends immutable runner-generated receipts to `executions.json`.
-
-For each new/changed necessary behavior test:
-
-1. Execute each required layer in order through the builder in the target project root.
-2. Preserve runner-generated receipts and complete stdout/stderr for every selected execution.
-3. Bind each applicable behavior risk to planned tests and selected execution IDs.
-4. Do not create historical checkouts, controlled mutations, or worktrees; current-state conformance is the testing-domain claim.
-
-
-## Completion Check
-
-Before packaging:
-
-- no applicable matrix cell lacks test/execution mapping;
-- all required planned layers have reliable selected executions in order;
-- affected-module and Regression Ring regressions are complete;
-- no verdict-capable unresolved edge remains for pass;
-- budgeted/staged work is complete, otherwise `TEST_BLOCKED`.

package/bundled/skills/prizmkit-test/references/trusted-evidence-execution.md

@@ -1,107 +0,0 @@
-# Trusted Evidence Execution
-
-Load this reference before `SCOPE_DISCOVER`, `EXECUTE_PROVE`, resume, or replay. It defines which choices remain with the model and which evidence mechanics are fixed.
-
-## Two Parameter Classes
-
-### Model-Chosen Project Parameters
-
-Inspect the target project and choose these semantically:
-
-- native test framework, runner, command, flags, and working directory;
-- timeout, attempt/retry policy, concurrency, resource limits, and isolation strategy;
-- unit/module/contract/integration/code-level E2E layers;
-- fixture, fake, Mock, service-double, browser, and database technology;
-- module roots, public behavior boundary, inventory patterns, exclusions, and Regression Ring;
-- environment classification and endpoint allow/deny evidence.
-
-The protocol does not prescribe Jest, pytest, a timeout number, a retry count, coverage threshold, runner flag, or mutation package. Record the reason for each choice in request and planning records.
-
-### Protocol-Fixed Locators and Mechanisms
-
-The protocol fixes only what trustworthy, replayable packaging needs:
-
-- locator arguments: project root, evidence directory, request/manifest/inventory/receipt path;
-- schema-shaped request records;
-- project-root and evidence-root path confinement;
-- actual child-process execution without a shell;
-- complete stdout/stderr capture and output hashes;
-- complete effective environment and tool-probe capture;
-- runner-generated UUID receipt, request hash, and runner hash;
-- append-only execution history;
-- direct current-workspace native execution with runner receipts;
-- deterministic resume invalidation calculation;
-- strict schema and cross-record validation.
-
-## Trust Boundary
-
-A receipt proves that the bundled runner produced a record with the captured inputs and outputs during this invocation. The runner snapshots its own executable bytes inside the evidence package so later validation does not silently depend on whichever PrizmKit version happens to be installed. Hashes bind bytes together and detect later drift. They do not create cryptographic non-repudiation and cannot prove that a same-OS-user, same-permission producer did not replace the runner, requests, repository, or evidence package before validation.
-
-Treat evidence as auditable project-controlled provenance, not a defense against a malicious same-privilege actor. The validator checks consistency, obvious conflicts, and replayability; it cannot mathematically prove that the model found every business behavior.
-
-## Builder Commands
-
-Drive a new package through the canonical lifecycle. Semantic request files remain model-authored; authoritative package records remain tool-owned. The builder applies a bounded default timeout when the request omits one, preserves common native cache variables, and returns a bounded unreliable receipt on timeout. The normal user path should author one semantic request and one execution plan; use individual lifecycle commands only for recovery or protocol debugging.
-
-```bash
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> init --baseline <commit>
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> capture-change
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> inventory --request requests/inventory.json
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> execute --request requests/focused.json
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py --project-root <root> --evidence-dir <staging> finalize --request requests/finalize.json
-```
-
-`<staging>` must be a child of `.prizmkit/test/evidence/`. After `finalize`, the package is `payload-finalized`; run the validator pre-check and then `validate_test_evidence.py --attest` to seal it. Do not treat the pre-attestation staging package as immutable or invoke `render-report` after sealing.
-
-
-```bash
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py \
-  --project-root <target-project-root> \
-  --evidence-dir <evidence-dir> \
-  inventory --request requests/inventory.json
-
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py \
-  --project-root <target-project-root> \
-  --evidence-dir <evidence-dir> \
-  execute --request requests/focused.json
-
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py \
-  --project-root <target-project-root> \
-  --evidence-dir <evidence-dir> \
-  execute --request requests/focused.json
-
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py \
-  --project-root <target-project-root> \
-  --evidence-dir <evidence-dir> \
-  resume --manifest manifest.json --inventory target-inventory.json
-```
-
-The subcommands cover fixed mechanics only:
-
-- `inventory`: expand model-selected project-relative patterns, independently enumerate all actual files under each declared module root, reject files that are neither categorized nor structurally excluded, hash actual files, and bind discovery inputs;
-- `execute`: run the declared native command in the current project workspace and append a runner-generated receipt;
-- `resume`: compare hashes and stage outputs to compute an invalidation decision while retaining `semantic_review_required=true`.
-
-## Replay
-
-Replay a prior receipt through the runner rather than treating attestation as historical proof:
-
-```bash
-python3 ${SKILL_DIR}/scripts/build_test_evidence.py \
-  --project-root <target-project-root> \
-  --evidence-dir <evidence-dir> \
-  execute --replay-receipt receipts/<receipt>.json
-```
-
-The recorded request hash must still match. Replay emits a new receipt linked with `replay_of`; it never overwrites the historical receipt. A replay can still differ because project state, installed tools, clocks, external test services, or environment values changed. Report those differences instead of claiming historical equivalence.
-
-## External Target Safety
-
-Do not block merely because a string contains `production`; names can be misleading. Classify every external target using endpoint/configuration evidence:
-
-- block `production` and `unknown` external targets;
-- permit only model-classified isolated/test/staging targets with explicit allow evidence and no deny evidence;
-- preserve the complete evidence used for the decision;
-- keep local fakes and in-process contract mocks classified `local` with `external=false`.
-
-The model owns the semantic classification; the runner enforces the declared production/unknown safety invariant and rejects contradictory allow/deny records.