prizmkit 1.1.154 → 1.1.156

package/bundled/skills/prizmkit-test/references/boundary-contract-and-test-double-guidance.md

@@ -0,0 +1,206 @@
+# Boundary Contract and Test Double Guidance
+
+## Purpose
+
+Apply one contract discipline to every serialized or producer-consumer boundary, whether internal or external: browser/backend APIs, cross-module endpoints, persistence, queues, filesystems, caches, generated clients/servers, SDK providers, and any test double that replaces a producer or consumer.
+
+Mocks are test tools, not proof of provider behavior or a deployed environment. Consumer-local types, fixtures, and mocks are expectations, not provider truth. A test cannot prove a property that depends on production composition it replaces.
+
+## Boundary-Specific Contract Authority
+
+Choose the highest authority that actually defines the property at the tested boundary:
+
+1. confirmed specification;
+2. machine-readable wire contract, such as OpenAPI, JSON Schema, Protocol Buffers, GraphQL, or AsyncAPI;
+3. type, client, server stub, or fixture that is traceably generated from that contract;
+4. provider raw-wire contract test or explicitly authorized isolated provider observation;
+5. provider implementation, version-locked SDK behavior, and matching public official service documentation;
+6. consumer-local types, existing tests, historical fixtures, and mocks.
+
+Lower-authority material cannot override higher-authority material. A generated artifact must retain traceable provenance. A database schema can define applicable persistence structure and constraints, but a database schema cannot independently prove network serialization. Current provider implementation is evidence, not automatic product truth when it conflicts with a higher-authority contract.
+
+Use the current locked/provider version when behavior differs by version. Record the source path, public URL, document/version identifier, generated provenance, raw-wire test, or isolated observation used in `test-report.md`.
+
+Never invent fields, statuses, error shapes, retry rules, pagination behavior, ordering, or timing guarantees without a traceable source. If authorities conflict and expected behavior cannot be resolved safely, return `TEST_BLOCKED`.
+
+## Safe Documentation Retrieval
+
+Public official service documentation retrieval may be used only to read the minimum contract material needed for tests.
+
+- Do not send source code, repository-private content, proprietary payloads, secrets, credentials, or user data to a public endpoint.
+- Prefer a project-local or vendored source when it is authoritative.
+- Distinguish official provider documentation from blogs, examples, forum answers, and third-party tutorials.
+- When official sources conflict with the project's pinned generated client or schema, apply the skill's truth precedence and report the conflict.
+- If the required contract cannot be established, return `TEST_BLOCKED` when it prevents a safe verdict.
+
+## Boundary and Test-Double Inventory
+
+Inventory every test double that crosses or replaces a producer-consumer boundary, including mocks, fakes, fixtures, route interceptions, mock servers, containers, emulators, and isolated services. Record:
+
+| Field | Required Content |
+|---|---|
+| Producer | Component that creates the value, message, file, state, or response. |
+| Consumer | Component that parses, reads, maps, or acts on it. |
+| Boundary type | Internal/external API, module, persistence, queue, filesystem, cache, generated client/server, or other boundary. |
+| Serialization or protocol | JSON, HTTP, event/message, database encoding, file format, RPC, or other wire form. |
+| Contract authority | Boundary-appropriate source and provenance from the authority order. |
+| Test Double | Mock, fake, fixture, interception, server, container, emulator, or isolated service. |
+| Fidelity proof | Generation, schema validation, shared raw-wire fixture, contract framework, or authorized isolated observation. |
+| Composition removed | Serializer, adapter, network, provider, persistence, process, or other production component replaced. |
+| Property not proven | Behavior that depends on the removed composition. |
+| Composition-preserving test | Contract, integration, or Full-stack path that keeps the verdict-relevant combination real. |
+| Remaining risk | Unproven behavior and its effect on the verdict. |
+
+A boundary with no test double still records its authority and the composition-preserving test when that boundary affects the verdict.
+
+## Test-Double Fidelity Proof
+
+A cross-boundary test double is fidelity-proven only when at least one of these applies:
+
+- generated from the authoritative contract with provenance;
+- validated against the authoritative schema during tests;
+- shared with a provider raw-wire contract test that validates the same fixture;
+- captured through an explicitly authorized isolated provider observation with source/version provenance;
+- checked by the project's consumer/provider contract framework.
+
+A consumer-authored ideal fixture without one of these proofs may support local UI or logic tests, but it does not count as provider compatibility evidence. Record its proof boundary explicitly.
+
+## Build the Smallest Faithful Double
+
+Use the target project's existing fake, fixture, mock library, mock server, container, or isolated service when adequate. Model only behavior relevant to the affected module, but preserve the contract property being tested.
+
+Applicable variants include:
+
+- normal success;
+- empty success;
+- minimum, maximum, pagination, cursor, or size boundary;
+- malformed or contract-invalid response;
+- timeout or cancellation;
+- rate limiting or quota rejection;
+- authentication or authorization rejection;
+- transient service failure;
+- permanent service failure;
+- partial response or interrupted stream;
+- retry, replay, and idempotency behavior;
+- transaction, constraint, rollback, or conflict behavior for stateful services.
+
+Do not require every variant mechanically. Select variants from the actual behavior/risk model and explain material omissions.
+
+## Assertions
+
+Assert the application's observable handling of the contract:
+
+- outbound request shape, required headers or metadata, and serialization;
+- response mapping, nullability, enum and format handling;
+- retry count and retryable versus permanent classification;
+- timeout and cancellation propagation;
+- pagination and cursor behavior;
+- idempotency and side-effect counts;
+- state transition, rollback, cleanup, and absence of partial effects;
+- consumer-visible error type or result.
+
+A mock-success-only test is insufficient when dependency failure can change observable behavior.
+
+### Provider Raw-Wire Assertions
+
+A Provider Contract Test for an HTTP response, message, event, file, cache value, or other serialized output must inspect the raw wire payload before any provider-owned model rehydrates it. Select risk-relevant assertions for:
+
+- required, optional, omitted, `null`, empty, and zero values;
+- field names, scalar types, enums, formats, timestamps, and default/omission behavior;
+- status or result code, error envelope, required headers, and metadata;
+- exact bytes or encoding when consumers depend on them.
+
+Deserializing output back into the provider's own model is not sufficient because defaults and zero values can conceal missing fields, nullability changes, or serializer-tag drift.
+
+## Avoid Over-Mocking
+
+Keep production composition real when that composition is the property under test. Mock at a stable external boundary rather than mocking the method being verified or every internal collaborator.
+
+Reject a double when it:
+
+- repeats the current implementation instead of the external contract;
+- bypasses serialization, mapping, retries, or state transitions under test;
+- returns impossible provider behavior;
+- asserts only that a mock was called without proving the business result;
+- silently drifts from the project or official contract.
+
+Use contract/integration or isolated infrastructure tests when a mock cannot preserve the relevant transaction, protocol, or composition property.
+
+## Test Layer Taxonomy
+
+Classify a test by the production composition it actually executes, not by runner or user-interface presence:
+
+| Layer | Critical Provider Replaced? | Proof Capability |
+|---|---:|---|
+| Focused / Unit Test | yes | Local logic, boundaries, and deterministic errors. |
+| UI Component Test | yes | Component rendering and interaction under supplied data. |
+| Mock Browser Test | yes | Browser UI workflow under intercepted or fixture-backed boundaries. |
+| Consumer Contract Test | contract-validated double | Consumer handling of the authoritative contract. |
+| Provider Contract Test | not applicable | Provider raw wire behavior at its serialization boundary. |
+| Integration Test | no for the combination under test | The named modules or infrastructure composed together. |
+| Full-stack E2E | no for critical production boundaries | Complete user path across real application layers in safe isolation. |
+
+Browser execution alone does not make a test Full-stack E2E. A browser test that intercepts a critical API is a Mock Browser Test and cannot prove browser/backend compatibility, provider serialization, persistence, or reload behavior.
+
+## Composition-Preserving Verdict Rule
+
+Locate each material risk in the combination where the defect can occur. Preserve that combination for risks involving consumer/provider serialization, UI/API behavior, API/persistence behavior, generated client/server compatibility, queue producer/consumer behavior, filesystem writer/reader behavior, cache producer/consumer behavior, or transaction/lock/retry/recovery state.
+
+Lower layers may diagnose a defect, but they cannot supply verdict evidence for a property that their doubles remove. Before `TEST_PASS`:
+
+1. identify every verdict-capable risk located in removed composition;
+2. require a provider contract, consumer contract plus provider raw-wire evidence, composition-preserving integration test, or Full-stack E2E path that proves the property without replacing that composition;
+3. verify the preserving test would fail while the target defect exists;
+4. record the preserving evidence and remaining risk in the report.
+
+If required composition-preserving verification cannot run in a proven safe isolated environment, return `TEST_BLOCKED`. Do not substitute a lower-layer green result or relabel a Mock Browser Test as E2E.
+
+## Databases and Stateful Services
+
+Prefer project-provided isolated infrastructure, a faithful local fake, or a disposable service. Derive structure and constraints from schemas, migrations, models, or official protocol contracts.
+
+Any disposable resource must have:
+
+- a unique non-production identity;
+- bounded lifetime;
+- deterministic setup;
+- verified cleanup;
+- no dependency on production credentials or data.
+
+Test relevant constraints, transactions, rollback, concurrency, idempotency, and failure mapping. Cleanup failure that undermines reliability produces `TEST_BLOCKED`.
+
+## Production and Data Prohibitions
+
+Never use:
+
+- production credentials or tokens;
+- production databases, APIs, queues, object storage, caches, or services;
+- real customer or user data;
+- a target whose non-production status cannot be established;
+- destructive operations against external data.
+
+Project configuration may be reused only when it demonstrably selects a safe isolated test target. If safety cannot be proven, do not connect; report the unexecuted check and return `TEST_BLOCKED` when it is necessary for the verdict.
+
+## Reporting
+
+For every verdict-relevant boundary or test double, complete the Boundary and Test-Double Inventory fields. Distinguish local/unit, consumer-contract, provider-contract, integration, Mock Browser, and Full-stack evidence. State whether a composition-preserving test exists and whether any missing proof changes the verdict.
+
+Also record:
+
+- variants exercised;
+- production resources used: `no`;
+- unresolved fidelity or deployed-environment risk.
+
+Do not claim that a local mock, fake, contract snapshot, container, isolated service, or Mock Browser Test verifies composition it replaces or a deployed production environment.
+
+## Generic Composition Example
+
+For a browser reading a provider response:
+
+1. Treat the machine-readable wire contract as the response-shape authority.
+2. Add a Provider Contract Test that asserts the raw serialized response, including a risk-relevant omitted or null field.
+3. Validate the Consumer Contract Test fixture against the same contract or share the provider-validated fixture.
+4. Classify a route-intercepted browser flow as a Mock Browser Test; it proves UI behavior under that fixture but not live browser/provider compatibility.
+5. Add a safe integration or Full-stack E2E path that keeps browser mapping, provider serialization, and required persistence real when those components contain the verdict-capable risk.
+
+The field names and protocol vary by project; the authority, fidelity, proof-boundary, and composition reasoning remain the same.

package/bundled/skills/prizmkit-test/references/independent-test-review.md

@@ -18,7 +18,7 @@ Main Agent builds and executes project-native tests
 → TEST_PASS | TEST_NEEDS_FIXES | TEST_BLOCKED
 ```
 
-Keep at most one Reviewer active for this invocation and permit at most one replacement. Prefer native continuation and never reuse a Reviewer from another lifecycle stage. A compliant replacement may continue the same shared response budget only with complete latest state, never only a conversation summary.
+Keep at most one Reviewer active for this invocation and permit at most one replacement. Prefer native continuation and never reuse a Reviewer from another invocation. A compliant replacement may continue the same shared response budget only with complete latest state, never only a conversation summary.
 
 ## Host Capability Gate
 
@@ -50,7 +50,7 @@ Rules:
 
 ## Stage-Specific Review Input
 
-Resolve exact requirement identity from workflow state or explicit handoff on every response:
+Use the exact caller-supplied testing identity on every response:
 
 ```text
 artifact_dir: [EXACT_ARTIFACT_DIR]
@@ -67,9 +67,9 @@ The Main Agent supplies:
 - exact artifact, spec, and plan paths plus current contents;
 - complete current production-and-test change;
 - affected business module, observable behaviors, applicable risks, and Regression Ring;
-- existing, added, and modified tests, fixtures, mocks, schemas, contracts, and selected layers;
+- existing, added, and modified tests, fixtures, mocks, schemas, contracts, selected layers, and the complete boundary/test-double inventory with authority, fidelity, removed composition, proof limits, preserving evidence, and verdict impact;
 - native test commands and results executed by Main Agent;
-- test-stage repairs;
+- testing-local repairs;
 - response number and total budget;
 - prior adjudication and actual corrections on continuation or replacement.
 
@@ -100,7 +100,7 @@ Execution boundaries:
 - Complete this review personally.
 - Do not create, schedule, resume, continue, request, or coordinate another execution unit.
 - Do not ask the Main Agent to create a helper.
-- Do not re-enter orchestration, delegation, another review workflow, or an equivalent process.
+- Do not re-enter delegation or another review process.
 - Do not modify, create, delete, rename, stage, commit, or otherwise mutate files.
 - Do not execute shell, Git, tests, builds, network calls, external processes, or any operation that can change state.
 - Use read-only checkout access only for concrete module, caller, consumer, schema, type, configuration, fixture, test, or contract coupling.
@@ -119,13 +119,20 @@ First validate input consistency. Then review:
 - selection of focused, module, contract/integration, applicable E2E, module-regression, and Regression Ring layers;
 - assertion strength and observable effect;
 - vacuous or false-positive tests and tests that cannot fail for the intended defect;
-- over-mocking or removal of production composition;
-- mock fidelity to project or public official contracts;
+- every producer-consumer boundary and test double having boundary-appropriate contract authority and fidelity proof;
+- any consumer-authored ideal fixture being treated only as consumer expectation unless independently contract-validated;
+- Provider Contract Tests containing raw Provider serialization evidence, including risk-relevant omitted, null, empty, zero, type, and field-name behavior;
+- each Browser Test being classified from actual production composition, with intercepted critical APIs classified as Mock Browser rather than Full-stack E2E;
+- no test claim exceeding the property its test double can prove and no verdict-capable composition being removed without preserving contract, integration, or Full-stack evidence;
+- each relevant test being able to fail while the target defect exists;
+- state-changing workflows covering commit, cancellation, failure recovery, reload or re-entry, retry/conflict/idempotency, and repeated operation semantics;
 - nondeterminism and flakiness risk;
 - native execution results matching the declared scope;
-- production repairs that require delta Code Review;
+- production defects or attempted repairs outside the permitted testing-local repair boundary;
 - remaining risks being stated honestly.
 
+Return `CORRECTION_NEEDED` when a verdict-relevant producer-consumer combination is replaced by a test double without authoritative fidelity proof and composition-preserving evidence, or when a test-layer claim exceeds the actual composition executed.
+
 Do not rewrite the requirement, modify code, execute tests, or perform broad exploration.
 Return exactly one result using the Reviewer Output Protocol.
 ```
@@ -159,7 +166,7 @@ All initial execution boundaries and the Reviewer Output Protocol remain mandato
 
 ## Reviewer Output Protocol
 
-Return exactly one form. Do not add severity, confidence, dimension, workflow routing, or acceptance fields.
+Return exactly one form. Do not add severity, confidence, dimension, caller routing, or acceptance fields.
 
 ### No Correction Needed
 
@@ -262,6 +269,7 @@ Record:
 - each response number `1..5`, input identity, result, and correction count;
 - every Main-Agent adjudication and its evidence;
 - actual repair and native verification;
+- boundary authority/fidelity, removed-composition, proof-limit, preserving-evidence, layer-classification, and mutation-lifecycle corrections;
 - whether the exact final state was independently rechecked;
 - capability basis, continuation mode (`native`, `replacement`, `mixed`, or `not-applicable`), and replacement count.
 

package/bundled/skills/prizmkit-test/references/test-coverage-model.md

@@ -40,16 +40,16 @@ Record dynamic or unprovable coupling as a remaining edge. An edge that can chan
 
 ## Truth Precedence
 
-Resolve expected behavior in this order:
+Resolve expected business behavior from confirmed specifications and acceptance criteria before lower-authority observations. For a producer-consumer boundary, apply the boundary-specific authority in `boundary-contract-and-test-double-guidance.md`:
 
 1. confirmed specification;
-2. machine-readable contract;
-3. acceptance criteria;
-4. trusted existing tests;
-5. callers and consumers;
-6. current implementation.
+2. machine-readable wire contract;
+3. traceably generated type, client, server stub, or fixture;
+4. provider raw-wire contract evidence or authorized isolated observation;
+5. provider implementation, locked SDK behavior, and matching official documentation;
+6. trusted existing tests, callers and consumers, consumer-local types/fixtures/mocks, and other current implementation evidence.
 
-Do not encode a possible implementation defect as expected behavior. Conflicting higher-precedence truth that cannot be resolved produces `TEST_BLOCKED`.
+Lower-authority material cannot override a higher-authority source or prove a property outside its boundary. Do not encode a possible implementation defect as expected behavior. Conflicting higher-precedence truth that cannot be resolved produces `TEST_BLOCKED`.
 
 ## Behavior Inventory
 
@@ -88,6 +88,21 @@ Cover validation, dependency, malformed-response, timeout, cancellation, cleanup
 
 Cover valid and invalid transitions, retries, repeated calls, writes, events, call counts, ordering, rollback, and cleanup.
 
+For every applicable state-changing user or system workflow, model and test the complete mutation lifecycle:
+
+1. precondition;
+2. input or selection;
+3. explicit commit point;
+4. cancel without side effects before commit;
+5. pending and duplicate-action protection;
+6. success visibility;
+7. failure recovery and absence of partial effects;
+8. reload or re-entry, including process restart when relevant;
+9. retry, conflict, and idempotency behavior;
+10. downstream read or consumption of the committed result.
+
+If the confirmed specification does not establish the commit point or interaction semantics, request clarification or return `TEST_BLOCKED` when the ambiguity affects the verdict. Do not infer the expected workflow from the current implementation.
+
 ### Permission
 
 Apply to identity, role, tenant, ownership, policy, entitlement, secret, or protected-resource behavior. Include missing/invalid identity, wrong owner or tenant, insufficient grants, and default-deny behavior.
@@ -112,20 +127,26 @@ Apply to databases, filesystems, queues, providers, clocks/randomness, cross-mod
 
 Apply when callers depend on return shape, errors, side effects, ordering, generated assets, shared types, contracts, state, or invocation conventions.
 
-## Layer Selection
+## Layer Selection and Proof Capability
 
-Use the lowest layer that proves a property without removing relevant composition.
+Use the lowest layer that proves a property without removing relevant composition. Classify tests by components actually executed:
 
 | Layer | Use For |
 |---|---|
-| Focused/unit | Critical pure logic, exact boundaries, deterministic errors, fast localization. |
-| Module/component | Public module behavior with internal collaborators composed as production uses them. |
-| Contract/integration | Shared protocol compatibility or isolated infrastructure that mocks cannot adequately prove. |
-| Code-level E2E | User-visible CLI, API, or UI composition when an applicable native harness exists. |
+| Focused / Unit Test | Critical pure logic, exact boundaries, deterministic errors, and fast localization; dependencies may be replaced. |
+| Module / Component Test | Public module behavior or UI component behavior under supplied dependencies. |
+| UI Component Test | Rendering and interaction with provider compatibility explicitly out of scope. |
+| Mock Browser Test | Browser workflow with an intercepted or fixture-backed critical boundary; not Full-stack evidence. |
+| Consumer Contract Test | Consumer handling against a contract-validated test double. |
+| Provider Contract Test | Provider raw wire payload at its serialization boundary. |
+| Integration Test | A named module/infrastructure combination with that combination kept real. |
+| Full-stack E2E | Complete user path with critical application boundaries not replaced. |
 | Affected-module regression | Every required test for the complete affected module. |
 | Regression Ring | Concrete callers, consumers, contracts, adapters, and shared state dependencies. |
 
-Not every behavior needs every layer. Record a concise reason for omitted higher layers, such as a pure library having no process or UI boundary.
+Browser execution alone does not determine the layer. Every test claim must state the property proved and any property not proven because a test double removes relevant composition.
+
+Not every behavior needs every layer. Record a concise reason for omitted higher layers, such as a pure library having no process or UI boundary. A missing layer blocks `TEST_PASS` only when it is needed to preserve a verdict-capable combination.
 
 ## Critical Low-Level Logic
 
@@ -182,12 +203,15 @@ Coverage is complete enough for `TEST_PASS` only when:
 1. every discoverable observable behavior is represented;
 2. every applicable risk has a credible project-native test;
 3. critical low-level logic has direct focused coverage when justified;
-4. selected layers preserve the property being proved;
-5. complete affected-module regression passes;
-6. Regression Ring verification passes;
-7. concrete unresolved coupling no longer affects the verdict;
-8. Main-Agent review converges;
-9. applicable independent review converges or is strictly downgraded;
-10. no mutation follows final review and execution.
+4. every verdict-relevant boundary and test double has contract authority, fidelity proof, removed-composition, proof-limit, and remaining-risk analysis;
+5. selected layers preserve the property being proved and composition-preserving evidence covers every verdict-capable removed combination;
+6. provider contracts inspect risk-relevant raw wire output;
+7. applicable state-changing workflows cover commit, cancellation, failure, re-entry, and repeated-operation semantics;
+8. complete affected-module regression passes;
+9. Regression Ring verification passes;
+10. concrete unresolved coupling no longer affects the verdict;
+11. Main-Agent review converges;
+12. applicable independent review converges or is strictly downgraded;
+13. no mutation follows final review and execution.
 
 Absolute completeness cannot be guaranteed. State remaining informational risks honestly without presenting them as proven behavior.

package/bundled/skills/prizmkit-test/references/test-report-template.md

@@ -49,7 +49,7 @@ Coverage metrics, when available: <diagnostic values or not collected>. Percenta
 
 | Path | Layer | Behaviors and Risks | Change |
 |---|---|---|---|
-| <path> | focused / module / contract / integration / E2E / regression | <coverage> | added / updated / existing |
+| <path> | focused/unit / module/component / UI component / Mock Browser / consumer contract / provider contract / integration / Full-stack E2E / regression | <coverage and proof boundary> | added / updated / existing |
 
 - Existing native framework reused: <yes/no and framework>
 - Infrastructure changes: <none or concise list>
@@ -104,12 +104,19 @@ Coverage metrics, when available: <diagnostic values or not collected>. Percenta
 - Review scope: delta / none
 - Rationale: <contract and risk analysis>
 
-## External Contracts and Mocks
+## Boundary Contracts and Test Doubles
 
-| Dependency | Contract Source | Test Double / Isolation | Variants | Remaining Risk |
+| Boundary | Contract Authority | Fidelity Proof | Test Double | Composition Removed |
 |---|---|---|---|---|
-| <dependency> | <project path or public official source/version> | <mock/fake/server/container/isolated service> | <success/boundary/failure variants> | <none or risk> |
+| <producer → consumer; protocol> | <boundary-appropriate source and provenance> | <generation/schema/raw-wire/shared fixture/isolated observation/contract framework> | <mock/fake/fixture/interception/server/container/service or none> | <serializer/adapter/network/provider/persistence/process or none> |
 
+| Property Not Proven | Composition-Preserving Test | Evidence Classification | Remaining Risk / Verdict Impact |
+|---|---|---|---|
+| <property outside the double-backed proof boundary> | <provider/consumer contract, integration, Full-stack E2E, or missing> | <local / consumer contract / provider contract / integration / Mock Browser / Full-stack> | <none, informational, TEST_NEEDS_FIXES correction, or TEST_BLOCKED prerequisite> |
+
+- Test-layer claims match actual composition: yes / no
+- Every verdict-capable removed combination has preserving evidence: yes / no
+- Provider raw wire asserted where serialization affects the verdict: yes / no / not-applicable
 - Production credentials or resources used: no
 - Real deployed environment validated: no
 
@@ -125,15 +132,18 @@ Render `TEST_PASS` only when:
 - mandatory Main-Agent review converged;
 - independent review converged or was visibly downgraded under its strict capability gate;
 - all required native tests pass on the exact final state;
+- every verdict-relevant test double has boundary-specific authority and fidelity proof;
+- every verdict-capable property removed by a double has composition-preserving evidence, and every layer claim matches actual composition;
+- applicable provider contract tests assert risk-relevant raw wire payload and state-changing workflows cover commit, cancellation, failure, re-entry, and repeated-operation semantics;
 - no accepted or unresolved finding remains;
-- no high-risk production repair awaits delta Code Review;
+- no high-risk production defect or correction remains;
 - no mutation occurred after final applicable review and execution.
 
-Render `TEST_NEEDS_FIXES` for a known remaining correction, exhausted review/repair budget with known work, or a completed high-risk repair requiring delta Code Review.
+Render `TEST_NEEDS_FIXES` for a known remaining correction, an exhausted testing-local review/repair budget with known work, or a proven high-risk production defect that this invocation must not repair.
 
-Render `TEST_BLOCKED` when truth, required input, safe environment, execution reliability, external-target safety, or required Reviewer input prevents a safe verdict.
+Render `TEST_BLOCKED` when truth, required input, safe environment, execution reliability, external-target safety, or required Reviewer input prevents a safe verdict. This includes unavailable required composition-preserving execution and unresolved contract authority or test-double fidelity that affects the verdict; lower-layer green tests cannot substitute.
 
-No conditional pass, commit authorization, release authorization, runtime classification, target hash, manifest, attestation, or package lifecycle belongs in the report.
+No conditional pass, commit authorization, release authorization, runtime classification, target hash, manifest, attestation, or package state belongs in the report.
 
 ## Terminal Machine Projection
 
@@ -153,8 +163,6 @@ Write `test-result.json` together with the report:
   },
   "repair_rounds": 0,
   "production_changed": false,
-  "review_required": false,
-  "review_scope": null,
   "unresolved_items": []
 }
 ```
@@ -170,7 +178,6 @@ Constraints:
 - `downgraded` requires `responses=0`, a non-empty `downgrade_reason`, and `final_state_rechecked=false`.
 - `not_applicable` requires `responses=0`, `downgrade_reason=null`, and `final_state_rechecked=false`.
 - `independent_review.responses` is otherwise bounded from `0` through `5`.
-- `review_scope` is `delta` exactly when `review_required=true`; otherwise it is null.
-- `unresolved_items` contains concise strings and agrees with the report.
-- Report and JSON agree on final result and production-review requirement.
+- `TEST_PASS` requires an empty `unresolved_items`; `TEST_NEEDS_FIXES` and `TEST_BLOCKED` each require at least one concise correction or blocker string, and the list agrees with the report.
+- Report and JSON agree on final result and production-change diagnostics.
 - The JSON is terminal output only and is never updated as an internal checkpoint.