prizmkit 1.1.159 → 1.1.160

package/bundled/skills/prizmkit-prizm-docs/references/op-update.md

@@ -7,10 +7,10 @@ PRECONDITION: `.prizmkit/prizm-docs/` exists with `root.prizm`.
 Use this operation for manual edits, merges, rebases, branch switches, generated code movement, or other changes that did not pass through `/prizmkit-retrospective`. During ordinary feature/bugfix/refactor work, use `/prizmkit-retrospective` instead.
 
 STEPS:
-1. Identify drift source. Prefer explicit user context; otherwise inspect git changes with `git diff --cached --name-status`, then `git diff --name-status`. If no git changes exist, run a bounded rescan comparing code structure against existing docs.
+1. Identify drift source from explicit user context when supplied; otherwise run a bounded source/document rescan over registered modules and concrete missing/stale pointers. Do not require Git history, inspect tracking state, or change behavior because managed files are ignored, untracked, or tracked.
 2. Map changed files to modules through MODULE_INDEX or MODULE_GROUPS in `root.prizm`, then resolve mirrored SUBDIRS or flat-module DETAILS ownership from the relevant L1.
 3. Classify each source change as A, D, M, or R, but do not mechanically turn changes into documentation. Treat every possible file, interface, dependency, flow, trap, decision, rule, and summary as a candidate and apply the future-incorrect-modification Value Gate.
-4. Before writing any existing L2, L1, or L0 target, read that target and its resolving parent/child pointers. Build a protected set of still-valid public/wire contracts, cross-module constraints, non-obvious dependencies, traps, decisions with necessary rationale, likely-to-recur rejected alternatives, side effects, and security/data-integrity/concurrency/transaction/compatibility rules.
+4. Before writing any existing L2, L1, or L0 target, read that complete target and complete resolving parent/child pointer documents. Build a protected set of still-valid public/wire contracts, cross-module constraints, non-obvious dependencies, traps, decisions with necessary rationale, likely-to-recur rejected alternatives, side effects, and security/data-integrity/concurrency/transaction/compatibility rules.
 5. Apply the Cleanup Gate by semantic meaning:
    - update an equivalent entry in place rather than appending alternate wording
    - merge synonymous entries into one shortest complete meaning
@@ -27,8 +27,9 @@ STEPS:
    - semantic details require the complete CONCERN terminal shape, explicit non-empty/non-overlapping FILES ownership, and one resolving L1 DETAILS entry
    - ambiguous concern identity, empty normalization, mirrored-path/slug collision, or overlapping ownership blocks creation and reports the manual decision; never use task IDs or numeric suffixes
 11. Measure all affected targets by exact raw UTF-8 bytes with L0/L1 4096B and L2 5120B limits. Natural content below 80% remains unchanged; warning-range content is valid and reported. Clean, move, or safely split rewritten targets at 90% or above toward 3277-3686B for L0/L1 or 4096-4607B for L2. If a hard-limit error or repeated pressure cannot be resolved without deleting protected knowledge, block the write.
-12. Validate Value/Cleanup compliance, parent-summary boundaries, semantic ownership/identity, pointers, hierarchy, capacity, memory hygiene, and format. Warning-only capacity results pass; hard-limit or format errors fail.
-13. Report updated, created, removed, merged, protected, and skipped facts/docs with reasons plus capacity diagnostics ordered by descending utilization.
-14. Stage updated `.prizm` files with `git add .prizmkit/prizm-docs/` only after reviewing the repair summary.
+12. Preflight complete candidate bytes, write validated targets bottom-up, compare each candidate with current bytes, and skip byte-identical replacements.
+13. Re-read actual bytes and validate Value/Cleanup compliance, parent-summary boundaries, semantic ownership/identity, pointers in both directions, hierarchy, capacity, memory hygiene, and format. Warning-only capacity results pass; hard-limit or format errors fail.
+14. If any post-write check fails, restore every existing target to its exact pre-write bytes and remove invalid new targets before returning a blocker.
+15. Report updated, created, removed, merged, protected, and skipped facts/docs with reasons plus capacity diagnostics ordered by descending utilization. Do not stage, commit, force-add, modify or interpret ignore policy, or require Git history.
 
 OUTPUT: List updated, created, removed, merged, protected, and skipped docs/facts with reasons; sorted capacity diagnostics; ambiguity blockers; and an explicit statement that this was out-of-band repair/resync, not a normal development retrospective.

package/bundled/skills/prizmkit-prizm-docs/references/op-validate.md

@@ -5,17 +5,18 @@ Check format compliance and consistency of all .prizm docs.
 PRECONDITION: .prizmkit/prizm-docs/ exists.
 
 STEPS:
-1. FORMAT CHECK: Verify all `.prizm` files use KEY: value format. Flag prose paragraphs, code blocks, markdown headers, emoji, ASCII art, horizontal rules, invalid TRAPS severity, and prohibited history/date/workflow/branch/absolute/artifact metadata. `[REVIEW]` before severity remains a valid temporary staleness marker.
-2. VALUE CHECK: Flag source-derivable signatures/structure, task or change history, test inventories, temporary conclusions, stale statements, duplicate meanings, long procedures, low-value file lists, line-count/complexity inventories, and parent copies of complete child behavior. Do not flag a still-valid public/wire contract, cross-module constraint, non-obvious dependency, trap, durable decision/rejected rationale, side effect, or security/data-integrity/concurrency/transaction/compatibility rule merely because it consumes capacity.
-3. CAPACITY CHECK: Measure exact raw UTF-8 bytes. Classify only the exact root as L0/4096B, direct children as L1/4096B, and nested mirrored or semantic documents as L2/5120B. Bands are normal below 80%, warning from 80% to below 90%, strong-warning from 90% through 100%, and error above 100%.
-4. CAPACITY REPORT: Sort all non-normal entries by exact descending utilization using integer ratio comparison, then repository-relative path for ties. Every entry includes path, level, current bytes, hard limit, band, target range (3277-3686B for L0/L1; 4096-4607B for L2), and level-appropriate trim, deduplicate, move-to-child, or semantic-split actions consistent with the canonical F-063 classifier.
-5. CAPACITY RESULT: Warning and strong-warning entries are advisory and do not fail Validate when no other violation exists. Any byte above a hard limit is an error and fails; format, pointer, hierarchy, ownership, or completeness errors also fail and are never downgraded because capacity is only a warning.
-6. POINTER/PARENT CHECK: Verify every arrow resolves. L0/L1 contain concise summaries and pointers rather than copied L2 INTERFACES/DATA_FLOW/TRAPS/DECISIONS/full RULES. SUBDIRS targets mirrored source-submodule L2. DETAILS uses exactly `- <concern-slug>: <one-line stable behavior summary> -> .prizmkit/prizm-docs/<module>/<concern-slug>.prizm` and targets one matching semantic L2.
-7. SEMANTIC IDENTITY/OWNERSHIP CHECK: For each semantic L2, verify required fields MODULE, CONCERN, FILES, RESPONSIBILITY, INTERFACES, DATA_FLOW, KEY_FILES, DEPENDENCIES, RULES, TRAPS, and DECISIONS; verify `CONCERN: <stable concern identity> | SLUG: <concern-slug>`; rerun Unicode NFKC/lowercase/kebab normalization; require non-empty explicit repository-relative FILES ownership with no sibling overlap; and require exact parent/path/slug agreement. A mirrored source-submodule path has precedence. Ambiguous identity, collision, or overlap is a validation error requiring a manual decision, not a numbered or task-named repair.
-8. COMPLETENESS CHECK: Verify root has PRIZM_VERSION, PROJECT, LANG, and exactly one of MODULE_INDEX/MODULE_GROUPS. Verify L1 has MODULE, FILES, RESPONSIBILITY, DEPENDENCIES and no behavioral sections. Verify mirrored L2 has MODULE, FILES, RESPONSIBILITY, INTERFACES, KEY_FILES, DEPENDENCIES, and TRAPS with no CONCERN field; DATA_FLOW, RULES, DECISIONS, and domain sections remain optional when no fact passes the Value Gate. In semantic L2 only, explicit `<SECTION>: none` satisfies a required behavioral section when no fact passes the Value Gate.
-9. STALENESS CHECK: Compare each document's git modification time with its mapped source directory or semantic FILES ownership. Flag source-newer documents. Without git history, use filesystem timestamps and report reduced accuracy.
-10. RULES HIERARCHY CHECK: Verify L1/L2 RULES do not contradict authoritative root RULES.
-11. TRAPS STALENESS CHECK: When an L2 TRAPS section has more than 8 entries, flag entries lacking `STALE_IF:` or `REF:` as `NEEDS_METADATA`; do not auto-remove them.
-12. SCALE CHECK: If MODULE_INDEX cannot fit within L0, require MODULE_GROUPS. Never allow a project-size override, limits above 4096B/4096B/5120B, L3/fourth-level documents, a memory state machine, or a fact scoring system.
+1. SNAPSHOT CHECK: `--all` validates every current working-tree `.prizm` document when the documentation tree exists. `--staged` is a no-op when no Prizm document is staged; otherwise it validates every `.prizm` blob in the Git index as one complete pointer snapshot, including staged additions/deletions, without reading unstaged working copies.
+2. FORMAT CHECK: Verify all `.prizm` files use KEY: value/list format. Flag prose lines, code blocks, markdown headers, horizontal rules, invalid TRAPS severity, and prohibited history/date/workflow/branch/absolute/artifact metadata. `[REVIEW]` before severity remains a valid temporary staleness marker.
+3. VALUE CHECK: Flag source-derivable signatures/structure, task or change history, test inventories, temporary conclusions, stale statements, duplicate meanings, long procedures, low-value file lists, line-count/complexity inventories, and parent copies of complete child behavior. Do not flag a still-valid public/wire contract, cross-module constraint, non-obvious dependency, trap, durable decision/rejected rationale, side effect, or security/data-integrity/concurrency/transaction/compatibility rule merely because it consumes capacity.
+4. CAPACITY CHECK: Measure exact raw UTF-8 bytes. Classify only the exact root as L0/4096B, direct children as L1/4096B, and nested mirrored or semantic documents as L2/5120B. Bands are normal below 80%, warning from 80% to below 90%, strong-warning from 90% through 100%, and error above 100%.
+5. CAPACITY REPORT: Sort all non-normal entries by exact descending utilization using integer ratio comparison, then repository-relative path for ties. Every entry includes path, level, current bytes, hard limit, band, target range (3277-3686B for L0/L1; 4096-4607B for L2), and level-appropriate trim, deduplicate, move-to-child, or semantic-split actions.
+6. CAPACITY RESULT: Warning and strong-warning entries are advisory and do not fail Validate when no other violation exists. Any byte above a hard limit is an error and fails; format, pointer, hierarchy, ownership, or completeness errors also fail and are never downgraded because capacity is only a warning.
+7. POINTER/PARENT CHECK: Verify every arrow resolves. L0/L1 contain concise summaries and pointers rather than copied L2 INTERFACES/DATA_FLOW/TRAPS/DECISIONS/full RULES. SUBDIRS targets mirrored source-submodule L2. DETAILS uses exactly `- <concern-slug>: <one-line stable behavior summary> -> .prizmkit/prizm-docs/<module>/<concern-slug>.prizm` and targets one matching semantic L2.
+8. SEMANTIC IDENTITY/OWNERSHIP CHECK: For each semantic L2, verify required fields MODULE, CONCERN, FILES, RESPONSIBILITY, INTERFACES, DATA_FLOW, KEY_FILES, DEPENDENCIES, RULES, TRAPS, and DECISIONS; verify `CONCERN: <stable concern identity> | SLUG: <concern-slug>`; rerun Unicode NFKC/lowercase/kebab normalization; require non-empty explicit repository-relative FILES ownership with no sibling overlap; and require exact parent/path/slug agreement. A mirrored source-submodule path has precedence. Ambiguous identity, collision, or overlap is a validation error requiring a manual decision, not a numbered or task-named repair.
+9. COMPLETENESS CHECK: Verify exact root has `PRIZM_VERSION: 4`, PROJECT, LANG, RULES, and exactly one of MODULE_INDEX/MODULE_GROUPS. Verify every direct-child L1 has MODULE, FILES, RESPONSIBILITY, DEPENDENCIES, no CONCERN, and none of INTERFACES/DATA_FLOW/TRAPS/DECISIONS. Verify every root module pointer targets L1 and every L1 SUBDIRS/DETAILS pointer targets nested L2. Verify mirrored L2 has MODULE, FILES, RESPONSIBILITY, INTERFACES, KEY_FILES, DEPENDENCIES, and TRAPS with no CONCERN field; DATA_FLOW, RULES, DECISIONS, and domain sections remain optional when no fact passes the Value Gate. In semantic L2 only, explicit `<SECTION>: none` satisfies a required behavioral section when no fact passes the Value Gate.
+10. STALENESS CHECK: When requested as a separate advisory health check, compare document/source filesystem times from current mapped ownership. Validation itself never requires Git history, interprets ignore rules, or treats ignored/untracked/tracked state as an error.
+11. RULES HIERARCHY CHECK: Verify L1/L2 RULES do not contradict authoritative root RULES.
+12. TRAPS STALENESS CHECK: When an L2 TRAPS section has more than 8 entries, flag entries lacking `STALE_IF:` or `REF:` as `NEEDS_METADATA`; do not auto-remove them.
+13. SCALE CHECK: If MODULE_INDEX cannot fit within L0, require MODULE_GROUPS. Never allow a project-size override, limits above 4096B/4096B/5120B, L3/fourth-level documents, a memory state machine, or a fact scoring system.
 
 OUTPUT: Validation report with PASS/FAIL per check, sorted non-normal capacity entries, issue paths with actionable fixes, and an exit result. Warning-only capacity diagnostics exit successfully; any hard-limit or other validation error exits nonzero.

package/bundled/skills/prizmkit-retrospective/SKILL.md

@@ -23,7 +23,7 @@ Do not discover a different artifact directory, expand the path set, or infer pr
 
 `prizmkit-retrospective` owns only targeted structural documentation synchronization, durable knowledge injection, and `{artifact_dir}/retrospective-result.json` for the supplied paths. It does not invoke another Skill, does not read or mutate caller or checkpoint state, and does not choose stage order or routing.
 
-It does not stage, commit, reset, checkout, or stash; it does not change Git/ignore policy; and it does not directly edit generated platform outputs. All paths under `.prizmkit/` are framework-internal and remain outside automated task commits. Capacity maintenance does not add a capacity state machine, fact scoring system, routing field, caller-state field, or fourth documentation level. The stage returns `RETRO_COMPLETE` or `RETRO_BLOCKED` and stops.
+It does not stage, commit, force-add, reset, checkout, or stash; it does not add, remove, or interpret `.gitignore` entries; and it does not directly edit generated platform outputs. `.prizmkit/**` is the PrizmKit framework directory, and this Skill owns only its exact documentation/result writes. The project controls whether those paths are ignored, untracked, or tracked; retrospective behavior is otherwise identical and never requires Git history. Capacity maintenance does not add a capacity state machine, fact scoring system, routing field, caller-state field, or fourth documentation level. The stage returns `RETRO_COMPLETE` or `RETRO_BLOCKED` and stops.
 
 ## When to Use
 
@@ -62,7 +62,7 @@ Reject source-derivable structure or signatures, transient conclusions, historic
 
 For every existing target:
 
-1. Read each existing target before preparing its replacement, including the resolving parent/child pointers necessary for that target.
+1. Read each complete existing target before preparing its replacement, including every complete resolving parent/child pointer document necessary for that target.
 2. Establish the protected set of still-valid contracts, constraints, traps, rules, data flow, dependencies, decisions, side effects, and safety/integrity knowledge.
 3. Match existing and candidate facts by semantic meaning; update the canonical entry in place, merge synonymous facts, and remove obsolete, stale, derivable, duplicate, conflicting, or parent-copied material.
 4. Add only genuinely new facts that pass the Value Gate and have no equivalent canonical entry. Append-only synchronization is prohibited.
@@ -75,7 +75,7 @@ Read `${SKILL_DIR}/references/structural-sync-steps.md` and run its preflight fo
 
 1. Measure the existing target's exact raw UTF-8 bytes.
 2. Build the complete candidate result, including cleanup, before replacement and measure its exact raw UTF-8 bytes.
-3. Apply hard limits of 4096B for the root project map, 4096B for a direct module index, and 5120B for a nested detail document. Classify normal below 80%, warning from 80% to below 90%, strong-warning from 90% through the hard limit, and error above the hard limit.
+3. Apply path-classified hard limits: exact `.prizmkit/prizm-docs/root.prizm` uses 4096B, every other direct `.prizm` child uses 4096B, and every nested `.prizm` document uses 5120B. Classify normal below 80%, warning from 80% to below 90%, strong-warning from 90% through the hard limit, and error above the hard limit.
 4. If current or candidate content reaches at least 80%, perform the minimum safe cleanup or semantic split before final replacement. Aim for 3277–3686B for a root/module index or 4096–4607B for a detail document, preserving approximately 10% headroom; never pad naturally concise output.
 5. Never delete protected knowledge merely to satisfy a byte check. If protected knowledge cannot fit, use an unambiguous stable semantic boundary or block safely.
 

package/bundled/skills/prizmkit-test/SKILL.md

@@ -61,6 +61,18 @@ Do not create `.prizmkit/test/evidence/`, manifests, hashes, attestations, packa
 
 Do not infer the active requirement solely from the name of an old artifact directory. Do not use a historical worktree, second checkout, mutation proof, baseline-failure proof, or test overlay.
 
+## Evidence Obligation Classification
+
+Read the verdict-relevance rules in `${SKILL_DIR}/references/test-coverage-model.md`. Before assigning verdict impact, classify every material acceptance criterion, composition check, environment prerequisite, and failed diagnostic:
+
+- `automated-required`: the default; missing safe verdict evidence blocks `TEST_PASS`;
+- `manual-external-nonblocking`: a confirmed specification, acceptance criterion, or explicit caller decision says physical, public, production-account, or human-confirmation evidence may remain pending after the automated software-change verdict;
+- `out-of-scope-diagnostic`: a current-checkout failure is non-blocking only when affected-module and Regression Ring verification pass, it is outside changed paths and concrete coupling, it is deterministic, and no changed dependency, configuration, generated artifact, or shared contract caused it.
+
+The default is `automated-required`. Difficulty, duration, cost, agent inability, or absent safely constructible local tooling or isolated services cannot downgrade an `automated-required` obligation. An explicit requirement or project rule that makes broad validation mandatory remains authoritative. Ambiguous authority or verdict relevance remains blocking. Do not claim historical or pre-existing provenance without forbidden baseline comparison.
+
+Keep authorized deferred evidence visible without claiming it passed or authorizing release/deployment. It is not an unresolved testing-domain item; `TEST_PASS` keeps `unresolved_items` empty when all automated-required obligations pass.
+
 ## Coverage Model
 
 Read `${SKILL_DIR}/references/test-coverage-model.md` before designing or reviewing tests.
@@ -143,7 +155,7 @@ A test cannot prove a property that depends on production composition it replace
 6. For any verdict-capable serialization or multi-layer risk in removed composition, require provider/consumer contract evidence, a composition-preserving integration test, or a Full-stack path appropriate to the risk and keeping the defect-bearing boundary real.
 7. For state-changing workflows, verify commit point, cancellation, pending/duplicate protection, failure recovery, reload or re-entry, retry/conflict/idempotency, and downstream consumption.
 
-If required composition-preserving evidence cannot run in a proven safe isolated environment, return `TEST_BLOCKED`. Never substitute a lower-layer green test or downgrade the proof requirement.
+If composition-preserving evidence required by an `automated-required` obligation cannot run in a proven safe isolated environment, return `TEST_BLOCKED`. Never substitute a lower-layer green test or downgrade the proof requirement. Explicitly authorized `manual-external-nonblocking` evidence remains reported as unproven but does not become part of the current automated verdict.
 
 Reuse an adequate existing framework. Add only the smallest necessary project-native infrastructure when a required property cannot otherwise be expressed.
 
@@ -162,7 +174,7 @@ A nonzero execution is testing feedback, not an immediate terminal result. Class
 | `test-defect` | Repair the test, fixture, mock, import, syntax, or test infrastructure. |
 | `local-production-defect` | Repair the proven internal implementation defect when public and cross-module contracts remain unchanged. |
 | `high-risk-production-defect` | Do not repair it in this invocation; record the proven defect and return `TEST_NEEDS_FIXES`. |
-| `environment-unavailable` | Return `TEST_BLOCKED` with the unavailable safe prerequisite. |
+| `environment-unavailable` | Return `TEST_BLOCKED` when the unavailable safe prerequisite is `automated-required`; record an authorized `manual-external-nonblocking` prerequisite without treating it as an execution failure. |
 | `truth-unresolved` | Return `TEST_BLOCKED`; never guess the assertion. |
 | `flaky-or-unreliable` | Diagnose within budget; otherwise return `TEST_BLOCKED`. |
 
@@ -207,6 +219,7 @@ unresolved_findings: 0
 Every complete round checks:
 
 - missing behavior, acceptance criteria, Regression Ring edges, and applicable risk dimensions;
+- every evidence-obligation classification, its authority, unsupported obligation downgrade, and any deferred evidence incorrectly treated as passed or verdict-capable;
 - critical low-level boundary logic;
 - incorrect truth precedence or expected behavior;
 - weak, vacuous, implementation-only, nondeterministic, or flaky assertions;
@@ -267,7 +280,7 @@ Read `${SKILL_DIR}/references/boundary-contract-and-test-double-guidance.md` for
 - Never use production credentials, production databases/APIs/queues/storage, real user data, or destructive external operations.
 - If an endpoint cannot be proven non-production, do not connect to it.
 - Use contract-backed local doubles or project-owned isolated services only within their stated proof boundary.
-- Missing fidelity or composition evidence that affects the verdict produces `TEST_BLOCKED`, not a conditional pass.
+- Missing fidelity or composition evidence for an `automated-required` obligation produces `TEST_BLOCKED`, not a conditional pass; authorized deferred external/manual evidence stays visible and unproven.
 
 ## Final Verification
 
@@ -275,13 +288,13 @@ Before writing `TEST_PASS`:
 
 1. Main-Agent review converged on the exact final state.
 2. Independent review converged or was strictly and visibly downgraded under its capability contract.
-3. Every required focused, module/component, consumer/provider contract, integration, actual-composition E2E, affected-module, and Regression Ring test passes reliably.
-4. Every verdict-relevant test double has boundary-appropriate authority and fidelity proof, and every test-layer claim matches actual composition.
-5. Every verdict-capable property in removed composition has composition-preserving evidence; applicable Provider Contract Tests assert raw wire output and state-changing workflows cover the required lifecycle.
-6. Any required project-wide regression passes.
-7. No accepted correction, unresolved finding, verdict-capable scope edge, missing fidelity/composition proof, or required environment check remains.
-8. No high-risk production defect or correction remains.
-9. No mutation occurred after the final applicable review and execution.
+3. Every `automated-required` focused, module/component, consumer/provider contract, integration, actual-composition E2E, affected-module, and Regression Ring test passes reliably.
+4. Every automated-verdict test double has boundary-appropriate authority and fidelity proof, and every test-layer claim matches actual composition.
+5. Every automated-verdict property in removed composition has composition-preserving evidence; applicable Provider Contract Tests assert raw wire output and state-changing workflows cover the required lifecycle.
+6. Every regression concretely coupled to the change passes, and every project-wide command made a whole-result completion gate by a confirmed requirement or explicit project rule passes; only other broad failures may use `out-of-scope-diagnostic`.
+7. No accepted correction, unresolved finding, automated-verdict scope edge, missing required fidelity/composition proof, or required environment check remains.
+8. Every `manual-external-nonblocking` item is authoritatively classified, visibly unproven, and separate from release/deployment authorization.
+9. No high-risk production defect or correction remains, and no mutation occurred after final review and execution.
 
 ## Terminal Results
 
@@ -291,11 +304,11 @@ Only these testing-domain outcomes are valid:
 TEST_PASS | TEST_NEEDS_FIXES | TEST_BLOCKED
 ```
 
-- `TEST_PASS`: final reviewed state passes every required native test and no high-risk correction remains.
+- `TEST_PASS`: final reviewed state passes every `automated-required` obligation and no high-risk correction remains; authorized deferred external/manual evidence may remain visibly unproven.
 - `TEST_NEEDS_FIXES`: a known correction remains or a testing-local review/repair budget did not converge.
-- `TEST_BLOCKED`: expected truth, safe input, environment, execution reliability, external-target safety, or required review input prevents a safe verdict.
+- `TEST_BLOCKED`: expected truth, safe input, required automated environment, execution reliability, external-target safety, or required review input prevents a safe verdict.
 
-No conditional pass exists.
+No conditional pass exists. A separate project-native status such as `MANUAL_VERIFICATION_REQUIRED` describes deferred evidence, not a fourth Test result or proof that external/manual behavior passed.
 
 ## Terminal Report and Result
 

package/bundled/skills/prizmkit-test/references/boundary-contract-and-test-double-guidance.md

@@ -4,7 +4,7 @@
 
 Apply one contract discipline to every serialized or producer-consumer boundary, whether internal or external: browser/backend APIs, cross-module endpoints, persistence, queues, filesystems, caches, generated clients/servers, SDK providers, and any test double that replaces a producer or consumer.
 
-Mocks are test tools, not proof of provider behavior or a deployed environment. Consumer-local types, fixtures, and mocks are expectations, not provider truth. A test cannot prove a property that depends on production composition it replaces.
+Mocks are test tools, not proof of provider behavior or a deployed environment. Consumer-local types, fixtures, and mocks are expectations, not provider truth. A test cannot prove a property that depends on production composition it replaces. Apply the Test coverage model's evidence-obligation classification before deciding whether that property belongs to the current automated verdict.
 
 ## Boundary-Specific Contract Authority
 
@@ -153,7 +153,9 @@ Lower layers may diagnose a defect, but they cannot supply verdict evidence for
 3. verify the preserving test would fail while the target defect exists;
 4. record the preserving evidence and remaining risk in the report.
 
-If required composition-preserving verification cannot run in a proven safe isolated environment, return `TEST_BLOCKED`. Do not substitute a lower-layer green result or relabel a Mock Browser Test as E2E.
+If required composition-preserving verification cannot run in a proven safe isolated environment, return `TEST_BLOCKED`. Required composition means an `automated-required` property under the authority-driven evidence-obligation classification. Difficulty, duration, cost, agent inability, or absent safely constructible local tooling or isolated services cannot downgrade an `automated-required` obligation. Do not substitute a lower-layer green result or relabel a Mock Browser Test as E2E.
+
+An explicitly authorized `manual-external-nonblocking` obligation may remain unexecuted for the current automated software-change verdict, but it stays visible as unproven and cannot be used to claim provider compatibility, deployed behavior, release readiness, or physical acceptance.
 
 ## Databases and Stateful Services
 
@@ -179,7 +181,7 @@ Never use:
 - a target whose non-production status cannot be established;
 - destructive operations against external data.
 
-Project configuration may be reused only when it demonstrably selects a safe isolated test target. If safety cannot be proven, do not connect; report the unexecuted check and return `TEST_BLOCKED` when it is necessary for the verdict.
+Project configuration may be reused only when it demonstrably selects a safe isolated test target. If safety cannot be proven, do not connect; report the unexecuted check and return `TEST_BLOCKED` when it is `automated-required`. A confirmed non-verdict manual/external target remains deferred and unproven rather than becoming permission to connect.
 
 ## Reporting
 
@@ -187,9 +189,11 @@ For every verdict-relevant boundary or test double, complete the Boundary and Te
 
 Also record:
 
+- the property's `automated-required` or `manual-external-nonblocking` obligation and its authority;
 - variants exercised;
 - production resources used: `no`;
-- unresolved fidelity or deployed-environment risk.
+- unresolved fidelity or deployed-environment risk;
+- authorized deferred external or manual evidence as visible unproven status, never as a conditional pass or unresolved testing-domain item.
 
 Do not claim that a local mock, fake, contract snapshot, container, isolated service, or Mock Browser Test verifies composition it replaces or a deployed production environment.
 

package/bundled/skills/prizmkit-test/references/independent-test-review.md

@@ -66,7 +66,7 @@ The Main Agent supplies:
 - original requirement and confirmed clarifications;
 - exact artifact, spec, and plan paths plus current contents;
 - complete current production-and-test change;
-- affected business module, observable behaviors, applicable risks, and Regression Ring;
+- affected business module, observable behaviors, applicable risks, Regression Ring, and the authority-driven evidence-obligation classification;
 - existing, added, and modified tests, fixtures, mocks, schemas, contracts, selected layers, and the complete boundary/test-double inventory with authority, fidelity, removed composition, proof limits, preserving evidence, and verdict impact;
 - native test commands and results executed by Main Agent;
 - testing-local repairs;
@@ -112,6 +112,10 @@ Execution boundaries:
 
 First validate input consistency. Then review:
 - requirement and acceptance-criteria coverage;
+- every evidence obligation defaulting to automated-required unless a confirmed specification, acceptance criterion, or explicit caller decision authorizes non-verdict manual/external deferral;
+- any unsupported obligation downgrade based only on difficulty, duration, cost, agent inability, or unavailable safely constructible tooling;
+- authorized deferred external or manual evidence remaining visible and unproven without being treated as a verdict blocker or passed behavior;
+- every out-of-scope diagnostic satisfying the exact current-checkout path, coupling, determinism, cause, and project-rule gate;
 - complete observable behavior of the affected module;
 - critical low-level logic and exact boundaries;
 - functional, boundary, error, state, side-effect, permission, concurrency, idempotency, time, dependency, and consumer risks;
@@ -131,7 +135,7 @@ First validate input consistency. Then review:
 - production defects or attempted repairs outside the permitted testing-local repair boundary;
 - remaining risks being stated honestly.
 
-Return `CORRECTION_NEEDED` when a verdict-relevant producer-consumer combination is replaced by a test double without authoritative fidelity proof and composition-preserving evidence, or when a test-layer claim exceeds the actual composition executed.
+Return `CORRECTION_NEEDED` when a verdict-relevant producer-consumer combination is replaced by a test double without authoritative fidelity proof and composition-preserving evidence, when a test-layer claim exceeds the actual composition executed, when an unsupported obligation downgrade weakens required automation, or when authorized deferred external or manual evidence is the sole reason an otherwise complete automated verdict is blocked.
 
 Do not rewrite the requirement, modify code, execute tests, or perform broad exploration.
 Return exactly one result using the Reviewer Output Protocol.
@@ -269,7 +273,7 @@ Record:
 - each response number `1..5`, input identity, result, and correction count;
 - every Main-Agent adjudication and its evidence;
 - actual repair and native verification;
-- boundary authority/fidelity, removed-composition, proof-limit, preserving-evidence, layer-classification, and mutation-lifecycle corrections;
+- boundary authority/fidelity, evidence-obligation authority, unsupported downgrade, deferred-evidence visibility, diagnostic-gate, removed-composition, proof-limit, preserving-evidence, layer-classification, and mutation-lifecycle corrections;
 - whether the exact final state was independently rechecked;
 - capability basis, continuation mode (`native`, `replacement`, `mixed`, or `not-applicable`), and replacement count.
 

package/bundled/skills/prizmkit-test/references/test-coverage-model.md

@@ -36,7 +36,7 @@ Include only evidenced coupling:
 - persistence, cache, lock, queue, transaction, or other shared state;
 - registrations, configuration, or runtime discovery that concretely connects behavior.
 
-Record dynamic or unprovable coupling as a remaining edge. An edge that can change the testing verdict prevents `TEST_PASS` until resolved.
+Record dynamic or unprovable coupling as a remaining edge. An edge that can change the automated testing verdict prevents `TEST_PASS` until resolved; an authoritatively separate manual/external obligation remains visible under its own evidence status.
 
 ## Truth Precedence
 
@@ -51,6 +51,28 @@ Resolve expected business behavior from confirmed specifications and acceptance
 
 Lower-authority material cannot override a higher-authority source or prove a property outside its boundary. Do not encode a possible implementation defect as expected behavior. Conflicting higher-precedence truth that cannot be resolved produces `TEST_BLOCKED`.
 
+## Evidence Obligation and Verdict Relevance
+
+Classify each material acceptance criterion, environment prerequisite, composition proof, and failing diagnostic before selecting layers or assigning verdict impact. The default is `automated-required`.
+
+| Obligation | Authority and Meaning | Verdict Rule |
+|---|---|---|
+| `automated-required` | The property belongs to the current software-change verdict, including safely constructible local tooling or isolated services needed to prove it. | Missing truth, safe execution, fidelity, or composition evidence prevents `TEST_PASS`. |
+| `manual-external-nonblocking` | A confirmed specification, acceptance criterion, or explicit caller decision says physical-device, public-infrastructure, production-account, or human-confirmation evidence may remain pending after the automated software-change verdict. | Record the evidence as unproven and preserve any project-native status such as `MANUAL_VERIFICATION_REQUIRED`; do not treat it as an unresolved testing-domain item. |
+| `out-of-scope-diagnostic` | A current-checkout failure has no concrete path, caller, consumer, contract, configuration, dependency, generated-artifact, or shared-state coupling to this change. | It may be informational only after every condition below is proven. |
+
+Difficulty, duration, cost, agent inability, or initial absence of safely constructible local tooling or isolated services cannot downgrade an `automated-required` obligation. A manual/external classification must be explicit at a higher authority and must separate that evidence from software implementation/commit completion; inability to access an environment is not itself authority. Ambiguous authority or verdict relevance remains blocking.
+
+A current-checkout failure is `out-of-scope-diagnostic` only when all of these hold:
+
+1. affected-module and Regression Ring verification pass;
+2. every failure is outside changed paths and concrete coupling;
+3. the failure reproduces deterministically on the current state;
+4. no changed dependency, configuration, generated artifact, or shared contract caused it;
+5. no explicit requirement or project rule makes that broad command a completion gate.
+
+Do not claim historical or pre-existing provenance from a historical worktree, second checkout, test overlay, or unsupported baseline comparison. If any relationship is uncertain, keep the failure verdict-capable. These classifications affect only the current automated Test verdict: they never approve release, deployment, public readiness, signing, security review, or physical-device acceptance.
+
 ## Behavior Inventory
 
 For each observable behavior, capture enough working context to answer:
@@ -146,7 +168,7 @@ Use the lowest layer that proves a property without removing relevant compositio
 
 Browser execution alone does not determine the layer. Every test claim must state the property proved and any property not proven because a test double removes relevant composition.
 
-Not every behavior needs every layer. Record a concise reason for omitted higher layers, such as a pure library having no process or UI boundary. A missing layer blocks `TEST_PASS` only when it is needed to preserve a verdict-capable combination.
+Not every behavior needs every layer. Record a concise reason for omitted higher layers, such as a pure library having no process or UI boundary. A missing layer blocks `TEST_PASS` when it is needed to preserve an `automated-required` verdict-capable combination; authorized manual/external evidence is reported as unproven rather than relabeled as an executed layer.
 
 ## Critical Low-Level Logic
 
@@ -200,18 +222,19 @@ Use existing line, branch, or function coverage to locate possibly omitted behav
 
 Coverage is complete enough for `TEST_PASS` only when:
 
-1. every discoverable observable behavior is represented;
-2. every applicable risk has a credible project-native test;
+1. every discoverable `automated-required` observable behavior is represented;
+2. every applicable automated-verdict risk has a credible project-native test;
 3. critical low-level logic has direct focused coverage when justified;
-4. every verdict-relevant boundary and test double has contract authority, fidelity proof, removed-composition, proof-limit, and remaining-risk analysis;
-5. selected layers preserve the property being proved and composition-preserving evidence covers every verdict-capable removed combination;
+4. every automated-verdict boundary and test double has contract authority, fidelity proof, removed-composition, proof-limit, and remaining-risk analysis;
+5. selected layers preserve the property being proved and composition-preserving evidence covers every automated-verdict removed combination;
 6. provider contracts inspect risk-relevant raw wire output;
 7. applicable state-changing workflows cover commit, cancellation, failure, re-entry, and repeated-operation semantics;
 8. complete affected-module regression passes;
 9. Regression Ring verification passes;
-10. concrete unresolved coupling no longer affects the verdict;
-11. Main-Agent review converges;
-12. applicable independent review converges or is strictly downgraded;
-13. no mutation follows final review and execution.
+10. concrete unresolved coupling no longer affects the verdict and every non-blocking current-checkout failure satisfies the full diagnostic gate;
+11. every deferred manual/external obligation has explicit authority, visible unproven status, and no false pass claim;
+12. Main-Agent review converges;
+13. applicable independent review converges or is strictly downgraded;
+14. no mutation follows final review and execution.
 
 Absolute completeness cannot be guaranteed. State remaining informational risks honestly without presenting them as proven behavior.

package/bundled/skills/prizmkit-test/references/test-report-template.md

@@ -17,6 +17,23 @@ Create one human-readable report for every terminal result. Replace an older rep
 - Test paths: <existing, added, and modified paths>
 - Requirement source: <specification, acceptance criteria, caller request, or none>
 
+## Evidence Obligation Classification
+
+| Property / Check | Authority | Obligation | Evidence / Status | Verdict Impact |
+|---|---|---|---|---|
+| <criterion, composition, prerequisite, or diagnostic> | <confirmed spec, acceptance criterion, explicit caller decision, project rule, or coupling evidence> | automated-required / manual-external-nonblocking / out-of-scope-diagnostic | <executed result, unproven status, or exact current-checkout failure> | <passed / TEST_NEEDS_FIXES correction / TEST_BLOCKED prerequisite / non-blocking> |
+
+- Classification ambiguities: <none or blocking list>
+- Unsupported obligation downgrades: none
+
+## Deferred External and Manual Evidence
+
+| Evidence | Authority for Deferral | Current Status | Automated Verdict Rationale |
+|---|---|---|---|
+| <physical/public/production-account/human evidence or none> | <confirmed source> | MANUAL_VERIFICATION_REQUIRED / other explicit unproven status | <why it may remain pending after automated software-change completion> |
+
+Authorized deferred evidence is not an unresolved testing-domain item, does not prove the deferred behavior, and does not authorize release or deployment.
+
 ## Affected Business Module
 
 - Boundary: <explicit module or cohesion-derived responsibility>
@@ -63,8 +80,9 @@ Coverage metrics, when available: <diagnostic values or not collected>. Percenta
 
 - Required affected-module regression complete: yes / no
 - Required Regression Ring verification complete: yes / no
-- Project-wide regression required: yes / no
-- Project-wide regression result: passed / failed / not-required / blocked
+- Project-wide command executed: yes / no
+- Project-wide command is a whole-result completion gate: yes / no, with authority
+- Project-wide command result: passed / failed / not-run / blocked / failed-with-proven-out-of-scope-diagnostics
 
 ## Main-Agent Review
 
@@ -112,7 +130,7 @@ Coverage metrics, when available: <diagnostic values or not collected>. Percenta
 
 | Property Not Proven | Composition-Preserving Test | Evidence Classification | Remaining Risk / Verdict Impact |
 |---|---|---|---|
-| <property outside the double-backed proof boundary> | <provider/consumer contract, integration, Full-stack E2E, or missing> | <local / consumer contract / provider contract / integration / Mock Browser / Full-stack> | <none, informational, TEST_NEEDS_FIXES correction, or TEST_BLOCKED prerequisite> |
+| <property outside the double-backed proof boundary> | <provider/consumer contract, integration, Full-stack E2E, authorized manual/external deferral, or missing> | <local / consumer contract / provider contract / integration / Mock Browser / Full-stack / manual-external-nonblocking> | <none, informational, deferred-unproven, TEST_NEEDS_FIXES correction, or TEST_BLOCKED prerequisite> |
 
 - Test-layer claims match actual composition: yes / no
 - Every verdict-capable removed combination has preserving evidence: yes / no
@@ -122,7 +140,9 @@ Coverage metrics, when available: <diagnostic values or not collected>. Percenta
 
 ## Remaining Risks and Unresolved Items
 
-- <none, or every known correction/blocker with concrete target and next required fact>
+- Testing-domain unresolved items: <none, or every known correction/blocker with concrete target and next required fact>
+- Informational risks and proven out-of-scope diagnostics: <none or exact list; do not claim unsupported historical provenance>
+- Deferred external/manual evidence is reported in its dedicated section, not repeated as an unresolved testing-domain item.
 ```
 
 ## Result Rendering Rules
@@ -131,19 +151,21 @@ Render `TEST_PASS` only when:
 
 - mandatory Main-Agent review converged;
 - independent review converged or was visibly downgraded under its strict capability gate;
-- all required native tests pass on the exact final state;
-- every verdict-relevant test double has boundary-specific authority and fidelity proof;
-- every verdict-capable property removed by a double has composition-preserving evidence, and every layer claim matches actual composition;
+- every `automated-required` native test and composition obligation passes on the exact final state;
+- every automated-verdict test double has boundary-specific authority and fidelity proof;
+- every automated-verdict property removed by a double has composition-preserving evidence, and every layer claim matches actual composition;
 - applicable provider contract tests assert risk-relevant raw wire payload and state-changing workflows cover commit, cancellation, failure, re-entry, and repeated-operation semantics;
-- no accepted or unresolved finding remains;
+- each `manual-external-nonblocking` item has explicit authority, visible unproven status, and no false pass/release/deployment claim;
+- each `out-of-scope-diagnostic` satisfies affected-module/Regression Ring, path/coupling, determinism, cause, and project-rule conditions;
+- no accepted or unresolved testing-domain finding remains;
 - no high-risk production defect or correction remains;
 - no mutation occurred after final applicable review and execution.
 
 Render `TEST_NEEDS_FIXES` for a known remaining correction, an exhausted testing-local review/repair budget with known work, or a proven high-risk production defect that this invocation must not repair.
 
-Render `TEST_BLOCKED` when truth, required input, safe environment, execution reliability, external-target safety, or required Reviewer input prevents a safe verdict. This includes unavailable required composition-preserving execution and unresolved contract authority or test-double fidelity that affects the verdict; lower-layer green tests cannot substitute.
+Render `TEST_BLOCKED` when truth, required input, an `automated-required` safe environment, execution reliability, external-target safety, obligation authority, diagnostic independence, or required Reviewer input prevents a safe verdict. This includes unavailable required composition-preserving execution and unresolved contract authority or test-double fidelity that affects the automated verdict; lower-layer green tests cannot substitute.
 
-No conditional pass, commit authorization, release authorization, runtime classification, target hash, manifest, attestation, or package state belongs in the report.
+Authorized `manual-external-nonblocking` evidence alone does not block an otherwise complete automated verdict, but it remains unproven. No conditional pass, commit authorization, release authorization, runtime classification, target hash, manifest, attestation, or package state belongs in the report.
 
 ## Terminal Machine Projection
 
@@ -178,6 +200,6 @@ Constraints:
 - `downgraded` requires `responses=0`, a non-empty `downgrade_reason`, and `final_state_rechecked=false`.
 - `not_applicable` requires `responses=0`, `downgrade_reason=null`, and `final_state_rechecked=false`.
 - `independent_review.responses` is otherwise bounded from `0` through `5`.
-- `TEST_PASS` requires an empty `unresolved_items`; `TEST_NEEDS_FIXES` and `TEST_BLOCKED` each require at least one concise correction or blocker string, and the list agrees with the report.
+- `TEST_PASS` keeps `unresolved_items` empty; authorized deferred evidence and proven out-of-scope diagnostics remain in their human report sections. `TEST_NEEDS_FIXES` and `TEST_BLOCKED` each require at least one concise testing-domain correction or blocker string, and the list agrees with the report.
 - Report and JSON agree on final result and production-change diagnostics.
 - The JSON is terminal output only and is never updated as an internal checkpoint.

package/bundled/skills/prizmkit-workflow/SKILL.md

@@ -211,17 +211,15 @@ The internal `prizmkit-code-review` limit of ten completed review rounds remains
 
 The composite reaches `/prizmkit-committer operation=interactive-commit` but must not silently create a Git commit.
 
-The composite must validate all prior stage artifacts, derive exact non-`.prizmkit/` change paths for the retrospective input, and validate its result. For interactive commit it then assembles one exact `intended_paths` manifest from:
+The composite must validate all prior stage artifacts, derive exact non-`.prizmkit/` source-change paths for retrospective input, and validate its result. It then assembles one exact interactive `intended_paths` manifest from every final Git-visible requirement output, regardless of whether a justified path is under `.prizmkit/**`. Ignored paths remain naturally absent. Prizm documentation has no separate commit-ownership or retrospective-evidence admission rule.
 
-- final validated requirement paths outside default support namespaces;
-- exact `.prizmkit/prizm-docs/**` paths listed by a consistent `RETRO_COMPLETE` + `DOCS_UPDATED` result;
-- exact support paths explicitly owned by the spec/plan, separately labeled in the preview, covered by the support validation below, and subject to the user's confirmation of that exact manifest.
+`.prizmkit/**` remains the framework capability boundary and ordinary Code Review black box, but project Git tracking is independent. The composite must not force-add a framework path, modify or interpret ignore policy, broadly stage, or reject a Git-visible intended path solely by directory name. Exact Runtime request/checkpoint/state and installed Runtime/host payloads remain outside the manifest because of their semantic support/bookkeeping role, not a blanket framework-directory rule. Global Secret checks apply equally to every intended path.
 
-For each explicit support path, select and execute its applicable semantic contract before invoking Committer: instruction files require readable structure, resolvable project references, consistency with the exact requirement and applicable project conventions, and secret scanning; lockfiles require parse/schema checks plus owning-installer or deterministic-regeneration parity; any other support class requires an exact project-native semantic validator named by the spec/plan. User confirmation alone is not support validation. If no applicable validator exists or evidence is non-passing, block support admission. Pass one exact `support_validation_evidence` record per admitted support path, including its path, contract, completed validation, `PASS` result, and exact evidence path.
+For each explicit host/platform support path, select and execute its applicable semantic contract before invoking Committer: instruction files require readable structure, resolvable project references, consistency with the exact requirement and applicable project conventions, and Secret scanning; lockfiles require parse/schema checks plus owning-installer or deterministic-regeneration parity; any other support class requires an exact project-native semantic validator named by the spec/plan. User confirmation alone is not support validation. A path is not host support merely because it is under `.prizmkit/**`.
 
-All other `.prizmkit/**`, generated support, transient, installed, secret, unknown, or unrelated paths remain excluded or blocking. Invoke the committer with the same `artifact_dir`, exact `evidence_paths`, caller-state paths in `excluded_paths`, the exact `intended_paths`, conditional one-to-one `support_validation_evidence`, and `operation=interactive-commit`. The committer validates the manifest, presents the exact commit, waits for confirmation, and creates it only after approval.
+Invoke Committer with the same `artifact_dir`, exact `evidence_paths`, exact caller-state/bookkeeping paths in `excluded_paths`, exact `intended_paths`, conditional one-to-one host `support_validation_evidence`, and `operation=interactive-commit`. Committer validates the exact manifest and staged-set equality, presents it, waits for confirmation, and creates it only after approval.
 
-External headless orchestration supplies explicit evidence to `operation=prepare-runtime-commit`, maps `COMMIT_REQUEST_READY` to its own pending state, and lets Python Runtime validate and execute the request. Preparation mode preserves the existing automated contract: the complete `.prizmkit/**` tree remains outside Runtime `intended_paths`. Remote publication remains separate.
+External headless orchestration supplies explicit readiness evidence to `operation=prepare-runtime-commit`, maps `COMMIT_REQUEST_READY` to its own pending state, and lets Python Runtime validate and execute the request. Safe Git-visible `.prizmkit/**` task output may appear in Runtime `intended_paths`; exact Runtime bookkeeping/support, Secrets, unrelated paths, and ignored paths do not. Remote publication remains separate.
 
 ## Automatic Handoff and Manual Fallback
 

package/bundled/skills/prizmkit-workflow/references/workflow-state-protocol.md

@@ -158,15 +158,14 @@ Any outer repair or continuation policy is independently owned by the caller and
 Interactive execution:
 
 ```text
-coordinator assembles exact intended_paths from final requirement paths
-  + exact validated Retrospective .prizmkit/prizm-docs paths
-  + separately labeled explicitly owned support paths with one-to-one passing support_validation_evidence
-→ committer validates and previews the exact files and message
+coordinator assembles exact intended_paths from all final Git-visible requirement paths, including justified `.prizmkit/**` output
+  + separately labeled explicitly owned host support paths with one-to-one passing support_validation_evidence
+→ committer validates ordinary task ownership, global Secret safety, and the exact files/message
 → waits for explicit current-user confirmation
 → stages exact pathspecs, creates, and verifies the local commit
 ```
 
-All other `.prizmkit/**`, generated support, transient, installed, secret, unknown, or unrelated paths remain excluded or blocking. Exact durable Prizm documentation admission is an interactive exception backed by the Retrospective result, not a general `.prizmkit` allowlist. User confirmation alone is not support validation: instruction files require structure/reference/requirement-consistency/secret checks, lockfiles require parse/schema plus installer or deterministic-regeneration parity, and any other support class requires the exact project-native semantic validator named by the spec/plan.
+The framework directory is not a blanket allowlist or denylist: a Git-visible `.prizmkit/**` path uses the same exact manifest, task justification, staged-set equality, Secret checks, and receipt verification as any other path, with no documentation-specific evidence. Ignored files remain absent and are never force-added. Exact Runtime request/checkpoint/state, installed Runtime/host payloads, sensitive, unknown, and unrelated paths remain excluded or blocking because of their semantic role. User confirmation alone is not host-support validation.
 
 Pipeline execution:
 
@@ -178,7 +177,7 @@ external coordinator validates its required gates and supplies exact readiness e
 → remote publication remains separate
 ```
 
-The preparation request is data for runtime validation, not prompt-level authorization. The committer must not stage, commit, or predeclare COMMITTED in pipeline preparation mode. Preparation preserves the existing automated path contract: the complete `.prizmkit/**` tree remains outside Runtime `intended_paths` in this protocol version.
+The preparation request is data for Runtime validation, not prompt-level authorization. The committer must not stage, commit, or predeclare COMMITTED in preparation mode. Safe Git-visible `.prizmkit/**` task output may appear in Runtime `intended_paths`; ignored paths remain absent, while exact Runtime bookkeeping/support and Secrets remain excluded. Runtime verifies the commit before writing its post-commit receipt/checkpoint and never retroactively inserts those writes into the committed snapshot.
 
 ## Recovery