proof-capture

Capture PR proof artifacts for: $ARGUMENTS

If $ARGUMENTS contains --strict, execute the strict controller workflow below. Otherwise, load the capturing-proof skill and execute its Protocol (Steps 1–9) inline in this parent session. Use the first argument as <feature-slug> (ask the user if missing) and the remaining arguments as the flow description. The skill owns the interactive rehearsal gate, named Maestro-inexpressibility carve-out, validation checklist, PROOF.md, and PR-BODY.md generation; do not duplicate or improvise that protocol here.

Strict controller workflow

Call proof_capture(action="contract") first and retain the returned schema and digest as the receipt contract. The transition protocol is:

begin_rehearsal -> finish_rehearsal -> arm -> start_recording
  -> storyboard operations and proof_step assertions
  -> stop_recording -> validate -> finalize

Before begin_rehearsal, resolve and pass the complete immutable context:

• clean absolute Git project root and candidate root
• unique lowercase kebab-case run id
• fresh absolute receipt, video, contact-sheet, and screenshot paths beneath docs/proof/<run-id>/
• issue identity, exact pull-request head SHA, proof class, acceptance mappings, fixture identity, and writer provider
• one learned action with its id, runtime revision, and exact action-file SHA-256
• at least three ordered storyboard steps whose source SHA equals clean HEAD
• for every step, canonical operation arguments and hash, exact proof_step arguments and hash, verifyTestID, screenshot path, and a bounded assertionWaitMs

When the driven app is outside this plugin repository, candidateRoot is mandatory and must identify the exact candidate checkout. Any candidate SHA, packaged runtime, runner manifest, live MCP process, project root, Metro session, port, device, or build-output mismatch is a hard stop.

Execute the transitions exactly:

1. Call begin_rehearsal with the immutable context.
2. Call only cdp_run_action(autoRepair=false, forceReload=false, proofReplay=true) during rehearsal, then call finish_rehearsal.
3. Restore the declared start state, run its exact proof_step, call arm, and repeat that assertion.
4. Call start_recording; never call device_record directly.
5. Execute each storyboard operation once in order and immediately follow it with its declared proof_step. Do not add undeclared tools.
6. Call stop_recording, then validate.
7. Give the mechanically accepted receipt and contact sheet to a vision-capable reviewer whose provider differs from the writer. The review must bind writerProvider, evidenceSha256, resultHash, and the exact boolean verdicts required by the receipt schema.
8. Call finalize(evidenceReview=...) and report only values from the accepted finalized receipt.

The controller requires managed Metro ownership, a serving root contained by the bound worktree, a signed initial-bundle marker, exact device and install bindings, and the source and dirty digest. Darwin receipts report managed-sandbox-v1 when the Apple-signed absolute-path Seatbelt sandbox and command-chain change detection are available; other hosts report unavailable. The sandbox level is evidence, not a strict-proof precondition. Do not record before the controller permits it, substitute screenshots for the required video, repair or reload during rehearsal or recording, reuse rejected artifacts, or report merge-ready evidence without a finalized accepted receipt.

When stage is uncertain, call status. On rejection, print the stable reason code exactly, call discard, restore the clean start state, and begin a fresh session with fresh destinations. Strict output contains only the accepted receipt path, screenshot paths, local video path and SHA-256, contact-sheet path, action and storyboard hashes, or the exact invalidation reason.