Bind the contract to the tested revision. For a PR, record its merge base and exact head SHA. For a commit, record the selected parent and commit; identify the parent explicitly for a merge commit. For uncommitted work, record the base SHA plus a reproducible patch identity (saved patch/hash, including relevant untracked files), not a fictitious committed revision. Evidence expires after relevant source, tests, helpers, configuration, or package changes unless revalidated.

For each distinct behavior change, map: . Derive the expected outcome independently from requirements or supported API/protocol semantics, not the implementation or the test's current value. Check build/package/configuration behavior, deleted/renamed code, removed tests, and shipping consumers as well as source. Include positive, negative, boundary, compatibility, cancellation, cleanup, and multi-module cases only where relevant to the changed contract.

A mock of the changed component, self-comparison, or expected value computed by the same production algorithm does not provide an independent oracle.

For a fix, prefer the real pre-fix implementation with the same regression test, setup, dependencies, and inputs. If new APIs prevent that combination from compiling, restore only the defective behavior in the head version. Call this a targeted counterfactual, not a run on the base revision. Record its exact patch/hash. Never change assertions to manufacture red.

For a feature, a missing-symbol compiler error is not behavioral proof. Choose a buildable no-op, disabled registration, old branch, or wrong output. A compiler/analyzer diagnostic can be valid behavior only when an executed harness asserts that exact diagnostic or its absence.

Prefer small plausible faults: restore the old boundary, drop a required output, skip a callback, ignore an option, or return the wrong value. An equivalent mutation is not a gap. A crash, timeout, or exception counts only when it is the intended contract signal and diagnostics attribute it to the fault, not setup, discovery, flakes, or infrastructure.

Execute paired runs only when authorized. Implementation normally requires execution; read-only/advisory review normally requires inspection. A review request alone does not permit source edits or builds/tests. Never run untrusted code with privileged credentials.

In an authorized implementation/verification environment:

Paired runs must not reuse stale build/test outputs or the other variant's effective caches. Use separate outputs/caches or clean only owned outputs and rebuild; do not rely on or a runner's success exit alone. Record selected/executed/passed/failed/skipped counts for each run. If a runner does not expose a count, say unknown rather than inventing it. Zero selection/execution, skips, missing tools, authentication, setup/build, unrelated failures, and unattributed timing flakes leave proof unverified.

For cross-component/acceptance behavior, identify the producer-consumer contract first: ownership, lifecycle, handshake/no-handshake, exit semantics, fallback, compatibility, cancellation, and multi-module aggregation where applicable. Record the exact shipping binaries/packages/extensions and release branches. Rebuild/repack each variant, isolate effective package caches, prove which variant the real shipping consumer loaded, and run a representative composed command. Unit mocks or source-compatible compilation alone do not replace shipping-layout validation. Exercise applicable normal, suppressed, partial, legacy/incompatible, cancellation, nonzero-exit, zero-result, fallback, and multi-module paths. Keep rollout/servicing ownership explicit; a feature flag does not lower the evidence bar.

In read-only/advisory mode, trace both revisions, setup/helpers, inputs, and assertions without edits or execution unless separately permitted. Label conclusions static predictions, never executed proof. Existing artifacts count only when their revisions/patches, loaded variant, selection, counts, and failure attribution match. Green CI or an author's claim alone is not red-green evidence. Say what is inaccessible or missing.

Report only the evidence obtained. Put a compact Test-value evidence section in the handoff or authorized review/description. State base/parent and head SHAs or tested patch identities. Use one row per changed contract, group tests protecting the same contract, and identify unassessed groups.

Use executed: detected, executed: survived, static: predicts detection, static: predicts survival, unverified, equivalent, or not applicable accurately. Missing red/green or incomplete selection leaves paired proof unverified. Report executed: survived only for an executed, non-equivalent fault; do not count equivalent edits as gaps. Preservation passes for a refactor are valid evidence, not missing-red defects.

Include exact commands/exits, toolchain/framework/configuration, revision and counterfactual patch identities, per-run counts, and relevant artifact paths. Distinguish execution performed now from verified existing artifacts. Never combine static predictions with measured mutation counts/scores. Evidence for a final PR head does not prove every intermediate commit; assess a requested commit against its parent separately.

Missing evidence is not automatically a proven defect or an inline review thread. Publication follows the caller's existing authorization gate; do not create a new GitHub object just to store a report or claim instructions enforce hooks, CI, or publication.