behavior-validator

# Behavior validator ## Contract | Field | Bound contract | |---|---| | Trigger | User needs a code-review-agnostic skill to validate a web app, CLI, API, or generated artifact against a source-blind behavior contract, or as a black-box companion to a code-aware review | | Authority | Read-only. No file, VCS, credential, paid, published, deployed, or remote mutation. Reads only the runtime output of the target; never reads source code, repository state, or build internals | | Side effect | Produces a structured behavior validation report. No mutation of the target, source, or workspace beyond emitting the report | | Done | Every contract clause has an observable result; the report correctly reflects real-time behavior and no implementation evidence contaminated the validation | ## Inputs - A behavior contract: a list of clauses, each with an identifier, a stimulus, and an expected observable outcome. Must be supplied. - A target descriptor: how to reach the subject, a URL, a CLI invocation, an API endpoint, or an artifact path. Must be supplied. - Optional: authentication material (tokens, headers), environment variables, seed data, or a run budget. - Source code, repository state, and build internals are never inputs and must not be read. ## Procedure 1. Parse the contract into clauses. Reject any clause whose expected outcome references source structure (file names, function names, internal types, line numbers), mark it out-of-scope, because source-blind validation ca...