Behavior Validation
Judge what the product does, not how its source appears to do it.
Establish isolation
Write or read the behavior contract before exercising the target. Use behavior-contract.md. The contract must name user tasks, expected outcomes, setup, allowed interfaces, negative cases, and required evidence.
Do not inspect source, diffs, internal tests, Git history, or implementation
notes during validation. Interact only through public browser, CLI, API,
artifact, accessibility, or operator surfaces. If source is required, mark the
clause blocked and hand it to root-cause-debugging.
Exercise the contract
- Run each task through the same entry point a real user or operator uses.
- Vary input and state to detect hard-coded success, stale data, or display-only behavior.
- Test invalid, empty, interrupted, retry, persistence, and permission paths where the contract makes them relevant.
- Capture redacted screenshots, terminal excerpts, response summaries, or artifact facts.
- Mark every clause pass, fail, blocked, or out of scope. Lack of evidence is not a pass.
When a finding is fixed, rerun the failed clause and nearby regression probes; do not rerun unrelated expensive scenarios without reason.
Completion condition
Every relevant contract clause has a status and reproducible evidence, anti-fake probes were attempted, secrets and private data were excluded, and the report does not infer implementation defects from observable symptoms.


