Reconcile prompt execution provenance

docs/internal/app-orchestration.md

@@ -9,7 +9,7 @@ is owned by the [CLI reference](../cli.md) and [operations guide](../operations.
 
 `GenerateDetailed` resolves the requested report and output destination before initializing an optional explicit debug writer. An explicit output file wins; otherwise the configured output directory is used, falling back to the captured working directory. It validates the report's generated-text catalog binding, exact Promptkit prompt, and selected profile before collecting weather data. The resolved profile, backend, and model are carried in the active result.
 
-The workflow builds facts, a module snapshot, briefing metadata, and the YAML prompt package in memory. It executes Promptkit, validates the returned generated text, builds a render context, and renders Markdown. `fileutil` atomically writes the completed Markdown to the selected output path. Only after that write succeeds does single-report notification run.
+The workflow builds facts, a module snapshot, briefing metadata, and the YAML prompt package in memory. It executes Promptkit only against the inspected prompt and profile, reconciles the preparation callback and completed result with that identity and the prepared report schema, validates the returned generated text, builds a render context, and renders Markdown. `fileutil` atomically writes the completed Markdown to the selected output path. Only after that write succeeds does single-report notification run.
 
 Failures return an active partial result with safe identity, profile, warning, validation, debug, and output information when available. After rendering and immediately before publication, the workflow checks for cancellation or deadline expiry. Any failure before publication leaves an existing destination unchanged. A notification failure retains the newly published output.
 
@@ -36,10 +36,11 @@ inspection fails, the partial result retains the resolved prompt ID, version,
 and hash. Artifact paths are added only after publication commits.
 
 The comparison execution core starts each inspected profile independently,
-keeps results in selection order, and waits for all started work. Independent
-profile failures are recorded and do not stop peers. Context cancellation marks
-unfinished work and prevents publication. Details of prepared values, execution
-and debugging, and publication are documented in [prepared report
+keeps results in selection order, and waits for all started work. Every profile
+reconciles its callback and completion provenance before its JSON can be
+rendered. Independent profile failures are recorded and do not stop peers.
+Context cancellation marks unfinished work and prevents publication. Details of
+prepared values, execution and debugging, and publication are documented in [prepared report
 internals](prepared-report.md), [comparison execution
 internals](comparison-execution.md), and [comparison publication
 internals](comparison-publication.md).

docs/internal/prepared-report.md

@@ -17,6 +17,14 @@ Preparation deep-copies mutable facts, snapshots, identity, and data-package
 bytes before returning them. Consumers receive independent copies so one
 execution cannot change another's input or rendering context.
 
+Before accepting generated JSON, the execution boundary reconciles the prepared
+report definition, inspected prompt hash and selected profile identity, the one
+preparation callback, and the completed Promptkit result. The callback and
+completion must agree on prompt, profile, backend, model, and rendered/input
+hashes; the callback output and completed validation must name the prepared
+report's JSON Schema. A mismatch produces no rendered Markdown and leaves
+results with only the inspected safe identity.
+
 Single-report generation executes one prepared profile and publishes its
 Markdown. Comparison prepares once, gives every selected profile the same YAML
 bytes, and only then assembles the resulting logical bundle. The prompt-input