Reconcile prompt execution provenance

docs/internal/prepared-report.md

@@ -17,6 +17,14 @@ Preparation deep-copies mutable facts, snapshots, identity, and data-package
 bytes before returning them. Consumers receive independent copies so one
 execution cannot change another's input or rendering context.
 
+Before accepting generated JSON, the execution boundary reconciles the prepared
+report definition, inspected prompt hash and selected profile identity, the one
+preparation callback, and the completed Promptkit result. The callback and
+completion must agree on prompt, profile, backend, model, and rendered/input
+hashes; the callback output and completed validation must name the prepared
+report's JSON Schema. A mismatch produces no rendered Markdown and leaves
+results with only the inspected safe identity.
+
 Single-report generation executes one prepared profile and publishes its
 Markdown. Comparison prepares once, gives every selected profile the same YAML
 bytes, and only then assembles the resulting logical bundle. The prompt-input