@t275005746/gse 0.1.1 → 0.1.2

package/.gse/state.json

@@ -1,26 +1,147 @@
-{
-  "schemaVersion": 1,
-  "projectName": "gse",
-  "mode": "enterprise",
-  "canonicalPlan": ".gse/gse-design-master-plan.md",
-  "phase": "release",
-  "currentSlice": {
-    "id": "GSE-108-public-registry-publication",
-    "outcome": "Complete the real public registry publication gate for @t275005746/gse, then record accepted publication evidence.",
-    "status": "verified",
-    "nextAction": "Collect real native slash-command host evidence for /gse continue, record it as accepted host invocation evidence, then re-run the public acceptance doctor."
-  },
-  "toolStatuses": {
-    "browser": "unknown",
-    "lsp": "unknown",
-    "mcp": "unknown",
-    "subagents": "unknown",
-    "ci": "verified-public"
-  },
-  "lastEvidence": ".gse/evidence/2026-07-07.md",
-  "residualRisks": [
-    "Native slash-command support remains external-required until a real host runtime proves native /gse invocation with accepted evidence.",
-    "Do not treat portable text-command routing, generated command pointers, package dry-runs, local tarball installs, or release bundles as public registry publication or native slash-command evidence.",
-    "Use /gse doctor and audit-public-acceptance-readiness.mjs as the current source of truth for pending final-form gates."
-  ]
-}
+{
+  "schemaVersion": 1,
+  "projectName": "gse",
+  "mode": "enterprise",
+  "canonicalPlan": ".gse/gse-design-master-plan.md",
+  "phase": "final-form",
+  "currentSummary": {
+    "status": "release-metadata-0.1.2-verified",
+    "localEngineeringReadiness": 100,
+    "fullFinalFormReadiness": 100,
+    "publicAccepted": "verified",
+    "pendingExternalGate": null,
+    "currentPlan": "Commit and publish GSE 0.1.2 from verified release metadata."
+  },
+  "currentSlice": {
+    "id": "GSE-147-release-metadata-0.1.2",
+    "outcome": "Publish GSE 0.1.2 with npm install guidance and public GitHub repository metadata aligned.",
+    "status": "verified",
+    "nextAction": "Commit the verified `0.1.2` release metadata slice, then run `npm publish`, create `v0.1.2`, and push the branch/tag from that committed state."
+  },
+  "toolStatuses": {
+    "browser": "unknown",
+    "lsp": "unknown",
+    "mcp": "unknown",
+    "subagents": "unknown",
+    "ci": "documented"
+  },
+  "lastEvidence": ".gse/evidence/2026-07-10.md",
+  "blockedGates": [],
+  "nextChecks": [
+    "node scripts/run-gse-command.mjs --root . --target . --command \"/gse doctor\" --json",
+    "node scripts/audit-public-acceptance-readiness.mjs --root . --json",
+    "cmd /c npm view @t275005746/gse version --json",
+    "cmd /c npm publish --access public",
+    "cmd /c npm view @t275005746/gse version dist-tags --json",
+    "git tag v0.1.2",
+    "git push origin codex/gse-final-form-roadmap",
+    "git push origin v0.1.2"
+  ],
+  "residualRisks": [
+    "Process skills provide workflow discipline and portable artifacts; they do not prove host-native slash-command, subagent, browser, MCP, LSP, CI, or host UI support.",
+    "Native slash-command support remains an optional per-host adapter claim and is not claimed without a real host invocation record.",
+    "Browser, MCP, LSP, and subagent statuses remain unknown until project/session evidence is recorded."
+  ],
+  "riskArchive": [
+    {
+      "archivedAt": "2026-07-10",
+      "risk": "0.1.1 is already published and immutable; release metadata changes must publish a new semver version.",
+      "resolution": "GSE-147 uses 0.1.2 as the publish target."
+    },
+    {
+      "archivedAt": "2026-07-10",
+      "risk": "Session sync records prove notification attempts and honest outcomes, not that another running session adopted the capability immediately.",
+      "resolution": "GSE-146 surfaces compactState.sessionSyncBoundary and CP21 so adoption is false unless an explicit adoption record exists."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "The final-form roadmap contract is not itself final-form completion; live claims still come from references/final-readiness.md and audit-final-readiness.mjs.",
+      "resolution": "Preserved through /gse continue blockedGates and final-readiness claim boundary."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "The next implementation slice must reduce long prompt dependence through /gse continue hard preflight, not add more prose-only guidance.",
+      "resolution": "Implemented by scripts/generate-continue-packet.mjs and /gse continue routing."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Use /gse doctor and audit-public-acceptance-readiness.mjs as the source of truth for pending final-form public gates.",
+      "resolution": "Integrated into continue packet ownerExternalGateSummary and blockedGates."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "The final-form plan could be interpreted as only the remaining owner/external release gates.",
+      "resolution": "references/final-form-roadmap.md now contains Wave 1-5 execution plan and current gap list for local engineering and external evidence."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Project guard automation is the next local engineering gap: repeated real-project lessons must become preflight guard items instead of reminder prose.",
+      "resolution": "Implemented as soft project guard preflight through .gse/project-guards.md, audit-project-guards.mjs, scaffold generation, and /gse continue CP11."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Evidence level granularity still needs sharper UI/browser/API/CI labels.",
+      "resolution": "Implemented through evidenceLevel and requiredEvidenceLevel taxonomy, audit-evidence-levels.mjs, /gse continue CP12, and close gate CG09."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Role and dispatch fallback packets need stronger default output and no-fake-dispatch checks.",
+      "resolution": "Implemented through role-dispatch-fallback.md, role-fallback-packet.md, .gse/agents/role-fallback-packets.md, audit-role-dispatch-fallback.mjs, and /gse continue CP13."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Downgraded evidence is now visible before continue/close, but each project decides whether a downgrade blocks close.",
+      "resolution": "Preserved through evidenceLevel and requiredEvidenceLevel warnings."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Use /gse doctor and audit-public-acceptance-readiness.mjs as the source of truth for current final-form external gates.",
+      "resolution": "Preserved as the public/external acceptance route while state repair handles local state/evidence drift."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "State/evidence repair is intentionally conservative: invalid JSON/JSONL is reported with concrete actions, not guessed or overwritten.",
+      "resolution": "GSE-115 implemented /gse repair and CP14; the remaining risk is now bounded as a deliberate repair policy."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Automatic /gse repair writes are limited to reversible residual-risk compaction with .gse/backups; stale next-action drift remains a deliberate update.",
+      "resolution": "GSE-115 verified execute-gated residual-risk compaction and kept stale next-action repair deliberate."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Learning promotion writes candidate-only .gse/learning-promotions.md output; guards, gates, templates, scripts, and skill updates still require deliberate follow-up changes.",
+      "resolution": "GSE-116 implemented candidate-only learning promotion; deliberate follow-up remains as normal slice work rather than an active blocker."
+    },
+    {
+      "archivedAt": "2026-07-08",
+      "risk": "Classification is deterministic and project-generic, not a human semantic review.",
+      "resolution": "GSE-116 bounded classification as routing evidence and preserved human review for actual guard/gate/script mutations."
+    },
+    {
+      "archivedAt": "2026-07-09",
+      "risk": "Role fallback packets prove auditable sequential role boundaries, not real subagent execution.",
+      "resolution": "Preserved by role fallback packets, no-fake-dispatch close gate, and host capability records; no longer needs default active risk display."
+    },
+    {
+      "archivedAt": "2026-07-09",
+      "risk": "AION and MuseFlow drill warnings are project-local readiness signals; GSE behavior must stay project-generic and must not mutate target projects during read-only drills.",
+      "resolution": "Preserved by target hardening drill limits and maintenance cadence; no longer needs default active risk display."
+    },
+    {
+      "archivedAt": "2026-07-09",
+      "risk": "Installed sync evidence proves local source/package/installed-copy parity only at the time of the audit; it does not publish a package or prove host-native slash-command support.",
+      "resolution": "Archived by GSE state repair to keep active residual risks compact."
+    },
+    {
+      "archivedAt": "2026-07-09",
+      "risk": "UI/browser evidence policy proves evidence labeling and downgrade surfacing only; target-project visible UI claims still need real browser or screenshot-backed proof.",
+      "resolution": "Archived by GSE state repair to keep active residual risks compact."
+    },
+    {
+      "archivedAt": "2026-07-09",
+      "risk": "Maintenance snapshots are point-in-time freshness evidence; future capability edits must regenerate the snapshot, release bundle, and installed copy.",
+      "resolution": "Archived by GSE state repair to keep active residual risks compact."
+    }
+  ]
+}

package/CHANGELOG.md

@@ -2,9 +2,25 @@
 
 All notable GSE changes should be recorded here before a public package, catalog entry, or release handoff is marked ready.
 
-## Unreleased
-
-### Added
+## Unreleased
+
+## 0.1.2 - 2026-07-10
+
+### Added
+
+- Public npm/GitHub install metadata for `@t275005746/gse`.
+- README and README.zh-CN npm install quick path.
+
+### Verified
+
+- Public GitHub repository visibility and npm registry status are checked during release close.
+- `/gse continue` exposes session-sync adoption boundaries so installed-copy sync is not mistaken for target-session adoption.
+
+### Boundary
+
+- Native host slash-command support remains optional per host adapter and is not claimed without host invocation evidence.
+
+### Added
 
 - Project bootstrap modes for Lite, Standard, and Enterprise `.gse/` scaffolds.
 - Native Goal-Spec-Evidence operating model with change packs, execution-quality packs, evidence taxonomy, close gates, and target project audits.

package/README.md

@@ -22,12 +22,19 @@ Goal -> Spec -> Execute -> Evidence -> Learn
 - Optional adapters for host folders, LSP notes, MCP notes, hooks, plugins, and project skills
 - Release, packaging, public-collaboration, and evidence-gate workflows for mature projects
 
-## Installation
-
-Use GSE from a checked-out copy:
-
-```bash
-node scripts/validate-gse.mjs --root . --json
+## Installation
+
+Install from npm:
+
+```bash
+npm install -g @t275005746/gse
+gse status --target .
+```
+
+Use GSE from a checked-out copy:
+
+```bash
+node scripts/validate-gse.mjs --root . --json
 ```
 
 Package a checked-out copy for handoff:

package/README.zh-CN.md

@@ -22,12 +22,19 @@ Goal -> Spec -> Execute -> Evidence -> Learn
 - 可选 host folders、LSP、MCP、hooks、plugins、project skills 适配说明
 - 面向成熟项目的 release、packaging、public collaboration 和 evidence gate 工作流
 
-## 安装
-
-从已检出的 GSE 副本直接使用：
-
-```bash
-node scripts/validate-gse.mjs --root . --json
+## 安装
+
+从 npm 安装：
+
+```bash
+npm install -g @t275005746/gse
+gse status --target .
+```
+
+从已检出的 GSE 副本直接使用：
+
+```bash
+node scripts/validate-gse.mjs --root . --json
 ```
 
 把已检出的副本打包给其他环境：

package/SKILL.md

@@ -37,19 +37,32 @@ Default stance: keep the workflow as light as the task allows and as rigorous as
 Portable command helpers:
 
 - Short CLI wrapper: `node <skill>/scripts/gse.mjs status --target <project-root> --json`
-- Short continuation prompt: `node <skill>/scripts/generate-session-prompt.mjs --target <project-root>`
-- Portable command runner: `node <skill>/scripts/run-gse-command.mjs --target <project-root> --command "/gse continue"`
-- Validation profile runner: `node <skill>/scripts/run-validation-profile.mjs --target <project-root> --profile lite|standard|enterprise|release`
+- Short continuation packet: `node <skill>/scripts/generate-continue-packet.mjs --target <project-root>`
+- Portable command runner: `node <skill>/scripts/run-gse-command.mjs --target <project-root> --command "/gse continue"`
+- State/evidence repair doctor: `node <skill>/scripts/run-gse-command.mjs --target <project-root> --command "/gse repair" --json`
+- Direct repair audit: `node <skill>/scripts/audit-state-repair.mjs --target <project-root> --json`
+- Validation profile runner: `node <skill>/scripts/run-validation-profile.mjs --target <project-root> --profile lite|standard|enterprise|release`
 - Command execution audit: `node <skill>/scripts/audit-command-execution.mjs --root <skill> --profile lite|full`
-- Close readiness check: `node <skill>/scripts/audit-close-gate.mjs --target <project-root>`
+- Close readiness check: `node <skill>/scripts/audit-close-gate.mjs --target <project-root>`
+- Project guard preflight: `node <skill>/scripts/audit-project-guards.mjs --target <project-root> --json`
 - GSE owner/external action list: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse owner-actions" --json --compact`
 - Owner/external live evidence probe: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse probe --public-repo-url <url>" --json`
 - Release bundle dry-run/write route: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse release" --json`
 - Package dry-run/write route: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse package" --json`
 - Install dry-run/write route: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse install --source <package-dir> --install-target <install-skill-dir>" --json`
 - Public release checklist route: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse public-release" --json`
-- Learning capture route: `node <skill>/scripts/run-gse-command.mjs --target <project-root> --command "/gse learn --summary <lesson>" --execute --json`
-- Existing project state/index update: `node <skill>/scripts/update-project-state.mjs --target <project-root>`
+- Learning capture route: `node <skill>/scripts/run-gse-command.mjs --target <project-root> --command "/gse learn --summary <lesson>" --execute --json`
+- Learning drift audit: `node <skill>/scripts/audit-learning-drift.mjs --root <skill> --target <project-root> --json`
+- Target hardening drills: `node <skill>/scripts/audit-target-hardening-drills.mjs --root <skill> --aion-target <project-root> --museflow-target <project-root> --json`
+- Maintenance cadence audit: `node <skill>/scripts/audit-maintenance-cadence.mjs --root <skill> --json`
+- Maintenance snapshot: `node <skill>/scripts/generate-maintenance-snapshot.mjs --root <skill> --target <project-root> --installed-root <installed-skill-dir> --execute --json`
+- Installed package smoke: `node <skill>/scripts/generate-maintenance-snapshot.mjs --root <installed-skill-dir> --target <installed-skill-dir> --package-smoke --skip-release-bundle --json`
+- Installed sync audit: `node <skill>/scripts/audit-installed-sync.mjs --root <skill> --installed-root <installed-skill-dir> --json`
+- Session sync record audit: `node <skill>/scripts/audit-session-sync.mjs --root <skill> --json`
+- Conservative evidence-level backfill: `node <skill>/scripts/backfill-evidence-levels.mjs --root <project-root> --json`
+- Historical evidence review queue: `node <skill>/scripts/audit-evidence-review-queue.mjs --root <skill> --target <project-root> --json`
+- UI/browser evidence policy audit: `node <skill>/scripts/audit-ui-browser-evidence-policy.mjs --root <skill> --target <project-root> --json`
+- Existing project state/index update: `node <skill>/scripts/update-project-state.mjs --target <project-root>`
 - Change spec pack: `node <skill>/scripts/init-change.mjs --target <project-root> --change-id <id> --level lite|standard|enterprise`
 - Public release record: `node <skill>/scripts/record-public-release.mjs --root <project-root> --license-status owner-required`
 - Release bundle: `node <skill>/scripts/generate-release-bundle.mjs --root <skill> --label <release-label> --out <bundle-dir>`
@@ -100,8 +113,9 @@ For long-running projects, bind the work to `.gse/goal-map.md` or the project's
 - Project-specific standards and tools: `references/project-profile.md`
 - Project-local agent workspace: `references/project-agent-workspace.md`
 - Host-specific adapters: `references/host-adapters.md`, `references/compatibility.md`
-- Benchmark and gap audit: `references/benchmark-audit.md`
-- Task level selection: `references/task-levels.md`
+- Benchmark and gap audit: `references/benchmark-audit.md`
+- Final form roadmap: `references/final-form-roadmap.md`, `scripts/audit-final-form-roadmap.mjs`
+- Task level selection: `references/task-levels.md`
 - Goal maps: `references/goal-map.md`
 - Specs and change folders: `references/spec-workflow.md`
 - Agent roles and ownership: `references/agent-roles.md`, `references/file-ownership.md`
@@ -128,7 +142,7 @@ For long-running projects, bind the work to `.gse/goal-map.md` or the project's
 - Release owner action plan drill: `scripts/audit-release-owner-action-plan-drill.mjs`
 - Public release checklist: `scripts/generate-public-release-checklist.mjs`, `scripts/audit-public-release-checklist.mjs`
 - Final-form progress report: `scripts/generate-final-form-progress-report.mjs`, `scripts/audit-final-form-progress-report.mjs`
-- Packaging and maintenance: `references/packaging.md`
+- Packaging and maintenance: `references/packaging.md`, `references/maintenance-cadence.md`, `scripts/audit-maintenance-cadence.mjs`, `scripts/generate-maintenance-snapshot.mjs`, `scripts/audit-maintenance-snapshot.mjs`, `scripts/audit-installed-sync.mjs`, `scripts/record-session-sync.mjs`, `scripts/audit-session-sync.mjs`
 - CI readiness: `.github/workflows/validate-gse.yml`, `scripts/audit-ci-readiness.mjs`
 - Public collaboration templates: `.github/PULL_REQUEST_TEMPLATE.md`, `.github/ISSUE_TEMPLATE/`, `scripts/audit-public-collaboration-templates.mjs`
 - Release trust and key custody: `references/release-trust.md`
@@ -142,7 +156,13 @@ For long-running projects, bind the work to `.gse/goal-map.md` or the project's
 - Final acceptance packet: `scripts/generate-final-acceptance-packet.mjs`, `scripts/audit-final-acceptance-packet.mjs`
 - Recovery and handoff: `references/recovery.md`
 - Forward testing: `references/forward-test.md`
-- Learning loop: `references/learning-system.md`
-- Learning capture: `scripts/record-learning.mjs`, `scripts/audit-learning-system.mjs`
-- Drift audit: `references/drift-audit.md`
+- Learning loop: `references/learning-system.md`
+- Learning capture: `scripts/record-learning.mjs`, `scripts/audit-learning-system.mjs`
+- Learning drift: `scripts/audit-learning-drift.mjs`
+- Conservative evidence-level backfill: `scripts/backfill-evidence-levels.mjs`
+- Historical evidence review queue: `scripts/audit-evidence-review-queue.mjs`
+- UI/browser evidence policy: `scripts/audit-ui-browser-evidence-policy.mjs`
+- Target hardening drills: `scripts/audit-target-hardening-drills.mjs`
+- Project guards: `references/project-guards.md`, `scripts/audit-project-guards.mjs`
+- Drift audit: `references/drift-audit.md`
 - Design basis and source boundaries: `references/design-basis.md`

package/assets/templates/dispatch-packet.md

@@ -4,16 +4,21 @@ Use this when assigning work to a real subagent, another human/agent session, or
 
 Do not require this packet for tiny single-agent edits. Use it when delegation, role separation, file ownership, or review evidence matters.
 
-## Execution Mode
-
-- Mode: real-subagent | sequential-role | handoff-session
-- Host/tool used:
-- Tool status: verified | documented | unknown | unavailable
-- If not real-subagent, state fallback reason:
+## Execution Mode
+
+- Mode: real-subagent | sequential-role | handoff-session
+- Real delegation used: yes | no
+- Host/tool used:
+- Tool status: verified | documented | unknown | unavailable
+- If not real-subagent, state fallback reason:
+- Dispatch evidence:
+- Fallback execution:
+- Role output evidence:
+- Claim boundary:
 
 ## Role
 
-- Role: Coordinator | Product Analyst | Architect | Code Locator | Builder | Reviewer | QA | Docs/Evidence | Other:
+- Role: Coordinator | Planner | Product Analyst | Architect | Locator | Implementer | Verifier | Reviewer | QA | Docs/Evidence | Release | Other:
 - Skill focus:
 - Model/tool preference, if project-approved:
 
@@ -75,12 +80,13 @@ Return a concise report with:
 - Residual risks:
 - Questions or blockers:
 
-## Verification
-
-- Required focused test/smoke/check:
-- Acceptable evidence level: result | verified | accepted
-- What proves success:
-- What would fail the task:
+## Verification
+
+- Required focused test/smoke/check:
+- Evidence status: result | verified | accepted
+- Acceptable evidence level: result | verified-unit | verified-component | verified-api | verified-browser | verified-ci | accepted-owner | accepted-release | external-required
+- What proves success:
+- What would fail the task:
 
 ## Stop Conditions
 
@@ -101,4 +107,6 @@ Stop and report `NEEDS_CONTEXT` or `BLOCKED` if:
 
 ## Notes For Sequential Fallback
 
-When no real subagent tool exists, use this packet as a role checklist in the main session. Say that no real delegation occurred if reporting delegation status matters. Keep role boundaries honest.
+When no real subagent tool exists, use this packet as a role checklist in the main session. Say that no real delegation occurred if reporting delegation status matters. Keep role boundaries honest.
+
+For repeatable role fallback packets, use `assets/templates/role-fallback-packet.md` and `references/role-dispatch-fallback.md`.

package/assets/templates/evidence.md

@@ -1,8 +1,14 @@
-# Evidence
-
-## Verification Commands
-
-## Results
+# Evidence
+
+## Status
+
+- Evidence status:
+- Evidence level:
+- Required evidence level:
+
+## Verification Commands
+
+## Results
 
 ## Files Changed
 

package/assets/templates/role-fallback-packet.md

@@ -0,0 +1,49 @@
+# Role Fallback Packet
+
+Use this packet for one role in a real-subagent run, sequential fallback, or handoff session.
+
+## Dispatch Boundary
+
+- Execution mode: real-subagent | sequential-role | handoff-session
+- Real delegation used: yes | no
+- Host/tool used:
+- Tool status: verified | documented | unknown | unavailable
+- Fallback reason:
+- Dispatch evidence:
+
+## Role
+
+- Role: Planner | Locator | Implementer | Verifier | Reviewer | Docs/Evidence | Release
+- Skill focus:
+- Objective:
+- Non-goals:
+
+## Ownership
+
+- Allowed files:
+- Forbidden files:
+- Read-only files:
+- Shared files requiring coordinator review:
+- Pre-existing dirty files:
+
+## Required Inputs
+
+1.
+2.
+3.
+
+## Expected Output
+
+- Role output evidence:
+- Files inspected:
+- Files changed:
+- Verification command/check:
+- Evidence level: result | verified-unit | verified-component | verified-api | verified-browser | verified-ci | accepted-owner | accepted-release | external-required
+- Residual risk:
+- Stop condition:
+- Claim boundary:
+
+## Completion
+
+- Status: DONE | DONE_WITH_CONCERNS | NEEDS_CONTEXT | BLOCKED
+- Coordinator integration required: yes | no

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@t275005746/gse",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Goal-Spec-Evidence Engineering workflow skill for long-running agent-assisted software projects.",
   "type": "module",
-  "license": "MIT",
-  "homepage": "https://gatehub.top/",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/275005746/gse.git"
+  },
+  "bugs": {
+    "url": "https://github.com/275005746/gse/issues"
+  },
+  "homepage": "https://gatehub.top/",
   "bin": {
     "gse": "scripts/gse.mjs"
   },
@@ -30,13 +37,14 @@
     "references",
     "scripts"
   ],
-  "scripts": {
-    "audit:npm": "node scripts/audit-npm-package-metadata.mjs --root . --json",
-    "audit:npm-install": "node scripts/audit-npm-tarball-install.mjs --root . --json",
-    "audit:npm-publish": "node scripts/audit-npm-publish-dry-run.mjs --root . --json",
-    "validate": "node scripts/validate-gse.mjs --root . --json",
-    "pack:dry-run": "npm pack --dry-run --json"
-  },
+  "scripts": {
+    "audit:npm": "node scripts/audit-npm-package-metadata.mjs --root . --json",
+    "audit:npm-install": "node scripts/audit-npm-tarball-install.mjs --root . --json",
+    "audit:npm-publish": "node scripts/audit-npm-publish-dry-run.mjs --root . --json",
+    "check:encoding": "node scripts/check-encoding.mjs",
+    "validate": "node scripts/validate-gse.mjs --root . --json",
+    "pack:dry-run": "npm pack --dry-run --json"
+  },
   "keywords": [
     "gse",
     "goal-spec-evidence",

package/references/agent-roles.md

@@ -2,11 +2,17 @@
 
 Use roles to make multi-agent work predictable.
 
-## Coordinator
-
-Owns scope, task level, context selection, final integration, and final answer.
-
-Never delegates final judgment.
+## Coordinator
+
+Owns scope, task level, context selection, final integration, and final answer.
+
+Never delegates final judgment.
+
+## Planner
+
+Defines the slice outcome, scope, acceptance, evidence, residual risk, and next action.
+
+Maps to Coordinator or Product Analyst in smaller tasks.
 
 ## Product Analyst
 
@@ -16,13 +22,23 @@ Clarifies user outcome, pain, audience, competitive baseline, and priority.
 
 Defines state, data flow, module boundaries, contracts, risks, and rollback.
 
-## Code Locator
-
-Read-only. Finds files, symbols, call chains, existing tests, and local patterns.
-
-## Builder
-
-Implements a bounded slice. Avoids unrelated refactors.
+## Code Locator
+
+Read-only. Finds files, symbols, call chains, existing tests, and local patterns.
+
+Also called Locator in portable role fallback packets.
+
+## Builder
+
+Implements a bounded slice. Avoids unrelated refactors.
+
+Also called Implementer in portable role fallback packets.
+
+## Verifier
+
+Runs focused checks and records what evidence level the check proves.
+
+Maps to QA in smaller tasks.
 
 ## Reviewer
 
@@ -32,18 +48,23 @@ Checks correctness, regressions, architecture drift, security, and missing tests
 
 Runs focused verification, browser smoke, API smoke, or screenshot checks.
 
-## Docs/Evidence
-
-Writes evidence, changelog notes, ADR links, and learning entries. Does not modify implementation unless explicitly assigned.
+## Docs/Evidence
+
+Writes evidence, changelog notes, ADR links, and learning entries. Does not modify implementation unless explicitly assigned.
+
+## Release
+
+Checks release, CI, package, public, owner, marketplace, registry, and host-runtime claim boundaries. Does not turn local evidence into external acceptance.
 
 ## Dispatch Rules
 
-- Use real subagent tools only when exposed by the current host.
-- Give each agent a role, files allowed, expected output, and forbidden actions. Use `assets/templates/dispatch-packet.md` when the assignment needs durable boundaries or evidence.
-- Avoid parallel writes to the same files.
-- If subagents are unavailable, execute roles sequentially in the main session and say so.
+- Use real subagent tools only when exposed by the current host.
+- Give each agent a role, files allowed, expected output, and forbidden actions. Use `assets/templates/dispatch-packet.md` when the assignment needs durable boundaries or evidence.
+- For portable fallback packets, use `references/role-dispatch-fallback.md` and `assets/templates/role-fallback-packet.md`.
+- Avoid parallel writes to the same files.
+- If subagents are unavailable, execute roles sequentially in the main session and say so.
 
 ## File Ownership
 
-Use `references/file-ownership.md` before assigning write access, running parallel implementation, or editing in a dirty worktree. Keep locator, reviewer, and QA roles read-only unless explicitly assigned otherwise.
+Use `references/file-ownership.md` before assigning write access, running parallel implementation, or editing in a dirty worktree. Keep locator, verifier, reviewer, release, and QA roles read-only unless explicitly assigned otherwise.