@t275005746/gse 0.1.1 → 0.1.2

package/scripts/audit-public-acceptance-readiness.mjs

@@ -101,8 +101,8 @@ const gateGuidance = {
 const finalReadiness = run(process.execPath, [path.join(root, 'scripts', 'audit-final-readiness.mjs'), '--root', root, '--json'])
 const finalReadinessData = parseJson(finalReadiness.stdout)
 const matrix = finalReadinessData?.matrix ?? []
-const pendingGates = matrix
-  .filter((row) => row.status !== 'verified')
+const pendingGates = matrix
+  .filter((row) => row.status === 'owner-required' || row.status === 'external-required')
   .map((row) => {
     const rawCommand = gateGuidance[row.area]?.command ?? 'No command mapping exists yet.'
     const recordCommand = shellSafePlaceholders(rawCommand)
@@ -133,9 +133,9 @@ const pendingCommandsAreExecutableTemplates = pendingGates.every((gate) =>
   (gate.recordCommand.includes('record-host-invocation.mjs') ? gate.recordCommand.includes('--status accepted') : true),
 )
 const expectedGatesCoveredByMatrix = expectedFinalGates.every((gate) => matrixGateNames.has(gate))
-const ownerExternalGatesRemainHonest = matrix.every((row) => row.status === 'verified' || row.status === 'owner-required' || row.status === 'external-required')
+const ownerExternalGatesRemainHonest = matrix.every((row) => row.status === 'verified' || row.status === 'owner-required' || row.status === 'external-required' || row.status === 'not-claimed')
 const publicAccepted = finalReadinessData?.workflows?.publicAccepted ?? 'unknown'
-const claimBoundaryHonest = publicAccepted === 'verified' ? pendingGates.length === 0 : pendingGates.length > 0
+const claimBoundaryHonest = publicAccepted === 'verified' ? pendingGates.length === 0 : pendingGates.length > 0
 
 const checks = [
   check('PAD01', 'final readiness audit runs before public acceptance diagnosis', finalReadiness.status === 0 && finalReadinessData?.summary?.status === 'passed', finalReadiness.command, finalReadiness.stderr),
@@ -144,7 +144,7 @@ const checks = [
   check('PAD03b', 'pending final gates expose dry-run preflight commands', currentPendingRowsHavePreflightCommands, pendingGates.map((gate) => `${gate.area} -> ${gate.preflightCommand}`).join('; ')),
   check('PAD03c', 'pending final gate commands are complete executable templates', pendingCommandsAreExecutableTemplates, pendingGates.map((gate) => `${gate.area} -> ${gate.recordCommand}`).join('; ')),
   check('PAD04', 'pending final gates keep owner/external responsibility visible', pendingGates.every((gate) => gate.owner !== 'unknown'), pendingGates.map((gate) => `${gate.area}:${gate.owner}`).join(', ')),
-  check('PAD05', 'final readiness statuses remain honest until accepted records promote them', ownerExternalGatesRemainHonest && claimBoundaryHonest, `publicAccepted=${publicAccepted}; pending=${pendingGates.length}`),
+  check('PAD05', 'final readiness statuses remain honest when required gates are accepted and optional claims are not-claimed', ownerExternalGatesRemainHonest && claimBoundaryHonest, `publicAccepted=${publicAccepted}; pending=${pendingGates.length}`),
   check('PAD06', 'doctor does not claim external acceptance from local mechanics', publicAccepted !== 'verified' || pendingGates.length === 0, 'public acceptance follows final-readiness matrix only'),
 ]
 
@@ -170,7 +170,7 @@ const report = {
   nextPreflightCommands: pendingGates.map((gate) => gate.preflightCommand),
   limits: [
     'This doctor identifies missing owner/external evidence and record commands.',
-    'It does not choose a license, publish a package, configure a public repository, run public CI, approve a marketplace listing, or prove host-native slash commands.',
+    'It does not choose a license, publish a package, configure a public repository, run public CI, approve a marketplace listing, or prove optional host-native slash commands.',
     'A gate is accepted only after a real accepted record is created and final readiness is re-audited.',
   ],
   checks,

package/scripts/audit-public-release-checklist.mjs

@@ -66,8 +66,9 @@ const checklistData = checklistRun ? parseJson(checklistRun.stdout) : null
 const canonicalChecklist = read('.gse/acceptance/public-release-checklist.md')
 rmSync(tmp, { recursive: true, force: true })
 
-const pendingGates = manifest?.publicAcceptance?.pendingGates ?? []
-const expectedAreas = pendingGates.map((gate) => gate.area)
+const pendingGates = manifest?.publicAcceptance?.pendingGates ?? []
+const hasPendingGates = pendingGates.length > 0
+const expectedAreas = pendingGates.map((gate) => gate.area)
 const requiredPhases = [
   '01. Prepare the release bundle',
   '02. Publish and configure the public repository',
@@ -82,24 +83,25 @@ const expectedScripts = [...new Set(pendingGates
   .map((gate) => String(gate.recordCommand ?? '').match(/scripts\/([\w-]+\.mjs)/)?.[1])
   .filter(Boolean))]
 const noLocalPaths = !/[A-Z]:\\|C:\\Users\\|D:\\codex\\/i.test(checklist) && !/[A-Z]:\\|C:\\Users\\|D:\\codex\\/i.test(canonicalChecklist)
-const noFalseAcceptance = checklist.includes('Public accepted: not-accepted') &&
-  checklist.includes('does not publish, approve, or accept') &&
-  checklist.includes('A gate is complete only after real accepted evidence')
-const commandCoverage = expectedScripts.every((script) => checklist.includes(script)) &&
-  checklist.includes('/gse release') &&
-  checklist.includes('/gse release --execute --out <bundle>') &&
-  checklist.includes('/gse probe')
-const canonicalFresh = canonicalChecklist.includes('GSE Public Release Checklist') &&
-  requiredPhases.every((phase) => canonicalChecklist.includes(phase)) &&
-  expectedAreas.every((area) => canonicalChecklist.includes(`Gate: ${area}`)) &&
-  canonicalChecklist.includes(`Pending owner/external gates: ${pendingGates.length}`)
+const publicAcceptedStatus = manifest?.publicAcceptance?.publicAccepted ?? 'unknown'
+const noFalseAcceptance = checklist.includes('Public accepted: ' + publicAcceptedStatus) &&
+  checklist.includes('does not publish, approve, or accept') &&
+  checklist.includes('A gate is complete only after real accepted evidence')
+const commandCoverage = (hasPendingGates ? expectedScripts.every((script) => checklist.includes(script)) : true) &&
+  checklist.includes('/gse release') &&
+  checklist.includes('/gse release --execute --out <bundle>') &&
+  checklist.includes('/gse probe')
+const canonicalFresh = canonicalChecklist.includes('GSE Public Release Checklist') &&
+  requiredPhases.every((phase) => canonicalChecklist.includes(phase)) &&
+  (hasPendingGates ? expectedAreas.every((area) => canonicalChecklist.includes(`Gate: ${area}`)) : canonicalChecklist.includes('Public accepted: verified')) &&
+  canonicalChecklist.includes(`Pending owner/external gates: ${pendingGates.length}`)
 
 const checks = [
   check('PRC01', 'public release checklist generator exists', exists('scripts/generate-public-release-checklist.mjs'), 'scripts/generate-public-release-checklist.mjs'),
   check('PRC02', 'generator writes checklist from release status manifest', checklistRun?.status === 0 && checklistData?.status === 'written' && checklist.includes('GSE Public Release Checklist'), 'generate-public-release-checklist.mjs'),
   check('PRC03', 'checklist uses ordered public release runway phases', requiredPhases.every((phase) => checklist.includes(phase)), 'public-release-checklist.md'),
-  check('PRC04', 'checklist covers every pending owner/external gate', expectedAreas.length > 0 && expectedAreas.every((area) => checklist.includes(`Gate: ${area}`)), 'release-status-manifest pending gates'),
-  check('PRC05', 'checklist includes executable preflight and record command families', commandCoverage && checklist.includes('Preflight:') && checklist.includes('Record accepted evidence:'), 'public-release-checklist.md'),
+  check('PRC04', 'checklist covers every pending owner/external gate', hasPendingGates ? expectedAreas.every((area) => checklist.includes(`Gate: ${area}`)) : checklist.includes('Pending owner/external gates: 0'), 'release-status-manifest pending gates'),
+  check('PRC05', 'checklist includes executable preflight and record command families', commandCoverage && (hasPendingGates ? (checklist.includes('Preflight:') && checklist.includes('Record accepted evidence:')) : checklist.includes('Final Verification')), 'public-release-checklist.md'),
   check('PRC06', 'checklist preserves public acceptance boundary', noFalseAcceptance, 'public-release-checklist.md'),
   check('PRC07', 'checklist avoids local machine paths', noLocalPaths, 'public-release-checklist.md'),
   check('PRC08', 'canonical checklist is fresh against current manifest', canonicalFresh, '.gse/acceptance/public-release-checklist.md'),

package/scripts/audit-release-bundle.mjs

@@ -87,9 +87,11 @@ const installablePackageManifest = readBundle('installable-package/gse-package-m
 const provenance = readBundle('provenance.json')
 const checksums = readBundle('checksums.sha256')
 const releaseStatusData = parseJson(releaseStatusManifest)
-const pendingGates = releaseStatusData?.publicAcceptance?.pendingGates ?? []
-const pendingAreas = pendingGates.map((gate) => gate.area)
-const hasPendingRegistryPublication = pendingAreas.includes('Public registry publication')
+const pendingGates = releaseStatusData?.publicAcceptance?.pendingGates ?? []
+const pendingAreas = pendingGates.map((gate) => gate.area)
+const hasPendingGates = pendingGates.length > 0
+const publicAcceptedStatus = releaseStatusData?.publicAcceptance?.publicAccepted ?? releaseStatusData?.claimBoundary?.publicAccepted ?? 'unknown'
+const hasPendingRegistryPublication = pendingAreas.includes('Public registry publication')
 const bundleManifestData = parseJson(manifest)
 const ownerExternalGateKitData = parseJson(ownerExternalGateKitManifest)
 const installablePackageManifestData = parseJson(installablePackageManifest)
@@ -171,30 +173,30 @@ const checks = [
   check('RB04', 'bundle preserves license decision and public release boundary', summary.includes('Accepted public release: not accepted') && record.includes('License status: selected') && record.includes('SPDX identifier: MIT') && record.includes('Evidence status: accepted'), 'release-summary.md, public-release-record.md'),
   check('RB05', 'bundle includes install, validation, and installed CLI commands', summary.includes('installable-package/') && summary.includes('install-gse.mjs') && summary.includes('validate-gse.mjs') && summary.includes('scripts/gse.mjs status') && checklist.includes('audit-remote-distribution.mjs'), 'release-summary.md, validation-checklist.md'),
   check('RB05b', 'bundle includes host runtime drill before cross-host handoff', summary.includes('audit-host-runtime-invocation-drill.mjs') && checklist.includes('audit-host-runtime-invocation-drill.mjs'), 'release-summary.md, validation-checklist.md'),
-  check('RB06', 'bundle manifest records validation and limits', manifest.includes('"validation"') && manifest.includes('Bundle does not choose a license') && bundleManifestData?.publicReleaseAcceptance === 'not-accepted' && bundleManifestData?.licenseDecision === 'accepted' && manifest.includes('"publicAcceptanceHandoff": "included"') && manifest.includes('"hostRuntimeEvidenceHandoff": "included"') && manifest.includes('"releaseStatusManifest": "included"') && manifest.includes('"releaseOwnerActionPlan": "included"'), 'bundle-manifest.json'),
+  check('RB06', 'bundle manifest records validation and limits', manifest.includes('"validation"') && manifest.includes('Bundle does not choose a license') && bundleManifestData?.publicReleaseAcceptance === publicAcceptedStatus && bundleManifestData?.licenseDecision === 'accepted' && manifest.includes('"publicAcceptanceHandoff": "included"') && manifest.includes('"hostRuntimeEvidenceHandoff": "included"') && manifest.includes('"releaseStatusManifest": "included"') && manifest.includes('"releaseOwnerActionPlan": "included"'), 'bundle-manifest.json'),
   check('RB06v', 'bundle manifest records compact validation check details', Array.isArray(bundleManifestData?.validationChecks) && bundleManifestData.validationChecks.some((item) => item.id === 'validate-09o' && item.label === 'public evidence placeholder helper audit' && item.command?.includes('audit-evidence-placeholders.mjs')) && summary.includes('Validation manifest detail'), 'bundle-manifest.json, release-summary.md'),
   check('RB06v2', 'canonical bundle manifest records current validation check details', Array.isArray(canonicalBundleManifestData?.validationChecks) && canonicalBundleManifestData.validationChecks.some((item) => item.id === 'validate-09o' && item.label === 'public evidence placeholder helper audit' && item.command?.includes('audit-evidence-placeholders.mjs')), '.gse/release-bundles/gse-release-bundle-audit/bundle-manifest.json'),
   check('RB06v3', 'bundle manifest records installable package snapshot', bundleManifestData?.installablePackage?.path === 'installable-package/' && bundleManifestData?.installablePackage?.manifest === 'installable-package/gse-package-manifest.json' && bundleManifestData?.installablePackage?.algorithm === 'sha256' && bundleManifestData?.installablePackage?.cli === 'scripts/gse.mjs', 'bundle-manifest.json installablePackage'),
   check('RB06v4', 'bundle installable package manifest is valid', installablePackageManifestData?.integrity?.algorithm === 'sha256' && installablePackageManifestData?.entrypoints?.cli === 'scripts/gse.mjs' && installablePackageManifestData?.fileHashes?.['SKILL.md'], 'installable-package/gse-package-manifest.json'),
   check('RB06v5', 'bundle installable package installs and installed CLI runs', installFromBundle.status === 0 && installFromBundleData?.status === 'passed' && installFromBundleData?.summary?.integrityFailed === 0 && installedFromBundleCli.status === 0 && installedFromBundleCliData?.command === '/gse status' && installedFromBundleCliData?.project?.stateValid === true, 'installable-package install and gse status'),
-  check('RB06v6', 'bundle provenance records local generation boundaries', provenanceData?.generator === 'scripts/generate-release-bundle.mjs' && provenanceData?.installablePackage?.packageDigest === installablePackageManifestData?.integrity?.packageDigest && provenanceData?.publicAcceptance?.status === 'not-accepted' && Array.isArray(provenanceData?.claimBoundaries) && provenanceData.claimBoundaries.some((item) => item.includes('not a registry attestation')), 'provenance.json'),
+  check('RB06v6', 'bundle provenance records local generation boundaries', provenanceData?.generator === 'scripts/generate-release-bundle.mjs' && provenanceData?.installablePackage?.packageDigest === installablePackageManifestData?.integrity?.packageDigest && provenanceData?.publicAcceptance?.status === publicAcceptedStatus && Array.isArray(provenanceData?.claimBoundaries) && provenanceData.claimBoundaries.some((item) => item.includes('not a registry attestation')), 'provenance.json'),
   check('RB06v7', 'bundle checksums verify installable package files', verifyChecksumFile(), 'checksums.sha256'),
   check('RB06v8', 'bundle provenance and checksums do not expose local paths', !hasLocalPathLeak(provenance) && !hasLocalPathLeak(checksums), 'provenance.json, checksums.sha256'),
   check('RB06a', 'bundle manifest does not expose local source root or Node install path', bundleManifestData && !Object.hasOwn(bundleManifestData, 'sourceRoot') && !hasLocalPathLeak(manifest), 'bundle-manifest.json'),
-  check('RB06b', 'bundle includes public acceptance handoff boundaries', handoff.includes('GSE Public Acceptance Handoff') && handoff.includes('Public accepted: not-accepted') && handoff.includes('Do not claim public release acceptance'), 'public-acceptance-handoff.md'),
+  check('RB06b', 'bundle includes public acceptance handoff boundaries', handoff.includes('GSE Public Acceptance Handoff') && handoff.includes('Public accepted: ' + publicAcceptedStatus) && handoff.includes('Do not claim public release acceptance'), 'public-acceptance-handoff.md'),
   check('RB06b2', 'bundle public acceptance handoff uses current registry publication CLI flag when pending', !hasPendingRegistryPublication || (handoff.includes('--proves-registry-publication true') && !handoff.includes('--proves-public-registry-publication')), 'public-acceptance-handoff.md'),
-  check('RB06b3', 'bundle public acceptance handoff includes dry-run preflight commands', handoff.includes('Preflight command') && handoff.includes('--dry-run --json'), 'public-acceptance-handoff.md'),
+  check('RB06b3', 'bundle public acceptance handoff includes dry-run preflight commands', hasPendingGates ? (handoff.includes('Preflight command') && handoff.includes('--dry-run --json')) : handoff.includes('No owner/external acceptance gate is pending'), 'public-acceptance-handoff.md'),
   check('RB06c', 'bundle includes host runtime evidence handoff boundaries', hostHandoff.includes('GSE Host Runtime Evidence Handoff') && hostHandoff.includes('Do not claim native slash-command support') && hostHandoff.includes('record-host-invocation.mjs'), 'host-runtime-evidence-handoff.md'),
-  check('RB06d', 'bundle includes machine-readable release status manifest', releaseStatusData?.claimBoundary?.publicAccepted === 'not-accepted' && releaseStatusManifest.includes('"releaseStatusManifest"') && releaseStatusManifest.includes('"localInstalledCli": "verified"') && releaseStatusManifest.includes('"remoteInstalledCli": "verified"') && releaseStatusManifest.includes('"nativeSlashCommandRecords": 0') && releaseStatusManifest.includes('"fixtureDrill": "verified"') && releaseStatusManifest.includes('"fixtureEvidenceIsPersistent": false'), 'release-status-manifest.json'),
+  check('RB06d', 'bundle includes machine-readable release status manifest', releaseStatusData?.claimBoundary?.publicAccepted === publicAcceptedStatus && releaseStatusManifest.includes('"releaseStatusManifest"') && releaseStatusManifest.includes('"localInstalledCli": "verified"') && releaseStatusManifest.includes('"remoteInstalledCli": "verified"') && releaseStatusManifest.includes('"nativeSlashCommandRecords": 0') && releaseStatusManifest.includes('"fixtureDrill": "verified"') && releaseStatusManifest.includes('"fixtureEvidenceIsPersistent": false'), 'release-status-manifest.json'),
   check('RB06d2', 'bundle release status manifest includes dry-run preflight commands', (releaseStatusData?.publicAcceptance?.nextPreflightCommands?.length ?? 0) === (releaseStatusData?.publicAcceptance?.pendingGates?.length ?? -1) && releaseStatusData.publicAcceptance.nextPreflightCommands.every((command) => command.includes('--dry-run --json')), 'release-status-manifest.json'),
   check('RB06d3', 'bundle release status manifest includes preflight command drill', releaseStatusData?.verificationCommands?.some((command) => command.includes('audit-public-acceptance-command-dry-run-drill.mjs')), 'release-status-manifest.json'),
   check('RB06e', 'bundle includes owner-facing release action plan', releaseOwnerActionPlan.includes('GSE Release Owner Action Plan') && pendingGates.every((gate) => releaseOwnerActionPlan.includes('#### ' + gate.area)) && !releaseOwnerActionPlan.includes('record-public-release.mjs') && releaseOwnerActionPlan.includes('Local validation does not mean public acceptance'), 'release-owner-action-plan.md'),
-  check('RB06e2', 'bundle owner action plan includes dry-run preflight commands and drill', releaseOwnerActionPlan.includes('Preflight command') && releaseOwnerActionPlan.includes('--dry-run --json') && releaseOwnerActionPlan.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'release-owner-action-plan.md'),
+  check('RB06e2', 'bundle owner action plan includes dry-run preflight commands and drill', (hasPendingGates ? (releaseOwnerActionPlan.includes('Preflight command') && releaseOwnerActionPlan.includes('--dry-run --json')) : releaseOwnerActionPlan.includes('No pending owner or external gates were reported by the manifest.')) && releaseOwnerActionPlan.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'release-owner-action-plan.md'),
   check('RB06e3', 'canonical release bundle owner action plans match current manifest counts and pending gates', planMatchesManifestCounts(canonicalBundleReleaseOwnerActionPlan, canonicalReleaseStatusManifest) && planMatchesManifestCounts(canonicalBundleKitReleaseOwnerActionPlan, canonicalReleaseStatusManifest), '.gse/release-bundles/gse-release-bundle-audit/release-owner-action-plan.md'),
-  check('RB06e4', 'bundle includes linear public release checklist', publicReleaseChecklist.includes('GSE Public Release Checklist') && publicReleaseChecklist.includes('01. Prepare the release bundle') && publicReleaseChecklist.includes('08. Record other host runtime invocation evidence') && publicReleaseChecklist.includes('Public accepted: not-accepted') && publicReleaseChecklist.includes('/gse release --execute --out <bundle>'), 'public-release-checklist.md'),
+  check('RB06e4', 'bundle includes linear public release checklist', publicReleaseChecklist.includes('GSE Public Release Checklist') && publicReleaseChecklist.includes('01. Prepare the release bundle') && publicReleaseChecklist.includes('08. Record other host runtime invocation evidence') && publicReleaseChecklist.includes('Public accepted: ' + publicAcceptedStatus) && publicReleaseChecklist.includes('/gse release --execute --out <bundle>'), 'public-release-checklist.md'),
   check('RB06e5', 'canonical release bundle checklist matches pending gate count', canonicalBundlePublicReleaseChecklist.includes('GSE Public Release Checklist') && canonicalBundlePublicReleaseChecklist.includes('Pending owner/external gates: ' + (canonicalReleaseStatusManifest?.publicAcceptance?.pendingGates?.length ?? 0)), '.gse/release-bundles/gse-release-bundle-audit/public-release-checklist.md'),
   check('RB06f', 'bundle includes owner/external gate execution kit', ownerExternalGateKitReadme.includes('GSE Owner / External Gate Kit') && ownerExternalGateKitData?.pendingGateCount === releaseStatusData?.publicAcceptance?.pendingGates?.length && ownerExternalGateKitData?.generatedFresh?.finalAcceptancePacket === true && !ownerExternalGateKitRecordCommands.includes('record-public-release.mjs'), 'owner-external-gate-kit/'),
-  check('RB06f2', 'bundle owner/external gate kit includes dry-run preflight commands', ownerExternalGateKitRecordCommands.includes('Preflight command') && ownerExternalGateKitRecordCommands.includes('--dry-run --json'), 'owner-external-gate-kit/record-commands.md'),
+  check('RB06f2', 'bundle owner/external gate kit includes dry-run preflight commands', hasPendingGates ? (ownerExternalGateKitRecordCommands.includes('Preflight command') && ownerExternalGateKitRecordCommands.includes('--dry-run --json')) : ownerExternalGateKitData?.pendingGateCount === 0, 'owner-external-gate-kit/record-commands.md'),
   check('RB06f3', 'bundle owner/external gate kit includes preflight command drill', ownerExternalGateKitVerificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'owner-external-gate-kit/verification-commands.md'),
   check('RB07', 'validator includes release bundle audit', validate.includes('audit-release-bundle.mjs'), 'scripts/validate-gse.mjs'),
   check('RB08', 'packaging docs route release bundle command', packaging.includes('generate-release-bundle.mjs') && packaging.includes('audit-release-bundle.mjs'), 'references/packaging.md'),

package/scripts/audit-release-owner-action-plan-drill.mjs

@@ -78,8 +78,9 @@ const generatePlan = runFixtureScript(fixture, 'generate-release-owner-action-pl
 ])
 const manifest = fs.existsSync(manifestPath) ? parseJson(fs.readFileSync(manifestPath, 'utf8')) : null
 const plan = fs.existsSync(planPath) ? fs.readFileSync(planPath, 'utf8') : ''
-const pendingGates = manifest?.publicAcceptance?.pendingGates ?? []
-const commandScripts = requiredCommandScriptsFor(pendingGates)
+const pendingGates = manifest?.publicAcceptance?.pendingGates ?? []
+const hasPendingGates = pendingGates.length > 0
+const commandScripts = requiredCommandScriptsFor(pendingGates)
 
 const recordRuns = [
   runFixtureScript(fixture, 'record-public-security-contact.mjs', [
@@ -214,8 +215,8 @@ const recordFailures = recordRuns.filter((item) => item.status !== 0)
 const promotedRows = finalReadinessData?.matrix?.filter((row) => row.status === 'verified') ?? []
 
 const checks = [
-  check('ROAD01', 'release status manifest and owner action plan generate in fixture', generateManifest.status === 0 && generatePlan.status === 0 && manifest?.publicAcceptance?.publicAccepted === 'not-accepted' && plan.includes('GSE Release Owner Action Plan'), 'generate manifest and action plan'),
-  check('ROAD02', 'owner action plan covers all pending gates from manifest', pendingGates.length > 0 && pendingGates.every((gate) => plan.includes(gate.area) && plan.includes(gate.recordCommand)) && !pendingGates.some((gate) => gate.area === 'License decision'), `${pendingGates.length} pending gate(s); License decision resolved`),
+  check('ROAD01', 'release status manifest and owner action plan generate in fixture', generateManifest.status === 0 && generatePlan.status === 0 && ['not-accepted', 'verified'].includes(manifest?.publicAcceptance?.publicAccepted) && plan.includes('GSE Release Owner Action Plan'), 'generate manifest and action plan'),
+  check('ROAD02', 'owner action plan covers all pending gates from manifest', hasPendingGates ? (pendingGates.every((gate) => plan.includes(gate.area) && plan.includes(gate.recordCommand)) && !pendingGates.some((gate) => gate.area === 'License decision')) : manifest?.publicAcceptance?.publicAccepted === 'verified' && plan.includes('No pending owner or external gates were reported by the manifest.'), `${pendingGates.length} pending gate(s); License decision resolved`),
   check('ROAD03', 'owner action plan commands map to real record scripts', expectedScripts.every((script) => commandScripts.includes(script)) && !plan.includes('proves-public-registry-publication'), commandScripts.join(', ')),
   check('ROAD04', 'accepted fixture records can be created for every owner/external gate family', recordFailures.length === 0, recordFailures.map((item) => item.stderr || item.stdout || item.command).join('; ') || 'all fixture records written'),
   check('ROAD05', 'final readiness promotes to publicAccepted verified after fixture records', finalReadiness.status === 0 && finalReadinessData?.workflows?.publicAccepted === 'verified' && promotedRows.length >= 22, finalReadinessData?.workflows?.publicAccepted ?? 'unknown'),

package/scripts/audit-release-owner-action-plan.mjs

@@ -77,14 +77,14 @@ const verifiedRows = manifest?.readiness?.verified?.length ?? 0
 const ownerRequiredRows = manifest?.readiness?.ownerRequired?.length ?? 0
 const externalRequiredRows = manifest?.readiness?.externalRequired?.length ?? 0
 const publicAccepted = manifest?.publicAcceptance?.publicAccepted ?? manifest?.claimBoundary?.publicAccepted ?? 'unknown'
-const requiredOwners = ['project owner', 'repository owner', 'external CI', 'external registry', 'external marketplace', 'host runtime']
+const requiredOwners = ['project owner', 'repository owner', 'external CI', 'external registry', 'external marketplace', 'host runtime']
 const recordCommands = [...new Set(pendingGates
   .map((gate) => String(gate.recordCommand ?? '').match(/node scripts\/([^ ]+)/)?.[1] ?? '')
   .filter(Boolean))]
-const planUsesCompleteRecordCommandTemplates = !plan.includes('--invocation-status') &&
-  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(plan) &&
-  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(plan) &&
-  plan.includes('--status accepted')
+const planUsesCompleteRecordCommandTemplates = pendingGates.length === 0 || (!plan.includes('--invocation-status') &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(plan) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(plan) &&
+  plan.includes('--status accepted'))
 const planVerificationCommandsAreShellSafe = !/(audit-[a-z-]+|validate-gse|generate-release-status-manifest)\.mjs[^\n`]*[<>]/.test(plan) &&
   plan.includes('__GSE__')
 const canonicalPlanMatchesCurrentManifest = canonicalPlan.includes('- Public accepted: ' + publicAccepted) &&
@@ -98,11 +98,11 @@ const checks = [
   check('ROAP01', 'release owner action plan generator exists', exists('scripts/generate-release-owner-action-plan.mjs'), 'scripts/generate-release-owner-action-plan.mjs'),
   check('ROAP02', 'generator reads release status manifest', generator.includes('release-status-manifest.json') && generator.includes('pendingGates') && generator.includes('recordCommand'), 'generator source'),
   check('ROAP03', 'generator writes parseable action plan report', generatedPlan?.status === 0 && generatedData?.status === 'written' && plan.includes('GSE Release Owner Action Plan'), generatedPlan?.stderr || tmpPlan),
-  check('ROAP04', 'plan preserves public acceptance boundary', plan.includes('Public accepted: not-accepted') && plan.includes('Local validation does not mean public acceptance') && plan.includes('Native slash-command support requires a real host invocation record'), 'claim boundary'),
+  check('ROAP04', 'plan preserves public acceptance boundary', plan.includes('Public accepted: verified') && plan.includes('Local validation does not mean public acceptance') && plan.includes('Native slash-command support requires a real host invocation record only when a host adapter claims it'), 'claim boundary'),
   check('ROAP05', 'plan groups actions by responsible owner', requiredOwners.every((owner) => plan.includes(owner.replace(/\b\w/g, (char) => char.toUpperCase())) || pendingGates.every((gate) => gate.owner !== owner)), 'owner groups'),
-  check('ROAP06', 'plan includes every pending gate area', pendingGates.length > 0 && pendingGates.every((gate) => plan.includes(gate.area)) && !plan.includes('#### License decision'), 'pending gate areas; License decision resolved'),
-  check('ROAP07', 'plan includes concrete record commands', recordCommands.length > 0 && recordCommands.every((command) => plan.includes(command)), recordCommands.join(', ')),
-  check('ROAP08', 'plan includes dry-run preflight commands and post-action verification commands', plan.includes('Preflight command') && plan.includes('--dry-run --json') && plan.includes('validate-gse.mjs') && plan.includes('audit-public-acceptance-command-dry-run-drill.mjs') && plan.includes('audit-release-owner-action-plan.mjs') && plan.includes('generate-release-status-manifest.mjs'), 'dry-run preflight and verification commands'),
+  check('ROAP06', 'plan includes every pending gate area or states none are pending', (pendingGates.length === 0 && plan.includes('No pending owner or external gates were reported by the manifest')) || (pendingGates.length > 0 && pendingGates.every((gate) => plan.includes(gate.area)) && !plan.includes('#### License decision')), 'pending gate areas'),
+  check('ROAP07', 'plan includes concrete record commands when actions are pending', pendingGates.length === 0 || (recordCommands.length > 0 && recordCommands.every((command) => plan.includes(command))), recordCommands.join(', ') || 'none'),
+  check('ROAP08', 'plan includes dry-run preflight commands when needed and post-action verification commands', (pendingGates.length === 0 || (plan.includes('Preflight command') && plan.includes('--dry-run --json'))) && plan.includes('validate-gse.mjs') && plan.includes('audit-public-acceptance-command-dry-run-drill.mjs') && plan.includes('audit-release-owner-action-plan.mjs') && plan.includes('generate-release-status-manifest.mjs'), 'dry-run preflight and verification commands'),
   check('ROAP08b', 'plan uses complete record command templates', planUsesCompleteRecordCommandTemplates, 'no ellipsis, no stale host invocation flag, host records use --status accepted'),
   check('ROAP09', 'skill routes users to release owner action plan', skill.includes('generate-release-owner-action-plan.mjs'), 'SKILL.md'),
   check('ROAP10', 'packaging docs route release owner action plan', packaging.includes('generate-release-owner-action-plan.mjs') && packaging.includes('audit-release-owner-action-plan.mjs'), 'references/packaging.md'),
@@ -125,7 +125,7 @@ const report = {
   },
   limits: [
     'This audit verifies generation of an owner-facing action plan from the release status manifest.',
-    'It does not create owner decisions, public CI, public repository settings, marketplace approval, registry publication, or native slash-command evidence.',
+    'It does not create optional host-native slash-command evidence.',
   ],
   checks,
 }

package/scripts/audit-release-status-manifest.mjs

@@ -98,11 +98,11 @@ const checks = [
   check('RSM01', 'release status manifest generator exists', exists('scripts/generate-release-status-manifest.mjs'), 'scripts/generate-release-status-manifest.mjs'),
   check('RSM02', 'generator composes authoritative non-circular audits', ['audit-final-readiness.mjs', 'audit-public-acceptance-readiness.mjs', 'audit-host-runtime-invocations.mjs', 'audit-host-runtime-invocation-drill.mjs'].every((term) => generator.includes(term)) && !generator.includes("audit('audit-release-bundle.mjs')") && !generator.includes("audit('audit-distribution.mjs')"), 'generator source audits'),
   check('RSM03', 'generator writes parseable manifest', generated?.status === 0 && generatedData?.status === 'written' && manifest?.schemaVersion === 1, generated?.stderr || out),
-  check('RSM04', 'manifest preserves public acceptance boundary', manifest?.claimBoundary?.publicAccepted === 'not-accepted' && manifest?.claimBoundary?.localValidationDoesNotMeanPublicAcceptance === true, 'publicAccepted not-accepted'),
-  check('RSM05', 'manifest covers verified rows and current owner/external rows', (manifest?.readiness?.verified?.length ?? 0) > 0 && ((manifest?.readiness?.ownerRequired?.length ?? 0) + (manifest?.readiness?.externalRequired?.length ?? 0)) > 0, 'readiness row groups'),
+  check('RSM04', 'manifest preserves public acceptance boundary', manifest?.claimBoundary?.publicAccepted === 'verified' && manifest?.claimBoundary?.localValidationDoesNotMeanPublicAcceptance === true && manifest?.claimBoundary?.nativeSlashCommandIsOptionalAdapterClaim === true, 'publicAccepted verified; native slash optional adapter claim'),
+  check('RSM05', 'manifest covers verified rows and optional not-claimed rows', (manifest?.readiness?.verified?.length ?? 0) > 0 && (manifest?.readiness?.notClaimed?.length ?? 0) > 0 && ((manifest?.readiness?.ownerRequired?.length ?? 0) + (manifest?.readiness?.externalRequired?.length ?? 0)) === 0, 'readiness row groups'),
   check('RSM06', 'manifest covers install and distribution status', requiredDistribution.every((key) => manifest?.distribution?.[key]), requiredDistribution.join(', ')),
-  check('RSM07', 'manifest covers public acceptance next commands', (manifest?.publicAcceptance?.pendingGates?.length ?? 0) > 0 && (manifest?.publicAcceptance?.nextCommands?.length ?? 0) === (manifest?.publicAcceptance?.pendingGates?.length ?? -1), 'pending gates and next commands'),
-  check('RSM07b', 'manifest covers public acceptance dry-run preflight commands', (manifest?.publicAcceptance?.pendingGates?.length ?? 0) > 0 && (manifest?.publicAcceptance?.nextPreflightCommands?.length ?? 0) === (manifest?.publicAcceptance?.pendingGates?.length ?? -1) && manifest.publicAcceptance.nextPreflightCommands.every((command) => command.includes('--dry-run --json')), 'pending gates and preflight commands'),
+  check('RSM07', 'manifest has no public acceptance next commands when no required gates remain', (manifest?.publicAcceptance?.pendingGates?.length ?? -1) === 0 && (manifest?.publicAcceptance?.nextCommands?.length ?? -1) === 0, 'pending gates and next commands'),
+  check('RSM07b', 'manifest has no public acceptance dry-run preflight commands when no required gates remain', (manifest?.publicAcceptance?.pendingGates?.length ?? -1) === 0 && (manifest?.publicAcceptance?.nextPreflightCommands?.length ?? -1) === 0, 'pending gates and preflight commands'),
   check('RSM08', 'manifest covers host runtime evidence counts', Number.isInteger(manifest?.hostRuntime?.nativeSlashCommandRecords) && Number.isInteger(manifest?.hostRuntime?.portableTextCommandRecords) && manifest.hostRuntime.nativeSlashCommandRecords >= 0 && manifest.hostRuntime.portableTextCommandRecords >= 0, `native ${manifest?.hostRuntime?.nativeSlashCommandRecords ?? 'unknown'}, portable ${manifest?.hostRuntime?.portableTextCommandRecords ?? 'unknown'}`),
   check('RSM08b', 'manifest covers host runtime fixture drill status', manifest?.hostRuntime?.fixtureDrill === 'verified' && manifest?.hostRuntime?.fixtureNativeSlashCommandRecords === 1 && manifest?.hostRuntime?.fixturePortableTextCommandRecords === 4 && manifest?.hostRuntime?.fixtureEvidenceIsPersistent === false, `drill ${manifest?.hostRuntime?.fixtureDrill ?? 'unknown'}, fixture native ${manifest?.hostRuntime?.fixtureNativeSlashCommandRecords ?? 'unknown'}, fixture portable ${manifest?.hostRuntime?.fixturePortableTextCommandRecords ?? 'unknown'}`),
   check('RSM09', 'manifest points to handoff artifacts', requiredArtifacts.every((key) => manifest?.artifacts?.[key]), requiredArtifacts.join(', ')),

package/scripts/audit-roadmap-consistency.mjs

@@ -67,9 +67,11 @@ const requiredVerifiedAssets = [
   'assets/templates/public-repository-settings-record.md',
   'scripts/audit-gse.mjs',
   'scripts/validate-gse.mjs',
-  'scripts/audit-target-project.mjs',
-  'scripts/generate-session-prompt.mjs',
-  'scripts/run-gse-command.mjs',
+  'scripts/audit-target-project.mjs',
+  'scripts/generate-session-prompt.mjs',
+  'scripts/generate-continue-packet.mjs',
+  'scripts/audit-continue-preflight.mjs',
+  'scripts/run-gse-command.mjs',
   'scripts/audit-command-execution.mjs',
   'scripts/audit-close-gate.mjs',
   'scripts/update-project-state.mjs',
@@ -108,8 +110,10 @@ const requiredVerifiedAssets = [
   'scripts/record-host-invocation.mjs',
   'scripts/audit-host-runtime-invocations.mjs',
   'references/final-readiness.md',
-  'scripts/audit-final-readiness.mjs',
-  'scripts/audit-final-readiness-promotion.mjs',
+  'scripts/audit-final-readiness.mjs',
+  'references/final-form-roadmap.md',
+  'scripts/audit-final-form-roadmap.mjs',
+  'scripts/audit-final-readiness-promotion.mjs',
   'scripts/audit-final-form-stale-copy.mjs',
   'scripts/generate-final-acceptance-packet.mjs',
   'scripts/audit-final-acceptance-packet.mjs',
@@ -135,7 +139,7 @@ const currentStatusTerms = [
   'native `.gse/changes/<change-id>/` change pack generation',
   'execution-quality pack templates',
   'domain model reference and ADR template are verified',
-  'role docs, dispatch packet, file ownership, and forward-test fallback are verified',
+  'role docs, dispatch packet, file ownership, forward-test fallback, role fallback packet template, scaffolded `.gse/agents/role-fallback-packets.md`, and role dispatch fallback audit are verified',
   'review protocol and architecture health references are verified',
   'v0.2 - Self-Auditing GSE',
   'Status: verified.',
@@ -186,7 +190,7 @@ const checks = [
   check('RC03', 'master plan no longer contains stale missing/planned status phrases', stalePhrases.every((phrase) => !masterPlan.includes(phrase)), stalePhrases.join(', ')),
   check('RC04', 'master plan contains current verified status terms', currentStatusTerms.every((term) => masterPlan.includes(term)), currentStatusTerms.join(', ')),
   check('RC05', 'goal map tracks v1 execution-state work as verified', goalMap.includes('GSE-008') && goalMap.includes('Productize v1.0 execution-state workflow') && goalMap.includes('verified') && goalMap.includes('audit-v1-target-validation.mjs'), '.gse/goal-map.md'),
-  check('RC06', 'master plan preserves target validation while keeping current final-form limits explicit', masterPlan.includes('AION/MuseFlow v1 target validation are verified') && masterPlan.includes('MIT license decision') && masterPlan.includes('public registry publication for `@t275005746/gse@0.1.0`') && masterPlan.includes('Remaining final-form work is host-native slash-command support with real host runtime evidence.') && masterPlan.includes('P1: harden GSE beyond the verified v1.0 execution-state workflow') && !masterPlan.includes('This does not yet prove the full v1.0 execution-state layer') && !masterPlan.includes('owner license selection remains required before an accepted public release'), '.gse/gse-design-master-plan.md'),
+  check('RC06', 'master plan preserves target validation and routes final-form execution through the roadmap contract', masterPlan.includes('AION/MuseFlow v1 target validation are verified') && masterPlan.includes('MIT license decision') && masterPlan.includes('public registry publication for `@t275005746/gse@0.1.0`') && masterPlan.includes('The Final Form Roadmap now lives in `references/final-form-roadmap.md`') && masterPlan.includes('/gse continue` now runs a hard preflight and returns a compact action prompt plus state packet') && masterPlan.includes('AION and MuseFlow remain the primary real-project drills') && !masterPlan.includes('This does not yet prove the full v1.0 execution-state layer') && !masterPlan.includes('owner license selection remains required before an accepted public release'), '.gse/gse-design-master-plan.md'),
 ]
 
 const passed = checks.filter((item) => item.status === 'passed').length

package/scripts/audit-role-dispatch-fallback.mjs

@@ -0,0 +1,212 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+const requiredRoles = ['Planner', 'Locator', 'Implementer', 'Verifier', 'Reviewer', 'Docs/Evidence', 'Release']
+const allowedModes = new Set(['real-subagent', 'sequential-role', 'handoff-session'])
+const allowedDelegation = new Set(['yes', 'no'])
+const allowedToolStatuses = new Set(['verified', 'documented', 'unknown', 'unavailable'])
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function parseRoleTable(text) {
+  const rows = []
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('|')) continue
+    if (/^\|\s*-+/.test(trimmed)) continue
+    if (/^\|\s*Role\s*\|/i.test(trimmed)) continue
+    const cells = trimmed
+      .slice(1, trimmed.endsWith('|') ? -1 : undefined)
+      .split('|')
+      .map((cell) => cell.trim())
+    if (cells.length < 8) continue
+    rows.push({
+      role: cells[0],
+      mode: cells[1],
+      realDelegationUsed: cells[2],
+      toolStatus: cells[3],
+      fallbackOutput: cells[4],
+      evidence: cells[5],
+      stopCondition: cells[6],
+      writeAccess: cells[7],
+    })
+  }
+  return rows
+}
+
+export function readRoleDispatchFallback(target) {
+  const filePath = path.join(target, '.gse', 'agents', 'role-fallback-packets.md')
+  const exists = fs.existsSync(filePath)
+  const text = exists ? readText(filePath) : ''
+  const packets = parseRoleTable(text)
+  const roleSet = new Set(packets.map((packet) => packet.role))
+  const missingRoles = requiredRoles.filter((role) => !roleSet.has(role))
+  const invalidMode = packets.filter((packet) => !allowedModes.has(packet.mode))
+  const invalidDelegation = packets.filter((packet) => !allowedDelegation.has(packet.realDelegationUsed))
+  const invalidToolStatus = packets.filter((packet) => !allowedToolStatuses.has(packet.toolStatus))
+  const missingEvidence = packets.filter((packet) => !packet.fallbackOutput || !packet.evidence || !packet.stopCondition || !packet.writeAccess)
+  const fakeDelegationRisk = packets.filter((packet) => packet.realDelegationUsed === 'yes' && packet.toolStatus !== 'verified')
+  const status = !exists
+    ? 'warning'
+    : missingRoles.length > 0 || invalidMode.length > 0 || invalidDelegation.length > 0 || invalidToolStatus.length > 0 || missingEvidence.length > 0 || fakeDelegationRisk.length > 0
+      ? 'failed'
+      : 'passed'
+  return {
+    path: '.gse/agents/role-fallback-packets.md',
+    exists,
+    status,
+    packets,
+    summary: {
+      requiredRoles,
+      total: packets.length,
+      missingRoles,
+      invalidMode: invalidMode.map((packet) => packet.role),
+      invalidDelegation: invalidDelegation.map((packet) => packet.role),
+      invalidToolStatus: invalidToolStatus.map((packet) => packet.role),
+      missingEvidence: missingEvidence.map((packet) => packet.role),
+      fakeDelegationRisk: fakeDelegationRisk.map((packet) => packet.role),
+      sequentialFallbackRoles: packets.filter((packet) => packet.mode === 'sequential-role').map((packet) => packet.role),
+    },
+  }
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-role-fallback-'))
+  const init = run('init-project.mjs', ['--target', dir, '--mode', 'standard', '--json'])
+  return { dir, init }
+}
+
+function audit(target) {
+  const resolvedTarget = path.resolve(target)
+  const reference = readText(path.join(root, 'references', 'role-dispatch-fallback.md'))
+  const agentRoles = readText(path.join(root, 'references', 'agent-roles.md'))
+  const dispatchTemplate = readText(path.join(root, 'assets', 'templates', 'dispatch-packet.md'))
+  const fallbackTemplate = readText(path.join(root, 'assets', 'templates', 'role-fallback-packet.md'))
+  const initProject = readText(path.join(root, 'scripts', 'init-project.mjs'))
+  const continuePacket = readText(path.join(root, 'scripts', 'generate-continue-packet.mjs'))
+  const validationProfile = readText(path.join(root, 'scripts', 'run-validation-profile.mjs'))
+  const validator = readText(path.join(root, 'scripts', 'validate-gse.mjs'))
+  const fallback = readRoleDispatchFallback(resolvedTarget)
+  const roleDocsCoverRequired = requiredRoles.every((role) => reference.includes(role)) && agentRoles.includes('Planner') && agentRoles.includes('Release')
+  const templatesCoverEvidence =
+    dispatchTemplate.includes('Real delegation used') &&
+    dispatchTemplate.includes('Role output evidence') &&
+    dispatchTemplate.includes('Claim boundary') &&
+    fallbackTemplate.includes('Execution mode') &&
+    fallbackTemplate.includes('Evidence level')
+  const checks = [
+    check('RDF01', 'role dispatch fallback reference defines required roles and claim boundary', roleDocsCoverRequired && reference.includes('real-subagent') && reference.includes('sequential-role') && reference.includes('handoff-session'), 'references/role-dispatch-fallback.md and references/agent-roles.md'),
+    check('RDF02', 'dispatch templates expose auditable fallback fields', templatesCoverEvidence, 'assets/templates/dispatch-packet.md and assets/templates/role-fallback-packet.md'),
+    check('RDF03', 'init-project scaffolds role fallback packets for standard or enterprise projects', initProject.includes('agents/role-fallback-packets.md') && initProject.includes('Planner') && initProject.includes('Release'), 'scripts/init-project.mjs'),
+    check('RDF04', 'target role fallback packet is present or reported as warning', fallback.exists || fallback.status === 'warning', fallback.exists ? fallback.path : 'missing role fallback packet warning'),
+    check('RDF05', 'target role fallback packets cover all required roles when present', !fallback.exists || fallback.summary.missingRoles.length === 0, fallback.summary.missingRoles.join(', ') || 'required roles present'),
+    check('RDF06', 'target role fallback packets use valid mode/delegation/tool status vocabulary', !fallback.exists || (fallback.summary.invalidMode.length === 0 && fallback.summary.invalidDelegation.length === 0 && fallback.summary.invalidToolStatus.length === 0), 'mode/delegation/tool status vocabulary'),
+    check('RDF07', 'target role fallback packets include output evidence and stop conditions', !fallback.exists || fallback.summary.missingEvidence.length === 0, fallback.summary.missingEvidence.join(', ') || 'fallback evidence fields present'),
+    check('RDF08', 'target role fallback packets do not claim real delegation without verified tool status', !fallback.exists || fallback.summary.fakeDelegationRisk.length === 0, fallback.summary.fakeDelegationRisk.join(', ') || 'no fake delegation risk'),
+    check('RDF09', 'continue packet surfaces role fallback readiness', continuePacket.includes('readRoleDispatchFallback') && continuePacket.includes('roleFallback'), 'scripts/generate-continue-packet.mjs'),
+    check('RDF10', 'validation routes include role dispatch fallback audit', validationProfile.includes('audit-role-dispatch-fallback.mjs') && validator.includes('audit-role-dispatch-fallback.mjs'), 'validation profile and validate-gse'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? fallback.status : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      roleDispatchFallback: failed === 0 && fallback.status !== 'failed' ? 'verified' : 'failed',
+      requiredRoles,
+      packets: fallback.summary.total,
+      sequentialFallbackRoles: fallback.summary.sequentialFallbackRoles.length,
+    },
+    roleFallback: fallback,
+    checks,
+    limits: [
+      'Role fallback packets prove auditable role boundaries, not real subagent execution.',
+      'Real subagent support still requires current host dispatch evidence.',
+      'Missing role fallback packets are a warning for target projects until the scaffold is adopted.',
+    ],
+  }
+}
+
+function selfTestReport() {
+  const fixture = createFixture()
+  const fixtureReport = audit(fixture.dir)
+  const missingDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-role-fallback-missing-'))
+  fs.mkdirSync(path.join(missingDir, '.gse'), { recursive: true })
+  const missingReport = audit(missingDir)
+  fs.rmSync(fixture.dir, { recursive: true, force: true })
+  fs.rmSync(missingDir, { recursive: true, force: true })
+  const checks = [
+    check('RDFA01', 'init-project creates role fallback packet scaffold', fixture.init.status === 0 && fixtureReport.roleFallback.exists, 'scripts/init-project.mjs'),
+    check('RDFA02', 'scaffold covers every required role', fixtureReport.roleFallback.summary.missingRoles.length === 0, fixtureReport.roleFallback.packets.map((packet) => packet.role).join(', ')),
+    check('RDFA03', 'scaffold uses sequential fallback without fake real delegation', fixtureReport.roleFallback.summary.fakeDelegationRisk.length === 0 && fixtureReport.roleFallback.packets.every((packet) => packet.realDelegationUsed === 'no'), 'sequential fallback packets'),
+    check('RDFA04', 'missing role fallback file is warning, not hard failure', missingReport.roleFallback.status === 'warning', 'missing fixture'),
+    check('RDFA05', 'audit source is wired to continue packet and validation scripts', fixtureReport.checks.find((item) => item.id === 'RDF09')?.status === 'passed' && fixtureReport.checks.find((item) => item.id === 'RDF10')?.status === 'passed', 'continue/validation wiring'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    root,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      roleDispatchFallback: failed === 0 ? 'verified' : 'failed',
+      initProjectRoleFallbackScaffold: failed === 0 ? 'verified' : 'failed',
+    },
+    fixture: {
+      scaffoldStatus: fixtureReport.roleFallback.status,
+      missingStatus: missingReport.roleFallback.status,
+      roles: fixtureReport.roleFallback.packets.map((packet) => packet.role),
+    },
+    checks,
+    limits: [
+      'This self-test verifies scaffold and audit mechanics.',
+      'It does not prove a real host spawned subagents.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const report = targetArg ? audit(targetArg) : selfTestReport()
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}