@t275005746/gse 0.1.1 → 0.1.2

package/scripts/audit-close-gate.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { analyzeEvidenceLevels } from './audit-evidence-levels.mjs'
+import { readRoleDispatchFallback } from './audit-role-dispatch-fallback.mjs'
 
 const args = process.argv.slice(2)
 
@@ -50,7 +52,7 @@ function exists(target, relativePath) {
   return fs.existsSync(path.join(target, relativePath))
 }
 
-function runGit(target, commandArgs) {
+function runGit(target, commandArgs) {
   const result = spawnSync('git', commandArgs, {
     cwd: target,
     encoding: 'utf8',
@@ -61,7 +63,58 @@ function runGit(target, commandArgs) {
     stdout: (result.stdout ?? '').trim(),
     stderr: (result.stderr ?? '').trim(),
   }
-}
+}
+
+function normalizeGitPath(rawPath) {
+  const normalized = rawPath.replace(/\\/g, '/')
+  const renameMarker = ' -> '
+  if (normalized.includes(renameMarker)) return normalized.split(renameMarker).pop()
+  return normalized
+}
+
+function parseGitPorcelain(text) {
+  const entries = []
+  for (const line of text.split(/\r?\n/).filter(Boolean)) {
+    const x = line[0] ?? ' '
+    const y = line[1] ?? ' '
+    const rawPath = line.slice(3).trim()
+    const filePath = normalizeGitPath(rawPath)
+    const untracked = x === '?' && y === '?'
+    const staged = !untracked && x !== ' '
+    const unstaged = !untracked && y !== ' '
+    const conflict = x === 'U' || y === 'U' || ['AA', 'DD', 'AU', 'UA', 'DU', 'UD', 'UU'].includes(x + y)
+    entries.push({ code: x + y, path: filePath, staged, unstaged, untracked, conflict })
+  }
+  return entries
+}
+
+const generatedArtifactPatterns = [
+  /^output\//,
+  /^playwright-report\//,
+  /^test-results\//,
+  /^coverage\//,
+  /^\.nyc_output\//,
+  /^node_modules\//,
+  /^\.turbo\//,
+  /^\.next\//,
+  /^dist\//,
+]
+
+function isGeneratedArtifact(relativePath) {
+  const normalized = relativePath.replace(/\\/g, '/')
+  return generatedArtifactPatterns.some((pattern) => pattern.test(normalized))
+}
+
+function summarizeGitEntries(entries) {
+  const staged = entries.filter((entry) => entry.staged)
+  const unstaged = entries.filter((entry) => entry.unstaged)
+  const untracked = entries.filter((entry) => entry.untracked)
+  const conflicts = entries.filter((entry) => entry.conflict)
+  const mixed = entries.filter((entry) => entry.staged && entry.unstaged)
+  const stagedGenerated = staged.filter((entry) => isGeneratedArtifact(entry.path))
+  const dirtyGenerated = entries.filter((entry) => !entry.staged && isGeneratedArtifact(entry.path))
+  return { staged, unstaged, untracked, conflicts, mixed, stagedGenerated, dirtyGenerated }
+}
 
 function statusFrom(ok, warn = false) {
   if (ok) return 'passed'
@@ -73,9 +126,10 @@ function check(id, label, status, evidence, recommendation = '') {
   return { id, label, status, evidence, recommendation }
 }
 
-function createFixture() {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-close-gate-'))
-  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-close-gate-'))
+  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+  fs.mkdirSync(path.join(dir, '.gse', 'agents'), { recursive: true })
   fs.writeFileSync(path.join(dir, '.gse', 'README.md'), '# GSE\n', 'utf8')
   fs.writeFileSync(path.join(dir, '.gse', 'project-profile.md'), '# Project Profile\n', 'utf8')
   fs.writeFileSync(path.join(dir, '.gse', 'goal-map.md'), '# Goal Map\n\nNext action: archive slice.\n', 'utf8')
@@ -111,20 +165,40 @@ function createFixture() {
     ) + '\n',
     'utf8',
   )
-  fs.writeFileSync(
-    path.join(dir, '.gse', 'evidence', 'index.jsonl'),
+  fs.writeFileSync(
+    path.join(dir, '.gse', 'evidence', 'index.jsonl'),
     JSON.stringify({
       date: '2026-07-06',
-      recordType: 'slice',
-      status: 'verified',
-      summary: 'Fixture close gate evidence.',
-      evidenceFile: '.gse/evidence/2026-07-06.md',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'verified-unit',
+      requiredEvidenceLevel: 'verified-unit',
+      summary: 'Fixture close gate evidence.',
+      evidenceFile: '.gse/evidence/2026-07-06.md',
       commands: ['node scripts/audit-close-gate.mjs --self-test'],
       nextAction: 'Archive slice.',
     }) + '\n',
-    'utf8',
-  )
-  runGit(dir, ['init'])
+    'utf8',
+  )
+  fs.writeFileSync(
+    path.join(dir, '.gse', 'agents', 'role-fallback-packets.md'),
+    [
+      '# Role Fallback Packets',
+      '',
+      '| Role | Mode | Real delegation used | Tool status | Fallback output | Evidence | Stop condition | Write access |',
+      '|---|---|---|---|---|---|---|---|',
+      '| Planner | sequential-role | no | unknown | Plan | fixture plan | Plan accepted | read-only |',
+      '| Locator | sequential-role | no | unknown | File map | fixture map | Files identified | read-only |',
+      '| Implementer | sequential-role | no | unknown | Patch | fixture patch | Patch complete | assigned files |',
+      '| Verifier | sequential-role | no | unknown | Test results | fixture tests | Focused checks pass | evidence only |',
+      '| Reviewer | sequential-role | no | unknown | Review notes | fixture review | No blocking findings | read-only |',
+      '| Docs/Evidence | sequential-role | no | unknown | Evidence log | fixture evidence | Evidence recorded | docs/evidence only |',
+      '| Release | sequential-role | no | unknown | Claim boundary | fixture release | External gates visible | read-only |',
+      '',
+    ].join('\n'),
+    'utf8',
+  )
+  runGit(dir, ['init'])
   runGit(dir, ['config', 'user.email', 'gse-fixture@example.local'])
   runGit(dir, ['config', 'user.name', 'GSE Fixture'])
   runGit(dir, ['add', '.'])
@@ -135,9 +209,10 @@ function createFixture() {
 function auditCloseGate(target) {
   const resolvedTarget = path.resolve(target)
   const gseDir = path.join(resolvedTarget, '.gse')
-  const state = readJson(path.join(gseDir, 'state.json'))
-  const evidenceIndex = readJsonl(path.join(gseDir, 'evidence', 'index.jsonl'))
-  const checks = []
+  const state = readJson(path.join(gseDir, 'state.json'))
+  const evidenceIndex = readJsonl(path.join(gseDir, 'evidence', 'index.jsonl'))
+  const evidenceLevelAnalysis = analyzeEvidenceLevels(evidenceIndex.records)
+  const checks = []
 
   checks.push(
     check(
@@ -241,15 +316,103 @@ function auditCloseGate(target) {
   const gitRoot = runGit(resolvedTarget, ['rev-parse', '--show-toplevel'])
   const isGitRepo = gitRoot.status === 0
   const gseStatus = isGitRepo ? runGit(resolvedTarget, ['status', '--short', '.gse']) : { status: 1, stdout: '', stderr: 'not a git repository' }
-  checks.push(
-    check(
-      'CG08',
+  checks.push(
+    check(
+      'CG08',
       '.gse git state is known',
       isGitRepo ? (gseStatus.stdout ? 'warning' : 'passed') : 'warning',
       isGitRepo ? gseStatus.stdout || 'clean' : 'not a git repository',
       isGitRepo && gseStatus.stdout ? 'Review and intentionally stage/commit or document project-local GSE changes.' : '',
-    ),
-  )
+    ),
+  )
+
+  const evidenceLevelStatus = evidenceLevelAnalysis.invalidLevel.length > 0
+    ? 'failed'
+    : evidenceLevelAnalysis.downgraded.length > 0 || evidenceLevelAnalysis.missingLevel.length > 0
+      ? 'warning'
+      : 'passed'
+  checks.push(
+    check(
+      'CG09',
+      'evidence level validity and downgrade labels are visible',
+      evidenceLevelStatus,
+      evidenceLevelAnalysis.invalidLevel.length
+        ? `invalid evidence level(s): ${evidenceLevelAnalysis.invalidLevel.map((item) => `${item.summary}:${item.evidenceLevel}`).join('; ')}`
+        : `${evidenceLevelAnalysis.recordsWithLevel}/${evidenceLevelAnalysis.records} record(s) with evidenceLevel; ${evidenceLevelAnalysis.downgraded.length} downgrade(s); ${evidenceLevelAnalysis.missingLevel.length} historical missing`,
+      evidenceLevelAnalysis.invalidLevel.length
+        ? 'Use one of the evidence levels from references/evidence-taxonomy.md.'
+        : evidenceLevelAnalysis.downgraded.length
+          ? 'Record whether the downgrade is acceptable for this slice before claiming browser, CI, owner, or release proof.'
+          : '',
+    ),
+  )
+
+  const roleFallback = readRoleDispatchFallback(resolvedTarget)
+  const roleFallbackStatus = roleFallback.status === 'failed' ? 'failed' : roleFallback.status === 'warning' ? 'warning' : 'passed'
+  checks.push(
+    check(
+      'CG10',
+      'role dispatch and subagent claims are honest',
+      roleFallbackStatus,
+      roleFallback.exists
+        ? roleFallback.summary.fakeDelegationRisk.length
+          ? `fake delegation risk: ${roleFallback.summary.fakeDelegationRisk.join(', ')}`
+          : `${roleFallback.summary.total} role packet(s); ${roleFallback.summary.sequentialFallbackRoles.length} sequential fallback role(s)`
+        : 'role fallback packet missing',
+      roleFallbackStatus === 'failed'
+        ? 'Do not claim real subagent dispatch unless the current host/tool status is verified.'
+        : roleFallbackStatus === 'warning'
+          ? 'Adopt role fallback packets or record why role dispatch evidence is unavailable.'
+          : '',
+    ),
+  )
+
+  const fullGitStatus = isGitRepo ? runGit(resolvedTarget, ['status', '--porcelain=v1']) : { status: 1, stdout: '', stderr: 'not a git repository' }
+  const gitEntries = isGitRepo && fullGitStatus.status === 0 ? parseGitPorcelain(fullGitStatus.stdout) : []
+  const gitSummary = summarizeGitEntries(gitEntries)
+  const ownershipStatus = !isGitRepo
+    ? 'warning'
+    : gitSummary.conflicts.length > 0 || gitSummary.mixed.length > 0
+      ? 'failed'
+      : gitEntries.length > 0
+        ? 'warning'
+        : 'passed'
+  checks.push(
+    check(
+      'CG11',
+      'worktree change ownership is bounded before close',
+      ownershipStatus,
+      isGitRepo
+        ? gitEntries.length
+          ? `${gitSummary.staged.length} staged, ${gitSummary.unstaged.length} unstaged, ${gitSummary.untracked.length} untracked, ${gitSummary.mixed.length} mixed, ${gitSummary.conflicts.length} conflict(s)`
+          : 'worktree clean'
+        : 'not a git repository',
+      ownershipStatus === 'failed'
+        ? 'Resolve merge conflicts or mixed staged/unstaged edits before closing so ownership and evidence are unambiguous.'
+        : ownershipStatus === 'warning'
+          ? 'Review changed files, exclude unrelated or generated artifacts, and stage/commit only the current slice.'
+          : '',
+    ),
+  )
+
+  const artifactStatus = gitSummary.stagedGenerated.length > 0 ? 'failed' : gitSummary.dirtyGenerated.length > 0 ? 'warning' : 'passed'
+  checks.push(
+    check(
+      'CG12',
+      'generated test artifacts are not staged as slice evidence',
+      artifactStatus,
+      gitSummary.stagedGenerated.length
+        ? `staged generated artifact(s): ${gitSummary.stagedGenerated.map((entry) => entry.path).join(', ')}`
+        : gitSummary.dirtyGenerated.length
+          ? `dirty generated artifact(s): ${gitSummary.dirtyGenerated.map((entry) => entry.path).join(', ')}`
+          : 'no generated/test output artifacts staged',
+      artifactStatus === 'failed'
+        ? 'Unstage generated test/browser/build artifacts unless the project explicitly requires them as source.'
+        : artifactStatus === 'warning'
+          ? 'Keep generated artifacts out of the commit or explain why they are required.'
+          : '',
+    ),
+  )
 
   const failed = checks.filter((item) => item.status === 'failed').length
   const warnings = checks.filter((item) => item.status === 'warning').length
@@ -275,13 +438,36 @@ function auditCloseGate(target) {
       currentSliceStatus: state.data?.currentSlice?.status ?? null,
       nextAction: state.data?.currentSlice?.nextAction ?? null,
     },
-    evidenceIndex: {
-      exists: evidenceIndex.exists,
-      valid: indexValid,
-      records: evidenceIndex.records.length,
-      closeableRecords: closeableEvidenceRecords.length,
-    },
-    checks,
+    evidenceIndex: {
+      exists: evidenceIndex.exists,
+      valid: indexValid,
+      records: evidenceIndex.records.length,
+      closeableRecords: closeableEvidenceRecords.length,
+      evidenceLevels: {
+        recordsWithLevel: evidenceLevelAnalysis.recordsWithLevel,
+        missingLevel: evidenceLevelAnalysis.missingLevel.length,
+        invalidLevel: evidenceLevelAnalysis.invalidLevel,
+        downgraded: evidenceLevelAnalysis.downgraded,
+      },
+    },
+    roleFallback: {
+      exists: roleFallback.exists,
+      status: roleFallback.status,
+      total: roleFallback.summary.total,
+      fakeDelegationRisk: roleFallback.summary.fakeDelegationRisk,
+    },
+    git: {
+      isGitRepo,
+      changedFiles: gitEntries.length,
+      staged: gitSummary.staged.length,
+      unstaged: gitSummary.unstaged.length,
+      untracked: gitSummary.untracked.length,
+      mixed: gitSummary.mixed.length,
+      conflicts: gitSummary.conflicts.length,
+      stagedGenerated: gitSummary.stagedGenerated.map((entry) => entry.path),
+      dirtyGenerated: gitSummary.dirtyGenerated.map((entry) => entry.path),
+    },
+    checks,
     limits: [
       'Close gate is diagnostic. It reports ready/not-ready and does not modify files.',
       'A ready close gate does not replace user, reviewer, release, or owner acceptance when the project requires it.',

package/scripts/audit-command-execution.mjs

@@ -64,9 +64,10 @@ fs.writeFileSync(path.join(target, 'docs', 'productization-architecture.md'), '#
 fs.appendFileSync(path.join(target, '.gse', 'README.md'), '\nCanonical plan: `docs/productization-architecture.md`.\n', 'utf8')
 
 const adapterRun = run('generate-command-adapter.mjs', ['--target', target, '--host', 'all', '--json'])
-const helpRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse help', '--json'])
-const continueRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse continue', '--json'])
-const shortCliRun = run('gse.mjs', ['status', '--target', target, '--json'])
+const helpRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse help', '--json'])
+const continueRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse continue', '--json'])
+const repairRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse repair', '--json'])
+const shortCliRun = run('gse.mjs', ['status', '--target', target, '--json'])
 
 const full = profile === 'full'
 const statusRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse status', '--json'])
@@ -92,11 +93,19 @@ const publicReleaseExecuteRun = maybeRun(full, 'run-gse-command.mjs', ['--root',
 const doctorTargetRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse doctor', '--json'])
 const verifyRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse verify --profile lite', '--json'])
 const auditRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse audit', '--json'])
-const closeRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse close', '--json'])
-const changeRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse change add-login --level lite', '--execute', '--json'])
-
-const help = parseJson(helpRun.stdout)
-const cont = parseJson(continueRun.stdout)
+const closeRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse close', '--json'])
+const changeRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse change add-login --level lite', '--execute', '--json'])
+if (full) {
+  const statePath = path.join(target, '.gse', 'state.json')
+  const stateForRepair = JSON.parse(fs.readFileSync(statePath, 'utf8'))
+  stateForRepair.residualRisks = Array.from({ length: 9 }, (_, index) => `Command repair fixture risk ${index + 1}.`)
+  fs.writeFileSync(statePath, JSON.stringify(stateForRepair, null, 2) + '\n', 'utf8')
+}
+const repairExecuteRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse repair --max-active-risks 3', '--execute', '--json'])
+
+const help = parseJson(helpRun.stdout)
+const cont = parseJson(continueRun.stdout)
+const repair = parseJson(repairRun.stdout)
 const status = statusRun ? parseJson(statusRun.stdout) : null
 const doctor = doctorRun ? parseJson(doctorRun.stdout) : null
 const acceptance = acceptanceRun ? parseJson(acceptanceRun.stdout) : null
@@ -110,7 +119,9 @@ const doctorTarget = doctorTargetRun ? parseJson(doctorTargetRun.stdout) : null
 const verify = verifyRun ? parseJson(verifyRun.stdout) : null
 const audit = auditRun ? parseJson(auditRun.stdout) : null
 const close = closeRun ? parseJson(closeRun.stdout) : null
-const change = changeRun ? parseJson(changeRun.stdout) : null
+const change = changeRun ? parseJson(changeRun.stdout) : null
+const repairExecute = repairExecuteRun ? parseJson(repairExecuteRun.stdout) : null
+const repairExecuteData = repairExecute ? parseJson(repairExecute.execution?.stdout ?? '') : null
 const doctorData = doctor ? parseJson(doctor.execution?.stdout ?? '') : null
 const ownerActionsData = ownerActions ? parseJson(ownerActions.execution?.stdout ?? '') : null
 const probeWaitingData = probeWaiting ? parseJson(probeWaiting.execution?.stdout ?? '') : null
@@ -148,17 +159,18 @@ const liteChecks = [
   check('CMDX02', 'target project initializes for command smoke', initRun.status === 0, initRun.command),
   check('CMDX03', 'host command adapters are generated', adapterRun.status === 0 && claudeCommand.includes('run-gse-command.mjs') && codexPointer.includes('run-gse-command.mjs') && copilotPointer.includes('GitHub Copilot GSE Adapter') && geminiPointer.includes('Gemini GSE Adapter'), 'generated supported host adapters'),
   check('CMDX04', '/gse help resolves command reference', helpRun.status === 0 && help?.route?.route === 'references/commands.md', '/gse help'),
-  check('CMDX05', '/gse continue executes session prompt generator', continueRun.status === 0 && cont?.execution?.status === 0 && cont?.execution?.stdout?.includes('Use GSE to continue'), '/gse continue'),
-  check('CMDX05b', 'short CLI wrapper routes to portable command runner', shortCliRun.status === 0 && shortCliRun.stdout.includes('"/gse status"') && shortCliRun.stdout.includes('"stateValid": true'), 'scripts/gse.mjs status --target <target> --json'),
+  check('CMDX05', '/gse continue executes hard preflight and compact state generator', continueRun.status === 0 && cont?.execution?.status === 0 && cont?.execution?.command?.includes('generate-continue-packet.mjs') && cont?.execution?.stdout?.includes('"compactState"'), '/gse continue'),
+  check('CMDX05c', '/gse repair executes state/evidence repair audit in read-only mode', repairRun.status === 0 && repair?.execution?.status === 0 && repair?.execution?.command?.includes('audit-state-repair.mjs') && repair?.execution?.stdout?.includes('"repairActions"'), '/gse repair'),
+  check('CMDX05b', 'short CLI wrapper routes to portable command runner', shortCliRun.status === 0 && shortCliRun.stdout.includes('"/gse status"') && shortCliRun.stdout.includes('"stateValid": true'), 'scripts/gse.mjs status --target <target> --json'),
 ]
 
 const fullChecks = full
   ? [
       check('CMDX06', '/gse status exposes GSE final-form progress when target is GSE skill', statusRun.status === 0 && status?.execution?.status === 0 && status?.execution?.stdout?.includes('fullFinalFormReadiness') && status?.execution?.stdout?.includes('pendingGateCount'), '/gse status'),
-      check('CMDX07', '/gse doctor exposes GSE public acceptance blockers when target is GSE skill', doctorRun.status === 0 && doctor?.execution?.status === 0 && doctorData?.workflows?.publicAcceptanceDoctor === 'verified' && doctorData?.summary?.pendingGates > 0 && doctorData?.summary?.publicAccepted === 'not-accepted', '/gse doctor'),
+      check('CMDX07', '/gse doctor exposes GSE public acceptance evidence state when target is GSE skill', doctorRun.status === 0 && doctor?.execution?.status === 0 && doctorData?.workflows?.publicAcceptanceDoctor === 'verified' && doctorData?.summary?.pendingGates > 0 && doctorData?.summary?.publicAccepted === 'not-accepted', '/gse doctor'),
       check('CMDX08', '/gse acceptance aliases the public acceptance doctor', acceptanceRun.status === 0 && acceptance?.execution?.status === 0 && acceptance?.execution?.stdout?.includes('"publicAcceptanceDoctor": "verified"'), '/gse acceptance'),
-      check('CMDX08b', '/gse owner-actions exposes compact owner/external action commands without claiming acceptance', ownerActionsRun.status === 0 && ownerActions?.execution?.status === 0 && ownerActionsData?.pendingGateCount === 7 && ownerActionsData?.publicAccepted === 'not-accepted' && ownerActionsData.actions?.every((item) => item.recordCommand && item.preflightCommand), '/gse owner-actions'),
-      check('CMDX08c', '/gse owner-actions --compact returns owner packet without wrapper path noise', ownerActionsCompactRun.status === 0 && ownerActionsCompact?.pendingGateCount === 7 && ownerActionsCompact?.publicAccepted === 'not-accepted' && !ownerActionsCompactRun.stdout.includes(root) && !ownerActionsCompactRun.stdout.includes(process.execPath), '/gse owner-actions --json --compact'),
+      check('CMDX08b', '/gse owner-actions exposes compact owner/external action commands without claiming acceptance', ownerActionsRun.status === 0 && ownerActions?.execution?.status === 0 && ownerActionsData?.pendingGateCount > 0 && ownerActionsData?.publicAccepted === 'not-accepted' && ownerActionsData.actions?.every((item) => item.recordCommand && item.preflightCommand), '/gse owner-actions'),
+      check('CMDX08c', '/gse owner-actions --compact returns owner packet without wrapper path noise', ownerActionsCompactRun.status === 0 && ownerActionsCompact?.pendingGateCount > 0 && ownerActionsCompact?.publicAccepted === 'not-accepted' && !ownerActionsCompactRun.stdout.includes(root) && !ownerActionsCompactRun.stdout.includes(process.execPath), '/gse owner-actions --json --compact'),
       check('CMDX08c2', '/gse owner-actions --compact routes probe verification through portable command runner', ownerActionsCompactRun.status === 0 && ownerActionsCompact?.verificationCommands?.some((command) => command.includes('run-gse-command.mjs') && command.includes('/gse probe')) && !ownerActionsCompact?.verificationCommands?.some((command) => command.startsWith('node scripts/probe-public-external-gates.mjs')), '/gse owner-actions compact verificationCommands'),
       check('CMDX08d', '/gse probe runs as a waiting diagnostic without evidence inputs', probeWaitingRun.status === 0 && probeWaiting?.execution?.status === 0 && probeWaitingData?.status === 'waiting-for-input' && probeWaitingData?.summary?.checked === 0, '/gse probe'),
       check('CMDX08e', '/gse probe rejects placeholder public evidence through portable command runner', probeRejectRun.status !== 0 && probeReject?.execution?.status !== 0 && probeRejectData?.status === 'failed' && probeRejectData?.probes?.some((item) => item.errors?.some((error) => error.includes('not a placeholder'))), '/gse probe --public-repo-url https://github.com/example/gse'),
@@ -174,14 +186,15 @@ const fullChecks = full
       check('CMDX10', '/gse verify executes validation profile runner', verifyRun.status === 0 && verify?.execution?.status === 0 && verify?.execution?.stdout?.includes('"profile": "lite"') && verify?.execution?.stdout?.includes('"validationProfile": "verified"'), '/gse verify --profile lite'),
       check('CMDX11', '/gse audit executes target project doctor', diagnosticOk(auditRun, audit), '/gse audit'),
       check('CMDX12', '/gse close executes close gate', diagnosticOk(closeRun, close), '/gse close'),
-      check('CMDX13', '/gse change executes change pack creation only with --execute', changeRun.status === 0 && change?.execution?.status === 0 && fs.existsSync(path.join(target, '.gse', 'changes', 'add-login', 'brief.md')), '/gse change --execute'),
-    ]
+      check('CMDX13', '/gse change executes change pack creation only with --execute', changeRun.status === 0 && change?.execution?.status === 0 && fs.existsSync(path.join(target, '.gse', 'changes', 'add-login', 'brief.md')), '/gse change --execute'),
+      check('CMDX14', '/gse repair --execute performs reversible residual risk compaction only when requested', repairExecuteRun.status === 0 && repairExecute?.execution?.status === 0 && repairExecuteData?.summary?.writes === 1 && repairExecuteData?.writes?.some((item) => item.action === 'compact-residual-risks') && fs.existsSync(path.join(target, '.gse', 'backups')), '/gse repair --execute'),
+    ]
   : []
 
 const checks = [...liteChecks, ...fullChecks]
 const passed = checks.filter((item) => item.status === 'passed').length
 const failed = checks.length - passed
-const commandRuns = [initRun, adapterRun, helpRun, continueRun, shortCliRun, statusRun, doctorRun, acceptanceRun, ownerActionsRun, ownerActionsCompactRun, probeWaitingRun, probeRejectRun, releaseDryRun, releaseExecuteRun, packageDryRun, packageExecuteRun, installDryRun, installExecuteRun, publicReleaseDryRun, publicReleaseExecuteRun, doctorTargetRun, verifyRun, auditRun, closeRun, changeRun].filter(Boolean)
+const commandRuns = [initRun, adapterRun, helpRun, continueRun, repairRun, shortCliRun, statusRun, doctorRun, acceptanceRun, ownerActionsRun, ownerActionsCompactRun, probeWaitingRun, probeRejectRun, releaseDryRun, releaseExecuteRun, packageDryRun, packageExecuteRun, installDryRun, installExecuteRun, publicReleaseDryRun, publicReleaseExecuteRun, doctorTargetRun, verifyRun, auditRun, closeRun, changeRun, repairExecuteRun].filter(Boolean)
 const report = {
   root,
   generatedAt: new Date().toISOString(),

package/scripts/audit-commands.mjs

@@ -36,9 +36,10 @@ const requiredCommands = [
   '/gse init',
   '/gse adopt',
   '/gse continue',
-  '/gse status',
-  '/gse doctor',
-  '/gse acceptance',
+  '/gse status',
+  '/gse doctor',
+  '/gse repair',
+  '/gse acceptance',
   '/gse owner-actions',
   '/gse probe',
   '/gse release',
@@ -68,8 +69,9 @@ const checks = [
   check('CMD12', 'public-release command is documented as checklist/runway and not acceptance', skill.includes('/gse public-release') && commands.includes('/gse public-release') && commands.includes('ordered public release checklist') && commands.includes('does not publish, approve, configure, or accept'), 'SKILL.md, references/commands.md'),
   check('CMD13', 'package/install commands expose installability without claiming publication', skill.includes('/gse package') && skill.includes('/gse install') && commands.includes('/gse package') && commands.includes('/gse install') && commands.includes('Only write a package when the command is run with `--execute`') && commands.includes('Only write the install target when the command is run with `--execute`') && commands.includes('does not publish to a registry'), 'SKILL.md, references/commands.md'),
   check('CMD14', 'close command is documented as read-only readiness check', commands.includes('| `/gse close` | Check whether the current slice is ready to close') && commands.includes('/gse close` is read-only in the portable command runner') && commands.includes('close-change.mjs --target <project-root> --change-id <change-id>'), 'references/commands.md'),
-  check('CMD15', 'learn command is documented as execute-gated learning capture', commands.includes('| `/gse learn` | Record a reusable lesson') && commands.includes('/gse learn --summary') && commands.includes('Append the entry only when `--execute` is supplied') && skill.includes('scripts/record-learning.mjs'), 'SKILL.md, references/commands.md'),
-]
+  check('CMD15', 'learn command is documented as execute-gated learning capture', commands.includes('| `/gse learn` | Record a reusable lesson') && commands.includes('/gse learn --summary') && commands.includes('Append the entry only when `--execute` is supplied') && skill.includes('scripts/record-learning.mjs'), 'SKILL.md, references/commands.md'),
+  check('CMD16', 'repair command is documented as diagnostic by default and execute-gated for safe repair', commands.includes('| `/gse repair` | Diagnose or repair stale state') && commands.includes('/gse repair') && commands.includes('Automatic writes are limited to reversible residual-risk compaction') && skill.includes('audit-state-repair.mjs'), 'SKILL.md, references/commands.md'),
+]
 
 const passed = checks.filter((item) => item.status === 'passed').length
 const failed = checks.length - passed