@t275005746/gse 0.1.2 → 0.2.0

package/.gse/releases/public-github-release-v0.1.2.md

@@ -0,0 +1,49 @@
+# Public Channel Publication Record
+
+Publication status: accepted
+
+Channel type: github-release
+
+Channel name: GitHub Release
+
+Channel URL: https://github.com/275005746/gse/releases/tag/v0.1.2
+
+Package or listing version: v0.1.2
+
+Artifact digest: not-applicable
+
+Review or approval status: published
+
+Evidence owner: 275005746
+
+Evidence date: 2026-07-10
+
+Evidence URL or run id: https://github.com/275005746/gse/releases/tag/v0.1.2
+
+## Verification
+
+Verification command: gh release view v0.1.2 --repo 275005746/gse --json tagName,url,isDraft,isPrerelease
+
+Verification result: passed
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: 275005746
+
+Accepted at: 2026-07-10
+
+## Boundaries
+
+- Does this prove public registry publication? false
+- Does this prove marketplace approval? unknown
+- Does this prove installability from the channel? true
+
+## Residual Risk
+
+- GitHub Release proves source release visibility; npm remains the package registry install channel.
+
+## Next Action
+
+- Keep GitHub Release v0.1.2 aligned with npm @t275005746/gse@0.1.2.

package/.gse/releases/public-registry-publication-npm.md

@@ -1,49 +1,49 @@
-# Public Channel Publication Record
-
-Publication status: accepted
-
-Channel type: package-registry
-
-Channel name: npm
-
-Channel URL: https://www.npmjs.com/package/@t275005746/gse
-
-Package or listing version: 0.1.0
-
-Artifact digest: sha512-DcnRp6yZv/LjON/uowlze5yuV2JIAWfOD9GGQhVpIGX5IgmA7r9j2FkIDFT3n4abSZ5q/3SH7rh56gICFrml3Q==
-
-Review or approval status: published
-
-Evidence owner: t275005746
-
-Evidence date: 2026-07-08
-
-Evidence URL or run id: https://www.npmjs.com/package/@t275005746/gse
-
-## Verification
-
-Verification command: node scripts/validate-gse.mjs --root . --json
-
-Verification result: passed
-
-## Acceptance
-
-Evidence status: accepted
-
-Accepted by: 275005746
-
-Accepted at: 2026-07-08
-
-## Boundaries
-
-- Does this prove public registry publication? true
-- Does this prove marketplace approval? unknown
-- Does this prove installability from the channel? true
-
-## Residual Risk
-
-- Public channel publication is not accepted until real external evidence is attached.
-
-## Next Action
-
-- Attach public channel publication evidence and re-run final readiness.
+# Public Channel Publication Record
+
+Publication status: accepted
+
+Channel type: package-registry
+
+Channel name: npm
+
+Channel URL: https://www.npmjs.com/package/@t275005746/gse
+
+Package or listing version: 0.1.2
+
+Artifact digest: sha512-QiMQGnpM515sR4/dEz4q8+Lau0m026Pxo83lBshH2aVoWw+ooR8W8Vz2nM4bSWqEC1rbkP95WAYS9GA5g4yYUA==
+
+Review or approval status: published
+
+Evidence owner: 275005746
+
+Evidence date: 2026-07-10
+
+Evidence URL or run id: https://www.npmjs.com/package/@t275005746/gse/v/0.1.2
+
+## Verification
+
+Verification command: cmd /c npm view @t275005746/gse@0.1.2 name version dist.integrity dist-tags --json
+
+Verification result: passed
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: 275005746
+
+Accepted at: 2026-07-10
+
+## Boundaries
+
+- Does this prove public registry publication? true
+- Does this prove marketplace approval? unknown
+- Does this prove installability from the channel? true
+
+## Residual Risk
+
+- Native host slash-command support remains a separate host invocation claim.
+
+## Next Action
+
+- Use npm @t275005746/gse@0.1.2 as the public install baseline for post-release sanity and downstream project adoption.

package/.gse/state.json

@@ -5,18 +5,18 @@
   "canonicalPlan": ".gse/gse-design-master-plan.md",
   "phase": "final-form",
   "currentSummary": {
-    "status": "release-metadata-0.1.2-verified",
+    "status": "support-slice-boundary-verified",
     "localEngineeringReadiness": 100,
     "fullFinalFormReadiness": 100,
     "publicAccepted": "verified",
     "pendingExternalGate": null,
-    "currentPlan": "Commit and publish GSE 0.1.2 from verified release metadata."
+    "currentPlan": "GSE-155 is verified in source: /gse continue now surfaces currentSlice.supportSliceBoundary for deliberate product maintenance and suppresses only soft CP23 when its narrow boundary is declared. Keep /gse doctor and audit-public-acceptance-readiness.mjs as final-form source of truth."
   },
   "currentSlice": {
-    "id": "GSE-147-release-metadata-0.1.2",
-    "outcome": "Publish GSE 0.1.2 with npm install guidance and public GitHub repository metadata aligned.",
+    "id": "GSE-155-support-slice-boundary",
+    "outcome": "GSE /gse continue now lets product projects explicitly bound a deliberate support slice so CP23 distinguishes bounded maintenance from unbounded repeated support work.",
     "status": "verified",
-    "nextAction": "Commit the verified `0.1.2` release metadata slice, then run `npm publish`, create `v0.1.2`, and push the branch/tag from that committed state."
+    "nextAction": "Use supportSliceBoundary only for deliberate bounded product maintenance; otherwise select a user-visible product delta and preserve native slash-command evidence as a host-specific external gate."
   },
   "toolStatuses": {
     "browser": "unknown",
@@ -25,22 +25,23 @@
     "subagents": "unknown",
     "ci": "documented"
   },
-  "lastEvidence": ".gse/evidence/2026-07-10.md",
+  "lastEvidence": ".gse/evidence/2026-07-11.md",
   "blockedGates": [],
   "nextChecks": [
     "node scripts/run-gse-command.mjs --root . --target . --command \"/gse doctor\" --json",
     "node scripts/audit-public-acceptance-readiness.mjs --root . --json",
-    "cmd /c npm view @t275005746/gse version --json",
-    "cmd /c npm publish --access public",
-    "cmd /c npm view @t275005746/gse version dist-tags --json",
-    "git tag v0.1.2",
-    "git push origin codex/gse-final-form-roadmap",
-    "git push origin v0.1.2"
+    "node scripts/audit-continue-preflight.mjs --root . --json",
+    "node scripts/run-validation-profile.mjs --target . --profile lite --json",
+    "cmd /c npm run check:encoding",
+    "node scripts/audit-installed-sync.mjs --root . --installed-root C:\\Users\\Admin\\.codex\\skills\\gse --json",
+    "node scripts/generate-maintenance-snapshot.mjs --root . --target . --installed-root C:\\Users\\Admin\\.codex\\skills\\gse --skip-release-bundle --execute --json",
+    "node scripts/run-gse-command.mjs --root . --target . --command \"/gse close\" --json",
+    "git diff --check"
   ],
   "residualRisks": [
-    "Process skills provide workflow discipline and portable artifacts; they do not prove host-native slash-command, subagent, browser, MCP, LSP, CI, or host UI support.",
-    "Native slash-command support remains an optional per-host adapter claim and is not claimed without a real host invocation record.",
-    "Browser, MCP, LSP, and subagent statuses remain unknown until project/session evidence is recorded."
+    "supportSliceBoundary is optional metadata and must stay a narrow scope or exit criterion, not a replacement for product-visible progress.",
+    "Existing product projects need future slices to add or infer userVisibleDelta from their real UI/API/provider/export evidence; CP22 still detects repeated internal drift.",
+    "Native slash-command support remains an optional per-host adapter claim and is not claimed without a real host invocation record."
   ],
   "riskArchive": [
     {

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable GSE changes should be recorded here before a public package, catalog
 
 ## Unreleased
 
+## 0.2.0 - 2026-07-11
+
+### Added
+
+- Product-visible progress drift guard for `/gse continue`, so repeated internal/component slices surface a product-visible recovery candidate before support work self-replicates.
+- Product outcome gate for product projects, requiring a named user-visible delta or an explicitly bounded support slice.
+- Optional `currentSlice.supportSliceBoundary` metadata for deliberate maintenance slices; bounded support slices now surface their exit criterion without weakening `CP22` drift detection.
+- Target hardening drill adoption summaries and repair plans that distinguish GSE core gaps from target-local hygiene.
+
+### Changed
+
+- `/gse repair --execute` guidance is gated behind target worktree ownership before mutating target `.gse` state or evidence.
+- Encoding close checks now use the npm script path and avoid creating dependency artifacts.
+- `validate-gse` now includes the latest target-hardening and product-outcome guard coverage.
+
+### Verified
+
+- `v0.1.2..HEAD` contains the product outcome, product drift, bounded support, target repair ownership, and adoption hygiene slices intended for this minor release.
+- Public registry and GitHub release evidence for `0.1.2` remain accepted; `0.2.0` must receive its own npm/GitHub publication evidence after publish.
+
+### Boundary
+
+- Native host slash-command support remains optional per host adapter and is not claimed without host invocation evidence.
+
 ## 0.1.2 - 2026-07-10
 
 ### Added
@@ -33,8 +57,12 @@ All notable GSE changes should be recorded here before a public package, catalog
 - `validate-gse.mjs` consolidates structural, project bootstrap, adoption, host adapter, compatibility, release, distribution, signing, command, target validation, and lifecycle audits.
 - AION and MuseFlow were used as real long-running target-project validation fixtures for GSE adoption checks.
 
-### Not Yet Accepted
-
-- Public registry publication and marketplace approval are not verified.
-- Host-native slash-command execution is not verified except where a host-specific record explicitly says so.
-- Open-source license selection remains an owner decision and must be recorded before a public release is accepted.
+### Accepted
+
+- Public npm registry publication and GitHub Release evidence are accepted for `@t275005746/gse@0.1.2`.
+- MIT license selection is recorded for the public release.
+
+### Not Claimed
+
+- Host-native slash-command execution is not verified except where a host-specific record explicitly says so.
+- Marketplace approval remains separate from npm/GitHub publication evidence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t275005746/gse",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Goal-Spec-Evidence Engineering workflow skill for long-running agent-assisted software projects.",
   "type": "module",
   "license": "MIT",

package/references/commands.md

@@ -106,7 +106,8 @@ Expected behavior:
 5. Keep owner/external evidence visible as public/release/host-specific claim requirements without converting it into GSE core workflow debt.
 6. Use `completionPlan.requiredSteps`, `completionPlan.requiredCloseCommands`, and active `completionPlan.conditionalCloseCommands` as the exact close checklist before claiming a slice is done.
 7. Use `gateTaxonomy` to distinguish default core blockers from release gates and host-adapter claim gates. Release and host-adapter gates block only the specific claim unless project policy promotes them.
-8. Execute, verify, record evidence, update `.gse/state.json` and `.gse/evidence/index.jsonl`, and close only when accepted by the applicable gate.
+8. For a deliberate product support slice, set `currentSlice.supportSliceBoundary` to a narrow scope or exit criterion; `/gse continue` surfaces it and keeps `CP23` as a soft outcome-steering check.
+9. Execute, verify, record evidence, update `.gse/state.json` and `.gse/evidence/index.jsonl`, and close only when accepted by the applicable gate.
 
 Portable helper:
 

package/references/final-form-roadmap.md

@@ -60,6 +60,8 @@ Completed slices:
 - Done: generated/noisy artifacts stay visible in `/gse continue` as ignored paths but no longer count as actionable changes or trigger conditional close commands by themselves.
 - Done: active residual risks and archived risk history are counted separately so `/gse continue` does not make historical risk archive entries look like current blockers.
 - Done: the human-facing `/gse continue` prompt is a short action packet with project, root, slice, next action, close summary, risk summary, gate boundary, and do-step instead of long explanatory prose.
+- Done: product-visible progress drift is surfaced through `compactState.productProgressDrift`, `CP22`, and a first-ranked `product-visible-recovery` next-slice candidate when repeated internal/component-level provenance or boundary slices risk replacing visible product workflow progress.
+- Done: product outcome gating is surfaced through `compactState.productOutcomeGate`, `CP23`, and a first-ranked `product-visible-recovery` candidate when a product project repeatedly opens support/internal slices without a named user-visible delta; a deliberate support slice can declare a narrow `supportSliceBoundary`; GSE self-development is classified as `skill` and is not forced through this product gate.
 
 Acceptance:
 
@@ -155,7 +157,7 @@ Acceptance:
 
 These items should drive future slices only when the claim is being made:
 
-- Short entry takeover is verified through the portable runner; `/gse continue` now exposes a compact action prompt, `completionPlan`, `gateTaxonomy`, generated/noisy ignored paths, and active-versus-archived risk counts. Real host-native slash-command evidence is optional per host adapter.
+- Short entry takeover is verified through the portable runner; `/gse continue` now exposes a compact action prompt, `completionPlan`, `gateTaxonomy`, generated/noisy ignored paths, active-versus-archived risk counts, product-visible progress drift warnings, and product outcome gating for product projects. Real host-native slash-command evidence is optional per host adapter.
 - Project guards, learning promotion candidates, learning drift status, no-fake-dispatch/file-ownership close checks, host capability records, and target-project hardening drills now surface or execute through portable audits; AION/MuseFlow drill warnings remain project-local readiness signals, not GSE hard failures.
 - Evidence index validity is a hard preflight; evidence level granularity, state/evidence repair actions, and conservative historical evidence-level backfill are implemented.
 - Role fallback packets and host capability records are auditable through scaffold, `/gse continue`, and focused audits; real subagent dispatch still needs current host evidence.

package/scripts/audit-completion-plan-drill.mjs

@@ -25,6 +25,18 @@ function run(command, commandArgs, cwd) {
   }
 }
 
+function runCommandString(command, cwd) {
+  const result = process.platform === 'win32'
+    ? spawnSync('cmd', ['/c', command.replace(/^cmd\s+\/c\s+/i, '')], { cwd, encoding: 'utf8', windowsHide: true })
+    : spawnSync(command, [], { cwd, encoding: 'utf8', shell: true, windowsHide: true })
+  return {
+    command,
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
 function parseJson(text) {
   try { return JSON.parse(text) } catch { return null }
 }
@@ -136,6 +148,31 @@ function drill(label, mutate, expectedActiveIds) {
   }
 }
 
+function encodingCommandCleanlinessDrill() {
+  const fixture = createFixture()
+  try {
+    write(path.join(fixture, 'docs', 'usage.md'), '# Usage\n')
+    const { result, data } = continuePacket(fixture)
+    const command = data?.compactState?.completionPlan?.conditionalCloseCommands?.find((item) => item.id === 'encoding')?.command ?? ''
+    const runResult = command ? runCommandString(command, fixture) : { command: '', status: 1, stdout: '', stderr: 'encoding command missing' }
+    const nodeModulesExists = fs.existsSync(path.join(fixture, 'node_modules'))
+    const pnpmLockExists = fs.existsSync(path.join(fixture, 'pnpm-lock.yaml'))
+    return {
+      label: 'encoding close command runs without creating dependency artifacts',
+      packetStatus: result.status,
+      command,
+      status: runResult.status,
+      stdout: runResult.stdout,
+      stderr: runResult.stderr,
+      nodeModulesExists,
+      pnpmLockExists,
+      ok: result.status === 0 && runResult.status === 0 && command.includes('npm run check:encoding') && !nodeModulesExists && !pnpmLockExists,
+    }
+  } finally {
+    fs.rmSync(fixture, { recursive: true, force: true })
+  }
+}
+
 const drills = [
   drill('clean worktree activates no conditionals', null, []),
   drill('docs change activates encoding only', (dir) => { write(path.join(dir, 'docs', 'usage.md'), '# Usage\n') }, ['encoding']),
@@ -166,6 +203,7 @@ const drills = [
     write(path.join(dir, 'pnpm-lock.yaml'), 'lockfileVersion: 9.0\nsettings:\n  strictPeerDependencies: false\n')
   }, ['encoding']),
 ]
+const encodingCleanliness = encodingCommandCleanlinessDrill()
 
 const checks = [
   check('CPD01', 'clean worktree does not falsely activate conditional close commands', drills[0].ok, drills[0].actualActiveIds.join(',') || 'none'),
@@ -178,6 +216,7 @@ const checks = [
   check('CPD08', 'tracked lockfile changes remain actionable and can trigger configured close checks', drills[7].ok && drills[7].changedPaths.includes('pnpm-lock.yaml') && drills[7].ignoredGeneratedPathCount === 0, `actual=${drills[7].actualActiveIds.join(',') || 'none'} changed=${drills[7].changedPaths.join(',') || 'none'}`),
   check('CPD09', 'non-release capability maintenance uses skip-release-bundle', drills[2].activeCommands.some((item) => item.includes('generate-maintenance-snapshot.mjs') && item.includes('--skip-release-bundle')), drills[2].activeCommands.join(' | ')),
   check('CPD10', 'release-sensitive maintenance keeps full release bundle freshness', drills[3].activeCommands.some((item) => item.includes('generate-maintenance-snapshot.mjs') && !item.includes('--skip-release-bundle')), drills[3].activeCommands.join(' | ')),
+  check('CPD11', 'encoding close command does not create dependency artifacts', encodingCleanliness.ok, `command=${encodingCleanliness.command}; node_modules=${encodingCleanliness.nodeModulesExists}; pnpm-lock=${encodingCleanliness.pnpmLockExists}`, encodingCleanliness.stderr),
 ]
 
 const passed = checks.filter((item) => item.status === 'passed').length
@@ -190,8 +229,10 @@ const report = {
     completionPlanDrill: failed === 0 ? 'verified' : 'failed',
     cleanWorktreeFalsePositiveGuard: drills[0].ok ? 'verified' : 'failed',
     dirtyWorktreeConditionalRouting: failed === 0 ? 'verified' : 'failed',
+    encodingCommandCleanliness: encodingCleanliness.ok ? 'verified' : 'failed',
   },
   drills,
+  encodingCleanliness,
   checks,
   limits: [
     'This audit verifies portable /gse continue completionPlan routing in temporary git fixtures.',

package/scripts/audit-continue-preflight.mjs

@@ -143,22 +143,96 @@ function verifiedSliceFixture() {
   fs.writeFileSync(goalMapPath, '# Goal Map\n\n- Active slice: Continue fixture verified.\n- Next action: Open the next fixture slice with a deliberately long machine-readable reason that should remain available to successor agents even when the display reason is compacted for the short entry prompt and JSON packet overview.\n', 'utf8')
   return dir
 }
-
-const validFixture = fixture(false)
-const invalidFixture = fixture(true)
-const verifiedFixture = verifiedSliceFixture()
-const directValid = run('generate-continue-packet.mjs', ['--root', root, '--target', validFixture, '--json'])
-const directInvalid = run('generate-continue-packet.mjs', ['--root', root, '--target', invalidFixture, '--json'])
-const directVerified = run('generate-continue-packet.mjs', ['--root', root, '--target', verifiedFixture, '--json'])
-const commandValid = run('run-gse-command.mjs', ['--root', root, '--target', validFixture, '--command', '/gse continue', '--json'])
+
+function productDriftFixture() {
+  const dir = fixture(false)
+  const statePath = path.join(dir, '.gse', 'state.json')
+  const goalMapPath = path.join(dir, '.gse', 'goal-map.md')
+  const indexPath = path.join(dir, '.gse', 'evidence', 'index.jsonl')
+  const state = JSON.parse(fs.readFileSync(statePath, 'utf8'))
+  state.currentSlice.status = 'verified'
+  state.currentSlice.outcome = 'Response-inspection decision provenance continuity.'
+  state.currentSlice.nextAction = 'Continue downstream provenance boundary hardening for the next handoff layer.'
+  state.residualRisks = []
+  fs.writeFileSync(statePath, JSON.stringify(state, null, 2) + '\n', 'utf8')
+  fs.writeFileSync(goalMapPath, '# Goal Map\n\n- Active slice: Internal provenance verified.\n- Next action: Continue downstream provenance boundary hardening for the next handoff layer.\n', 'utf8')
+  const records = [1, 2, 3, 4].map((index) => ({
+    date: '2026-07-08',
+    recordType: 'slice',
+    status: 'verified',
+    evidenceLevel: 'verified-component',
+    requiredEvidenceLevel: 'verified-component',
+    summary: `Internal provenance boundary handoff continuity ${index}.`,
+    evidenceFile: '.gse/evidence/2026-07-08.md',
+    commands: ['focused component store test'],
+    nextAction: 'Continue downstream provenance boundary hardening.',
+  }))
+  fs.writeFileSync(indexPath, records.map((record) => JSON.stringify(record)).join('\n') + '\n', 'utf8')
+  return dir
+}
+
+function productVisibleFixture() {
+  const dir = fixture(false)
+  const statePath = path.join(dir, '.gse', 'state.json')
+  const indexPath = path.join(dir, '.gse', 'evidence', 'index.jsonl')
+  const state = JSON.parse(fs.readFileSync(statePath, 'utf8'))
+  state.currentSlice.status = 'verified'
+  state.currentSlice.outcome = 'Provider API workflow now returns a visible generation result.'
+  state.currentSlice.nextAction = 'Open the next user-visible export workflow slice.'
+  state.currentSlice.userVisibleDelta = 'Users can run the provider workflow and see a generated result or actionable failure state.'
+  state.residualRisks = []
+  fs.writeFileSync(statePath, JSON.stringify(state, null, 2) + '\n', 'utf8')
+  const records = [
+    {
+      date: '2026-07-08',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'verified-api',
+      requiredEvidenceLevel: 'verified-api',
+      summary: 'Provider API workflow smoke returned a visible result payload.',
+      userVisibleDelta: 'Users can run the provider workflow and see a generated result or actionable failure state.',
+      evidenceFile: '.gse/evidence/2026-07-08.md',
+      commands: ['provider workflow API smoke'],
+      nextAction: 'Open the next user-visible export workflow slice.',
+    },
+  ]
+  fs.writeFileSync(indexPath, records.map((record) => JSON.stringify(record)).join('\n') + '\n', 'utf8')
+  return dir
+}
+
+function boundedSupportFixture() {
+  const dir = productDriftFixture()
+  const statePath = path.join(dir, '.gse', 'state.json')
+  const state = JSON.parse(fs.readFileSync(statePath, 'utf8'))
+  state.currentSlice.supportSliceBoundary = 'Repair only the malformed evidence index, then return to a user-visible export workflow slice.'
+  fs.writeFileSync(statePath, JSON.stringify(state, null, 2) + '\n', 'utf8')
+  return dir
+}
+
+const validFixture = fixture(false)
+const invalidFixture = fixture(true)
+const verifiedFixture = verifiedSliceFixture()
+const driftFixture = productDriftFixture()
+const visibleFixture = productVisibleFixture()
+const boundedSupport = boundedSupportFixture()
+const directValid = run('generate-continue-packet.mjs', ['--root', root, '--target', validFixture, '--json'])
+const directInvalid = run('generate-continue-packet.mjs', ['--root', root, '--target', invalidFixture, '--json'])
+const directVerified = run('generate-continue-packet.mjs', ['--root', root, '--target', verifiedFixture, '--json'])
+const directProductDrift = run('generate-continue-packet.mjs', ['--root', root, '--target', driftFixture, '--json'])
+const directProductVisible = run('generate-continue-packet.mjs', ['--root', root, '--target', visibleFixture, '--json'])
+const directBoundedSupport = run('generate-continue-packet.mjs', ['--root', root, '--target', boundedSupport, '--json'])
+const commandValid = run('run-gse-command.mjs', ['--root', root, '--target', validFixture, '--command', '/gse continue', '--json'])
 const commandCompact = run('run-gse-command.mjs', ['--root', root, '--target', validFixture, '--command', '/gse continue', '--json', '--compact'])
 const commandInvalid = run('run-gse-command.mjs', ['--root', root, '--target', invalidFixture, '--command', '/gse continue', '--json'])
 const gseSelf = run('run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse continue', '--json', '--compact'])
 
 const validData = parseJson(directValid.stdout)
-const invalidData = parseJson(directInvalid.stdout)
-const verifiedData = parseJson(directVerified.stdout)
-const commandValidData = parseJson(commandValid.stdout)
+const invalidData = parseJson(directInvalid.stdout)
+const verifiedData = parseJson(directVerified.stdout)
+const productDriftData = parseJson(directProductDrift.stdout)
+const productVisibleData = parseJson(directProductVisible.stdout)
+const boundedSupportData = parseJson(directBoundedSupport.stdout)
+const commandValidData = parseJson(commandValid.stdout)
 const commandCompactData = parseJson(commandCompact.stdout)
 const commandInvalidData = parseJson(commandInvalid.stdout)
 const gseSelfData = parseJson(gseSelf.stdout)
@@ -184,7 +258,7 @@ const checks = [
   check('CPF12', 'continue packet surfaces latest maintenance snapshot freshness', validData?.preflight?.checks?.some((item) => item.id === 'CP20') && validData?.compactState?.maintenanceSnapshot?.status === 'passed' && validData?.compactState?.maintenanceSnapshot?.installedSync === 'package-only', 'scripts/generate-continue-packet.mjs'),
   check('CPF13', 'continue packet keeps owner/external records out of core workflow blockers', validData?.limits?.some((item) => item.includes('not GSE core workflow blockers')) && !validData?.limits?.some((item) => item.includes('block final acceptance')) && !fs.readFileSync(path.join(root, 'scripts', 'generate-continue-packet.mjs'), 'utf8').includes('Blocked final-acceptance gates'), 'scripts/generate-continue-packet.mjs'),
   check('CPF14', 'continue packet exposes exact completion plan and close commands', Array.isArray(validData?.compactState?.completionPlan?.requiredCloseCommands) && validData.compactState.completionPlan.requiredCloseCommands.some((item) => item.includes('run-validation-profile.mjs')) && validData.compactState.completionPlan.requiredCloseCommands.some((item) => item.includes('/gse close')) && validData.compactState.completionPlan.requiredSteps.some((item) => item.includes('evidence/index.jsonl')), 'compactState.completionPlan'),
-  check('CPF15', 'continue packet activates conditional close commands from detected changed capability/docs/release files', validData?.compactState?.completionPlan?.conditionalCloseCommands?.some((item) => item.id === 'encoding' && item.active && item.command.includes('pnpm check:encoding')) && validData?.compactState?.completionPlan?.conditionalCloseCommands?.some((item) => item.id === 'installed-sync' && item.active && item.command.includes('audit-installed-sync.mjs')) && validData?.compactState?.completionPlan?.conditionalCloseCommands?.some((item) => item.id === 'release-bundle' && item.active && item.command.includes('generate-release-bundle.mjs')) && validData?.compactState?.completionPlan?.conditionalCloseCommands?.some((item) => item.id === 'session-sync' && item.active && item.command.includes('audit-session-sync.mjs')), 'compactState.completionPlan.conditionalCloseCommands'),
+  check('CPF15', 'continue packet activates conditional close commands from detected changed capability/docs/release files', validData?.compactState?.completionPlan?.conditionalCloseCommands?.some((item) => item.id === 'encoding' && item.active && item.command.includes('npm run check:encoding')) && validData?.compactState?.completionPlan?.conditionalCloseCommands?.some((item) => item.id === 'installed-sync' && item.active && item.command.includes('audit-installed-sync.mjs')) && validData?.compactState?.completionPlan?.conditionalCloseCommands?.some((item) => item.id === 'release-bundle' && item.active && item.command.includes('generate-release-bundle.mjs')) && validData?.compactState?.completionPlan?.conditionalCloseCommands?.some((item) => item.id === 'session-sync' && item.active && item.command.includes('audit-session-sync.mjs')), 'compactState.completionPlan.conditionalCloseCommands'),
   check('CPF16', 'continue packet exposes core/release/host-adapter gate taxonomy', validData?.compactState?.gateTaxonomy?.core?.blocking === true && validData?.compactState?.gateTaxonomy?.release?.scope?.includes('public release') && validData?.compactState?.gateTaxonomy?.hostAdapter?.scope?.includes('native slash-command') && validData?.compactState?.gateTaxonomy?.rule?.includes('block only the specific public, release, or host claim'), 'compactState.gateTaxonomy'),
   check('CPF17', 'continue packet prompt is short-entry actionable instead of long-goal prose', promptLines.length <= 6 && validData?.prompt?.includes('GSE continue:') && validData?.prompt?.includes('Root:') && validData?.prompt?.includes('Slice:') && validData?.prompt?.includes('Next:') && validData?.prompt?.includes('Mode: continue-current-slice') && validData?.prompt?.includes('Do: one verifiable slice') && validData?.prompt?.includes('risks=4 active/1 archived') && !validData?.prompt?.includes('Run one verifiable slice, record evidence'), 'compact prompt line count and required action fields'),
   check('CPF18', 'verified current slice switches short entry into open-next-slice mode', directVerified.status === 0 && verifiedData?.compactState?.nextSliceMode?.action === 'open-next-slice' && verifiedData?.compactState?.nextSliceMode?.currentSliceVerified === true && verifiedData?.prompt?.includes('Mode: open-next-slice'), directVerified.command),
@@ -195,11 +269,19 @@ const checks = [
   check('CPF23', 'next-slice candidates prefer concrete gaps over meta open-next-slice reminders', directVerified.status === 0 && verifiedData?.compactState?.nextSliceCandidates?.[0]?.source === '.gse/state.json residualRisks' && !verifiedData.compactState.nextSliceCandidates[0].fullReason.toLowerCase().includes('open the next fixture slice'), 'compactState.nextSliceCandidates ranking'),
   check('CPF24', 'next-slice candidates include structured action packets for short-entry takeover', directVerified.status === 0 && verifiedData?.compactState?.nextSliceCandidates?.every((item) => item.actionPacket?.candidateType && item.actionPacket?.outcomeHint && item.actionPacket?.scopeHint && item.actionPacket?.acceptanceHint && item.actionPacket?.evidenceHint && item.actionPacket?.riskHint && item.actionPacket?.nextActionHint && Array.isArray(item.actionPacket?.focusedChecks) && item.actionPacket.focusedChecks.length >= 1), 'compactState.nextSliceCandidates.actionPacket'),
   check('CPF25', 'continue packet separates session sync evidence from target-session adoption', validData?.preflight?.checks?.some((item) => item.id === 'CP21') && validData?.compactState?.sessionSyncBoundary?.boundary === 'sync-records-do-not-prove-adoption' && validData?.compactState?.sessionSyncBoundary?.adoptionProven === false && validData?.compactState?.sessionSyncBoundary?.limits?.some((item) => item.includes('not target-session adoption')), 'compactState.sessionSyncBoundary'),
+  check('CPF26', 'continue packet detects repeated internal/component slices and prefers product-visible recovery', directProductDrift.status === 0 && productDriftData?.compactState?.productProgressDrift?.status === 'warning' && productDriftData?.preflight?.checks?.some((item) => item.id === 'CP22' && item.status === 'warning') && productDriftData?.compactState?.nextSliceCandidates?.[0]?.actionPacket?.candidateType === 'product-visible-recovery' && productDriftData?.compactState?.nextSliceCandidates?.[0]?.acceptanceHint?.includes('user-visible behavior'), 'compactState.productProgressDrift'),
+  check('CPF27', 'product outcome gate warns on repeated support slices in product projects', directProductDrift.status === 0 && productDriftData?.compactState?.productOutcomeGate?.status === 'warning' && productDriftData?.compactState?.productOutcomeGate?.projectType === 'product' && productDriftData?.compactState?.productOutcomeGate?.sliceType === 'support' && productDriftData?.preflight?.checks?.some((item) => item.id === 'CP23' && item.status === 'warning') && productDriftData?.compactState?.nextSliceCandidates?.[0]?.source === 'compactState.productOutcomeGate', 'compactState.productOutcomeGate warning'),
+  check('CPF28', 'product outcome gate passes when product slice names a visible delta', directProductVisible.status === 0 && productVisibleData?.compactState?.productOutcomeGate?.status === 'passed' && productVisibleData?.compactState?.productOutcomeGate?.userVisibleDelta?.includes('Users can run') && productVisibleData?.compactState?.nextSliceCandidates?.every((item) => item.source !== 'compactState.productOutcomeGate'), 'compactState.productOutcomeGate passed'),
+  check('CPF29', 'GSE self is not forced through product outcome gate', gseSelf.status === 0 && gseSelfData?.compactState?.productOutcomeGate?.status === 'not-applicable' && gseSelfData?.compactState?.productOutcomeGate?.projectType === 'skill', 'compactState.productOutcomeGate not-applicable'),
+  check('CPF30', 'bounded product support slices surface their boundary without CP23 warning', directBoundedSupport.status === 0 && boundedSupportData?.compactState?.productOutcomeGate?.status === 'passed' && boundedSupportData?.compactState?.productOutcomeGate?.sliceType === 'support' && boundedSupportData?.compactState?.productOutcomeGate?.supportSliceBoundary?.includes('malformed evidence index') && !boundedSupportData?.preflight?.checks?.some((item) => item.id === 'CP23' && item.status === 'warning'), 'compactState.productOutcomeGate.supportSliceBoundary'),
 ]
-
-fs.rmSync(validFixture, { recursive: true, force: true })
-fs.rmSync(invalidFixture, { recursive: true, force: true })
-fs.rmSync(verifiedFixture, { recursive: true, force: true })
+
+fs.rmSync(validFixture, { recursive: true, force: true })
+fs.rmSync(invalidFixture, { recursive: true, force: true })
+fs.rmSync(verifiedFixture, { recursive: true, force: true })
+fs.rmSync(driftFixture, { recursive: true, force: true })
+fs.rmSync(visibleFixture, { recursive: true, force: true })
+fs.rmSync(boundedSupport, { recursive: true, force: true })
 
 const passed = checks.filter((item) => item.status === 'passed').length
 const failed = checks.length - passed
@@ -218,8 +300,10 @@ const report = {
     nextSliceCandidates: failed === 0 ? 'verified' : 'failed',
     nextSliceActionPackets: failed === 0 ? 'verified' : 'failed',
     sessionSyncAdoptionBoundary: failed === 0 ? 'verified' : 'failed',
+    productProgressDriftGuard: failed === 0 ? 'verified' : 'failed',
+    productOutcomeGate: failed === 0 ? 'verified' : 'failed',
   },
-  commands: [directValid.command, directInvalid.command, directVerified.command, commandValid.command, commandCompact.command, commandInvalid.command, gseSelf.command],
+  commands: [directValid.command, directInvalid.command, directVerified.command, directProductDrift.command, directProductVisible.command, directBoundedSupport.command, commandValid.command, commandCompact.command, commandInvalid.command, gseSelf.command],
   checks,
   limits: [
     'This audit verifies portable /gse continue semantics and compact packet output.',