pumuki 6.3.7

package/docs/validation/consumer-startup-escalation-handoff-latest.md

@@ -0,0 +1,237 @@
+# Consumer Startup Escalation Handoff (Latest)
+
+- generated_at: 2026-02-12T11:15:33Z
+- target_repo: `SwiftEnProfundidad/pumuki-actions-healthcheck-temp`
+- phase5_latest_verdict_chain:
+  - `phase5-blockers-readiness`: `READY`
+  - `phase5-execution-closure-status`: `BLOCKED`
+  - `phase5-external-handoff`: `BLOCKED`
+  - `consumer-startup-unblock-status`: `BLOCKED`
+
+## Current Blocking Signals
+
+- `startup_failure_runs: 0`
+- `startup_stalled_runs: 8`
+- `oldest_queued_run_age_minutes: 32`
+- latest queued runs still have:
+  - `jobs.total_count: 0`
+  - `artifacts.total_count: 0`
+
+## Latest Probe URLs
+
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21902330502
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21901391166
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21900914631
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21900855192
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21900096926
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21898971835
+
+## Cancel API Error Sample
+
+- endpoint: `POST /repos/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21900096926/cancel`
+- response: `HTTP 500`
+- message: `Failed to cancel workflow run`
+- x-github-request-id: `86BD:50C44:E9BB08D:D8B86F4:698C4FC9`
+
+## Evidence Bundle (Phase5 Latest)
+
+- `.audit-reports/phase5-latest/consumer-ci-auth-check.md`
+- `.audit-reports/phase5-latest/consumer-startup-failure-support-bundle.md`
+- `.audit-reports/phase5-latest/consumer-startup-unblock-status.md`
+- `.audit-reports/phase5-latest/consumer-startup-triage-report.md`
+- `.audit-reports/phase5-latest/consumer-support-ticket-draft.md`
+- `.audit-reports/phase5-latest/phase5-blockers-readiness.md`
+- `.audit-reports/phase5-latest/phase5-execution-closure-status.md`
+- `.audit-reports/phase5-latest/phase5-execution-closure-run-report.md`
+- `.audit-reports/phase5-latest/phase5-external-handoff.md`
+
+### Packaged Attachment Bundle
+
+- archive: `.audit-reports/phase5-latest/consumer-startup-escalation-bundle-latest.tgz`
+- size: `8.0K`
+- sha256: `00fbaa5952e3ca32bf6f3e546b76895aa550cc99f4500fadd7e970803420cc0c`
+
+## Escalation Message
+
+Persistent GitHub Actions startup blockage is reproducible in a private repository using controlled workflow_dispatch probes. Latest runs remain queued/stalled before job graph creation (`jobs=0`, `artifacts=0`) without progressing to normal execution; cancel attempts on queued runs also return `HTTP 500`. Request platform-side verification of account/repository controls for private Actions execution (policy, billing/quota, or internal restrictions) and explicit root cause confirmation.
+
+## Support Ticket Payload (Ready To Paste)
+
+Subject:
+
+`Persistent GitHub Actions startup blockage with queued runs and cancel HTTP 500 (private repo)`
+
+Body:
+
+```text
+Repository: SwiftEnProfundidad/pumuki-actions-healthcheck-temp (private)
+
+Current status:
+- phase5-blockers-readiness: READY
+- phase5-execution-closure-status: BLOCKED
+- consumer-startup-unblock-status: BLOCKED
+
+Signals:
+- startup_failure_runs: 0
+- startup_stalled_runs: 8
+- oldest_queued_run_age_minutes: 32
+- queued runs have jobs.total_count=0 and artifacts.total_count=0
+
+Cancel endpoint sample:
+- POST /repos/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21900096926/cancel
+- HTTP 500 "Failed to cancel workflow run"
+- x-github-request-id: 86BD:50C44:E9BB08D:D8B86F4:698C4FC9
+
+Latest run URLs:
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21944339604
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21943852102
+- https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21943766103
+
+Please verify platform-side/account-side controls for private Actions startup (policy, quota/billing, or internal restrictions) and confirm root cause.
+```
+
+## Submission Tracking
+
+- submission_readiness: `READY_TO_SUBMIT`
+- submission_blocker: `NONE`
+- support_ticket_id: `4077449`
+- submitted_at_utc: `2026-02-11T13:54:02Z`
+- submitted_by: `SwiftEnProfundidad`
+- support_channel: `GitHub Support`
+- follow_up_eta: `2026-02-12 18:00 UTC`
+- follow_up_last_posted_at_utc: `2026-02-14T20:02:21Z`
+- follow_up_last_posted_by: `juancarlosmerlosalbarracin`
+- follow_up_state: `DEFERRED_NOT_PRIORITY_TICKET_CLOSED`
+- support_reply_received_at_utc: `NOT_APPLICABLE_TICKET_CLOSED_BY_OPERATOR_2026-02-14T21:15:10Z`
+- support_reply_summary: `Ticket 4077449 closed by operator decision without support response; external support path is de-scoped and not a current Pumuki priority.`
+- loop_guard_started_at_utc: `2026-02-14T19:38:12Z`
+- loop_guard_next_refresh_not_before_utc: `2026-02-15T19:38:12Z`
+- loop_guard_override_condition: `support path de-scoped by operator/product decision (ticket closed)`
+- loop_guard_auto_release_state: `follow_up_state=DEFERRED_NOT_PRIORITY_TICKET_CLOSED`
+- loop_guard_check_command: `bash scripts/check-phase8-loop-guard.sh`
+- loop_guard_check_command_alias: `npm run validation:phase8:loop-guard`
+- loop_guard_coverage_alias: `npm run validation:phase8:loop-guard-coverage`
+- loop_guard_enforced_in: `scripts/run-phase8-tick.sh`, `scripts/run-phase8-autopilot.sh`, `scripts/run-phase8-after-billing-reactivation.sh`, `scripts/run-phase5-post-support-refresh.sh`, `scripts/refresh-phase5-latest-escalation.sh`, `scripts/run-phase8-next-step.sh`, `scripts/run-phase8-status-pack.sh`, `scripts/run-phase8-doctor.sh`
+- follow_up_tracking_command: `N/A (ticket 4077449 closed/de-scoped for current closure scope)`
+- follow_up_tracking_command_alias: `N/A`
+- follow_up_tracking_posted_now_alias: `N/A`
+- follow_up_tracking_replied_now_alias: `N/A`
+- known_external_cause: `BILLING_INACTIVE_OR_NOT_UPDATED`
+- ticket_closure_owner: `SwiftEnProfundidad (manual close planned)`
+- pre_submission_verification: `PASS`
+- pre_submission_verified_at_utc: `2026-02-11T09:54:18Z`
+
+## Support Ticket Follow-up Payload (2026-02-14)
+
+Use this exact payload in ticket `4077449` as the next support follow-up update:
+
+```text
+Follow-up update for ticket 4077449 (consumer Actions startup queue stall)
+
+Current blocker remains active in private repo:
+- sample_size: 20 recent runs
+- queued_runs: 20/20
+- newest_run_id: 21944339604 (created_at: 2026-02-12T11:15:05Z)
+- oldest_run_id: 21942203435 (created_at: 2026-02-12T10:08:37Z)
+- oldest_queued_age_minutes: 3447 (snapshot captured on 2026-02-14T19:35:47Z)
+- latest_run_url: https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21944339604
+- latest_cancel_attempt: POST /actions/runs/21944339604/cancel -> HTTP 500 Failed to cancel workflow run
+- latest_follow_up_api_attempt_1: POST /support/tickets/4077449/comments -> HTTP 404 Not Found
+- latest_follow_up_api_attempt_2: POST /user/support/tickets/4077449/comments -> HTTP 404 Not Found
+- latest_follow_up_payload_artifact: `.audit-reports/phase5-latest/github-support-followup-4077449-2026-02-14-portal-ready.txt`
+- latest_follow_up_payload_sha256: `e9eca0665f26610c3aa83ebec335c65dde99657fe768af5b134fb53792a149c4`
+
+Impact:
+- Startup queue remains blocked, preventing READY chain completion for:
+  - consumer-startup-unblock-status
+  - phase5-execution-closure-status
+
+Request:
+- Please confirm account/platform-side root cause and required remediation steps.
+- Once mitigated, we will immediately re-run readiness chain and attach new READY evidence.
+```
+
+## Manual Portal Submission Checklist (Execution)
+
+Use this sequence exactly when submitting in GitHub Support portal:
+
+1. Open a new support case and paste:
+   - Subject: `Persistent GitHub Actions startup blockage with queued runs and cancel HTTP 500 (private repo)`
+   - Body: copy from `Support Ticket Payload (Ready To Paste)` above.
+2. Attach the packaged evidence archive:
+   - `.audit-reports/phase5-latest/consumer-startup-escalation-bundle-latest.tgz`
+3. Add latest run URLs (minimum 2) in the case body:
+   - `https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21944339604`
+   - `https://github.com/SwiftEnProfundidad/pumuki-actions-healthcheck-temp/actions/runs/21943852102`
+4. After pressing submit, update `Submission Tracking` in this file:
+   - `support_ticket_id: <real id>`
+   - `submitted_at_utc: <YYYY-MM-DDTHH:MM:SSZ>`
+   - `submitted_by: <github user>`
+   - `follow_up_eta: <date/time from support SLA>`
+5. Optional fast update command:
+   - `npm run validation:phase5-escalation:mark-submitted -- <support_ticket_id> <submitted_by> "<follow_up_eta>" [submitted_at_utc]`
+6. Optional payload/export command (portal copy/paste + attachments checklist):
+   - `npm run validation:phase5-escalation:payload -- .audit-reports/phase5-latest`
+   - output: `.audit-reports/phase5-latest/github-support-portal-payload.txt`
+7. Optional deterministic pre-submit gate:
+   - `npm run validation:phase5-escalation:ready-to-submit -- .audit-reports/phase5-latest`
+   - expected exit code: `0` only when readiness, checksum and attachment checklist are aligned.
+8. Optional one-shot submission package helper:
+   - `npm run validation:phase5-escalation:prepare -- .audit-reports/phase5-latest`
+   - runs pre-submit gate + payload generation and prints final manual steps.
+9. Optional post-submit close helper (handoff + queue transition):
+   - `npm run validation:phase5-escalation:close-submission -- <support_ticket_id> <submitted_by> "<follow_up_eta>" [submitted_at_utc]`
+   - applies `Submission Tracking` update and flips queue from `P8-2b` to `P8-3`.
+10. Channel constraint:
+   - GitHub CLI does not provide a `support` command for case creation; submission must be done in GitHub Support portal.
+   - Direct REST probe endpoints also return `404 Not Found` (`POST /support/tickets`, `POST /user/support/tickets`, `POST /support/tickets/4077449/comments`, `POST /user/support/tickets/4077449/comments`).
+
+## Pre-Submission Verification
+
+Before sending the support ticket, run:
+
+```bash
+shasum -a 256 .audit-reports/phase5-latest/consumer-startup-escalation-bundle-latest.tgz
+```
+
+Expected:
+
+- `00fbaa5952e3ca32bf6f3e546b76895aa550cc99f4500fadd7e970803420cc0c  .audit-reports/phase5-latest/consumer-startup-escalation-bundle-latest.tgz`
+
+And verify required files are present:
+
+```bash
+ls -1 \
+  .audit-reports/phase5-latest/consumer-ci-auth-check.md \
+  .audit-reports/phase5-latest/consumer-startup-failure-support-bundle.md \
+  .audit-reports/phase5-latest/consumer-startup-unblock-status.md \
+  .audit-reports/phase5-latest/consumer-support-ticket-draft.md \
+  .audit-reports/phase5-latest/phase5-external-handoff.md
+```
+
+## Post-Submission Refresh Sequence
+
+After GitHub Support replies/applies a fix:
+
+Fast path:
+
+1. Run one-shot refresh:
+   - `npm run validation:phase5-latest:refresh -- SwiftEnProfundidad/pumuki-actions-healthcheck-temp 8 .audit-reports/phase5-latest .audit-reports/phase5/mock-consumer-ab-report.md`
+2. Run one-shot post-support closure check:
+   - `npm run validation:phase5-post-support:refresh -- SwiftEnProfundidad/pumuki-actions-healthcheck-temp 8 .audit-reports/phase5-latest .audit-reports/phase5/mock-consumer-ab-report.md`
+   - expected exit code: `0` only when chain is fully `READY`.
+
+Equivalent explicit steps:
+
+1. Trigger a fresh probe:
+   - `gh workflow run health.yml --repo SwiftEnProfundidad/pumuki-actions-healthcheck-temp`
+2. Recompute phase5 latest closure:
+   - `npx --yes tsx@4.21.0 scripts/run-phase5-execution-closure.ts --repo SwiftEnProfundidad/pumuki-actions-healthcheck-temp --limit 7 --out-dir .audit-reports/phase5-latest --skip-adapter --skip-workflow-lint`
+3. Regenerate external handoff:
+   - `npx --yes tsx@4.21.0 scripts/build-phase5-external-handoff.ts --repo SwiftEnProfundidad/pumuki-actions-healthcheck-temp --phase5-status-report .audit-reports/phase5-latest/phase5-execution-closure-status.md --phase5-blockers-report .audit-reports/phase5-latest/phase5-blockers-readiness.md --consumer-unblock-report .audit-reports/phase5-latest/consumer-startup-unblock-status.md --mock-ab-report .audit-reports/phase5/mock-consumer-ab-report.md --run-report .audit-reports/phase5-latest/phase5-execution-closure-run-report.md --artifact-url <new_run_url_1> --artifact-url <new_run_url_2> --out .audit-reports/phase5-latest/phase5-external-handoff.md`
+4. Update progress/TODO and set blocker to closed only when:
+   - `consumer-startup-unblock-status`: `READY`
+   - `phase5-execution-closure-status`: `READY`
+5. Run deterministic chain check:
+   - `npm run validation:phase5-latest:ready-check`
+   - expected exit code: `0` only when all required reports are `READY`.

package/docs/validation/enterprise-consumer-isolation-policy.md

@@ -0,0 +1,45 @@
+# Enterprise Consumer Isolation Policy
+
+This policy defines how Pumuki framework validation is executed during stabilization, to prevent accidental changes in enterprise consumer repositories.
+
+## Scope
+
+- Applies to all framework-maintenance work in this repository.
+- Applies to all external consumer repositories used for diagnostics or rollout validation.
+
+## Baseline Rule
+
+During framework stabilization, enterprise consumer repositories are read-only validation targets.
+
+- Do not commit, push, or open remediation branches in enterprise consumer repositories.
+- Do not change workflows, source files, or configuration in enterprise consumer repositories as part of framework validation.
+- Keep framework implementation and consumer application remediation as separate streams.
+
+## Allowed Operations on Enterprise Consumers
+
+- Read-only diagnostics:
+  - CI artifact collection
+  - startup triage report generation
+  - workflow lint scans (report-only)
+  - evidence capture for incident/support payloads
+- Local temporary files generated by diagnostics are allowed only when ignored and cleaned after execution.
+
+## Default Validation Target
+
+Use a dedicated mock consumer repository for active integration validation:
+
+- install Pumuki from local framework workspace
+- run PRE_COMMIT / PRE_PUSH / CI runners
+- execute deterministic A/B checks
+- validate evidence generation (`.ai_evidence.json`, `version: "2.1"`)
+
+## Exception Process
+
+Enterprise consumer modifications require explicit operator approval and must be handled in the consumer repository lifecycle (separate change request), not in framework stabilization tasks.
+
+## Enforcement Checklist
+
+- [ ] Validation run starts in mock consumer repository first.
+- [ ] Enterprise consumer diagnostics are read-only.
+- [ ] No staged changes remain in enterprise consumer repository after diagnostics.
+- [ ] Any required remediation is documented as external follow-up, not applied from framework tasks.

package/docs/validation/github-support-ticket-template-startup-failure.md

@@ -0,0 +1,84 @@
+# GitHub Support Ticket Template - Actions Startup Failure (Private Repo)
+
+Use this template when startup failures persist after local workflow lint and repository-level permissions checks.
+
+## Subject
+
+Persistent GitHub Actions `startup_failure` with no jobs in private repository
+
+## Repository
+
+- Owner/repo: `<owner>/<repo>`
+- Visibility: `private`
+- Example branch: `<branch>`
+
+## Problem Summary
+
+GitHub Actions runs consistently fail with:
+
+- `conclusion: startup_failure`
+- queued/stalled runs accumulating (`status: queued`, no conclusion)
+- cancel attempts on queued runs failing (`POST /cancel -> HTTP 500`)
+- no jobs created (`jobs.total_count = 0`)
+- no check runs (`latest_check_runs_count = 0`)
+- artifact endpoint empty (`total_count = 0`)
+
+This happens across push, pull_request, and workflow_dispatch events.
+
+## Evidence
+
+Run URLs (examples):
+
+- `<run_url_1>`
+- `<run_url_2>`
+- `<run_url_3>`
+
+Counters snapshot (from latest support bundle):
+
+- `startup_failure_runs: <n>`
+- `startup_stalled_runs: <n>`
+- `oldest_queued_run_age_minutes: <n>`
+
+API metadata sample:
+
+- `GET /repos/<owner>/<repo>/actions/runs/<run_id>`
+  - `name`: `<name>`
+  - `path`: `<path>`
+  - `conclusion`: `startup_failure`
+- `GET /repos/<owner>/<repo>/actions/runs/<run_id>/jobs`
+  - `total_count: 0`
+- `GET /repos/<owner>/<repo>/actions/runs/<run_id>/artifacts`
+  - `total_count: 0`
+- `POST /repos/<owner>/<repo>/actions/runs/<run_id>/cancel`
+  - `HTTP 500`
+  - `x-github-request-id: <request_id>`
+- `GET /repos/<owner>/<repo>/check-suites/<suite_id>`
+  - `conclusion: startup_failure`
+  - `latest_check_runs_count: 0`
+
+## Diagnostics Already Performed
+
+1. Verified Actions enabled:
+   - `GET /repos/<owner>/<repo>/actions/permissions`
+2. Verified workflow permissions:
+   - `GET /repos/<owner>/<repo>/actions/permissions/workflow`
+3. Tested access-level toggle (`actions/permissions/access`) and reverted.
+4. Ran semantic workflow lint and fixed known lint findings in a temporary branch.
+5. Attempted to cancel queued runs; GitHub API returned `HTTP 500`.
+6. Re-triggered workflow_dispatch after fixes; startup failure/queue stall persisted.
+
+## Expected Behavior
+
+At least one workflow job should start for workflow_dispatch on a valid workflow file, and logs should be available.
+
+## Request
+
+Please check account/repository-level controls for private Actions execution (billing, policy, internal restrictions) and provide the exact reason for startup failure in these runs.
+
+## Attachments
+
+- CI artifact scan report markdown
+- startup support bundle markdown
+- startup unblock status markdown
+- workflow lint report markdown
+- startup-fix experiment report markdown

package/docs/validation/mock-consumer-integration-runbook.md

@@ -0,0 +1,89 @@
+# Mock Consumer Integration Runbook
+
+Use this runbook to validate framework integration behavior in a dedicated mock consumer repository before running any enterprise-consumer diagnostics.
+
+Policy anchor: `docs/validation/enterprise-consumer-isolation-policy.md`.
+
+## Goal
+
+Validate packaging and runtime behavior (`PRE_COMMIT`, `PRE_PUSH`, `CI`) without touching enterprise consumer repositories.
+
+## Preconditions
+
+- Framework repository up to date on the active working branch.
+- Dependencies installed in framework workspace (`npm ci`).
+- Local mock consumer repository available (for example: `pumuki-mock-consumer`).
+
+## Path A: Deterministic package smoke (recommended baseline)
+
+Run both smoke modes from framework workspace:
+
+```bash
+npm run validation:package-smoke
+npm run validation:package-smoke:minimal
+```
+
+Expected outcomes:
+
+- `block` mode: stage commands exit `1` with `snapshot.outcome=BLOCK`.
+- `minimal` mode: stage commands exit `0` with `snapshot.outcome=PASS`.
+
+Artifacts:
+
+- `.audit-reports/package-smoke/block/summary.md`
+- `.audit-reports/package-smoke/minimal/summary.md`
+
+Optional deterministic A/B report (smoke + evidence v2.1 contract):
+
+```bash
+npm run validation:mock-consumer-ab-report -- \
+  --repo <owner>/<repo> \
+  --out .audit-reports/mock-consumer/mock-consumer-ab-report.md \
+  --block-summary .audit-reports/package-smoke/block/summary.md \
+  --minimal-summary .audit-reports/package-smoke/minimal/summary.md \
+  --block-evidence .audit-reports/package-smoke/block/ci.ai_evidence.json \
+  --minimal-evidence .audit-reports/package-smoke/minimal/ci.ai_evidence.json
+```
+
+## Path B: Manual local integration in mock consumer
+
+1. Pack framework from current branch:
+
+```bash
+npm pack
+```
+
+2. Install tarball in mock consumer:
+
+```bash
+npm install /absolute/path/to/pumuki-<version>.tgz
+```
+
+3. Execute stage wrappers from mock consumer:
+
+```bash
+npx tsx integrations/git/preCommitIOS.cli.ts
+npx tsx integrations/git/prePushBackend.cli.ts
+npx tsx integrations/git/ciFrontend.cli.ts
+```
+
+4. Inspect deterministic evidence:
+
+```bash
+jq -r '.version' .ai_evidence.json
+jq -r '.snapshot.stage' .ai_evidence.json
+jq -r '.snapshot.outcome' .ai_evidence.json
+```
+
+## A/B Checklist
+
+- [ ] Same input repo state yields stable evidence semantics (`snapshot/findings/platforms/rulesets`).
+- [ ] `block` and `minimal` smoke modes behave as expected.
+- [ ] No enterprise consumer repository was modified during this validation.
+
+## Exit Criteria
+
+- Smoke summaries show `Status: PASS` for both modes.
+- Mock consumer evidence is `version: "2.1"`.
+- Mock consumer A/B report reaches `verdict: READY`.
+- Any enterprise-consumer follow-up is documented as external diagnostics/remediation, not applied from framework workspace.

package/docs/validation/phase5-execution-closure.md

@@ -0,0 +1,227 @@
+# Phase 5 Execution Closure Runbook
+
+## Purpose
+
+Close the remaining manual blockers for Phase 5 rollout validation using deterministic generated reports, without coupling gate runtime behavior to IDE-specific adapters.
+
+## Scope
+
+This runbook is operational. It validates rollout readiness and incident closure evidence. It does not change PRE_COMMIT, PRE_PUSH, or CI gate outcomes in this repository.
+
+## One-shot orchestration command
+
+Use this command to run the full closure flow end-to-end:
+
+```bash
+npm run validation:phase5-execution-closure -- \
+  --repo <owner>/<repo> \
+  --out-dir .audit-reports/phase5 \
+  --skip-workflow-lint
+```
+
+Default behavior includes an auth/scope preflight (`check-consumer-ci-auth`) and stops before triage when auth is blocked.
+
+Strict adapter mode:
+
+```bash
+npm run validation:phase5-execution-closure -- \
+  --repo <owner>/<repo> \
+  --out-dir .audit-reports/phase5 \
+  --repo-path /absolute/path/to/consumer-repo \
+  --actionlint-bin /tmp/actionlint-bin/actionlint \
+  --require-adapter-readiness
+```
+
+Generated orchestration summary:
+
+- `.audit-reports/phase5/phase5-execution-closure-run-report.md`
+
+Optional: disable auth preflight when you intentionally want triage to execute auth internally:
+
+```bash
+npm run validation:phase5-execution-closure -- \
+  --repo <owner>/<repo> \
+  --out-dir .audit-reports/phase5 \
+  --skip-workflow-lint \
+  --skip-auth-preflight
+```
+
+Mock-consumer mode (local, no external GH dependency):
+
+```bash
+npm run validation:phase5-execution-closure -- \
+  --repo <owner>/<repo> \
+  --out-dir .audit-reports/phase5 \
+  --mock-consumer
+```
+
+This mode consumes local package-smoke summaries:
+
+- `.audit-reports/package-smoke/block/summary.md`
+- `.audit-reports/package-smoke/minimal/summary.md`
+- `.audit-reports/package-smoke/block/ci.ai_evidence.json`
+- `.audit-reports/package-smoke/minimal/ci.ai_evidence.json`
+
+and emits local A/B readiness evidence:
+
+- `.audit-reports/phase5/mock-consumer-ab-report.md`
+
+CI coverage:
+
+- `.github/workflows/pumuki-phase5-mock.yml`
+
+## Required Inputs
+
+- Consumer startup triage report (external consumer repository diagnostics):
+  - `.audit-reports/consumer-triage/consumer-startup-triage-report.md`
+
+Optional adapter diagnostics input:
+
+- Adapter real-session runtime report:
+  - `.audit-reports/adapter/adapter-real-session-report.md`
+
+## Step 1: Generate/refresh Adapter report
+
+Run in this repository:
+
+```bash
+npm run validation:adapter-session-status -- --out .audit-reports/adapter/adapter-session-status.md
+npm run validation:adapter-real-session-report -- \
+  --status-report .audit-reports/adapter/adapter-session-status.md \
+  --out .audit-reports/adapter/adapter-real-session-report.md
+```
+
+If strict runtime checks fail with `node: command not found`, execute:
+
+- `docs/validation/adapter-hook-runtime-validation.md`
+
+and regenerate both reports.
+
+## Step 2: Generate adapter readiness report (optional but recommended)
+
+```bash
+npm run validation:adapter-readiness -- \
+  --adapter-report .audit-reports/adapter/adapter-real-session-report.md \
+  --out .audit-reports/adapter/adapter-readiness.md
+```
+
+Expected adapter verdict when runtime is healthy:
+
+- `READY`
+
+If verdict is `BLOCKED` or `PENDING`, resolve the next-actions section in that report and regenerate it.
+
+## Step 3: Generate/refresh consumer startup triage
+
+Run against consumer repository context:
+
+```bash
+npm run validation:consumer-startup-triage -- \
+  --repo <owner>/<repo> \
+  --out-dir .audit-reports/phase5 \
+  --skip-workflow-lint
+```
+
+For local mock-consumer closure, this step is generated by `--mock-consumer` orchestration.
+
+Optional with workflow lint:
+
+```bash
+npm run validation:consumer-startup-triage -- \
+  --repo <owner>/<repo> \
+  --repo-path /absolute/path/to/consumer-repo \
+  --actionlint-bin /tmp/actionlint-bin/actionlint
+```
+
+## Step 4: Consolidate Phase 5 blockers readiness
+
+```bash
+npm run validation:phase5-blockers-readiness -- \
+  --consumer-triage-report .audit-reports/phase5/consumer-startup-triage-report.md \
+  --out .audit-reports/phase5/phase5-blockers-readiness.md
+```
+
+Optional strict adapter mode:
+
+```bash
+npm run validation:phase5-blockers-readiness -- \
+  --require-adapter-report \
+  --adapter-report .audit-reports/adapter/adapter-real-session-report.md \
+  --consumer-triage-report .audit-reports/phase5/consumer-startup-triage-report.md \
+  --out .audit-reports/phase5/phase5-blockers-readiness.md
+```
+
+Expected verdict to close Phase 5 execution:
+
+- `READY`
+
+If verdict is `BLOCKED` or `MISSING_INPUTS`, follow the next-actions section in generated report and rerun.
+
+## Step 5: Generate execution-closure status snapshot
+
+```bash
+npm run validation:phase5-execution-closure-status -- \
+  --phase5-blockers-report .audit-reports/phase5/phase5-blockers-readiness.md \
+  --consumer-unblock-report .audit-reports/phase5/consumer-startup-unblock-status.md \
+  --out .audit-reports/phase5/phase5-execution-closure-status.md
+```
+
+Optional strict adapter mode:
+
+```bash
+npm run validation:phase5-execution-closure-status -- \
+  --phase5-blockers-report .audit-reports/phase5/phase5-blockers-readiness.md \
+  --consumer-unblock-report .audit-reports/phase5/consumer-startup-unblock-status.md \
+  --adapter-readiness-report .audit-reports/adapter/adapter-readiness.md \
+  --require-adapter-readiness \
+  --out .audit-reports/phase5/phase5-execution-closure-status.md
+```
+
+## Step 6: Generate external handoff report
+
+```bash
+npm run validation:phase5-external-handoff -- \
+  --repo <owner>/<repo> \
+  --require-mock-ab-report \
+  --out .audit-reports/phase5/phase5-external-handoff.md
+```
+
+Optional strict artifact mode:
+
+```bash
+npm run validation:phase5-external-handoff -- \
+  --repo <owner>/<repo> \
+  --require-mock-ab-report \
+  --require-artifact-urls \
+  --artifact-url https://github.com/<owner>/<repo>/actions/runs/<run-id> \
+  --out .audit-reports/phase5/phase5-external-handoff.md
+```
+
+## Exit Criteria
+
+Phase 5 execution closure is complete when all are true:
+
+- `.audit-reports/phase5/phase5-blockers-readiness.md` exists with `- verdict: READY`
+- `.audit-reports/phase5/phase5-execution-closure-status.md` exists with `- verdict: READY`
+- `.audit-reports/phase5/phase5-external-handoff.md` exists with `- verdict: READY`
+- `docs/TODO.md` Phase 5 execution closure item is marked complete
+- Relevant rollout/report docs include links to final generated artifacts
+
+## Quick Checklist
+
+- [ ] `validation:adapter-real-session-report` generated and reviewed
+- [ ] `validation:adapter-readiness` generated and reviewed
+- [ ] `validation:consumer-startup-triage` generated against target repo
+- [ ] `validation:phase5-blockers-readiness` returns `verdict=READY`
+- [ ] `validation:phase5-execution-closure-status` returns `verdict=READY`
+- [ ] mock-consumer A/B report exists with `verdict=READY` when using `--mock-consumer`
+- [ ] `validation:phase5-external-handoff` returns `verdict=READY`
+- [ ] `docs/TODO.md` execution-closure item updated
+
+## Related References
+
+- `docs/validation/adapter-hook-runtime-validation.md`
+- `docs/validation/consumer-ci-startup-failure-playbook.md`
+- `docs/validation/phase8-external-rollout-pack.md`
+- `docs/validation/skills-rollout-consumer-repositories.md`
+- `docs/TODO.md`