From 94ccf4424d22b6f240df197880162f70a3499c8e Mon Sep 17 00:00:00 2001
From: Roger Chappel <miscanalysis@gmail.com>
Date: Tue, 25 Aug 2026 07:28:29 +1000
Subject: [PATCH 1/3] fix: make fixture validation isolated

---
 scripts/assert-fully-typed.mjs | 17 +++++++++++++++++
 scripts/validate.sh            | 22 ++++++++++++++++------
 2 files changed, 33 insertions(+), 6 deletions(-)
 create mode 100644 scripts/assert-fully-typed.mjs

diff --git a/scripts/assert-fully-typed.mjs b/scripts/assert-fully-typed.mjs
new file mode 100644
index 0000000..1bdcedf
--- /dev/null
+++ b/scripts/assert-fully-typed.mjs
@@ -0,0 +1,17 @@
+import { readFile } from 'node:fs/promises';
+
+const [reportPath] = process.argv.slice(2);
+
+if (!reportPath) {
+  console.error('Usage: node scripts/assert-fully-typed.mjs <report.json>');
+  process.exit(2);
+}
+
+const report = JSON.parse(await readFile(reportPath, 'utf8'));
+
+if (report.coverage !== 100 || report.implicitCount !== 0) {
+  console.error(
+    `Expected 100% coverage and zero implicit types; received ${String(report.coverage)}% coverage and ${String(report.implicitCount)} implicit types.`,
+  );
+  process.exit(1);
+}
diff --git a/scripts/validate.sh b/scripts/validate.sh
index 11a40d6..9b09f00 100755
--- a/scripts/validate.sh
+++ b/scripts/validate.sh
@@ -4,13 +4,23 @@ set -euo pipefail
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
 
-npm run check
 npm run build
-npm test
-npm run smoke
-npm run package:smoke
 
-node dist/cli.js fixtures/fully-typed --format json --min-coverage 100 >/tmp/typegap-fully-typed.json
-node -e "const fs=require('node:fs'); const r=JSON.parse(fs.readFileSync('/tmp/typegap-fully-typed.json','utf8')); if (r.coverage !== 100 || r.implicitCount !== 0) process.exit(1)"
+output_dir="$(mktemp -d "${TMPDIR:-/tmp}/typegap-validation.XXXXXX")"
+trap 'rm -rf "$output_dir"' EXIT
+
+report_path="$output_dir/fully-typed.json"
+invalid_report_path="$output_dir/invalid.json"
+
+node dist/cli.js fixtures/fully-typed --format json --min-coverage 100 >"$report_path"
+node scripts/assert-fully-typed.mjs "$report_path"
+
+# Exercise the negative path so the gate cannot silently stop enforcing the
+# fixture-specific coverage and implicit-type contract.
+printf '%s\n' '{"coverage":99,"implicitCount":1}' >"$invalid_report_path"
+if node scripts/assert-fully-typed.mjs "$invalid_report_path" >/dev/null 2>&1; then
+  printf 'Invalid fully-typed report unexpectedly passed validation.\n' >&2
+  exit 1
+fi
 
 printf 'TypeGap validation passed.\n'

From 9a200132616de5e9e9789aef3bf6833797d305f1 Mon Sep 17 00:00:00 2001
From: Roger Chappel <miscanalysis@gmail.com>
Date: Tue, 25 Aug 2026 07:28:29 +1000
Subject: [PATCH 2/3] ci: include fixture validation in release gate

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 93fba1a..8cd217a 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "audit:all": "npm audit",
     "audit:prod": "npm audit --omit=dev",
     "prepublishOnly": "npm run build",
-    "release:check": "npm run audit:all && npm run audit:prod && npm run check && npm run lint && npm test && npm run smoke && npm run package:smoke",
+    "release:check": "npm run audit:all && npm run audit:prod && npm run check && npm run lint && npm test && npm run smoke && npm run validate && npm run package:smoke",
     "package:smoke": "npm run build && node scripts/package-smoke.mjs",
     "smoke": "npm run build && node dist/cli.js --help && node dist/cli.js fixtures --format text"
   },

From b46d4b48f66fd30d0697a264ac157a3a5cf93a9c Mon Sep 17 00:00:00 2001
From: Roger Chappel <miscanalysis@gmail.com>
Date: Tue, 25 Aug 2026 07:28:29 +1000
Subject: [PATCH 3/3] docs: align release gate inventory

---
 README.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/README.md b/README.md
index aac1b09..a43cfd5 100644
--- a/README.md
+++ b/README.md
@@ -212,9 +212,8 @@ The release gate covers:
 - `npm run build` - tsc && chmod +x dist/cli.js
 - `npm test` - vitest run --coverage
 - `npm run smoke` - npm run build && node dist/cli.js --help && node dist/cli.js fixtures --format text
-- `npm run validate` - bash scripts/validate.sh
+- `npm run validate` - build the CLI, assert the fully typed fixture reports 100% coverage and zero implicit types, and verify invalid output is rejected
 - `npm run package:smoke` - npm run build && node scripts/package-smoke.mjs
-- `npm run release:check` - full and production audits, typecheck, lint, tests, smoke checks, and package smoke check
 
 ## Release readiness