One green command is not universal release evidence.

RuleOak separates source integrity, workspace tests, hosted CI, package contents, reproducibility and public publication because each proves a different layer.

Local sequence

npm run check:bootstrap
npm run check:source-manifest
npm test
npm run qa:auto
npm run qualify

Evidence ladder

1. Source treeExact paths, modes and hashes.
2. Local/static testsDeclared contracts exercised on the host.
3. Hosted CI/securityExact commit on declared runners.
4. PackageWhat would actually be distributed and installed.
5. Attestation/signingArtifact provenance where configured.
6. Public registry/repositoryActual hosted release truth.
7. Real integrationExternal environment evidence.

A timeout in an aggregate command is neither PASS nor automatic FAIL. Preserve completed evidence and rerun remaining gates independently.