Everyone here has one job, a limit on what they are allowed to do, and something that stops them if they get it wrong. Nobody marks their own work. Roles that are not built yet are marked and say what is missing.
Every node declares a typed input, a typed output, and a gate. A node may not run until its input validates, and its output may not propagate until its gate passes. Exactly one node can set a promotable state, and it holds a signing key the application does not have.
THE RULE THIS ROSTER OBEYS
A role only exists if it has a typed input, a typed output, and a gate that can stop it. Anything that cannot name all three is a job title, not a node. This page is served from the running system: the counts are computed, every built role links to the code and tests behind it, and every unbuilt role states exactly what is missing rather than being described as if it worked.