diff --git a/scripts/test.sh b/scripts/test.sh
index f5c11cd..0732cfe 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -2,17 +2,18 @@
 #
 # test.sh — project test runner (framework entry point).
 #
-# Wraps the legacy suite in tests/ so `make test` and the pre-push full
-# audit (scripts/check-rules.sh) have a single canonical entry point.
-# The legacy suite sources the vendored KNELShellFramework; if that ever
-# breaks, add standalone checks here rather than forking the runner.
+# LOCAL GATE: runs the unit suite, which applies to the repo itself and
+# must pass on any workstation ("shift left").
+#
+# The validation/security suites in tests/ are deployment-target tests
+# (PAM/2FA packages, target resolv.conf, external repo reachability) —
+# run them ON a sectestbed/target system, not here:
+#   bash tests/run-tests.sh validation | security
 #
 set -uo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/.." || exit 1
 
 status=0
-if [ -f tests/run-tests.sh ]; then
-    bash tests/run-tests.sh || status=1
-fi
+bash tests/run-tests.sh unit || status=1
 
 exit "$status"