@t275005746/gse 0.1.0 → 0.1.1

package/scripts/audit-acceptance-execution-packet.mjs

@@ -1,133 +1,133 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const template = read('assets/templates/acceptance-execution-packet.md')
-const forwardTest = read('references/forward-test.md')
-const recipes = read('references/adoption-recipes.md')
-const validate = read('scripts/validate-gse.mjs')
-
-const fields = [
-  'Acceptance path:',
-  'Target project or session:',
-  'Purpose:',
-  'Required inputs:',
-  'Allowed files:',
-  'Forbidden files:',
-  'Allowed commands:',
-  'Forbidden commands:',
-  'Expected output:',
-  'Evidence record path:',
-  'Acceptance gate:',
-  'Accepted by:',
-  'Stop conditions:',
-  'Residual risk if incomplete:',
-  'Next action after completion:',
-]
-
-const freshInputs = [
-  'SKILL.md',
-  '.gse/gse-design-master-plan.md',
-  '.gse/goal-map.md',
-  '.gse/current-slice.md',
-  'references/forward-test.md',
-  'references/evidence-taxonomy.md',
-]
-
-const projectInputs = [
-  'Project owner approval text or issue/task link.',
-  'references/adoption-recipes.md',
-  'assets/templates/target-adoption-evidence.md',
-  'assets/templates/update-release-acceptance-record.md',
-]
-
-const antiOverclaim = [
-  'Do not write `Accepted by: fresh-session` unless a separate session actually ran the packet.',
-  'Do not write `Accepted by: owner` unless owner approval is explicit and recorded.',
-  'Do not treat a generated packet, local validation, fixture audit, or read-only discovery as acceptance.',
-  'Evidence status: not ready',
-  'Accepted by: not accepted',
-]
-
-const checks = [
-  check('AEP01', 'acceptance execution packet template exists', exists('assets/templates/acceptance-execution-packet.md'), 'assets/templates/acceptance-execution-packet.md'),
-  check('AEP02', 'packet captures execution boundaries', fields.every((item) => template.includes(item)), fields.join(', ')),
-  check('AEP03', 'fresh-session path uses documented GSE inputs', freshInputs.every((item) => template.includes(item)), freshInputs.join(', ')),
-  check('AEP04', 'owner-approved path requires explicit owner evidence and project templates', projectInputs.every((item) => template.includes(item)), projectInputs.join(', ')),
-  check('AEP05', 'packet limits default project writes to .gse artifacts', template.includes('.gse/project-profile.md') && template.includes('.gse/evidence/YYYY-MM-DD.md') && template.includes('Source code, lockfiles, secrets'), 'allowed and forbidden file sections'),
-  check('AEP06', 'packet prevents fake acceptance', antiOverclaim.every((item) => template.includes(item)), 'anti-overclaim rules'),
-  check('AEP07', 'forward-test reference supports fresh-session acceptance boundary', forwardTest.includes('Use `accepted by: fresh-session` only when a separate agent/session actually ran the path.'), 'references/forward-test.md'),
-  check('AEP08', 'adoption recipes support target adoption evidence template', recipes.includes('assets/templates/target-adoption-evidence.md'), 'references/adoption-recipes.md'),
-  check('AEP09', 'consolidated validator includes this audit', validate.includes('audit-acceptance-execution-packet.mjs'), 'scripts/validate-gse.mjs'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { acceptanceExecutionPacket: failed === 0 ? 'verified' : 'failed' },
-  acceptedBy: 'not accepted; this audit verifies packet readiness only',
-  limits: [
-    'This audit verifies acceptance packet readiness only.',
-    'It does not create a separate session, write to a target project, or record owner acceptance.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Acceptance Execution Packet Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Acceptance execution packet: ' + data.workflows.acceptanceExecutionPacket)
-  lines.push('- Accepted by: ' + data.acceptedBy)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const template = read('assets/templates/acceptance-execution-packet.md')
+const forwardTest = read('references/forward-test.md')
+const recipes = read('references/adoption-recipes.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const fields = [
+  'Acceptance path:',
+  'Target project or session:',
+  'Purpose:',
+  'Required inputs:',
+  'Allowed files:',
+  'Forbidden files:',
+  'Allowed commands:',
+  'Forbidden commands:',
+  'Expected output:',
+  'Evidence record path:',
+  'Acceptance gate:',
+  'Accepted by:',
+  'Stop conditions:',
+  'Residual risk if incomplete:',
+  'Next action after completion:',
+]
+
+const freshInputs = [
+  'SKILL.md',
+  '.gse/gse-design-master-plan.md',
+  '.gse/goal-map.md',
+  '.gse/current-slice.md',
+  'references/forward-test.md',
+  'references/evidence-taxonomy.md',
+]
+
+const projectInputs = [
+  'Project owner approval text or issue/task link.',
+  'references/adoption-recipes.md',
+  'assets/templates/target-adoption-evidence.md',
+  'assets/templates/update-release-acceptance-record.md',
+]
+
+const antiOverclaim = [
+  'Do not write `Accepted by: fresh-session` unless a separate session actually ran the packet.',
+  'Do not write `Accepted by: owner` unless owner approval is explicit and recorded.',
+  'Do not treat a generated packet, local validation, fixture audit, or read-only discovery as acceptance.',
+  'Evidence status: not ready',
+  'Accepted by: not accepted',
+]
+
+const checks = [
+  check('AEP01', 'acceptance execution packet template exists', exists('assets/templates/acceptance-execution-packet.md'), 'assets/templates/acceptance-execution-packet.md'),
+  check('AEP02', 'packet captures execution boundaries', fields.every((item) => template.includes(item)), fields.join(', ')),
+  check('AEP03', 'fresh-session path uses documented GSE inputs', freshInputs.every((item) => template.includes(item)), freshInputs.join(', ')),
+  check('AEP04', 'owner-approved path requires explicit owner evidence and project templates', projectInputs.every((item) => template.includes(item)), projectInputs.join(', ')),
+  check('AEP05', 'packet limits default project writes to .gse artifacts', template.includes('.gse/project-profile.md') && template.includes('.gse/evidence/YYYY-MM-DD.md') && template.includes('Source code, lockfiles, secrets'), 'allowed and forbidden file sections'),
+  check('AEP06', 'packet prevents fake acceptance', antiOverclaim.every((item) => template.includes(item)), 'anti-overclaim rules'),
+  check('AEP07', 'forward-test reference supports fresh-session acceptance boundary', forwardTest.includes('Use `accepted by: fresh-session` only when a separate agent/session actually ran the path.'), 'references/forward-test.md'),
+  check('AEP08', 'adoption recipes support target adoption evidence template', recipes.includes('assets/templates/target-adoption-evidence.md'), 'references/adoption-recipes.md'),
+  check('AEP09', 'consolidated validator includes this audit', validate.includes('audit-acceptance-execution-packet.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { acceptanceExecutionPacket: failed === 0 ? 'verified' : 'failed' },
+  acceptedBy: 'not accepted; this audit verifies packet readiness only',
+  limits: [
+    'This audit verifies acceptance packet readiness only.',
+    'It does not create a separate session, write to a target project, or record owner acceptance.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Acceptance Execution Packet Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Acceptance execution packet: ' + data.workflows.acceptanceExecutionPacket)
+  lines.push('- Accepted by: ' + data.acceptedBy)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-adoption-recipes.mjs

@@ -1,99 +1,99 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const recipes = read('references/adoption-recipes.md')
-const skill = read('SKILL.md')
-const bootstrap = read('references/project-bootstrap.md')
-const packaging = read('references/packaging.md')
-const examples = read('examples/README.md')
-
-const recipeNames = ['Fresh Project Install', 'Existing Repo Adoption', 'Update Existing GSE', 'Host Adapter Adoption', 'CLI Or Package Project Adoption']
-const recordFields = ['Adoption recipe:', 'Project path:', 'Mode or host:', 'Project rules read:', 'Commands run:', 'Files created or changed:', 'Preserved project-specific rules:', 'Host/tool statuses:', 'Validation evidence:', 'Evidence status:', 'Residual risk:', 'Next action:']
-const commands = ['init-project.mjs', 'discover-project-profile.mjs', 'generate-command-adapter.mjs', 'audit-command-adapters.mjs', 'generate-host-adapter.mjs', 'audit-project.mjs', 'audit-adoption.mjs', 'audit-host-adapters.mjs', 'audit-fixtures.mjs', 'validate-gse.mjs']
-const statusTerms = ['result', 'verified', 'accepted', 'not ready', 'unknown', 'documented', 'unavailable']
-
-const checks = [
-  check('AR01', 'adoption recipes reference exists', exists('references/adoption-recipes.md'), 'references/adoption-recipes.md'),
-  check('AR02', 'SKILL routes adoption recipes', skill.includes('references/adoption-recipes.md'), 'SKILL.md Reference Routing'),
-  check('AR03', 'bootstrap, packaging, and examples route to recipes', bootstrap.includes('references/adoption-recipes.md') && packaging.includes('references/adoption-recipes.md') && examples.includes('references/adoption-recipes.md'), 'project-bootstrap.md, packaging.md, examples/README.md'),
-  check('AR04', 'core adoption recipes are present', recipeNames.every((item) => recipes.includes(item)), recipeNames.join(', ')),
-  check('AR05', 'fresh install includes mode selection and init command', recipes.includes('--mode <mode>') && recipes.includes('node <gse-skill>/scripts/init-project.mjs --target <project-root> --mode <mode>'), 'Fresh Project Install'),
-  check('AR06', 'existing repo adoption protects pre-existing project files', recipes.includes('Do not overwrite') && recipes.includes('--force') && recipes.includes('documented`, not `verified`'), 'Existing Repo Adoption'),
-  check('AR07', 'update recipe preserves local decisions and validates skill package', recipes.includes('Preserve local project decisions') && recipes.includes('node <gse-skill>/scripts/validate-gse.mjs --root <gse-skill>'), 'Update Existing GSE'),
-  check('AR08', 'host adapter recipe uses current command adapter path and keeps .gse source of truth', recipes.includes('Keep `.gse/` as the source of truth') && recipes.includes('generate-command-adapter.mjs') && recipes.includes('claude|codex|hermes|workbuddy|copilot|gemini|generic|all') && recipes.includes('legacy fixture helper') && recipes.includes('verified`, `documented`, `unknown`, or `unavailable`'), 'Host Adapter Adoption'),
-  check('AR09', 'adoption record has required fields', recordFields.every((item) => recipes.includes(item)), recordFields.join(', ')),
-  check('AR10', 'verification command list covers adoption scripts', commands.every((item) => recipes.includes(item)), commands.join(', ')),
-  check('AR11', 'status vocabulary avoids overclaiming', statusTerms.every((item) => recipes.includes(item)) && recipes.includes('do not certify arbitrary production repositories'), 'status and certification boundary'),
-  check('AR12', 'recipes are host-neutral and require project evidence', recipes.includes('host-neutral') && recipes.includes('project-specific evidence') && recipes.includes('unknown` until checked'), 'host-neutral project evidence rules'),
-  check('AR13', 'CLI/package adoption keeps release and install claims evidence-bound', recipes.includes('CLI Or Package Project Adoption') && recipes.includes('npm pack --dry-run') && recipes.includes('registry access') && recipes.includes('global install') && recipes.includes('shell completion require project-specific evidence'), 'CLI/package adoption recipe'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { adoptionRecipes: failed === 0 ? 'verified' : 'failed' },
-  limits: [
-    'Adoption recipe audit verifies reusable recipe coverage and routing; it does not install GSE into arbitrary production repositories.',
-    'Real adoption still needs project-specific inspection, focused smokes, and host/tool evidence.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Adoption Recipe Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Adoption recipes: ' + data.workflows.adoptionRecipes)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const recipes = read('references/adoption-recipes.md')
+const skill = read('SKILL.md')
+const bootstrap = read('references/project-bootstrap.md')
+const packaging = read('references/packaging.md')
+const examples = read('examples/README.md')
+
+const recipeNames = ['Fresh Project Install', 'Existing Repo Adoption', 'Update Existing GSE', 'Host Adapter Adoption', 'CLI Or Package Project Adoption']
+const recordFields = ['Adoption recipe:', 'Project path:', 'Mode or host:', 'Project rules read:', 'Commands run:', 'Files created or changed:', 'Preserved project-specific rules:', 'Host/tool statuses:', 'Validation evidence:', 'Evidence status:', 'Residual risk:', 'Next action:']
+const commands = ['init-project.mjs', 'discover-project-profile.mjs', 'generate-command-adapter.mjs', 'audit-command-adapters.mjs', 'generate-host-adapter.mjs', 'audit-project.mjs', 'audit-adoption.mjs', 'audit-host-adapters.mjs', 'audit-fixtures.mjs', 'validate-gse.mjs']
+const statusTerms = ['result', 'verified', 'accepted', 'not ready', 'unknown', 'documented', 'unavailable']
+
+const checks = [
+  check('AR01', 'adoption recipes reference exists', exists('references/adoption-recipes.md'), 'references/adoption-recipes.md'),
+  check('AR02', 'SKILL routes adoption recipes', skill.includes('references/adoption-recipes.md'), 'SKILL.md Reference Routing'),
+  check('AR03', 'bootstrap, packaging, and examples route to recipes', bootstrap.includes('references/adoption-recipes.md') && packaging.includes('references/adoption-recipes.md') && examples.includes('references/adoption-recipes.md'), 'project-bootstrap.md, packaging.md, examples/README.md'),
+  check('AR04', 'core adoption recipes are present', recipeNames.every((item) => recipes.includes(item)), recipeNames.join(', ')),
+  check('AR05', 'fresh install includes mode selection and init command', recipes.includes('--mode <mode>') && recipes.includes('node <gse-skill>/scripts/init-project.mjs --target <project-root> --mode <mode>'), 'Fresh Project Install'),
+  check('AR06', 'existing repo adoption protects pre-existing project files', recipes.includes('Do not overwrite') && recipes.includes('--force') && recipes.includes('documented`, not `verified`'), 'Existing Repo Adoption'),
+  check('AR07', 'update recipe preserves local decisions and validates skill package', recipes.includes('Preserve local project decisions') && recipes.includes('node <gse-skill>/scripts/validate-gse.mjs --root <gse-skill>'), 'Update Existing GSE'),
+  check('AR08', 'host adapter recipe uses current command adapter path and keeps .gse source of truth', recipes.includes('Keep `.gse/` as the source of truth') && recipes.includes('generate-command-adapter.mjs') && recipes.includes('claude|codex|hermes|workbuddy|copilot|gemini|generic|all') && recipes.includes('legacy fixture helper') && recipes.includes('verified`, `documented`, `unknown`, or `unavailable`'), 'Host Adapter Adoption'),
+  check('AR09', 'adoption record has required fields', recordFields.every((item) => recipes.includes(item)), recordFields.join(', ')),
+  check('AR10', 'verification command list covers adoption scripts', commands.every((item) => recipes.includes(item)), commands.join(', ')),
+  check('AR11', 'status vocabulary avoids overclaiming', statusTerms.every((item) => recipes.includes(item)) && recipes.includes('do not certify arbitrary production repositories'), 'status and certification boundary'),
+  check('AR12', 'recipes are host-neutral and require project evidence', recipes.includes('host-neutral') && recipes.includes('project-specific evidence') && recipes.includes('unknown` until checked'), 'host-neutral project evidence rules'),
+  check('AR13', 'CLI/package adoption keeps release and install claims evidence-bound', recipes.includes('CLI Or Package Project Adoption') && recipes.includes('npm pack --dry-run') && recipes.includes('registry access') && recipes.includes('global install') && recipes.includes('shell completion require project-specific evidence'), 'CLI/package adoption recipe'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { adoptionRecipes: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'Adoption recipe audit verifies reusable recipe coverage and routing; it does not install GSE into arbitrary production repositories.',
+    'Real adoption still needs project-specific inspection, focused smokes, and host/tool evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Adoption Recipe Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Adoption recipes: ' + data.workflows.adoptionRecipes)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-change-lifecycle.mjs

@@ -1,77 +1,77 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-const target = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-change-lifecycle-'))
-const initScript = path.join(root, 'scripts', 'init-change.mjs')
-const closeScript = path.join(root, 'scripts', 'close-change.mjs')
-
-function run(script, commandArgs) {
-  return spawnSync(process.execPath, [script, ...commandArgs], { cwd: root, encoding: 'utf8', windowsHide: true })
-}
-
-function parseJson(text) {
-  try { return JSON.parse(text) } catch { return null }
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-fs.mkdirSync(path.join(target, '.gse', 'evidence'), { recursive: true })
-fs.writeFileSync(path.join(target, '.gse', 'goal-map.md'), '# Goal Map\n', 'utf8')
-fs.writeFileSync(path.join(target, '.gse', 'quality-gates.md'), '# Quality Gates\n', 'utf8')
-fs.writeFileSync(path.join(target, '.gse', 'evidence', 'index.jsonl'), '', 'utf8')
-
-const init = run(initScript, ['--target', target, '--change-id', 'Archive Me', '--level', 'standard', '--json'])
-const dryRun = run(closeScript, ['--target', target, '--change-id', 'archive-me', '--status', 'verified', '--date', '2026-07-06', '--dry-run', '--json'])
-const dryRunPreservedSource = fs.existsSync(path.join(target, '.gse', 'changes', 'archive-me'))
-const close = run(closeScript, ['--target', target, '--change-id', 'archive-me', '--status', 'verified', '--date', '2026-07-06', '--json'])
-const closeJson = parseJson(close.stdout)
-const archiveDir = path.join(target, '.gse', 'archive', '2026-07-06-archive-me')
-const sourceDir = path.join(target, '.gse', 'changes', 'archive-me')
-const indexText = fs.readFileSync(path.join(target, '.gse', 'evidence', 'index.jsonl'), 'utf8')
-const archiveRecord = fs.existsSync(path.join(archiveDir, 'archive-record.md')) ? fs.readFileSync(path.join(archiveDir, 'archive-record.md'), 'utf8') : ''
-
-const checks = [
-  check('CHGLC01', 'close-change script exists', fs.existsSync(closeScript), 'scripts/close-change.mjs'),
-  check('CHGLC02', 'init-change creates closeable change pack', init.status === 0, 'scripts/init-change.mjs fixture run'),
-  check('CHGLC03', 'dry-run reports pass without moving source folder', dryRun.status === 0 && dryRunPreservedSource, 'close-change --dry-run'),
-  check('CHGLC04', 'close moves change folder into archive', close.status === 0 && fs.existsSync(archiveDir) && !fs.existsSync(sourceDir), '.gse/archive/YYYY-MM-DD-change-id'),
-  check('CHGLC05', 'archive record captures closure metadata', archiveRecord.includes('Status: verified') && archiveRecord.includes('Source: .gse/changes/archive-me'), 'archive-record.md'),
-  check('CHGLC06', 'evidence index receives schema-complete change-archive record', indexText.includes('"recordType":"change-archive"') && indexText.includes('"changeId":"archive-me"') && indexText.includes('"commands":') && indexText.includes('"nextAction":'), '.gse/evidence/index.jsonl'),
-  check('CHGLC07', 'close output preserves evidence status and archive path', closeJson?.evidenceStatus === 'verified' && closeJson?.indexRecord?.archivePath === '.gse/archive/2026-07-06-archive-me', 'close-change JSON'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { changeArchiveLifecycle: failed === 0 ? 'verified' : 'failed' },
-  limits: [
-    'This audit verifies local change archive mechanics in a fixture.',
-    'It does not certify the product correctness of a real target-project change.',
-  ],
-  checks,
-}
-
-fs.rmSync(target, { recursive: true, force: true })
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(JSON.stringify(report, null, 2))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const target = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-change-lifecycle-'))
+const initScript = path.join(root, 'scripts', 'init-change.mjs')
+const closeScript = path.join(root, 'scripts', 'close-change.mjs')
+
+function run(script, commandArgs) {
+  return spawnSync(process.execPath, [script, ...commandArgs], { cwd: root, encoding: 'utf8', windowsHide: true })
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+fs.mkdirSync(path.join(target, '.gse', 'evidence'), { recursive: true })
+fs.writeFileSync(path.join(target, '.gse', 'goal-map.md'), '# Goal Map\n', 'utf8')
+fs.writeFileSync(path.join(target, '.gse', 'quality-gates.md'), '# Quality Gates\n', 'utf8')
+fs.writeFileSync(path.join(target, '.gse', 'evidence', 'index.jsonl'), '', 'utf8')
+
+const init = run(initScript, ['--target', target, '--change-id', 'Archive Me', '--level', 'standard', '--json'])
+const dryRun = run(closeScript, ['--target', target, '--change-id', 'archive-me', '--status', 'verified', '--date', '2026-07-06', '--dry-run', '--json'])
+const dryRunPreservedSource = fs.existsSync(path.join(target, '.gse', 'changes', 'archive-me'))
+const close = run(closeScript, ['--target', target, '--change-id', 'archive-me', '--status', 'verified', '--date', '2026-07-06', '--json'])
+const closeJson = parseJson(close.stdout)
+const archiveDir = path.join(target, '.gse', 'archive', '2026-07-06-archive-me')
+const sourceDir = path.join(target, '.gse', 'changes', 'archive-me')
+const indexText = fs.readFileSync(path.join(target, '.gse', 'evidence', 'index.jsonl'), 'utf8')
+const archiveRecord = fs.existsSync(path.join(archiveDir, 'archive-record.md')) ? fs.readFileSync(path.join(archiveDir, 'archive-record.md'), 'utf8') : ''
+
+const checks = [
+  check('CHGLC01', 'close-change script exists', fs.existsSync(closeScript), 'scripts/close-change.mjs'),
+  check('CHGLC02', 'init-change creates closeable change pack', init.status === 0, 'scripts/init-change.mjs fixture run'),
+  check('CHGLC03', 'dry-run reports pass without moving source folder', dryRun.status === 0 && dryRunPreservedSource, 'close-change --dry-run'),
+  check('CHGLC04', 'close moves change folder into archive', close.status === 0 && fs.existsSync(archiveDir) && !fs.existsSync(sourceDir), '.gse/archive/YYYY-MM-DD-change-id'),
+  check('CHGLC05', 'archive record captures closure metadata', archiveRecord.includes('Status: verified') && archiveRecord.includes('Source: .gse/changes/archive-me'), 'archive-record.md'),
+  check('CHGLC06', 'evidence index receives schema-complete change-archive record', indexText.includes('"recordType":"change-archive"') && indexText.includes('"changeId":"archive-me"') && indexText.includes('"commands":') && indexText.includes('"nextAction":'), '.gse/evidence/index.jsonl'),
+  check('CHGLC07', 'close output preserves evidence status and archive path', closeJson?.evidenceStatus === 'verified' && closeJson?.indexRecord?.archivePath === '.gse/archive/2026-07-06-archive-me', 'close-change JSON'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { changeArchiveLifecycle: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies local change archive mechanics in a fixture.',
+    'It does not certify the product correctness of a real target-project change.',
+  ],
+  checks,
+}
+
+fs.rmSync(target, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)