@t275005746/gse 0.1.0 → 0.1.1

package/scripts/audit-close-gate.mjs

@@ -1,323 +1,323 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const jsonOnly = args.includes('--json')
-const selfTest = args.includes('--self-test') || !args.includes('--target')
-const targetArg = readArg('--target')
-
-function readText(filePath) {
-  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
-}
-
-function readJson(filePath) {
-  if (!fs.existsSync(filePath)) return { exists: false, ok: false, data: null, error: 'missing' }
-  try {
-    return { exists: true, ok: true, data: JSON.parse(readText(filePath)), error: '' }
-  } catch (error) {
-    return { exists: true, ok: false, data: null, error: error.message }
-  }
-}
-
-function readJsonl(filePath) {
-  if (!fs.existsSync(filePath)) return { exists: false, ok: false, records: [], error: 'missing' }
-  const lines = readText(filePath)
-    .split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter(Boolean)
-  const records = []
-  for (const [index, line] of lines.entries()) {
-    try {
-      records.push(JSON.parse(line))
-    } catch (error) {
-      return { exists: true, ok: false, records, error: `line ${index + 1}: ${error.message}` }
-    }
-  }
-  return { exists: true, ok: true, records, error: '' }
-}
-
-function exists(target, relativePath) {
-  return fs.existsSync(path.join(target, relativePath))
-}
-
-function runGit(target, commandArgs) {
-  const result = spawnSync('git', commandArgs, {
-    cwd: target,
-    encoding: 'utf8',
-    windowsHide: true,
-  })
-  return {
-    status: result.status ?? 1,
-    stdout: (result.stdout ?? '').trim(),
-    stderr: (result.stderr ?? '').trim(),
-  }
-}
-
-function statusFrom(ok, warn = false) {
-  if (ok) return 'passed'
-  if (warn) return 'warning'
-  return 'failed'
-}
-
-function check(id, label, status, evidence, recommendation = '') {
-  return { id, label, status, evidence, recommendation }
-}
-
-function createFixture() {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-close-gate-'))
-  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
-  fs.writeFileSync(path.join(dir, '.gse', 'README.md'), '# GSE\n', 'utf8')
-  fs.writeFileSync(path.join(dir, '.gse', 'project-profile.md'), '# Project Profile\n', 'utf8')
-  fs.writeFileSync(path.join(dir, '.gse', 'goal-map.md'), '# Goal Map\n\nNext action: archive slice.\n', 'utf8')
-  fs.writeFileSync(path.join(dir, '.gse', 'quality-gates.md'), '# Quality Gates\n\n## Universal\n\n- Evidence required.\n', 'utf8')
-  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-06.md'), '# Evidence\n\nEvidence status: verified.\n', 'utf8')
-  fs.writeFileSync(
-    path.join(dir, '.gse', 'state.json'),
-    JSON.stringify(
-      {
-        schemaVersion: 1,
-        projectName: 'fixture-product',
-        mode: 'standard',
-        canonicalPlan: '',
-        phase: 'verify',
-        currentSlice: {
-          id: 'fixture-close',
-          outcome: 'Fixture close gate.',
-          status: 'verified',
-          nextAction: 'Archive slice.',
-        },
-        toolStatuses: {
-          browser: 'unknown',
-          lsp: 'unknown',
-          mcp: 'unknown',
-          subagents: 'unknown',
-          ci: 'unknown',
-        },
-        lastEvidence: '.gse/evidence/2026-07-06.md',
-        residualRisks: ['Fixture residual risk.'],
-      },
-      null,
-      2,
-    ) + '\n',
-    'utf8',
-  )
-  fs.writeFileSync(
-    path.join(dir, '.gse', 'evidence', 'index.jsonl'),
-    JSON.stringify({
-      date: '2026-07-06',
-      recordType: 'slice',
-      status: 'verified',
-      summary: 'Fixture close gate evidence.',
-      evidenceFile: '.gse/evidence/2026-07-06.md',
-      commands: ['node scripts/audit-close-gate.mjs --self-test'],
-      nextAction: 'Archive slice.',
-    }) + '\n',
-    'utf8',
-  )
-  runGit(dir, ['init'])
-  runGit(dir, ['config', 'user.email', 'gse-fixture@example.local'])
-  runGit(dir, ['config', 'user.name', 'GSE Fixture'])
-  runGit(dir, ['add', '.'])
-  runGit(dir, ['commit', '-m', 'fixture'])
-  return dir
-}
-
-function auditCloseGate(target) {
-  const resolvedTarget = path.resolve(target)
-  const gseDir = path.join(resolvedTarget, '.gse')
-  const state = readJson(path.join(gseDir, 'state.json'))
-  const evidenceIndex = readJsonl(path.join(gseDir, 'evidence', 'index.jsonl'))
-  const checks = []
-
-  checks.push(
-    check(
-      'CG01',
-      '.gse directory exists',
-      statusFrom(exists(resolvedTarget, '.gse')),
-      exists(resolvedTarget, '.gse') ? '.gse exists' : '.gse missing',
-      exists(resolvedTarget, '.gse') ? '' : 'Initialize or adopt GSE before closing a slice.',
-    ),
-  )
-
-  const stateValid =
-    state.ok &&
-    state.data?.schemaVersion === 1 &&
-    typeof state.data?.phase === 'string' &&
-    typeof state.data?.currentSlice?.status === 'string' &&
-    typeof state.data?.currentSlice?.nextAction === 'string'
-  checks.push(
-    check(
-      'CG02',
-      'state.json is valid',
-      statusFrom(stateValid),
-      state.exists ? state.ok ? `phase:${state.data.phase}, status:${state.data.currentSlice?.status}` : 'invalid ' + state.error : 'missing',
-      stateValid ? '' : 'Repair .gse/state.json before closing the slice.',
-    ),
-  )
-
-  const indexValid =
-    evidenceIndex.ok &&
-    evidenceIndex.records.length > 0 &&
-    evidenceIndex.records.every(
-      (record) =>
-        typeof record.date === 'string' &&
-        typeof record.recordType === 'string' &&
-        typeof record.status === 'string' &&
-        typeof record.summary === 'string' &&
-        typeof record.evidenceFile === 'string' &&
-        Array.isArray(record.commands) &&
-        typeof record.nextAction === 'string',
-    )
-  checks.push(
-    check(
-      'CG03',
-      'evidence index is valid',
-      statusFrom(indexValid),
-      evidenceIndex.exists ? evidenceIndex.ok ? `${evidenceIndex.records.length} record(s)` : 'invalid ' + evidenceIndex.error : 'missing',
-      indexValid ? '' : 'Record at least one evidence index entry before closing.',
-    ),
-  )
-
-  const closeableState = ['verified', 'accepted'].includes(state.data?.currentSlice?.status)
-  checks.push(
-    check(
-      'CG04',
-      'current slice status is closeable',
-      statusFrom(closeableState),
-      `currentSlice.status:${state.data?.currentSlice?.status ?? 'unknown'}`,
-      closeableState ? '' : 'Set currentSlice.status to verified or accepted only after focused evidence exists.',
-    ),
-  )
-
-  const closeableEvidenceRecords = evidenceIndex.records.filter((record) => ['verified', 'accepted'].includes(record.status))
-  const evidenceFilesExist =
-    closeableEvidenceRecords.length > 0 &&
-    closeableEvidenceRecords.every((record) => exists(resolvedTarget, record.evidenceFile))
-  checks.push(
-    check(
-      'CG05',
-      'verified or accepted evidence record exists',
-      statusFrom(evidenceFilesExist),
-      closeableEvidenceRecords.length
-        ? closeableEvidenceRecords.map((record) => `${record.status}:${record.evidenceFile}:${exists(resolvedTarget, record.evidenceFile) ? 'exists' : 'missing'}`).join('; ')
-        : 'no verified/accepted evidence index record',
-      evidenceFilesExist ? '' : 'Add verified evidence and ensure the referenced evidence file exists.',
-    ),
-  )
-
-  const requiredDocs = ['.gse/README.md', '.gse/project-profile.md', '.gse/goal-map.md', '.gse/quality-gates.md']
-  const missingDocs = requiredDocs.filter((relativePath) => !exists(resolvedTarget, relativePath))
-  checks.push(
-    check(
-      'CG06',
-      'required workflow docs exist',
-      statusFrom(missingDocs.length === 0),
-      missingDocs.length ? 'missing: ' + missingDocs.join(', ') : `${requiredDocs.length}/${requiredDocs.length} present`,
-      missingDocs.length ? 'Restore required workflow docs before closing.' : '',
-    ),
-  )
-
-  const residualRisksOk = Array.isArray(state.data?.residualRisks)
-  checks.push(
-    check(
-      'CG07',
-      'residual risks are explicit',
-      statusFrom(residualRisksOk),
-      residualRisksOk ? `${state.data.residualRisks.length} residual risk(s)` : 'missing residualRisks array',
-      residualRisksOk ? '' : 'Use an empty array if there is no known residual risk.',
-    ),
-  )
-
-  const gitRoot = runGit(resolvedTarget, ['rev-parse', '--show-toplevel'])
-  const isGitRepo = gitRoot.status === 0
-  const gseStatus = isGitRepo ? runGit(resolvedTarget, ['status', '--short', '.gse']) : { status: 1, stdout: '', stderr: 'not a git repository' }
-  checks.push(
-    check(
-      'CG08',
-      '.gse git state is known',
-      isGitRepo ? (gseStatus.stdout ? 'warning' : 'passed') : 'warning',
-      isGitRepo ? gseStatus.stdout || 'clean' : 'not a git repository',
-      isGitRepo && gseStatus.stdout ? 'Review and intentionally stage/commit or document project-local GSE changes.' : '',
-    ),
-  )
-
-  const failed = checks.filter((item) => item.status === 'failed').length
-  const warnings = checks.filter((item) => item.status === 'warning').length
-  const passed = checks.filter((item) => item.status === 'passed').length
-
-  return {
-    target: resolvedTarget,
-    generatedAt: new Date().toISOString(),
-    summary: {
-      status: failed > 0 ? 'not-ready' : warnings > 0 ? 'ready-with-warnings' : 'ready',
-      passed,
-      warnings,
-      failed,
-      total: checks.length,
-    },
-    workflows: {
-      closeGate: failed > 0 ? 'not-ready' : warnings > 0 ? 'ready-with-warnings' : 'ready',
-    },
-    state: {
-      exists: state.exists,
-      valid: stateValid,
-      phase: state.data?.phase ?? null,
-      currentSliceStatus: state.data?.currentSlice?.status ?? null,
-      nextAction: state.data?.currentSlice?.nextAction ?? null,
-    },
-    evidenceIndex: {
-      exists: evidenceIndex.exists,
-      valid: indexValid,
-      records: evidenceIndex.records.length,
-      closeableRecords: closeableEvidenceRecords.length,
-    },
-    checks,
-    limits: [
-      'Close gate is diagnostic. It reports ready/not-ready and does not modify files.',
-      'A ready close gate does not replace user, reviewer, release, or owner acceptance when the project requires it.',
-      'Project tests, browser smokes, CI, MCP, LSP, subagents, and release checks must still be run according to project quality gates.',
-    ],
-  }
-}
-
-function renderMarkdown(report) {
-  const lines = []
-  lines.push('# GSE Close Gate')
-  lines.push('')
-  lines.push('Generated: ' + report.generatedAt)
-  lines.push('Target: ' + report.target)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + report.summary.status)
-  lines.push('- Checks: ' + report.summary.passed + ' passed, ' + report.summary.warnings + ' warnings, ' + report.summary.failed + ' failed, ' + report.summary.total + ' total')
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of report.checks) {
-    const marker = item.status === 'passed' ? '[x]' : item.status === 'warning' ? '[!]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-    if (item.recommendation) lines.push('  - Recommendation: ' + item.recommendation)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of report.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-const target = selfTest ? createFixture() : targetArg
-const report = auditCloseGate(target)
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const jsonOnly = args.includes('--json')
+const selfTest = args.includes('--self-test') || !args.includes('--target')
+const targetArg = readArg('--target')
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function readJson(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, data: null, error: 'missing' }
+  try {
+    return { exists: true, ok: true, data: JSON.parse(readText(filePath)), error: '' }
+  } catch (error) {
+    return { exists: true, ok: false, data: null, error: error.message }
+  }
+}
+
+function readJsonl(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, records: [], error: 'missing' }
+  const lines = readText(filePath)
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+  const records = []
+  for (const [index, line] of lines.entries()) {
+    try {
+      records.push(JSON.parse(line))
+    } catch (error) {
+      return { exists: true, ok: false, records, error: `line ${index + 1}: ${error.message}` }
+    }
+  }
+  return { exists: true, ok: true, records, error: '' }
+}
+
+function exists(target, relativePath) {
+  return fs.existsSync(path.join(target, relativePath))
+}
+
+function runGit(target, commandArgs) {
+  const result = spawnSync('git', commandArgs, {
+    cwd: target,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function statusFrom(ok, warn = false) {
+  if (ok) return 'passed'
+  if (warn) return 'warning'
+  return 'failed'
+}
+
+function check(id, label, status, evidence, recommendation = '') {
+  return { id, label, status, evidence, recommendation }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-close-gate-'))
+  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+  fs.writeFileSync(path.join(dir, '.gse', 'README.md'), '# GSE\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'project-profile.md'), '# Project Profile\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'goal-map.md'), '# Goal Map\n\nNext action: archive slice.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'quality-gates.md'), '# Quality Gates\n\n## Universal\n\n- Evidence required.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-06.md'), '# Evidence\n\nEvidence status: verified.\n', 'utf8')
+  fs.writeFileSync(
+    path.join(dir, '.gse', 'state.json'),
+    JSON.stringify(
+      {
+        schemaVersion: 1,
+        projectName: 'fixture-product',
+        mode: 'standard',
+        canonicalPlan: '',
+        phase: 'verify',
+        currentSlice: {
+          id: 'fixture-close',
+          outcome: 'Fixture close gate.',
+          status: 'verified',
+          nextAction: 'Archive slice.',
+        },
+        toolStatuses: {
+          browser: 'unknown',
+          lsp: 'unknown',
+          mcp: 'unknown',
+          subagents: 'unknown',
+          ci: 'unknown',
+        },
+        lastEvidence: '.gse/evidence/2026-07-06.md',
+        residualRisks: ['Fixture residual risk.'],
+      },
+      null,
+      2,
+    ) + '\n',
+    'utf8',
+  )
+  fs.writeFileSync(
+    path.join(dir, '.gse', 'evidence', 'index.jsonl'),
+    JSON.stringify({
+      date: '2026-07-06',
+      recordType: 'slice',
+      status: 'verified',
+      summary: 'Fixture close gate evidence.',
+      evidenceFile: '.gse/evidence/2026-07-06.md',
+      commands: ['node scripts/audit-close-gate.mjs --self-test'],
+      nextAction: 'Archive slice.',
+    }) + '\n',
+    'utf8',
+  )
+  runGit(dir, ['init'])
+  runGit(dir, ['config', 'user.email', 'gse-fixture@example.local'])
+  runGit(dir, ['config', 'user.name', 'GSE Fixture'])
+  runGit(dir, ['add', '.'])
+  runGit(dir, ['commit', '-m', 'fixture'])
+  return dir
+}
+
+function auditCloseGate(target) {
+  const resolvedTarget = path.resolve(target)
+  const gseDir = path.join(resolvedTarget, '.gse')
+  const state = readJson(path.join(gseDir, 'state.json'))
+  const evidenceIndex = readJsonl(path.join(gseDir, 'evidence', 'index.jsonl'))
+  const checks = []
+
+  checks.push(
+    check(
+      'CG01',
+      '.gse directory exists',
+      statusFrom(exists(resolvedTarget, '.gse')),
+      exists(resolvedTarget, '.gse') ? '.gse exists' : '.gse missing',
+      exists(resolvedTarget, '.gse') ? '' : 'Initialize or adopt GSE before closing a slice.',
+    ),
+  )
+
+  const stateValid =
+    state.ok &&
+    state.data?.schemaVersion === 1 &&
+    typeof state.data?.phase === 'string' &&
+    typeof state.data?.currentSlice?.status === 'string' &&
+    typeof state.data?.currentSlice?.nextAction === 'string'
+  checks.push(
+    check(
+      'CG02',
+      'state.json is valid',
+      statusFrom(stateValid),
+      state.exists ? state.ok ? `phase:${state.data.phase}, status:${state.data.currentSlice?.status}` : 'invalid ' + state.error : 'missing',
+      stateValid ? '' : 'Repair .gse/state.json before closing the slice.',
+    ),
+  )
+
+  const indexValid =
+    evidenceIndex.ok &&
+    evidenceIndex.records.length > 0 &&
+    evidenceIndex.records.every(
+      (record) =>
+        typeof record.date === 'string' &&
+        typeof record.recordType === 'string' &&
+        typeof record.status === 'string' &&
+        typeof record.summary === 'string' &&
+        typeof record.evidenceFile === 'string' &&
+        Array.isArray(record.commands) &&
+        typeof record.nextAction === 'string',
+    )
+  checks.push(
+    check(
+      'CG03',
+      'evidence index is valid',
+      statusFrom(indexValid),
+      evidenceIndex.exists ? evidenceIndex.ok ? `${evidenceIndex.records.length} record(s)` : 'invalid ' + evidenceIndex.error : 'missing',
+      indexValid ? '' : 'Record at least one evidence index entry before closing.',
+    ),
+  )
+
+  const closeableState = ['verified', 'accepted'].includes(state.data?.currentSlice?.status)
+  checks.push(
+    check(
+      'CG04',
+      'current slice status is closeable',
+      statusFrom(closeableState),
+      `currentSlice.status:${state.data?.currentSlice?.status ?? 'unknown'}`,
+      closeableState ? '' : 'Set currentSlice.status to verified or accepted only after focused evidence exists.',
+    ),
+  )
+
+  const closeableEvidenceRecords = evidenceIndex.records.filter((record) => ['verified', 'accepted'].includes(record.status))
+  const evidenceFilesExist =
+    closeableEvidenceRecords.length > 0 &&
+    closeableEvidenceRecords.every((record) => exists(resolvedTarget, record.evidenceFile))
+  checks.push(
+    check(
+      'CG05',
+      'verified or accepted evidence record exists',
+      statusFrom(evidenceFilesExist),
+      closeableEvidenceRecords.length
+        ? closeableEvidenceRecords.map((record) => `${record.status}:${record.evidenceFile}:${exists(resolvedTarget, record.evidenceFile) ? 'exists' : 'missing'}`).join('; ')
+        : 'no verified/accepted evidence index record',
+      evidenceFilesExist ? '' : 'Add verified evidence and ensure the referenced evidence file exists.',
+    ),
+  )
+
+  const requiredDocs = ['.gse/README.md', '.gse/project-profile.md', '.gse/goal-map.md', '.gse/quality-gates.md']
+  const missingDocs = requiredDocs.filter((relativePath) => !exists(resolvedTarget, relativePath))
+  checks.push(
+    check(
+      'CG06',
+      'required workflow docs exist',
+      statusFrom(missingDocs.length === 0),
+      missingDocs.length ? 'missing: ' + missingDocs.join(', ') : `${requiredDocs.length}/${requiredDocs.length} present`,
+      missingDocs.length ? 'Restore required workflow docs before closing.' : '',
+    ),
+  )
+
+  const residualRisksOk = Array.isArray(state.data?.residualRisks)
+  checks.push(
+    check(
+      'CG07',
+      'residual risks are explicit',
+      statusFrom(residualRisksOk),
+      residualRisksOk ? `${state.data.residualRisks.length} residual risk(s)` : 'missing residualRisks array',
+      residualRisksOk ? '' : 'Use an empty array if there is no known residual risk.',
+    ),
+  )
+
+  const gitRoot = runGit(resolvedTarget, ['rev-parse', '--show-toplevel'])
+  const isGitRepo = gitRoot.status === 0
+  const gseStatus = isGitRepo ? runGit(resolvedTarget, ['status', '--short', '.gse']) : { status: 1, stdout: '', stderr: 'not a git repository' }
+  checks.push(
+    check(
+      'CG08',
+      '.gse git state is known',
+      isGitRepo ? (gseStatus.stdout ? 'warning' : 'passed') : 'warning',
+      isGitRepo ? gseStatus.stdout || 'clean' : 'not a git repository',
+      isGitRepo && gseStatus.stdout ? 'Review and intentionally stage/commit or document project-local GSE changes.' : '',
+    ),
+  )
+
+  const failed = checks.filter((item) => item.status === 'failed').length
+  const warnings = checks.filter((item) => item.status === 'warning').length
+  const passed = checks.filter((item) => item.status === 'passed').length
+
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: {
+      status: failed > 0 ? 'not-ready' : warnings > 0 ? 'ready-with-warnings' : 'ready',
+      passed,
+      warnings,
+      failed,
+      total: checks.length,
+    },
+    workflows: {
+      closeGate: failed > 0 ? 'not-ready' : warnings > 0 ? 'ready-with-warnings' : 'ready',
+    },
+    state: {
+      exists: state.exists,
+      valid: stateValid,
+      phase: state.data?.phase ?? null,
+      currentSliceStatus: state.data?.currentSlice?.status ?? null,
+      nextAction: state.data?.currentSlice?.nextAction ?? null,
+    },
+    evidenceIndex: {
+      exists: evidenceIndex.exists,
+      valid: indexValid,
+      records: evidenceIndex.records.length,
+      closeableRecords: closeableEvidenceRecords.length,
+    },
+    checks,
+    limits: [
+      'Close gate is diagnostic. It reports ready/not-ready and does not modify files.',
+      'A ready close gate does not replace user, reviewer, release, or owner acceptance when the project requires it.',
+      'Project tests, browser smokes, CI, MCP, LSP, subagents, and release checks must still be run according to project quality gates.',
+    ],
+  }
+}
+
+function renderMarkdown(report) {
+  const lines = []
+  lines.push('# GSE Close Gate')
+  lines.push('')
+  lines.push('Generated: ' + report.generatedAt)
+  lines.push('Target: ' + report.target)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + report.summary.status)
+  lines.push('- Checks: ' + report.summary.passed + ' passed, ' + report.summary.warnings + ' warnings, ' + report.summary.failed + ' failed, ' + report.summary.total + ' total')
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of report.checks) {
+    const marker = item.status === 'passed' ? '[x]' : item.status === 'warning' ? '[!]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+    if (item.recommendation) lines.push('  - Recommendation: ' + item.recommendation)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of report.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+const target = selfTest ? createFixture() : targetArg
+const report = auditCloseGate(target)
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))