@t275005746/gse 0.1.0 → 0.1.1

package/scripts/audit-host-ui-invocation.mjs

@@ -1,132 +1,132 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const recordPath = readArg('--record')
-const jsonOnly = args.includes('--json')
-
-function read(relativePathOrFullPath) {
-  const fullPath = path.isAbsolute(relativePathOrFullPath) ? relativePathOrFullPath : path.join(root, relativePathOrFullPath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function run(script, commandArgs) {
-  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
-    cwd: root,
-    encoding: 'utf8',
-    windowsHide: true,
-  })
-  return {
-    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
-    status: result.status ?? 1,
-    stdout: (result.stdout ?? '').trim(),
-    stderr: (result.stderr ?? '').trim(),
-  }
-}
-
-function parseJson(text) {
-  try { return JSON.parse(text) } catch { return null }
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const target = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-ui-'))
-fs.mkdirSync(target, { recursive: true })
-fs.writeFileSync(path.join(target, 'AGENTS.md'), '# Host UI Fixture\n', 'utf8')
-const initRun = run('init-project.mjs', ['--target', target, '--mode', 'enterprise', '--json'])
-const adapterRun = run('generate-command-adapter.mjs', ['--target', target, '--host', 'all', '--json'])
-const commandRun = run('run-gse-command.mjs', ['--target', target, '--command', '/gse help', '--json'])
-const adapterData = parseJson(adapterRun.stdout)
-const commandData = parseJson(commandRun.stdout)
-const claudeCommand = read(path.join(target, '.claude', 'commands', 'gse.md'))
-const codexPointer = read(path.join(target, '.codex', 'gse-command.md'))
-const record = recordPath ? read(path.resolve(recordPath)) : ''
-const recordHasEvidence =
-  Boolean(record) &&
-  record.includes('## Host') &&
-  record.includes('## Command') &&
-  record.includes('## Result') &&
-  record.includes('## Evidence') &&
-  /Status:\s*(verified|accepted)/i.test(record)
-
-const checks = [
-  check('HUI01', 'host UI invocation record template exists', exists('assets/templates/host-ui-invocation-record.md'), 'assets/templates/host-ui-invocation-record.md'),
-  check('HUI02', 'portable runner can execute command semantics', commandRun.status === 0 && commandData?.route?.route === 'references/commands.md', '/gse help through run-gse-command.mjs'),
-  check('HUI03', 'Claude command adapter is generated at current native path', adapterRun.status === 0 && fs.existsSync(path.join(target, '.claude', 'commands', 'gse.md')) && claudeCommand.includes('Portable execution path'), '.claude/commands/gse.md'),
-  check('HUI04', 'Codex command pointer is generated without native claim', adapterRun.status === 0 && fs.existsSync(path.join(target, '.codex', 'gse-command.md')) && codexPointer.includes('not proof of a native project-level /gse slash-command mechanism'), '.codex/gse-command.md'),
-  check('HUI05', 'adapter generator labels native support honestly', adapterData?.results?.some((item) => item.host === 'claude' && item.nativeSlashCommand === true) && adapterData?.results?.some((item) => item.host === 'codex' && item.nativeSlashCommand === false), 'generate-command-adapter.mjs result metadata'),
-  check('HUI06', 'commands reference requires host runtime evidence', read('references/commands.md').includes('host-specific smoke') && read('references/commands.md').includes('Do not claim native slash-command support unless the current host exposes it and it was verified.'), 'references/commands.md'),
-  check('HUI07', 'optional real host invocation record is valid when supplied', recordPath ? recordHasEvidence : true, recordPath ? recordPath : 'no --record supplied; template/readiness only'),
-  check('HUI08', 'validator includes host UI invocation audit', read('scripts/validate-gse.mjs').includes('audit-host-ui-invocation.mjs'), 'scripts/validate-gse.mjs'),
-]
-
-fs.rmSync(target, { recursive: true, force: true })
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: {
-    hostUiInvocationReadiness: failed === 0 ? 'verified' : 'failed',
-    realHostUiInvocation: recordHasEvidence ? 'verified-by-record' : 'not-verified',
-  },
-  acceptedBy: recordHasEvidence ? 'host invocation record' : 'not accepted; no real host UI invocation record was supplied',
-  limits: [
-    'This audit verifies portable command execution, generated host pointers, and the evidence format for real host UI invocation.',
-    'Without --record, it does not prove a real Codex, Claude Code, Hermes, WorkBuddy, or other UI invoked the command.',
-    'Generated adapters are not runtime proof by themselves.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Host UI Invocation Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Host UI invocation readiness: ' + data.workflows.hostUiInvocationReadiness)
-  lines.push('- Real host UI invocation: ' + data.workflows.realHostUiInvocation)
-  lines.push('- Accepted by: ' + data.acceptedBy)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const recordPath = readArg('--record')
+const jsonOnly = args.includes('--json')
+
+function read(relativePathOrFullPath) {
+  const fullPath = path.isAbsolute(relativePathOrFullPath) ? relativePathOrFullPath : path.join(root, relativePathOrFullPath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const target = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-ui-'))
+fs.mkdirSync(target, { recursive: true })
+fs.writeFileSync(path.join(target, 'AGENTS.md'), '# Host UI Fixture\n', 'utf8')
+const initRun = run('init-project.mjs', ['--target', target, '--mode', 'enterprise', '--json'])
+const adapterRun = run('generate-command-adapter.mjs', ['--target', target, '--host', 'all', '--json'])
+const commandRun = run('run-gse-command.mjs', ['--target', target, '--command', '/gse help', '--json'])
+const adapterData = parseJson(adapterRun.stdout)
+const commandData = parseJson(commandRun.stdout)
+const claudeCommand = read(path.join(target, '.claude', 'commands', 'gse.md'))
+const codexPointer = read(path.join(target, '.codex', 'gse-command.md'))
+const record = recordPath ? read(path.resolve(recordPath)) : ''
+const recordHasEvidence =
+  Boolean(record) &&
+  record.includes('## Host') &&
+  record.includes('## Command') &&
+  record.includes('## Result') &&
+  record.includes('## Evidence') &&
+  /Status:\s*(verified|accepted)/i.test(record)
+
+const checks = [
+  check('HUI01', 'host UI invocation record template exists', exists('assets/templates/host-ui-invocation-record.md'), 'assets/templates/host-ui-invocation-record.md'),
+  check('HUI02', 'portable runner can execute command semantics', commandRun.status === 0 && commandData?.route?.route === 'references/commands.md', '/gse help through run-gse-command.mjs'),
+  check('HUI03', 'Claude command adapter is generated at current native path', adapterRun.status === 0 && fs.existsSync(path.join(target, '.claude', 'commands', 'gse.md')) && claudeCommand.includes('Portable execution path'), '.claude/commands/gse.md'),
+  check('HUI04', 'Codex command pointer is generated without native claim', adapterRun.status === 0 && fs.existsSync(path.join(target, '.codex', 'gse-command.md')) && codexPointer.includes('not proof of a native project-level /gse slash-command mechanism'), '.codex/gse-command.md'),
+  check('HUI05', 'adapter generator labels native support honestly', adapterData?.results?.some((item) => item.host === 'claude' && item.nativeSlashCommand === true) && adapterData?.results?.some((item) => item.host === 'codex' && item.nativeSlashCommand === false), 'generate-command-adapter.mjs result metadata'),
+  check('HUI06', 'commands reference requires host runtime evidence', read('references/commands.md').includes('host-specific smoke') && read('references/commands.md').includes('Do not claim native slash-command support unless the current host exposes it and it was verified.'), 'references/commands.md'),
+  check('HUI07', 'optional real host invocation record is valid when supplied', recordPath ? recordHasEvidence : true, recordPath ? recordPath : 'no --record supplied; template/readiness only'),
+  check('HUI08', 'validator includes host UI invocation audit', read('scripts/validate-gse.mjs').includes('audit-host-ui-invocation.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+fs.rmSync(target, { recursive: true, force: true })
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    hostUiInvocationReadiness: failed === 0 ? 'verified' : 'failed',
+    realHostUiInvocation: recordHasEvidence ? 'verified-by-record' : 'not-verified',
+  },
+  acceptedBy: recordHasEvidence ? 'host invocation record' : 'not accepted; no real host UI invocation record was supplied',
+  limits: [
+    'This audit verifies portable command execution, generated host pointers, and the evidence format for real host UI invocation.',
+    'Without --record, it does not prove a real Codex, Claude Code, Hermes, WorkBuddy, or other UI invoked the command.',
+    'Generated adapters are not runtime proof by themselves.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Host UI Invocation Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Host UI invocation readiness: ' + data.workflows.hostUiInvocationReadiness)
+  lines.push('- Real host UI invocation: ' + data.workflows.realHostUiInvocation)
+  lines.push('- Accepted by: ' + data.acceptedBy)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-marketplace-discovery.mjs

@@ -1,122 +1,122 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function readJson(relativePath) {
-  try {
-    return JSON.parse(read(relativePath))
-  } catch {
-    return null
-  }
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const listingText = read('assets/marketplace/gse-listing.json')
-const listing = readJson('assets/marketplace/gse-listing.json')
-const marketplaceRef = read('references/marketplace-discovery.md')
-const packaging = read('references/packaging.md')
-const openai = read('agents/openai.yaml')
-const validate = read('scripts/validate-gse.mjs')
-
-const keywords = new Set(Array.isArray(listing?.keywords) ? listing.keywords : [])
-const categories = new Set(Array.isArray(listing?.categories) ? listing.categories : [])
-const entrypoints = new Set(Array.isArray(listing?.entrypoints) ? listing.entrypoints : [])
-const verification = Array.isArray(listing?.verification) ? listing.verification : []
-const hostSupport = Array.isArray(listing?.hostSupport) ? listing.hostSupport : []
-const boundaries = Array.isArray(listing?.boundaries) ? listing.boundaries.join('\n') : ''
-const privateLeakPattern = new RegExp(
-  [
-    ['C:', 'Users', 'Admin'].join('[\\\\\\\\/]'),
-    ['D:', 'codex'].join('[\\\\\\\\/]'),
-    ['hermes', 'workspace'].join('[-_]'),
-    ['node', 'banana'].join('[-_]'),
-  ].join('|'),
-  'i',
-)
-const noPrivateOrLocalLeak =
-  !privateLeakPattern.test(listingText) &&
-  !privateLeakPattern.test(marketplaceRef)
-
-const checks = [
-  check('MD01', 'marketplace listing metadata exists and parses', Boolean(listing), 'assets/marketplace/gse-listing.json'),
-  check('MD02', 'listing has searchable identity and summary', listing?.name === 'gse' && listing?.displayName === 'GSE' && typeof listing?.tagline === 'string' && listing.tagline.length > 20 && typeof listing?.summary === 'string' && listing.summary.includes('Goal-Spec-Evidence'), 'name, displayName, tagline, summary'),
-  check('MD03', 'listing uses natural ecosystem keywords', ['agentic engineering', 'spec-driven development', 'SDD', 'AI coding agent workflow', 'evidence gates', 'goal map'].every((item) => keywords.has(item)), 'keywords'),
-  check('MD04', 'listing classifies project category without keyword stuffing block', categories.has('agentic engineering') && categories.has('software development workflow') && marketplaceRef.includes('Do not add isolated search-term blocks'), 'categories and marketplace reference'),
-  check('MD05', 'listing exposes human and machine entrypoints', ['SKILL.md', 'README.md', 'README.zh-CN.md', 'scripts/run-gse-command.mjs', 'scripts/validate-gse.mjs'].every((item) => entrypoints.has(item)), 'entrypoints'),
-  check('MD06', 'listing exposes validation commands', verification.some((item) => item.includes('validate-gse.mjs')) && verification.some((item) => item.includes('audit-marketplace-discovery.mjs')) && verification.some((item) => item.includes('audit-host-ui-invocation.mjs')), 'verification commands'),
-  check('MD07', 'listing separates host support status from proof', hostSupport.some((item) => item.host.includes('Codex') && item.status === 'documented') && hostSupport.some((item) => item.host.includes('Claude') && item.status === 'documented') && boundaries.includes('native host UI invocation require separate evidence'), 'hostSupport and boundaries'),
-  check('MD08', 'release trust and distribution references are linked', listing?.distribution?.packageScript === 'scripts/package-gse.mjs' && listing?.distribution?.trustPolicy === 'references/release-trust.md' && packaging.includes('references/marketplace-discovery.md'), 'distribution metadata and packaging reference'),
-  check('MD09', 'OpenAI host metadata remains present', openai.includes('display_name: "GSE"') && openai.includes('default_prompt'), 'agents/openai.yaml'),
-  check('MD10', 'validator includes marketplace discovery audit', validate.includes('audit-marketplace-discovery.mjs'), 'scripts/validate-gse.mjs'),
-  check('MD11', 'metadata avoids local/private project leakage', noPrivateOrLocalLeak, 'listing and marketplace reference'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { marketplaceDiscovery: failed === 0 ? 'verified' : 'failed' },
-  acceptedBy: 'not accepted; this audit verifies metadata readiness but does not publish to or receive approval from a marketplace',
-  limits: [
-    'This audit verifies local discovery metadata, not marketplace approval.',
-    'It does not prove maintainer identity, public registry publication, ranking, search indexing, or host-native installation.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Marketplace Discovery Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Marketplace discovery: ' + data.workflows.marketplaceDiscovery)
-  lines.push('- Accepted by: ' + data.acceptedBy)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function readJson(relativePath) {
+  try {
+    return JSON.parse(read(relativePath))
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const listingText = read('assets/marketplace/gse-listing.json')
+const listing = readJson('assets/marketplace/gse-listing.json')
+const marketplaceRef = read('references/marketplace-discovery.md')
+const packaging = read('references/packaging.md')
+const openai = read('agents/openai.yaml')
+const validate = read('scripts/validate-gse.mjs')
+
+const keywords = new Set(Array.isArray(listing?.keywords) ? listing.keywords : [])
+const categories = new Set(Array.isArray(listing?.categories) ? listing.categories : [])
+const entrypoints = new Set(Array.isArray(listing?.entrypoints) ? listing.entrypoints : [])
+const verification = Array.isArray(listing?.verification) ? listing.verification : []
+const hostSupport = Array.isArray(listing?.hostSupport) ? listing.hostSupport : []
+const boundaries = Array.isArray(listing?.boundaries) ? listing.boundaries.join('\n') : ''
+const privateLeakPattern = new RegExp(
+  [
+    ['C:', 'Users', 'Admin'].join('[\\\\\\\\/]'),
+    ['D:', 'codex'].join('[\\\\\\\\/]'),
+    ['hermes', 'workspace'].join('[-_]'),
+    ['node', 'banana'].join('[-_]'),
+  ].join('|'),
+  'i',
+)
+const noPrivateOrLocalLeak =
+  !privateLeakPattern.test(listingText) &&
+  !privateLeakPattern.test(marketplaceRef)
+
+const checks = [
+  check('MD01', 'marketplace listing metadata exists and parses', Boolean(listing), 'assets/marketplace/gse-listing.json'),
+  check('MD02', 'listing has searchable identity and summary', listing?.name === 'gse' && listing?.displayName === 'GSE' && typeof listing?.tagline === 'string' && listing.tagline.length > 20 && typeof listing?.summary === 'string' && listing.summary.includes('Goal-Spec-Evidence'), 'name, displayName, tagline, summary'),
+  check('MD03', 'listing uses natural ecosystem keywords', ['agentic engineering', 'spec-driven development', 'SDD', 'AI coding agent workflow', 'evidence gates', 'goal map'].every((item) => keywords.has(item)), 'keywords'),
+  check('MD04', 'listing classifies project category without keyword stuffing block', categories.has('agentic engineering') && categories.has('software development workflow') && marketplaceRef.includes('Do not add isolated search-term blocks'), 'categories and marketplace reference'),
+  check('MD05', 'listing exposes human and machine entrypoints', ['SKILL.md', 'README.md', 'README.zh-CN.md', 'scripts/run-gse-command.mjs', 'scripts/validate-gse.mjs'].every((item) => entrypoints.has(item)), 'entrypoints'),
+  check('MD06', 'listing exposes validation commands', verification.some((item) => item.includes('validate-gse.mjs')) && verification.some((item) => item.includes('audit-marketplace-discovery.mjs')) && verification.some((item) => item.includes('audit-host-ui-invocation.mjs')), 'verification commands'),
+  check('MD07', 'listing separates host support status from proof', hostSupport.some((item) => item.host.includes('Codex') && item.status === 'documented') && hostSupport.some((item) => item.host.includes('Claude') && item.status === 'documented') && boundaries.includes('native host UI invocation require separate evidence'), 'hostSupport and boundaries'),
+  check('MD08', 'release trust and distribution references are linked', listing?.distribution?.packageScript === 'scripts/package-gse.mjs' && listing?.distribution?.trustPolicy === 'references/release-trust.md' && packaging.includes('references/marketplace-discovery.md'), 'distribution metadata and packaging reference'),
+  check('MD09', 'OpenAI host metadata remains present', openai.includes('display_name: "GSE"') && openai.includes('default_prompt'), 'agents/openai.yaml'),
+  check('MD10', 'validator includes marketplace discovery audit', validate.includes('audit-marketplace-discovery.mjs'), 'scripts/validate-gse.mjs'),
+  check('MD11', 'metadata avoids local/private project leakage', noPrivateOrLocalLeak, 'listing and marketplace reference'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { marketplaceDiscovery: failed === 0 ? 'verified' : 'failed' },
+  acceptedBy: 'not accepted; this audit verifies metadata readiness but does not publish to or receive approval from a marketplace',
+  limits: [
+    'This audit verifies local discovery metadata, not marketplace approval.',
+    'It does not prove maintainer identity, public registry publication, ranking, search indexing, or host-native installation.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Marketplace Discovery Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Marketplace discovery: ' + data.workflows.marketplaceDiscovery)
+  lines.push('- Accepted by: ' + data.acceptedBy)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)