@t275005746/gse 0.1.0 → 0.1.1

package/scripts/audit-public-security-contact.mjs

@@ -1,171 +1,171 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function run(command, commandArgs, cwd = root) {
-  const result = spawnSync(command, commandArgs, {
-    cwd,
-    encoding: 'utf8',
-    windowsHide: true,
-  })
-  return {
-    status: result.status ?? 1,
-    stdout: (result.stdout ?? '').trim(),
-    stderr: (result.stderr ?? '').trim(),
-    command: [command, ...commandArgs].join(' '),
-  }
-}
-
-function parseJson(stdout) {
-  try {
-    return JSON.parse(stdout)
-  } catch {
-    return null
-  }
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-function createFixture() {
-  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-public-security-contact-'))
-  fs.mkdirSync(path.join(fixture, '.gse', 'releases'), { recursive: true })
-  fs.writeFileSync(path.join(fixture, 'SECURITY.md'), '# Security Policy\n\nNo public vulnerability disclosure address has been owner-approved yet.\n', 'utf8')
-  return fixture
-}
-
-const recordScript = path.join(root, 'scripts', 'record-public-security-contact.mjs')
-const template = read('assets/templates/public-security-contact-record.md')
-const security = read('SECURITY.md')
-const publicRelease = read('references/public-release.md')
-const finalReadiness = read('references/final-readiness.md')
-const validate = read('scripts/validate-gse.mjs')
-
-const fixture = exists('scripts/record-public-security-contact.mjs') ? createFixture() : null
-const pending = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--contact-status', 'pending', '--dry-run', '--json']) : null
-const acceptedOk = fixture ? run(process.execPath, [
-  recordScript,
-  '--root', fixture,
-  '--contact-status', 'accepted',
-  '--contact-type', 'email',
-  '--contact-value', 'security@example.com',
-  '--evidence-owner', 'fixture-owner',
-  '--evidence-date', '2026-07-06',
-  '--evidence-url', 'https://github.com/example/gse/security/policy',
-  '--is-public', 'true',
-  '--security-policy-updated', 'true',
-  '--evidence-status', 'accepted',
-  '--accepted-by', 'fixture-owner',
-  '--accepted-at', '2026-07-06',
-  '--dry-run',
-  '--json',
-]) : null
-const acceptedMissing = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--contact-status', 'accepted', '--evidence-status', 'pending', '--dry-run', '--json']) : null
-const acceptedPlaceholderWrite = fixture ? run(process.execPath, [
-  recordScript,
-  '--root', fixture,
-  '--contact-status', 'accepted',
-  '--contact-type', 'email',
-  '--contact-value', 'security@example.com',
-  '--evidence-owner', 'fixture-owner',
-  '--evidence-date', '2026-07-06',
-  '--evidence-url', 'https://github.com/example/gse/security/policy',
-  '--is-public', 'true',
-  '--security-policy-updated', 'true',
-  '--evidence-status', 'accepted',
-  '--accepted-by', 'fixture-owner',
-  '--accepted-at', '2026-07-06',
-  '--json',
-]) : null
-
-const pendingData = pending ? parseJson(pending.stdout) : null
-const acceptedOkData = acceptedOk ? parseJson(acceptedOk.stdout) : null
-const acceptedMissingData = acceptedMissing ? parseJson(acceptedMissing.stdout) : null
-const acceptedPlaceholderWriteData = acceptedPlaceholderWrite ? parseJson(acceptedPlaceholderWrite.stdout) : null
-
-const checks = [
-  check('PSC01', 'public security contact record command exists', exists('scripts/record-public-security-contact.mjs'), 'scripts/record-public-security-contact.mjs'),
-  check('PSC02', 'public security contact template exists', exists('assets/templates/public-security-contact-record.md') && template.includes('Contact status') && template.includes('Security policy updated?'), 'assets/templates/public-security-contact-record.md'),
-  check('PSC03', 'pending contact path remains writable without owner proof', pending?.status === 0 && pendingData?.status === 'ready' && pendingData?.contactStatus === 'pending' && pendingData?.evidenceStatus === 'pending', 'record-public-security-contact pending dry-run'),
-  check('PSC04', 'accepted contact path accepts complete owner evidence', acceptedOk?.status === 0 && acceptedOkData?.status === 'ready' && acceptedOkData?.contactStatus === 'accepted' && acceptedOkData?.evidenceStatus === 'accepted', 'record-public-security-contact accepted dry-run'),
-  check('PSC05', 'accepted contact path rejects missing owner evidence', acceptedMissing?.status !== 0 && acceptedMissingData?.status === 'failed' && acceptedMissingData?.errors?.some((item) => item.includes('--contact-value')) && acceptedMissingData?.errors?.some((item) => item.includes('--accepted-by')) && acceptedMissingData?.errors?.some((item) => item.includes('--evidence-status accepted')), 'record-public-security-contact accepted missing-fields dry-run'),
-  check('PSC06', 'accepted contact real write rejects placeholder or example evidence', acceptedPlaceholderWrite?.status !== 0 && acceptedPlaceholderWriteData?.status === 'failed' && acceptedPlaceholderWriteData?.errors?.some((item) => item.includes('not a placeholder')), 'record-public-security-contact accepted placeholder write'),
-  check('PSC07', 'security policy keeps public contact owner-gated', security.includes('Until a public security contact is chosen') && security.includes('No public vulnerability disclosure address has been owner-approved yet'), 'SECURITY.md'),
-  check('PSC08', 'public release docs reference public security contact evidence', publicRelease.includes('Public security contact') && publicRelease.includes('record-public-security-contact.mjs'), 'references/public-release.md'),
-  check('PSC09', 'final readiness matrix includes public security contact record', finalReadiness.includes('Public security contact record') && finalReadiness.includes('Public security contact'), 'references/final-readiness.md'),
-  check('PSC10', 'consolidated validator includes public security contact audit', validate.includes('audit-public-security-contact.mjs'), 'scripts/validate-gse.mjs'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  fixtureRoot: fixture,
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: {
-    publicSecurityContact: failed === 0 ? 'verified' : 'failed',
-    acceptedSecurityContact: acceptedOkData?.status === 'ready' ? 'fixture-verified' : 'not-verified',
-  },
-  limits: [
-    'This audit verifies record mechanics and guardrails for public security contact acceptance.',
-    'It does not create a real public vulnerability disclosure address or approve a SECURITY.md policy.',
-    'Accepted public security contact still requires owner evidence from the real public release process.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Public Security Contact Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Public security contact: ' + data.workflows.publicSecurityContact)
-  lines.push('- Accepted security contact path: ' + data.workflows.acceptedSecurityContact)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-public-security-contact-'))
+  fs.mkdirSync(path.join(fixture, '.gse', 'releases'), { recursive: true })
+  fs.writeFileSync(path.join(fixture, 'SECURITY.md'), '# Security Policy\n\nNo public vulnerability disclosure address has been owner-approved yet.\n', 'utf8')
+  return fixture
+}
+
+const recordScript = path.join(root, 'scripts', 'record-public-security-contact.mjs')
+const template = read('assets/templates/public-security-contact-record.md')
+const security = read('SECURITY.md')
+const publicRelease = read('references/public-release.md')
+const finalReadiness = read('references/final-readiness.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const fixture = exists('scripts/record-public-security-contact.mjs') ? createFixture() : null
+const pending = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--contact-status', 'pending', '--dry-run', '--json']) : null
+const acceptedOk = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--contact-status', 'accepted',
+  '--contact-type', 'email',
+  '--contact-value', 'security@example.com',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/security/policy',
+  '--is-public', 'true',
+  '--security-policy-updated', 'true',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--dry-run',
+  '--json',
+]) : null
+const acceptedMissing = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--contact-status', 'accepted', '--evidence-status', 'pending', '--dry-run', '--json']) : null
+const acceptedPlaceholderWrite = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--contact-status', 'accepted',
+  '--contact-type', 'email',
+  '--contact-value', 'security@example.com',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/security/policy',
+  '--is-public', 'true',
+  '--security-policy-updated', 'true',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--json',
+]) : null
+
+const pendingData = pending ? parseJson(pending.stdout) : null
+const acceptedOkData = acceptedOk ? parseJson(acceptedOk.stdout) : null
+const acceptedMissingData = acceptedMissing ? parseJson(acceptedMissing.stdout) : null
+const acceptedPlaceholderWriteData = acceptedPlaceholderWrite ? parseJson(acceptedPlaceholderWrite.stdout) : null
+
+const checks = [
+  check('PSC01', 'public security contact record command exists', exists('scripts/record-public-security-contact.mjs'), 'scripts/record-public-security-contact.mjs'),
+  check('PSC02', 'public security contact template exists', exists('assets/templates/public-security-contact-record.md') && template.includes('Contact status') && template.includes('Security policy updated?'), 'assets/templates/public-security-contact-record.md'),
+  check('PSC03', 'pending contact path remains writable without owner proof', pending?.status === 0 && pendingData?.status === 'ready' && pendingData?.contactStatus === 'pending' && pendingData?.evidenceStatus === 'pending', 'record-public-security-contact pending dry-run'),
+  check('PSC04', 'accepted contact path accepts complete owner evidence', acceptedOk?.status === 0 && acceptedOkData?.status === 'ready' && acceptedOkData?.contactStatus === 'accepted' && acceptedOkData?.evidenceStatus === 'accepted', 'record-public-security-contact accepted dry-run'),
+  check('PSC05', 'accepted contact path rejects missing owner evidence', acceptedMissing?.status !== 0 && acceptedMissingData?.status === 'failed' && acceptedMissingData?.errors?.some((item) => item.includes('--contact-value')) && acceptedMissingData?.errors?.some((item) => item.includes('--accepted-by')) && acceptedMissingData?.errors?.some((item) => item.includes('--evidence-status accepted')), 'record-public-security-contact accepted missing-fields dry-run'),
+  check('PSC06', 'accepted contact real write rejects placeholder or example evidence', acceptedPlaceholderWrite?.status !== 0 && acceptedPlaceholderWriteData?.status === 'failed' && acceptedPlaceholderWriteData?.errors?.some((item) => item.includes('not a placeholder')), 'record-public-security-contact accepted placeholder write'),
+  check('PSC07', 'security policy keeps public contact owner-gated', security.includes('Until a public security contact is chosen') && security.includes('No public vulnerability disclosure address has been owner-approved yet'), 'SECURITY.md'),
+  check('PSC08', 'public release docs reference public security contact evidence', publicRelease.includes('Public security contact') && publicRelease.includes('record-public-security-contact.mjs'), 'references/public-release.md'),
+  check('PSC09', 'final readiness matrix includes public security contact record', finalReadiness.includes('Public security contact record') && finalReadiness.includes('Public security contact'), 'references/final-readiness.md'),
+  check('PSC10', 'consolidated validator includes public security contact audit', validate.includes('audit-public-security-contact.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  fixtureRoot: fixture,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicSecurityContact: failed === 0 ? 'verified' : 'failed',
+    acceptedSecurityContact: acceptedOkData?.status === 'ready' ? 'fixture-verified' : 'not-verified',
+  },
+  limits: [
+    'This audit verifies record mechanics and guardrails for public security contact acceptance.',
+    'It does not create a real public vulnerability disclosure address or approve a SECURITY.md policy.',
+    'Accepted public security contact still requires owner evidence from the real public release process.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Security Contact Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public security contact: ' + data.workflows.publicSecurityContact)
+  lines.push('- Accepted security contact path: ' + data.workflows.acceptedSecurityContact)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-readme-docs.mjs

@@ -58,8 +58,8 @@ function hasEncodingDamage(text) {
   return mojibakeSentinels.some((item) => text.includes(item))
 }
 
-const english = read('README.md')
-const chinese = read('README.zh-CN.md')
+const english = read('README.md')
+const chinese = read('README.zh-CN.md')
 const skill = read('SKILL.md')
 const validate = read('scripts/validate-gse.mjs')
 const packaging = read('references/packaging.md')
@@ -89,7 +89,9 @@ const zh = {
   gatehubSupports: 'GateHub' + z([0xff08]) + '[gatehub.top](https://gatehub.top/)' + z([0xff09, 0x652f, 0x6301, 0x20, 0x47, 0x53, 0x45, 0x20, 0x7684, 0x5f00, 0x53d1]),
   installation: z([0x23, 0x23, 0x20, 0x5b89, 0x88c5]),
 }
-const chineseCommunity = section(chinese, zh.community)
+const chineseCommunity = section(chinese, zh.community)
+const englishReadmeUrl = 'https://github.com/275005746/gse/blob/main/README.md'
+const chineseReadmeUrl = 'https://github.com/275005746/gse/blob/main/README.zh-CN.md'
 
 const sharedTerms = [
   'Goal -> Spec -> Execute -> Evidence -> Learn',
@@ -120,7 +122,7 @@ const defensivePhrases = [
 const checks = [
   check('RD01', 'English README exists', exists('README.md'), 'README.md'),
   check('RD02', 'Chinese README exists', exists('README.zh-CN.md'), 'README.zh-CN.md'),
-  check('RD02A', 'READMEs link to each other for language switching', english.includes('[简体中文](README.zh-CN.md)') && chinese.includes('[English](README.md)'), 'README.md, README.zh-CN.md'),
+  check('RD02A', 'READMEs link to each other with public absolute URLs for npm and GitHub rendering', english.includes(`[简体中文](${chineseReadmeUrl})`) && chinese.includes(`[English](${englishReadmeUrl})`), 'README.md, README.zh-CN.md'),
   check('RD03', 'READMEs share core concepts and commands', sharedTerms.every((term) => english.includes(term) && chinese.includes(term)), sharedTerms.join(', ')),
   check('RD04', 'READMEs open with value, quick start, and highlights', english.includes('## Highlights') && english.includes('## Quick Start') && english.includes('Goal-Spec-Evidence Engineering for long-running') && chinese.includes(zh.highlights) && chinese.includes(zh.quickStart) && chinese.includes(zh.longRunningAgentProjects), 'README.md, README.zh-CN.md'),
   check('RD05', 'READMEs explain when to use GSE', english.includes('## When To Use GSE') && english.includes('the project will continue across many agent sessions') && chinese.includes(zh.whenToUse) && chinese.includes(zh.manyAgentSessions), 'README.md, README.zh-CN.md'),

package/scripts/audit-recovery-readiness.mjs

@@ -1,98 +1,98 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const recovery = read('references/recovery.md')
-const release = read('references/release.md')
-const incident = read('assets/templates/incident-review.md')
-const quality = read('references/quality-gates.md')
-
-const recoveryClasses = ['recoverable failure', 'blocked work', 'rollback required', 'handoff required', 'incident recovery']
-const failedVerificationSteps = ['Preserve the failed command', 'Decide whether the failure invalidates the result', 'Fix the smallest reusable artifact', 'Re-run the same focused verification', 'mark readiness `not ready` or `result`']
-const releaseRecoveryFields = ['Release scope:', 'Failed gate:', 'Release level:', 'Readiness after failure:', 'Rollback or resume decision:', 'Verification to rerun:', 'Next action:']
-const continuationFields = ['Goal or spec:', 'Active slice:', 'Current evidence status:', 'Changed files:', 'Failed or unavailable tools:', 'Next verification command:', 'Next action:']
-const incidentFields = ['Incident title:', 'Evidence status:', 'Affected users/systems:', 'Data/security/privacy impact:', 'Verification that stabilization worked:', 'Action Items', 'Follow-Up Evidence']
-
-const checks = [
-  check('RC01', 'recovery reference exists', exists('references/recovery.md'), 'references/recovery.md'),
-  check('RC02', 'failure classes cover core recovery cases', recoveryClasses.every((item) => recovery.includes(item)), recoveryClasses.join(', ')),
-  check('RC03', 'failed verification path prevents lowering acceptance', recovery.includes('do not reduce the acceptance bar') && failedVerificationSteps.every((item) => recovery.includes(item)), 'Failed Verification Path'),
-  check('RC04', 'release recovery record has required fields', releaseRecoveryFields.every((item) => recovery.includes(item)), releaseRecoveryFields.join(', ')),
-  check('RC05', 'release recovery routes through release gates', recovery.includes('references/release.md') && release.includes('Use references/recovery.md') && quality.includes('Use `references/recovery.md`'), 'release, recovery, and quality integration'),
-  check('RC06', 'rollback rules protect user and unrelated work', recovery.includes('Do not revert user work or unrelated dirty files') && recovery.includes('references/file-ownership.md'), 'rollback ownership rules'),
-  check('RC07', 'incident template includes commercial follow-up fields', incidentFields.every((item) => incident.includes(item)), incidentFields.join(', ')),
-  check('RC08', 'incident follow-up distinguishes signal, stabilization, prevention, and evidence', incident.includes('Detection gap') && incident.includes('Stabilization') && incident.includes('What Prevents Recurrence') && incident.includes('Remaining risk'), 'incident-review.md sections'),
-  check('RC09', 'future-agent continuation packet is defined', continuationFields.every((item) => recovery.includes(item)), continuationFields.join(', ')),
-  check('RC10', 'fresh-session acceptance is not faked during handoff', recovery.includes('accepted by: fresh-session') && recovery.includes('only after a separate session actually follows the packet'), 'future-agent continuation rule'),
-  check('RC11', 'recovery evidence status routes through taxonomy', recovery.includes('references/evidence-taxonomy.md') && recovery.includes('result, verified, accepted, blocked, rollback required, or not ready'), 'handoff evidence status'),
-  check('RC12', 'incident review is scoped, not mandatory for every failure', recovery.includes('Do not turn every failed command into an incident'), 'incident scope rule'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { recoveryReadiness: failed === 0 ? 'verified' : 'failed' },
-  limits: [
-    'Recovery readiness audit verifies reusable recovery and incident workflow coverage; it does not exercise a live incident or release rollback.',
-    'Production readiness still depends on project-specific monitors, release tooling, ownership, and environment evidence.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Recovery Readiness Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Recovery readiness: ' + data.workflows.recoveryReadiness)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const recovery = read('references/recovery.md')
+const release = read('references/release.md')
+const incident = read('assets/templates/incident-review.md')
+const quality = read('references/quality-gates.md')
+
+const recoveryClasses = ['recoverable failure', 'blocked work', 'rollback required', 'handoff required', 'incident recovery']
+const failedVerificationSteps = ['Preserve the failed command', 'Decide whether the failure invalidates the result', 'Fix the smallest reusable artifact', 'Re-run the same focused verification', 'mark readiness `not ready` or `result`']
+const releaseRecoveryFields = ['Release scope:', 'Failed gate:', 'Release level:', 'Readiness after failure:', 'Rollback or resume decision:', 'Verification to rerun:', 'Next action:']
+const continuationFields = ['Goal or spec:', 'Active slice:', 'Current evidence status:', 'Changed files:', 'Failed or unavailable tools:', 'Next verification command:', 'Next action:']
+const incidentFields = ['Incident title:', 'Evidence status:', 'Affected users/systems:', 'Data/security/privacy impact:', 'Verification that stabilization worked:', 'Action Items', 'Follow-Up Evidence']
+
+const checks = [
+  check('RC01', 'recovery reference exists', exists('references/recovery.md'), 'references/recovery.md'),
+  check('RC02', 'failure classes cover core recovery cases', recoveryClasses.every((item) => recovery.includes(item)), recoveryClasses.join(', ')),
+  check('RC03', 'failed verification path prevents lowering acceptance', recovery.includes('do not reduce the acceptance bar') && failedVerificationSteps.every((item) => recovery.includes(item)), 'Failed Verification Path'),
+  check('RC04', 'release recovery record has required fields', releaseRecoveryFields.every((item) => recovery.includes(item)), releaseRecoveryFields.join(', ')),
+  check('RC05', 'release recovery routes through release gates', recovery.includes('references/release.md') && release.includes('Use references/recovery.md') && quality.includes('Use `references/recovery.md`'), 'release, recovery, and quality integration'),
+  check('RC06', 'rollback rules protect user and unrelated work', recovery.includes('Do not revert user work or unrelated dirty files') && recovery.includes('references/file-ownership.md'), 'rollback ownership rules'),
+  check('RC07', 'incident template includes commercial follow-up fields', incidentFields.every((item) => incident.includes(item)), incidentFields.join(', ')),
+  check('RC08', 'incident follow-up distinguishes signal, stabilization, prevention, and evidence', incident.includes('Detection gap') && incident.includes('Stabilization') && incident.includes('What Prevents Recurrence') && incident.includes('Remaining risk'), 'incident-review.md sections'),
+  check('RC09', 'future-agent continuation packet is defined', continuationFields.every((item) => recovery.includes(item)), continuationFields.join(', ')),
+  check('RC10', 'fresh-session acceptance is not faked during handoff', recovery.includes('accepted by: fresh-session') && recovery.includes('only after a separate session actually follows the packet'), 'future-agent continuation rule'),
+  check('RC11', 'recovery evidence status routes through taxonomy', recovery.includes('references/evidence-taxonomy.md') && recovery.includes('result, verified, accepted, blocked, rollback required, or not ready'), 'handoff evidence status'),
+  check('RC12', 'incident review is scoped, not mandatory for every failure', recovery.includes('Do not turn every failed command into an incident'), 'incident scope rule'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { recoveryReadiness: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'Recovery readiness audit verifies reusable recovery and incident workflow coverage; it does not exercise a live incident or release rollback.',
+    'Production readiness still depends on project-specific monitors, release tooling, ownership, and environment evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Recovery Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Recovery readiness: ' + data.workflows.recoveryReadiness)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)