@t275005746/gse 0.1.0 → 0.1.1

package/scripts/audit-signing.mjs

@@ -1,147 +1,147 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function run(command, commandArgs, cwd = root) {
-  const result = spawnSync(command, commandArgs, { cwd, encoding: 'utf8', windowsHide: true })
-  return {
-    command: [command, ...commandArgs].join(' '),
-    status: result.status ?? 1,
-    stdout: (result.stdout ?? '').trim(),
-    stderr: (result.stderr ?? '').trim(),
-  }
-}
-
-function parseJson(text) {
-  try { return JSON.parse(text) } catch { return null }
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-signing-'))
-const packageOut = path.join(tempRoot, 'package')
-const installTarget = path.join(tempRoot, 'installed-gse')
-const tamperedPackage = path.join(tempRoot, 'tampered-package')
-const tamperedTarget = path.join(tempRoot, 'tampered-installed')
-const privateKey = path.join(tempRoot, 'gse-private.pem')
-const publicKey = path.join(tempRoot, 'gse-public.pem')
-
-const packageRun = run(process.execPath, [
-  path.join(root, 'scripts', 'package-gse.mjs'),
-  '--root',
-  root,
-  '--out',
-  packageOut,
-  '--label',
-  'gse-signing-audit',
-  '--json',
-])
-const signRun = run(process.execPath, [
-  path.join(root, 'scripts', 'sign-gse-package.mjs'),
-  '--package',
-  packageOut,
-  '--private-key',
-  privateKey,
-  '--public-key',
-  publicKey,
-  '--generate-key',
-  '--json',
-])
-const verifyRun = run(process.execPath, [
-  path.join(root, 'scripts', 'verify-gse-package.mjs'),
-  '--package',
-  packageOut,
-  '--public-key',
-  publicKey,
-  '--json',
-])
-const installRun = run(process.execPath, [
-  path.join(root, 'scripts', 'install-gse.mjs'),
-  '--source',
-  packageOut,
-  '--target',
-  installTarget,
-  '--public-key',
-  publicKey,
-  '--json',
-])
-
-fs.cpSync(packageOut, tamperedPackage, { recursive: true })
-fs.appendFileSync(path.join(tamperedPackage, 'SKILL.md'), '\nTampered for signature audit.\n', 'utf8')
-const tamperedVerify = run(process.execPath, [
-  path.join(root, 'scripts', 'verify-gse-package.mjs'),
-  '--package',
-  tamperedPackage,
-  '--public-key',
-  publicKey,
-  '--json',
-])
-const tamperedInstall = run(process.execPath, [
-  path.join(root, 'scripts', 'install-gse.mjs'),
-  '--source',
-  tamperedPackage,
-  '--target',
-  tamperedTarget,
-  '--public-key',
-  publicKey,
-  '--json',
-])
-
-const signData = parseJson(signRun.stdout)
-const verifyData = parseJson(verifyRun.stdout)
-const installData = parseJson(installRun.stdout)
-const tamperedVerifyData = parseJson(tamperedVerify.stdout)
-const tamperedInstallData = parseJson(tamperedInstall.stdout)
-
-const checks = [
-  check('SIGN01', 'package command succeeds', packageRun.status === 0, packageRun.command),
-  check('SIGN02', 'sign command creates signature and keys', signRun.status === 0 && fs.existsSync(path.join(packageOut, 'gse-package-signature.json')) && fs.existsSync(publicKey), signRun.command),
-  check('SIGN03', 'verify command accepts signed package', verifyRun.status === 0 && verifyData?.summary?.failed === 0, verifyRun.command),
-  check('SIGN04', 'install command accepts signed package with public key', installRun.status === 0 && installData?.signature?.status === 'verified', installRun.command),
-  check('SIGN05', 'tampered package fails signature/hash verification', tamperedVerify.status === 1 && tamperedVerifyData?.summary?.failed > 0, tamperedVerify.command),
-  check('SIGN06', 'install command rejects tampered signed package', tamperedInstall.status === 1 && (tamperedInstallData?.signature?.status === 'failed' || tamperedInstallData?.summary?.integrityFailed > 0), tamperedInstall.command),
-  check('SIGN07', 'signature uses Ed25519', signData?.algorithm === 'ed25519', 'sign-gse-package output'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  tempRoot,
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: {
-    packageSigning: signRun.status === 0 ? 'verified' : 'failed',
-    signatureVerification: verifyRun.status === 0 ? 'verified' : 'failed',
-    signedInstall: installRun.status === 0 ? 'verified' : 'failed',
-    tamperRejection: tamperedVerify.status === 1 && tamperedInstall.status === 1 ? 'verified' : 'failed',
-  },
-  commands: [packageRun.command, signRun.command, verifyRun.command, installRun.command, tamperedVerify.command, tamperedInstall.command],
-  limits: [
-    'This audit verifies local Ed25519 signing and verification mechanics.',
-    'It does not prove public key custody, maintainer identity, transparency logs, or marketplace trust.',
-  ],
-  checks,
-}
-
-fs.rmSync(tempRoot, { recursive: true, force: true })
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(JSON.stringify(report, null, 2))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, { cwd, encoding: 'utf8', windowsHide: true })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-signing-'))
+const packageOut = path.join(tempRoot, 'package')
+const installTarget = path.join(tempRoot, 'installed-gse')
+const tamperedPackage = path.join(tempRoot, 'tampered-package')
+const tamperedTarget = path.join(tempRoot, 'tampered-installed')
+const privateKey = path.join(tempRoot, 'gse-private.pem')
+const publicKey = path.join(tempRoot, 'gse-public.pem')
+
+const packageRun = run(process.execPath, [
+  path.join(root, 'scripts', 'package-gse.mjs'),
+  '--root',
+  root,
+  '--out',
+  packageOut,
+  '--label',
+  'gse-signing-audit',
+  '--json',
+])
+const signRun = run(process.execPath, [
+  path.join(root, 'scripts', 'sign-gse-package.mjs'),
+  '--package',
+  packageOut,
+  '--private-key',
+  privateKey,
+  '--public-key',
+  publicKey,
+  '--generate-key',
+  '--json',
+])
+const verifyRun = run(process.execPath, [
+  path.join(root, 'scripts', 'verify-gse-package.mjs'),
+  '--package',
+  packageOut,
+  '--public-key',
+  publicKey,
+  '--json',
+])
+const installRun = run(process.execPath, [
+  path.join(root, 'scripts', 'install-gse.mjs'),
+  '--source',
+  packageOut,
+  '--target',
+  installTarget,
+  '--public-key',
+  publicKey,
+  '--json',
+])
+
+fs.cpSync(packageOut, tamperedPackage, { recursive: true })
+fs.appendFileSync(path.join(tamperedPackage, 'SKILL.md'), '\nTampered for signature audit.\n', 'utf8')
+const tamperedVerify = run(process.execPath, [
+  path.join(root, 'scripts', 'verify-gse-package.mjs'),
+  '--package',
+  tamperedPackage,
+  '--public-key',
+  publicKey,
+  '--json',
+])
+const tamperedInstall = run(process.execPath, [
+  path.join(root, 'scripts', 'install-gse.mjs'),
+  '--source',
+  tamperedPackage,
+  '--target',
+  tamperedTarget,
+  '--public-key',
+  publicKey,
+  '--json',
+])
+
+const signData = parseJson(signRun.stdout)
+const verifyData = parseJson(verifyRun.stdout)
+const installData = parseJson(installRun.stdout)
+const tamperedVerifyData = parseJson(tamperedVerify.stdout)
+const tamperedInstallData = parseJson(tamperedInstall.stdout)
+
+const checks = [
+  check('SIGN01', 'package command succeeds', packageRun.status === 0, packageRun.command),
+  check('SIGN02', 'sign command creates signature and keys', signRun.status === 0 && fs.existsSync(path.join(packageOut, 'gse-package-signature.json')) && fs.existsSync(publicKey), signRun.command),
+  check('SIGN03', 'verify command accepts signed package', verifyRun.status === 0 && verifyData?.summary?.failed === 0, verifyRun.command),
+  check('SIGN04', 'install command accepts signed package with public key', installRun.status === 0 && installData?.signature?.status === 'verified', installRun.command),
+  check('SIGN05', 'tampered package fails signature/hash verification', tamperedVerify.status === 1 && tamperedVerifyData?.summary?.failed > 0, tamperedVerify.command),
+  check('SIGN06', 'install command rejects tampered signed package', tamperedInstall.status === 1 && (tamperedInstallData?.signature?.status === 'failed' || tamperedInstallData?.summary?.integrityFailed > 0), tamperedInstall.command),
+  check('SIGN07', 'signature uses Ed25519', signData?.algorithm === 'ed25519', 'sign-gse-package output'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    packageSigning: signRun.status === 0 ? 'verified' : 'failed',
+    signatureVerification: verifyRun.status === 0 ? 'verified' : 'failed',
+    signedInstall: installRun.status === 0 ? 'verified' : 'failed',
+    tamperRejection: tamperedVerify.status === 1 && tamperedInstall.status === 1 ? 'verified' : 'failed',
+  },
+  commands: [packageRun.command, signRun.command, verifyRun.command, installRun.command, tamperedVerify.command, tamperedInstall.command],
+  limits: [
+    'This audit verifies local Ed25519 signing and verification mechanics.',
+    'It does not prove public key custody, maintainer identity, transparency logs, or marketplace trust.',
+  ],
+  checks,
+}
+
+fs.rmSync(tempRoot, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-state-freshness.mjs

@@ -73,20 +73,25 @@ const mentionsAllPending = pendingAreas.every((area) => stateSearch.includes(are
 ) || (
   area === 'Native slash command' && stateSearch.includes('Native slash-command')
 ))
+const registryPending = pendingAreas.includes('Public registry publication')
+const registryStateMatches = registryPending
+  ? state?.currentSlice?.status === 'blocked-external-auth' &&
+    (stateSearch.includes('npm is not logged in') || stateSearch.includes('not yet published on npm'))
+  : !stateSearch.includes('not yet published on npm') &&
+    !stateSearch.includes('npm is not logged in') &&
+    !stateSearch.includes('Publish @t275005746/gse to npm with an authorized token')
 
 const checks = [
   check('STF01', 'state JSON exists and parses', Boolean(state), '.gse/state.json'),
   check('STF02', 'public acceptance doctor runs before state freshness check', doctorRun.status === 0 && doctor?.summary?.status === 'passed', doctorRun.command),
-  check('STF03', 'state next action mentions every current pending final-form gate', mentionsAllPending && pendingAreas.length === 2, pendingAreas.join(', ')),
+  check('STF03', 'state next action mentions every current pending final-form gate', mentionsAllPending, pendingAreas.join(', ')),
   check('STF04', 'state no longer routes users to resolved public CI/security/repository/marketplace gates', staleMatches.length === 0, staleMatches.length ? staleMatches.join('; ') : '.gse/state.json'),
-  check(
-    'STF05',
-    'state marks current registry work as externally blocked by npm auth/publication',
-    state?.currentSlice?.id === 'GSE-108-public-registry-publication' &&
-      state?.currentSlice?.status === 'blocked-external-auth' &&
-      (stateSearch.includes('npm is not logged in') || stateSearch.includes('not yet published on npm')),
-    '.gse/state.json',
-  ),
+  check(
+    'STF05',
+    'state matches current registry publication gate status',
+    registryStateMatches,
+    '.gse/state.json',
+  ),
   check('STF06', 'state points users to current doctor as source of truth', stateSearch.includes('/gse doctor') || stateSearch.includes('audit-public-acceptance-readiness.mjs'), '.gse/state.json'),
 ]
 

package/scripts/audit-target-adoption-evidence.mjs

@@ -1,117 +1,117 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const template = read('assets/templates/target-adoption-evidence.md')
-const recipes = read('references/adoption-recipes.md')
-const discovery = read('scripts/discover-project-profile.mjs')
-const validate = read('scripts/validate-gse.mjs')
-
-const fields = [
-  'Target project:',
-  'Adoption path:',
-  'Project rules read:',
-  'Files inspected:',
-  'Files changed:',
-  'Commands run:',
-  'Detected project type:',
-  'Detected package manager:',
-  'Detected scripts:',
-  'Host/tool statuses:',
-  'Evidence status:',
-  'Accepted by:',
-  'Residual risks:',
-  'Next action:',
-]
-
-const noOverclaim = [
-  'documented` until executed',
-  'unknown` unless the tool was actually checked',
-  'Do not claim arbitrary real-repo certification',
-  'host runtime support',
-  'subagent support',
-  'browser support',
-  'MCP support',
-  'CI support',
-  'release publication',
-  'owner acceptance',
-  'Accepted by: not accepted',
-]
-
-const checks = [
-  check('TAE01', 'target adoption evidence template exists', exists('assets/templates/target-adoption-evidence.md'), 'assets/templates/target-adoption-evidence.md'),
-  check('TAE02', 'template captures target-project evidence fields', fields.every((item) => template.includes(item)), fields.join(', ')),
-  check('TAE03', 'template prevents real-repo and host capability overclaims', noOverclaim.every((item) => template.includes(item)), 'anti-overclaim rules'),
-  check('TAE04', 'adoption recipes route real target evidence to template', recipes.includes('assets/templates/target-adoption-evidence.md') && recipes.includes('Accepted by: not accepted'), 'references/adoption-recipes.md'),
-  check('TAE05', 'discovery captures namespaced project scripts', discovery.includes('/^(smoke|evidence|replay|eval|release|deploy|publish|electron):/') && discovery.includes('package.json smoke script'), 'scripts/discover-project-profile.mjs'),
-  check('TAE06', 'consolidated validator includes this audit', validate.includes('audit-target-adoption-evidence.mjs'), 'scripts/validate-gse.mjs'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { targetAdoptionEvidence: failed === 0 ? 'verified' : 'failed' },
-  limits: [
-    'This audit verifies the target-project evidence template and discovery support only.',
-    'It does not certify any arbitrary repository or accept a host/runtime capability.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Target Adoption Evidence Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Target adoption evidence: ' + data.workflows.targetAdoptionEvidence)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const template = read('assets/templates/target-adoption-evidence.md')
+const recipes = read('references/adoption-recipes.md')
+const discovery = read('scripts/discover-project-profile.mjs')
+const validate = read('scripts/validate-gse.mjs')
+
+const fields = [
+  'Target project:',
+  'Adoption path:',
+  'Project rules read:',
+  'Files inspected:',
+  'Files changed:',
+  'Commands run:',
+  'Detected project type:',
+  'Detected package manager:',
+  'Detected scripts:',
+  'Host/tool statuses:',
+  'Evidence status:',
+  'Accepted by:',
+  'Residual risks:',
+  'Next action:',
+]
+
+const noOverclaim = [
+  'documented` until executed',
+  'unknown` unless the tool was actually checked',
+  'Do not claim arbitrary real-repo certification',
+  'host runtime support',
+  'subagent support',
+  'browser support',
+  'MCP support',
+  'CI support',
+  'release publication',
+  'owner acceptance',
+  'Accepted by: not accepted',
+]
+
+const checks = [
+  check('TAE01', 'target adoption evidence template exists', exists('assets/templates/target-adoption-evidence.md'), 'assets/templates/target-adoption-evidence.md'),
+  check('TAE02', 'template captures target-project evidence fields', fields.every((item) => template.includes(item)), fields.join(', ')),
+  check('TAE03', 'template prevents real-repo and host capability overclaims', noOverclaim.every((item) => template.includes(item)), 'anti-overclaim rules'),
+  check('TAE04', 'adoption recipes route real target evidence to template', recipes.includes('assets/templates/target-adoption-evidence.md') && recipes.includes('Accepted by: not accepted'), 'references/adoption-recipes.md'),
+  check('TAE05', 'discovery captures namespaced project scripts', discovery.includes('/^(smoke|evidence|replay|eval|release|deploy|publish|electron):/') && discovery.includes('package.json smoke script'), 'scripts/discover-project-profile.mjs'),
+  check('TAE06', 'consolidated validator includes this audit', validate.includes('audit-target-adoption-evidence.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { targetAdoptionEvidence: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies the target-project evidence template and discovery support only.',
+    'It does not certify any arbitrary repository or accept a host/runtime capability.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Target Adoption Evidence Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Target adoption evidence: ' + data.workflows.targetAdoptionEvidence)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)