@t275005746/gse 0.1.0 → 0.1.1

package/scripts/update-project-state.mjs

@@ -1,223 +1,223 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const jsonOnly = args.includes('--json')
-const dryRun = args.includes('--dry-run')
-const force = args.includes('--force')
-const selfTest = args.includes('--self-test') || !args.includes('--target')
-const targetArg = readArg('--target')
-const date = new Date().toISOString().slice(0, 10)
-
-function readText(filePath) {
-  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
-}
-
-function exists(target, relativePath) {
-  return fs.existsSync(path.join(target, relativePath))
-}
-
-function readJson(filePath) {
-  if (!fs.existsSync(filePath)) return { exists: false, ok: false, data: null, error: 'missing' }
-  try {
-    return { exists: true, ok: true, data: JSON.parse(readText(filePath)), error: '' }
-  } catch (error) {
-    return { exists: true, ok: false, data: null, error: error.message }
-  }
-}
-
-function runGit(target, commandArgs) {
-  const result = spawnSync('git', commandArgs, {
-    cwd: target,
-    encoding: 'utf8',
-    windowsHide: true,
-  })
-  return {
-    status: result.status ?? 1,
-    stdout: (result.stdout ?? '').trim(),
-    stderr: (result.stderr ?? '').trim(),
-  }
-}
-
-function cleanInlineValue(value) {
-  return String(value || '').trim().replace(/[.。:：]+$/, '').trim()
-}
-
-function firstMatch(text, regex) {
-  const match = text.match(regex)
-  return match ? cleanInlineValue(match[1]) : ''
-}
-
-function findCanonicalPlan(target) {
-  const texts = [
-    readText(path.join(target, '.gse', 'README.md')),
-    readText(path.join(target, '.gse', 'project-profile.md')),
-    readText(path.join(target, '.gse', 'goal-map.md')),
-  ].join('\n')
-  const match = texts.match(/docs\/[A-Za-z0-9._/-]*?(?:architecture|productization)[A-Za-z0-9._/-]*?\.md/)
-  if (match && exists(target, match[0])) return match[0]
-  for (const fallback of [
-    'docs/aion-productization-architecture.md',
-    'docs/museflow-ai-film-productization-architecture.md',
-  ]) {
-    if (exists(target, fallback)) return fallback
-  }
-  return ''
-}
-
-function detectMode(target) {
-  if (exists(target, '.gse/hooks/README.md') || exists(target, '.gse/mcp/README.md') || exists(target, '.gse/plugins/README.md')) return 'enterprise'
-  if (exists(target, '.gse/agents/roles.md') || exists(target, '.gse/agent-workspace.md')) return 'standard'
-  return 'lite'
-}
-
-function detectSparseWarning(target) {
-  const sparse = runGit(target, ['sparse-checkout', 'list'])
-  const sparseLines = sparse.status === 0 && sparse.stdout ? sparse.stdout.split(/\r?\n/).map((line) => line.trim().replace(/\\/g, '/')).filter(Boolean) : []
-  const sparseEnabled = sparse.status === 0 && sparseLines.length > 0
-  const sparseIncludesGse = sparseLines.some((line) => line === '.gse' || line === '.gse/' || line.startsWith('.gse/') || line === '/*' || line === '*')
-  if (sparseEnabled && !sparseIncludesGse) {
-    return `sparse-checkout excludes .gse; use git add --sparse for project-local GSE updates or add .gse to sparse rules.`
-  }
-  return ''
-}
-
-function writeFile(target, relativePath, content, results) {
-  const fullPath = path.join(target, relativePath)
-  const alreadyExists = fs.existsSync(fullPath)
-  if (alreadyExists && !force) {
-    results.push({ relativePath, status: 'skipped', reason: 'exists' })
-    return
-  }
-  if (!dryRun) {
-    fs.mkdirSync(path.dirname(fullPath), { recursive: true })
-    fs.writeFileSync(fullPath, content.replace(/\n/g, '\r\n'), 'utf8')
-  }
-  results.push({ relativePath, status: dryRun ? (alreadyExists ? 'would-skip' : 'would-write') : alreadyExists ? 'overwritten' : 'written' })
-}
-
-function buildState(target) {
-  const profile = readText(path.join(target, '.gse', 'project-profile.md'))
-  const goalMap = readText(path.join(target, '.gse', 'goal-map.md'))
-  const projectName = firstMatch(profile, /Product\/system name:\s*([^\n]+)/i) || firstMatch(profile, /Product\/system name\s*:\s*([^\n]+)/i) || path.basename(target)
-  const canonicalPlan = findCanonicalPlan(target)
-  const activeSlice = firstMatch(goalMap, /Active slice:\s*([^\n]+)/i) || 'Continue from the project goal map.'
-  const nextAction = firstMatch(goalMap, /Next action:\s*([^\n]+)/i) || 'Pick the next verifiable slice.'
-  return {
-    schemaVersion: 1,
-    projectName,
-    mode: detectMode(target),
-    canonicalPlan,
-    phase: 'execute',
-    currentSlice: {
-      id: '',
-      outcome: activeSlice,
-      status: 'planned',
-      nextAction,
-    },
-    toolStatuses: {
-      browser: 'unknown',
-      lsp: 'unknown',
-      mcp: 'unknown',
-      subagents: 'unknown',
-      ci: 'unknown',
-    },
-    lastEvidence: '.gse/evidence/index.jsonl',
-    residualRisks: [
-      'State/index was generated by GSE update; project-specific tool statuses remain unknown until verified.',
-    ],
-  }
-}
-
-function updateProject(target) {
-  const resolvedTarget = path.resolve(target)
-  const results = []
-  const warnings = []
-  if (!exists(resolvedTarget, '.gse')) {
-    return {
-      target: resolvedTarget,
-      generatedAt: new Date().toISOString(),
-      dryRun,
-      force,
-      summary: { status: 'failed', written: 0, skipped: 0, warnings: 0, total: 0 },
-      results,
-      warnings: ['missing .gse directory'],
-      recommendation: 'Run init-project.mjs first or adopt GSE before updating state/index.',
-    }
-  }
-
-  const state = readJson(path.join(resolvedTarget, '.gse', 'state.json'))
-  if (state.exists && !state.ok && !force) warnings.push('existing .gse/state.json is invalid; rerun with --force only after backing up or reviewing it')
-  const sparseWarning = detectSparseWarning(resolvedTarget)
-  if (sparseWarning) warnings.push(sparseWarning)
-
-  const stateContent = JSON.stringify(buildState(resolvedTarget), null, 2) + '\n'
-  const evidenceIndexRecord = JSON.stringify({
-    date,
-    recordType: 'adoption',
-    status: 'result',
-    summary: 'Added GSE machine-readable state and evidence index for an existing project.',
-    evidenceFile: `.gse/evidence/${date}.md`,
-    commands: ['node <gse-skill>/scripts/update-project-state.mjs --target <project-root>'],
-    nextAction: 'Run target doctor, generate-session-prompt, and close gate to verify project-local readiness.',
-  }) + '\n'
-
-  writeFile(resolvedTarget, '.gse/state.json', stateContent, results)
-  writeFile(resolvedTarget, '.gse/evidence/index.jsonl', evidenceIndexRecord, results)
-
-  const written = results.filter((item) => ['written', 'overwritten', 'would-write'].includes(item.status)).length
-  const skipped = results.filter((item) => ['skipped', 'would-skip'].includes(item.status)).length
-  return {
-    target: resolvedTarget,
-    generatedAt: new Date().toISOString(),
-    dryRun,
-    force,
-    summary: {
-      status: warnings.length ? 'warning' : 'passed',
-      written,
-      skipped,
-      warnings: warnings.length,
-      total: results.length,
-    },
-    results,
-    warnings,
-    recommendation: warnings.length ? 'Review warnings before staging project-local .gse changes.' : 'Run target doctor and close gate before claiming the project update is verified.',
-  }
-}
-
-function createFixture() {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-state-update-'))
-  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
-  fs.writeFileSync(path.join(dir, '.gse', 'README.md'), '# GSE\n\nCanonical plan: `docs/productization-architecture.md`.\n', 'utf8')
-  fs.writeFileSync(path.join(dir, '.gse', 'project-profile.md'), '# Project Profile\n\n- Product/system name: Fixture Product.\n', 'utf8')
-  fs.writeFileSync(path.join(dir, '.gse', 'goal-map.md'), '# Goal Map\n\n## Current Focus\n\n- Active slice: Fixture migration.\n- Next action: Verify fixture migration.\n', 'utf8')
-  fs.writeFileSync(path.join(dir, '.gse', 'quality-gates.md'), '# Quality Gates\n\n## Universal\n', 'utf8')
-  fs.mkdirSync(path.join(dir, 'docs'), { recursive: true })
-  fs.writeFileSync(path.join(dir, 'docs', 'productization-architecture.md'), '# Plan\n', 'utf8')
-  return dir
-}
-
-const target = selfTest ? createFixture() : targetArg
-const report = updateProject(target)
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else {
-  console.log('# GSE Project State Update')
-  console.log('')
-  console.log('Target: ' + report.target)
-  console.log('Status: ' + report.summary.status)
-  for (const item of report.results) console.log('- ' + item.relativePath + ': ' + item.status + (item.reason ? ' (' + item.reason + ')' : ''))
-  for (const warning of report.warnings) console.log('- warning: ' + warning)
-}
-
-if (report.summary.status === 'failed') process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const jsonOnly = args.includes('--json')
+const dryRun = args.includes('--dry-run')
+const force = args.includes('--force')
+const selfTest = args.includes('--self-test') || !args.includes('--target')
+const targetArg = readArg('--target')
+const date = new Date().toISOString().slice(0, 10)
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(target, relativePath) {
+  return fs.existsSync(path.join(target, relativePath))
+}
+
+function readJson(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, data: null, error: 'missing' }
+  try {
+    return { exists: true, ok: true, data: JSON.parse(readText(filePath)), error: '' }
+  } catch (error) {
+    return { exists: true, ok: false, data: null, error: error.message }
+  }
+}
+
+function runGit(target, commandArgs) {
+  const result = spawnSync('git', commandArgs, {
+    cwd: target,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function cleanInlineValue(value) {
+  return String(value || '').trim().replace(/[.。:：]+$/, '').trim()
+}
+
+function firstMatch(text, regex) {
+  const match = text.match(regex)
+  return match ? cleanInlineValue(match[1]) : ''
+}
+
+function findCanonicalPlan(target) {
+  const texts = [
+    readText(path.join(target, '.gse', 'README.md')),
+    readText(path.join(target, '.gse', 'project-profile.md')),
+    readText(path.join(target, '.gse', 'goal-map.md')),
+  ].join('\n')
+  const match = texts.match(/docs\/[A-Za-z0-9._/-]*?(?:architecture|productization)[A-Za-z0-9._/-]*?\.md/)
+  if (match && exists(target, match[0])) return match[0]
+  for (const fallback of [
+    'docs/aion-productization-architecture.md',
+    'docs/museflow-ai-film-productization-architecture.md',
+  ]) {
+    if (exists(target, fallback)) return fallback
+  }
+  return ''
+}
+
+function detectMode(target) {
+  if (exists(target, '.gse/hooks/README.md') || exists(target, '.gse/mcp/README.md') || exists(target, '.gse/plugins/README.md')) return 'enterprise'
+  if (exists(target, '.gse/agents/roles.md') || exists(target, '.gse/agent-workspace.md')) return 'standard'
+  return 'lite'
+}
+
+function detectSparseWarning(target) {
+  const sparse = runGit(target, ['sparse-checkout', 'list'])
+  const sparseLines = sparse.status === 0 && sparse.stdout ? sparse.stdout.split(/\r?\n/).map((line) => line.trim().replace(/\\/g, '/')).filter(Boolean) : []
+  const sparseEnabled = sparse.status === 0 && sparseLines.length > 0
+  const sparseIncludesGse = sparseLines.some((line) => line === '.gse' || line === '.gse/' || line.startsWith('.gse/') || line === '/*' || line === '*')
+  if (sparseEnabled && !sparseIncludesGse) {
+    return `sparse-checkout excludes .gse; use git add --sparse for project-local GSE updates or add .gse to sparse rules.`
+  }
+  return ''
+}
+
+function writeFile(target, relativePath, content, results) {
+  const fullPath = path.join(target, relativePath)
+  const alreadyExists = fs.existsSync(fullPath)
+  if (alreadyExists && !force) {
+    results.push({ relativePath, status: 'skipped', reason: 'exists' })
+    return
+  }
+  if (!dryRun) {
+    fs.mkdirSync(path.dirname(fullPath), { recursive: true })
+    fs.writeFileSync(fullPath, content.replace(/\n/g, '\r\n'), 'utf8')
+  }
+  results.push({ relativePath, status: dryRun ? (alreadyExists ? 'would-skip' : 'would-write') : alreadyExists ? 'overwritten' : 'written' })
+}
+
+function buildState(target) {
+  const profile = readText(path.join(target, '.gse', 'project-profile.md'))
+  const goalMap = readText(path.join(target, '.gse', 'goal-map.md'))
+  const projectName = firstMatch(profile, /Product\/system name:\s*([^\n]+)/i) || firstMatch(profile, /Product\/system name\s*:\s*([^\n]+)/i) || path.basename(target)
+  const canonicalPlan = findCanonicalPlan(target)
+  const activeSlice = firstMatch(goalMap, /Active slice:\s*([^\n]+)/i) || 'Continue from the project goal map.'
+  const nextAction = firstMatch(goalMap, /Next action:\s*([^\n]+)/i) || 'Pick the next verifiable slice.'
+  return {
+    schemaVersion: 1,
+    projectName,
+    mode: detectMode(target),
+    canonicalPlan,
+    phase: 'execute',
+    currentSlice: {
+      id: '',
+      outcome: activeSlice,
+      status: 'planned',
+      nextAction,
+    },
+    toolStatuses: {
+      browser: 'unknown',
+      lsp: 'unknown',
+      mcp: 'unknown',
+      subagents: 'unknown',
+      ci: 'unknown',
+    },
+    lastEvidence: '.gse/evidence/index.jsonl',
+    residualRisks: [
+      'State/index was generated by GSE update; project-specific tool statuses remain unknown until verified.',
+    ],
+  }
+}
+
+function updateProject(target) {
+  const resolvedTarget = path.resolve(target)
+  const results = []
+  const warnings = []
+  if (!exists(resolvedTarget, '.gse')) {
+    return {
+      target: resolvedTarget,
+      generatedAt: new Date().toISOString(),
+      dryRun,
+      force,
+      summary: { status: 'failed', written: 0, skipped: 0, warnings: 0, total: 0 },
+      results,
+      warnings: ['missing .gse directory'],
+      recommendation: 'Run init-project.mjs first or adopt GSE before updating state/index.',
+    }
+  }
+
+  const state = readJson(path.join(resolvedTarget, '.gse', 'state.json'))
+  if (state.exists && !state.ok && !force) warnings.push('existing .gse/state.json is invalid; rerun with --force only after backing up or reviewing it')
+  const sparseWarning = detectSparseWarning(resolvedTarget)
+  if (sparseWarning) warnings.push(sparseWarning)
+
+  const stateContent = JSON.stringify(buildState(resolvedTarget), null, 2) + '\n'
+  const evidenceIndexRecord = JSON.stringify({
+    date,
+    recordType: 'adoption',
+    status: 'result',
+    summary: 'Added GSE machine-readable state and evidence index for an existing project.',
+    evidenceFile: `.gse/evidence/${date}.md`,
+    commands: ['node <gse-skill>/scripts/update-project-state.mjs --target <project-root>'],
+    nextAction: 'Run target doctor, generate-session-prompt, and close gate to verify project-local readiness.',
+  }) + '\n'
+
+  writeFile(resolvedTarget, '.gse/state.json', stateContent, results)
+  writeFile(resolvedTarget, '.gse/evidence/index.jsonl', evidenceIndexRecord, results)
+
+  const written = results.filter((item) => ['written', 'overwritten', 'would-write'].includes(item.status)).length
+  const skipped = results.filter((item) => ['skipped', 'would-skip'].includes(item.status)).length
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    dryRun,
+    force,
+    summary: {
+      status: warnings.length ? 'warning' : 'passed',
+      written,
+      skipped,
+      warnings: warnings.length,
+      total: results.length,
+    },
+    results,
+    warnings,
+    recommendation: warnings.length ? 'Review warnings before staging project-local .gse changes.' : 'Run target doctor and close gate before claiming the project update is verified.',
+  }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-state-update-'))
+  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+  fs.writeFileSync(path.join(dir, '.gse', 'README.md'), '# GSE\n\nCanonical plan: `docs/productization-architecture.md`.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'project-profile.md'), '# Project Profile\n\n- Product/system name: Fixture Product.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'goal-map.md'), '# Goal Map\n\n## Current Focus\n\n- Active slice: Fixture migration.\n- Next action: Verify fixture migration.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'quality-gates.md'), '# Quality Gates\n\n## Universal\n', 'utf8')
+  fs.mkdirSync(path.join(dir, 'docs'), { recursive: true })
+  fs.writeFileSync(path.join(dir, 'docs', 'productization-architecture.md'), '# Plan\n', 'utf8')
+  return dir
+}
+
+const target = selfTest ? createFixture() : targetArg
+const report = updateProject(target)
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log('# GSE Project State Update')
+  console.log('')
+  console.log('Target: ' + report.target)
+  console.log('Status: ' + report.summary.status)
+  for (const item of report.results) console.log('- ' + item.relativePath + ': ' + item.status + (item.reason ? ' (' + item.reason + ')' : ''))
+  for (const warning of report.warnings) console.log('- warning: ' + warning)
+}
+
+if (report.summary.status === 'failed') process.exit(1)

package/scripts/verify-gse-package.mjs

@@ -1,85 +1,85 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-import crypto from 'node:crypto'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const packageDir = path.resolve(readArg('--package', process.cwd()))
-const publicKeyPath = path.resolve(readArg('--public-key', path.join(packageDir, 'gse-signing-public.pem')))
-const signaturePath = path.resolve(readArg('--signature', path.join(packageDir, 'gse-package-signature.json')))
-const jsonOnly = args.includes('--json')
-
-function sha256(filePath) {
-  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
-}
-
-function fingerprint(pem) {
-  return crypto.createHash('sha256').update(pem).digest('hex')
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-function readJson(filePath) {
-  if (!fs.existsSync(filePath)) return null
-  return JSON.parse(fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, ''))
-}
-
-const manifestPath = path.join(packageDir, 'gse-package-manifest.json')
-const manifest = readJson(manifestPath)
-const signatureRecord = readJson(signaturePath)
-const publicKeyPem = fs.existsSync(publicKeyPath) ? fs.readFileSync(publicKeyPath, 'utf8') : ''
-
-const files = manifest?.files ?? []
-const hashMismatches = []
-for (const relativePath of files) {
-  const fullPath = path.join(packageDir, relativePath)
-  const expected = manifest?.fileHashes?.[relativePath]
-  const actual = fs.existsSync(fullPath) ? sha256(fullPath) : null
-  if (!expected || actual !== expected) hashMismatches.push({ relativePath, expected, actual })
-}
-const recomputedDigest = manifest
-  ? crypto.createHash('sha256').update(JSON.stringify({ files: manifest.files, fileHashes: manifest.fileHashes })).digest('hex')
-  : null
-const payloadText = signatureRecord?.payload ? JSON.stringify(signatureRecord.payload) : ''
-let signatureOk = false
-try {
-  signatureOk = Boolean(publicKeyPem && signatureRecord?.signature && crypto.verify(null, Buffer.from(payloadText), publicKeyPem, Buffer.from(signatureRecord.signature, 'base64')))
-} catch {
-  signatureOk = false
-}
-
-const checks = [
-  check('SIG01', 'manifest exists', Boolean(manifest), manifestPath),
-  check('SIG02', 'signature record exists', Boolean(signatureRecord), signaturePath),
-  check('SIG03', 'public key exists', Boolean(publicKeyPem), publicKeyPath),
-  check('SIG04', 'all file hashes match manifest', hashMismatches.length === 0, hashMismatches.length ? JSON.stringify(hashMismatches.slice(0, 5)) : 'all files'),
-  check('SIG05', 'manifest package digest matches file hash table', Boolean(manifest?.integrity?.packageDigest && recomputedDigest === manifest.integrity.packageDigest), 'integrity.packageDigest'),
-  check('SIG06', 'signature payload matches manifest digest', Boolean(signatureRecord?.payload?.packageDigest && signatureRecord.payload.packageDigest === manifest?.integrity?.packageDigest), 'signature payload packageDigest'),
-  check('SIG07', 'signature verifies with public key', signatureOk, 'ed25519 signature'),
-  check('SIG08', 'public key fingerprint matches signature record', Boolean(publicKeyPem && signatureRecord?.publicKeyFingerprint === fingerprint(publicKeyPem)), 'public key fingerprint'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  packageDir,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { packageSignature: failed === 0 ? 'verified' : 'failed' },
-  checks,
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(JSON.stringify(report, null, 2))
-
-if (failed > 0) process.exit(1)
-
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const packageDir = path.resolve(readArg('--package', process.cwd()))
+const publicKeyPath = path.resolve(readArg('--public-key', path.join(packageDir, 'gse-signing-public.pem')))
+const signaturePath = path.resolve(readArg('--signature', path.join(packageDir, 'gse-package-signature.json')))
+const jsonOnly = args.includes('--json')
+
+function sha256(filePath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
+}
+
+function fingerprint(pem) {
+  return crypto.createHash('sha256').update(pem).digest('hex')
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function readJson(filePath) {
+  if (!fs.existsSync(filePath)) return null
+  return JSON.parse(fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, ''))
+}
+
+const manifestPath = path.join(packageDir, 'gse-package-manifest.json')
+const manifest = readJson(manifestPath)
+const signatureRecord = readJson(signaturePath)
+const publicKeyPem = fs.existsSync(publicKeyPath) ? fs.readFileSync(publicKeyPath, 'utf8') : ''
+
+const files = manifest?.files ?? []
+const hashMismatches = []
+for (const relativePath of files) {
+  const fullPath = path.join(packageDir, relativePath)
+  const expected = manifest?.fileHashes?.[relativePath]
+  const actual = fs.existsSync(fullPath) ? sha256(fullPath) : null
+  if (!expected || actual !== expected) hashMismatches.push({ relativePath, expected, actual })
+}
+const recomputedDigest = manifest
+  ? crypto.createHash('sha256').update(JSON.stringify({ files: manifest.files, fileHashes: manifest.fileHashes })).digest('hex')
+  : null
+const payloadText = signatureRecord?.payload ? JSON.stringify(signatureRecord.payload) : ''
+let signatureOk = false
+try {
+  signatureOk = Boolean(publicKeyPem && signatureRecord?.signature && crypto.verify(null, Buffer.from(payloadText), publicKeyPem, Buffer.from(signatureRecord.signature, 'base64')))
+} catch {
+  signatureOk = false
+}
+
+const checks = [
+  check('SIG01', 'manifest exists', Boolean(manifest), manifestPath),
+  check('SIG02', 'signature record exists', Boolean(signatureRecord), signaturePath),
+  check('SIG03', 'public key exists', Boolean(publicKeyPem), publicKeyPath),
+  check('SIG04', 'all file hashes match manifest', hashMismatches.length === 0, hashMismatches.length ? JSON.stringify(hashMismatches.slice(0, 5)) : 'all files'),
+  check('SIG05', 'manifest package digest matches file hash table', Boolean(manifest?.integrity?.packageDigest && recomputedDigest === manifest.integrity.packageDigest), 'integrity.packageDigest'),
+  check('SIG06', 'signature payload matches manifest digest', Boolean(signatureRecord?.payload?.packageDigest && signatureRecord.payload.packageDigest === manifest?.integrity?.packageDigest), 'signature payload packageDigest'),
+  check('SIG07', 'signature verifies with public key', signatureOk, 'ed25519 signature'),
+  check('SIG08', 'public key fingerprint matches signature record', Boolean(publicKeyPem && signatureRecord?.publicKeyFingerprint === fingerprint(publicKeyPem)), 'public key fingerprint'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  packageDir,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { packageSignature: failed === 0 ? 'verified' : 'failed' },
+  checks,
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)
+