@t275005746/gse 0.1.0 → 0.1.2

package/scripts/audit-fresh-session-readiness.mjs

@@ -1,177 +1,177 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-function section(markdown, heading) {
-  const lines = markdown.split(/\r?\n/)
-  const start = lines.findIndex((line) => line.trim() === '## ' + heading)
-  if (start === -1) return ''
-  const body = []
-  for (let index = start + 1; index < lines.length; index += 1) {
-    const line = lines[index]
-    if (line.startsWith('## ')) break
-    body.push(line)
-  }
-  return body.join('\n').trim()
-}
-
-const requiredInputs = [
-  'SKILL.md',
-  '.gse/gse-design-master-plan.md',
-  '.gse/goal-map.md',
-  '.gse/current-slice.md',
-  'references/forward-test.md',
-  'references/evidence-taxonomy.md',
-]
-
-const skill = read('SKILL.md')
-const masterPlan = read('.gse/gse-design-master-plan.md')
-const goalMap = read('.gse/goal-map.md')
-const currentSlice = read('.gse/current-slice.md')
-const forwardTest = read('references/forward-test.md')
-const taxonomy = read('references/evidence-taxonomy.md')
-
-const outcome = section(currentSlice, 'Outcome')
-const scope = section(currentSlice, 'Scope')
-const acceptance = section(currentSlice, 'Acceptance')
-const evidence = section(currentSlice, 'Evidence') || section(currentSlice, 'Evidence Plan')
-const nextAction = section(currentSlice, 'Next Action')
-
-const probePacketLines = [
-  '# GSE Fresh-Session Probe Packet',
-  '',
-  'Purpose: verify whether a separate session can continue GSE development without hidden conversation history.',
-  '',
-  'Read these files in order:',
-  ...requiredInputs.map((item) => '- ' + item),
-  '',
-  'Task for the fresh session:',
-  '- Identify the active GSE slice from `.gse/current-slice.md`.',
-  '- State outcome, scope, acceptance, evidence, risk, and next action.',
-  '- Do not claim accepted unless a separate session actually ran the path or an explicit policy accepts it.',
-  '- Do not invent subagent, MCP, LSP, browser, model, hook, or host support.',
-  '',
-  'Expected active slice:',
-  outcome || '(missing)',
-  '',
-  'Expected next action:',
-  nextAction || '(missing)',
-  '',
-  'Required response fields:',
-  '- Forward-test level',
-  '- Scenario',
-  '- Changed behavior',
-  '- Commands or inspection',
-  '- Result evidence',
-  '- Verification evidence',
-  '- Accepted by',
-  '- Residual risk',
-  '- Next action',
-]
-const probePacket = probePacketLines.join('\n') + '\n'
-
-const checks = [
-  check('FS01', 'required startup inputs exist', requiredInputs.every(exists), requiredInputs.join(', ')),
-  check('FS02', 'SKILL routes GSE changes through control and validation', skill.includes('references/router.md') && skill.includes('scripts/validate-gse.mjs') && skill.includes('references/forward-test.md'), 'SKILL.md'),
-  check('FS03', 'master plan preserves fresh-session boundary after owner acceptance', masterPlan.includes('owner-approved AION project-write acceptance is executed') && (masterPlan.includes('fresh-session acceptance remains optional future confidence evidence') || masterPlan.includes('Marketplace discovery, public key custody, and cross-host native command execution remain final-form work') || masterPlan.includes('Marketplace discovery and real host UI invocation remain final-form work') || masterPlan.includes('Public marketplace approval, public registry publication, other host runtime invocation records, and host-native slash-command execution remain final-form work') || masterPlan.includes('Remaining final-form work is real public security contact approval, real public repository settings, public CI run, real public registry publication, real public marketplace approval, host-native slash-command support, and other host runtime invocation records.')), '.gse/gse-design-master-plan.md'),
-  check('FS04', 'goal map exposes active slice and next action without hidden history', goalMap.includes('- Active slice:') && goalMap.includes('- Next action:') && goalMap.includes('scripts/audit-fresh-session-readiness.mjs'), '.gse/goal-map.md'),
-  check('FS05', 'current slice has required GSE fields', Boolean(outcome && scope && acceptance && evidence && nextAction), 'Outcome, Scope, Acceptance, Evidence or Evidence Plan, Next Action'),
-  check('FS06', 'probe packet explicitly avoids false acceptance', probePacket.includes('Do not claim accepted unless a separate session actually ran the path or an explicit policy accepts it.'), 'generated probe packet'),
-  check('FS07', 'forward-test protocol defines fresh-session acceptance rules', forwardTest.includes('Fresh-session forward test') && forwardTest.includes('accepted by: fresh-session') && forwardTest.includes('separate agent/session actually ran the path'), 'references/forward-test.md'),
-  check('FS08', 'evidence taxonomy supports result verified accepted labels', taxonomy.includes('result -> verified -> accepted') && taxonomy.includes('Not enough for `accepted`'), 'references/evidence-taxonomy.md'),
-  check('FS09', 'probe packet uses only documented inputs', requiredInputs.every((item) => probePacket.includes(item)) && probePacket.includes('without hidden conversation history'), 'generated probe packet'),
-  check('FS10', 'probe packet asks for evidence taxonomy and residual risk', probePacket.includes('Accepted by') && probePacket.includes('Residual risk') && probePacket.includes('Do not claim accepted'), 'generated probe packet fields'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  level: 'fresh-session readiness probe',
-  scenario: 'Prepare a separate-session GSE continuation packet using documented startup inputs.',
-  changedBehavior: 'GSE now has a repeatable readiness check for fresh-session acceptance without overstating acceptance when no separate-session tool is available.',
-  evidenceStatus: failed === 0 ? 'verified' : 'result',
-  acceptedBy: 'not accepted; no separate-session tool was available to execute the probe in this run',
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { freshSessionReadiness: failed === 0 ? 'verified' : 'failed', freshSessionAcceptance: 'not accepted' },
-  commandsOrInspection: [
-    'Read documented startup inputs: ' + requiredInputs.join(', '),
-    'Generate fresh-session probe packet from current slice and forward-test rules',
-    'Verify accepted status is not claimed without a real separate-session run',
-  ],
-  probePacket,
-  residualRisk: [
-    'This readiness probe is not a true fresh-session run.',
-    'The result cannot be marked accepted until a separate session, thread, or host-specific equivalent actually follows the packet.',
-    'Host-specific thread/subagent tools must be verified before using them as acceptance evidence.',
-  ],
-  nextAction: 'When a separate-session or thread tool is available, run the probe packet and record accepted or failed evidence.',
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Fresh-Session Readiness Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Record')
-  lines.push('')
-  lines.push('- Forward-test level: ' + data.level)
-  lines.push('- Scenario: ' + data.scenario)
-  lines.push('- Changed behavior: ' + data.changedBehavior)
-  lines.push('- Result evidence: probe packet generated from documented inputs')
-  lines.push('- Verification evidence: ' + data.summary.passed + '/' + data.summary.total + ' checks passed')
-  lines.push('- Evidence status: ' + data.evidenceStatus)
-  lines.push('- Accepted by: ' + data.acceptedBy)
-  lines.push('- Next action: ' + data.nextAction)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Probe Packet')
-  lines.push('')
-  lines.push('```text')
-  lines.push(data.probePacket.trimEnd())
-  lines.push('```')
-  lines.push('')
-  lines.push('## Residual Risk')
-  lines.push('')
-  for (const item of data.residualRisk) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function section(markdown, heading) {
+  const lines = markdown.split(/\r?\n/)
+  const start = lines.findIndex((line) => line.trim() === '## ' + heading)
+  if (start === -1) return ''
+  const body = []
+  for (let index = start + 1; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (line.startsWith('## ')) break
+    body.push(line)
+  }
+  return body.join('\n').trim()
+}
+
+const requiredInputs = [
+  'SKILL.md',
+  '.gse/gse-design-master-plan.md',
+  '.gse/goal-map.md',
+  '.gse/current-slice.md',
+  'references/forward-test.md',
+  'references/evidence-taxonomy.md',
+]
+
+const skill = read('SKILL.md')
+const masterPlan = read('.gse/gse-design-master-plan.md')
+const goalMap = read('.gse/goal-map.md')
+const currentSlice = read('.gse/current-slice.md')
+const forwardTest = read('references/forward-test.md')
+const taxonomy = read('references/evidence-taxonomy.md')
+
+const outcome = section(currentSlice, 'Outcome')
+const scope = section(currentSlice, 'Scope')
+const acceptance = section(currentSlice, 'Acceptance')
+const evidence = section(currentSlice, 'Evidence') || section(currentSlice, 'Evidence Plan')
+const nextAction = section(currentSlice, 'Next Action')
+
+const probePacketLines = [
+  '# GSE Fresh-Session Probe Packet',
+  '',
+  'Purpose: verify whether a separate session can continue GSE development without hidden conversation history.',
+  '',
+  'Read these files in order:',
+  ...requiredInputs.map((item) => '- ' + item),
+  '',
+  'Task for the fresh session:',
+  '- Identify the active GSE slice from `.gse/current-slice.md`.',
+  '- State outcome, scope, acceptance, evidence, risk, and next action.',
+  '- Do not claim accepted unless a separate session actually ran the path or an explicit policy accepts it.',
+  '- Do not invent subagent, MCP, LSP, browser, model, hook, or host support.',
+  '',
+  'Expected active slice:',
+  outcome || '(missing)',
+  '',
+  'Expected next action:',
+  nextAction || '(missing)',
+  '',
+  'Required response fields:',
+  '- Forward-test level',
+  '- Scenario',
+  '- Changed behavior',
+  '- Commands or inspection',
+  '- Result evidence',
+  '- Verification evidence',
+  '- Accepted by',
+  '- Residual risk',
+  '- Next action',
+]
+const probePacket = probePacketLines.join('\n') + '\n'
+
+const checks = [
+  check('FS01', 'required startup inputs exist', requiredInputs.every(exists), requiredInputs.join(', ')),
+  check('FS02', 'SKILL routes GSE changes through control and validation', skill.includes('references/router.md') && skill.includes('scripts/validate-gse.mjs') && skill.includes('references/forward-test.md'), 'SKILL.md'),
+  check('FS03', 'master plan preserves fresh-session boundary after owner acceptance', masterPlan.includes('owner-approved AION project-write acceptance is executed') && (masterPlan.includes('fresh-session acceptance remains optional future confidence evidence') || masterPlan.includes('Marketplace discovery, public key custody, and cross-host native command execution remain final-form work') || masterPlan.includes('Marketplace discovery and real host UI invocation remain final-form work') || masterPlan.includes('Public marketplace approval, public registry publication, other host runtime invocation records, and host-native slash-command execution remain final-form work') || masterPlan.includes('Remaining final-form work is host-native slash-command support with real host runtime evidence.') || masterPlan.includes('The Final Form Roadmap now lives in `references/final-form-roadmap.md`')), '.gse/gse-design-master-plan.md'),
+  check('FS04', 'goal map exposes active slice and next action without hidden history', goalMap.includes('- Active slice:') && goalMap.includes('- Next action:') && goalMap.includes('scripts/audit-fresh-session-readiness.mjs'), '.gse/goal-map.md'),
+  check('FS05', 'current slice has required GSE fields', Boolean(outcome && scope && acceptance && evidence && nextAction), 'Outcome, Scope, Acceptance, Evidence or Evidence Plan, Next Action'),
+  check('FS06', 'probe packet explicitly avoids false acceptance', probePacket.includes('Do not claim accepted unless a separate session actually ran the path or an explicit policy accepts it.'), 'generated probe packet'),
+  check('FS07', 'forward-test protocol defines fresh-session acceptance rules', forwardTest.includes('Fresh-session forward test') && forwardTest.includes('accepted by: fresh-session') && forwardTest.includes('separate agent/session actually ran the path'), 'references/forward-test.md'),
+  check('FS08', 'evidence taxonomy supports result verified accepted labels', taxonomy.includes('result -> verified -> accepted') && taxonomy.includes('Not enough for `accepted`'), 'references/evidence-taxonomy.md'),
+  check('FS09', 'probe packet uses only documented inputs', requiredInputs.every((item) => probePacket.includes(item)) && probePacket.includes('without hidden conversation history'), 'generated probe packet'),
+  check('FS10', 'probe packet asks for evidence taxonomy and residual risk', probePacket.includes('Accepted by') && probePacket.includes('Residual risk') && probePacket.includes('Do not claim accepted'), 'generated probe packet fields'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  level: 'fresh-session readiness probe',
+  scenario: 'Prepare a separate-session GSE continuation packet using documented startup inputs.',
+  changedBehavior: 'GSE now has a repeatable readiness check for fresh-session acceptance without overstating acceptance when no separate-session tool is available.',
+  evidenceStatus: failed === 0 ? 'verified' : 'result',
+  acceptedBy: 'not accepted; no separate-session tool was available to execute the probe in this run',
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { freshSessionReadiness: failed === 0 ? 'verified' : 'failed', freshSessionAcceptance: 'not accepted' },
+  commandsOrInspection: [
+    'Read documented startup inputs: ' + requiredInputs.join(', '),
+    'Generate fresh-session probe packet from current slice and forward-test rules',
+    'Verify accepted status is not claimed without a real separate-session run',
+  ],
+  probePacket,
+  residualRisk: [
+    'This readiness probe is not a true fresh-session run.',
+    'The result cannot be marked accepted until a separate session, thread, or host-specific equivalent actually follows the packet.',
+    'Host-specific thread/subagent tools must be verified before using them as acceptance evidence.',
+  ],
+  nextAction: 'When a separate-session or thread tool is available, run the probe packet and record accepted or failed evidence.',
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Fresh-Session Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Record')
+  lines.push('')
+  lines.push('- Forward-test level: ' + data.level)
+  lines.push('- Scenario: ' + data.scenario)
+  lines.push('- Changed behavior: ' + data.changedBehavior)
+  lines.push('- Result evidence: probe packet generated from documented inputs')
+  lines.push('- Verification evidence: ' + data.summary.passed + '/' + data.summary.total + ' checks passed')
+  lines.push('- Evidence status: ' + data.evidenceStatus)
+  lines.push('- Accepted by: ' + data.acceptedBy)
+  lines.push('- Next action: ' + data.nextAction)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Probe Packet')
+  lines.push('')
+  lines.push('```text')
+  lines.push(data.probePacket.trimEnd())
+  lines.push('```')
+  lines.push('')
+  lines.push('## Residual Risk')
+  lines.push('')
+  for (const item of data.residualRisk) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-host-capabilities.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+const requiredCapabilities = ['native-slash-command', 'browser', 'mcp', 'lsp', 'subagent', 'ci']
+const allowedStatuses = new Set(['verified', 'documented', 'unknown', 'unavailable', 'external-required'])
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function parseCapabilityTable(text) {
+  const rows = []
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('|')) continue
+    if (/^\|\s*-+/.test(trimmed)) continue
+    if (/^\|\s*Capability\s*\|/i.test(trimmed)) continue
+    const cells = trimmed
+      .slice(1, trimmed.endsWith('|') ? -1 : undefined)
+      .split('|')
+      .map((cell) => cell.trim())
+    if (cells.length < 6) continue
+    rows.push({
+      capability: cells[0].toLowerCase(),
+      hostOrTool: cells[1],
+      status: cells[2],
+      evidence: cells[3],
+      claimBoundary: cells[4],
+      lastChecked: cells[5],
+    })
+  }
+  return rows
+}
+
+function hasConcreteEvidence(value) {
+  const normalized = String(value || '').trim().toLowerCase()
+  return Boolean(normalized && !['-', 'n/a', 'none', 'unknown', 'tbd', 'todo'].includes(normalized))
+}
+
+export function readHostCapabilities(target) {
+  const filePath = path.join(target, '.gse', 'host-capabilities.md')
+  const exists = fs.existsSync(filePath)
+  const text = exists ? readText(filePath) : ''
+  const capabilities = parseCapabilityTable(text)
+  const byCapability = new Map(capabilities.map((item) => [item.capability, item]))
+  const missingRequired = requiredCapabilities.filter((capability) => !byCapability.has(capability))
+  const invalidStatus = capabilities.filter((item) => !allowedStatuses.has(item.status))
+  const missingEvidenceForVerified = capabilities.filter((item) => item.status === 'verified' && !hasConcreteEvidence(item.evidence))
+  const nativeSlash = byCapability.get('native-slash-command') ?? null
+  const nativeSlashOverclaim =
+    nativeSlash?.status === 'verified' &&
+    (
+      !/native/i.test(nativeSlash.evidence) ||
+      /portable|text-command|run-gse-command|generate-continue-packet/i.test(nativeSlash.evidence)
+    )
+  const documentedWithoutBoundary = capabilities.filter((item) =>
+    ['documented', 'external-required'].includes(item.status) && !hasConcreteEvidence(item.claimBoundary),
+  )
+  const status = !exists
+    ? 'warning'
+    : capabilities.length === 0 ||
+      missingRequired.length > 0 ||
+      invalidStatus.length > 0 ||
+      missingEvidenceForVerified.length > 0 ||
+      nativeSlashOverclaim ||
+      documentedWithoutBoundary.length > 0
+      ? 'failed'
+      : 'passed'
+  return {
+    path: '.gse/host-capabilities.md',
+    exists,
+    status,
+    capabilities,
+    summary: {
+      requiredCapabilities,
+      total: capabilities.length,
+      verified: capabilities.filter((item) => item.status === 'verified').map((item) => item.capability),
+      documented: capabilities.filter((item) => item.status === 'documented').map((item) => item.capability),
+      unknown: capabilities.filter((item) => item.status === 'unknown').map((item) => item.capability),
+      unavailable: capabilities.filter((item) => item.status === 'unavailable').map((item) => item.capability),
+      externalRequired: capabilities.filter((item) => item.status === 'external-required').map((item) => item.capability),
+      missingRequired,
+      invalidStatus: invalidStatus.map((item) => item.capability),
+      missingEvidenceForVerified: missingEvidenceForVerified.map((item) => item.capability),
+      nativeSlashOverclaim: nativeSlashOverclaim ? ['native-slash-command'] : [],
+      documentedWithoutBoundary: documentedWithoutBoundary.map((item) => item.capability),
+    },
+  }
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture(content) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-capabilities-'))
+  const init = run('init-project.mjs', ['--target', dir, '--mode', 'enterprise', '--json'])
+  if (content) {
+    fs.writeFileSync(path.join(dir, '.gse', 'host-capabilities.md'), content.trimStart().replace(/\n/g, '\r\n'), 'utf8')
+  }
+  return { dir, init }
+}
+
+function audit(target) {
+  const resolvedTarget = path.resolve(target)
+  const hostCapabilities = readHostCapabilities(resolvedTarget)
+  const hostAdapters = readText(path.join(root, 'references', 'host-adapters.md'))
+  const toolAdapters = readText(path.join(root, 'references', 'tool-adapters.md'))
+  const qualityGates = readText(path.join(root, 'references', 'quality-gates.md'))
+  const initProject = readText(path.join(root, 'scripts', 'init-project.mjs'))
+  const continuePacket = readText(path.join(root, 'scripts', 'generate-continue-packet.mjs'))
+  const validationProfile = readText(path.join(root, 'scripts', 'run-validation-profile.mjs'))
+  const validator = readText(path.join(root, 'scripts', 'validate-gse.mjs'))
+  const checks = [
+    check('HC01', 'host capability record is present or reported as warning', hostCapabilities.exists || hostCapabilities.status === 'warning', hostCapabilities.exists ? hostCapabilities.path : 'missing host capability record warning'),
+    check('HC02', 'capability table covers required capability rows when present', !hostCapabilities.exists || hostCapabilities.summary.missingRequired.length === 0, hostCapabilities.summary.missingRequired.join(', ') || 'required capabilities present'),
+    check('HC03', 'capability statuses use allowed vocabulary', !hostCapabilities.exists || hostCapabilities.summary.invalidStatus.length === 0, hostCapabilities.summary.invalidStatus.join(', ') || Array.from(allowedStatuses).join(', ')),
+    check('HC04', 'verified capabilities include concrete evidence', !hostCapabilities.exists || hostCapabilities.summary.missingEvidenceForVerified.length === 0, hostCapabilities.summary.missingEvidenceForVerified.join(', ') || 'verified rows have evidence'),
+    check('HC05', 'native slash-command is not verified from portable command evidence', !hostCapabilities.exists || hostCapabilities.summary.nativeSlashOverclaim.length === 0, hostCapabilities.summary.nativeSlashOverclaim.join(', ') || 'native slash-command boundary preserved'),
+    check('HC06', 'documented and external-required rows include claim boundaries', !hostCapabilities.exists || hostCapabilities.summary.documentedWithoutBoundary.length === 0, hostCapabilities.summary.documentedWithoutBoundary.join(', ') || 'claim boundaries present'),
+    check('HC07', 'host/tool docs explain capability record and claim boundary', hostAdapters.includes('.gse/host-capabilities.md') && toolAdapters.includes('.gse/host-capabilities.md') && qualityGates.includes('host-capabilities'), 'references host/tool/quality docs'),
+    check('HC08', 'init-project scaffolds host capability records', initProject.includes('host-capabilities.md') && initProject.includes('native-slash-command') && initProject.includes('external-required'), 'scripts/init-project.mjs'),
+    check('HC09', 'continue packet surfaces host capability readiness', continuePacket.includes('readHostCapabilities') && continuePacket.includes('CP16') && continuePacket.includes('hostCapabilities'), 'scripts/generate-continue-packet.mjs'),
+    check('HC10', 'validation routes include host capability audit', validationProfile.includes('audit-host-capabilities.mjs') && validator.includes('audit-host-capabilities.mjs'), 'validation profile and validate-gse'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? hostCapabilities.status : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      hostCapabilityRecords: failed === 0 && hostCapabilities.status !== 'failed' ? 'verified' : 'failed',
+      nativeSlashCommandBoundary: failed === 0 ? 'verified' : 'failed',
+    },
+    hostCapabilities,
+    checks,
+    limits: [
+      'Host capability records prove local record/audit mechanics and recorded project facts.',
+      'They do not create native slash-command, browser, MCP, LSP, subagent, or CI capability.',
+      'Native slash-command support still requires real host runtime invocation evidence.',
+    ],
+  }
+}
+
+function selfTestReport() {
+  const valid = createFixture()
+  const invalid = createFixture([
+    '# Host Capabilities',
+    '',
+    '| Capability | Host/Tool | Status | Evidence | Claim Boundary | Last Checked |',
+    '|---|---|---|---|---|---|',
+    '| native-slash-command | Codex | verified | portable run-gse-command smoke | Claims native slash support | 2026-07-09 |',
+    '| browser | Playwright | verified | - | Browser smoke available | 2026-07-09 |',
+    '| mcp | MCP | maybe | - | Unknown | 2026-07-09 |',
+    '| lsp | LSP | unknown | - | Unknown | 2026-07-09 |',
+    '| subagent | Host dispatch | unknown | - | Unknown | 2026-07-09 |',
+    '| ci | GitHub Actions | documented | .github/workflows/validate-gse.yml | | 2026-07-09 |',
+    '',
+  ].join('\n'))
+  const missingDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-capabilities-missing-'))
+  fs.mkdirSync(path.join(missingDir, '.gse'), { recursive: true })
+  const validReport = audit(valid.dir)
+  const invalidReport = audit(invalid.dir)
+  const missingReport = audit(missingDir)
+  fs.rmSync(valid.dir, { recursive: true, force: true })
+  fs.rmSync(invalid.dir, { recursive: true, force: true })
+  fs.rmSync(missingDir, { recursive: true, force: true })
+  const checks = [
+    check('HCA01', 'init-project creates host capability record scaffold', valid.init.status === 0 && validReport.hostCapabilities.exists, 'scripts/init-project.mjs'),
+    check('HCA02', 'scaffold covers required capabilities', validReport.hostCapabilities.summary.missingRequired.length === 0, validReport.hostCapabilities.capabilities.map((item) => item.capability).join(', ')),
+    check('HCA03', 'missing host capability file is warning, not hard failure', missingReport.hostCapabilities.status === 'warning', 'missing fixture'),
+    check('HCA04', 'invalid status, missing verified evidence, missing boundary, and native overclaim fail', invalidReport.summary.status === 'failed' && invalidReport.hostCapabilities.summary.invalidStatus.includes('mcp') && invalidReport.hostCapabilities.summary.missingEvidenceForVerified.includes('browser') && invalidReport.hostCapabilities.summary.nativeSlashOverclaim.includes('native-slash-command') && invalidReport.hostCapabilities.summary.documentedWithoutBoundary.includes('ci'), 'invalid fixture'),
+    check('HCA05', 'audit source is wired to continue packet and validation scripts', validReport.checks.find((item) => item.id === 'HC09')?.status === 'passed' && validReport.checks.find((item) => item.id === 'HC10')?.status === 'passed', 'continue/validation wiring'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    root,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      hostCapabilityRecords: failed === 0 ? 'verified' : 'failed',
+      initProjectHostCapabilityScaffold: failed === 0 ? 'verified' : 'failed',
+      nativeSlashCommandBoundary: failed === 0 ? 'verified' : 'failed',
+    },
+    fixture: {
+      validStatus: validReport.hostCapabilities.status,
+      invalidStatus: invalidReport.hostCapabilities.status,
+      missingStatus: missingReport.hostCapabilities.status,
+    },
+    checks,
+    limits: [
+      'This self-test verifies scaffold, parsing, and claim-boundary mechanics.',
+      'It does not prove live host capabilities.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const report = targetArg ? audit(targetArg) : selfTestReport()
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}