@t275005746/gse 0.1.0 → 0.1.2

package/scripts/audit-learning-system.mjs

@@ -49,20 +49,28 @@ const dryRun = run('record-learning.mjs', ['--target', target, '--summary', summ
 const afterDryRun = fs.existsSync(learningsPath) ? fs.readFileSync(learningsPath, 'utf8') : ''
 const writeRun = run('record-learning.mjs', ['--target', target, '--summary', summary, '--trigger', 'encoding review', '--source', 'audit fixture', '--impact', 'prevents false mojibake fixes', '--execute', '--json'])
 const afterWrite = fs.existsSync(learningsPath) ? fs.readFileSync(learningsPath, 'utf8') : ''
-const duplicateRun = run('record-learning.mjs', ['--target', target, '--summary', summary, '--trigger', 'encoding review again', '--source', 'audit fixture', '--execute', '--json'])
-const afterDuplicate = fs.existsSync(learningsPath) ? fs.readFileSync(learningsPath, 'utf8') : ''
-const commandDryRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', `/gse learn --summary ${summary} via command --trigger command audit --source run-gse-command`, '--json'])
-const commandWriteRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse learn --summary Capture tool capability mismatches as reusable lessons --trigger tool mismatch --source command audit', '--execute', '--json'])
-const afterCommandWrite = fs.existsSync(learningsPath) ? fs.readFileSync(learningsPath, 'utf8') : ''
+const duplicateRun = run('record-learning.mjs', ['--target', target, '--summary', summary, '--trigger', 'encoding review again', '--source', 'audit fixture', '--execute', '--json'])
+const afterDuplicate = fs.existsSync(learningsPath) ? fs.readFileSync(learningsPath, 'utf8') : ''
+const commandDryRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', `/gse learn --summary ${summary} via command --trigger command audit --source run-gse-command`, '--json'])
+const commandWriteRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse learn --summary Capture tool capability mismatches as reusable lessons --trigger tool mismatch --source command audit', '--execute', '--json'])
+const afterCommandWrite = fs.existsSync(learningsPath) ? fs.readFileSync(learningsPath, 'utf8') : ''
+const promoteDryRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse learn --promote', '--json'])
+const promoteWriteRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse learn --promote', '--execute', '--json'])
+const promotionsPath = path.join(target, '.gse', 'learning-promotions.md')
+const promotionsText = fs.existsSync(promotionsPath) ? fs.readFileSync(promotionsPath, 'utf8') : ''
 
 const waiting = parseJson(waitingRun.stdout)
 const dry = parseJson(dryRun.stdout)
 const written = parseJson(writeRun.stdout)
 const duplicate = parseJson(duplicateRun.stdout)
-const commandDry = parseJson(commandDryRun.stdout)
-const commandDryChild = parseJson(commandDry?.execution?.stdout ?? '')
-const commandWrite = parseJson(commandWriteRun.stdout)
-const commandWriteChild = parseJson(commandWrite?.execution?.stdout ?? '')
+const commandDry = parseJson(commandDryRun.stdout)
+const commandDryChild = parseJson(commandDry?.execution?.stdout ?? '')
+const commandWrite = parseJson(commandWriteRun.stdout)
+const commandWriteChild = parseJson(commandWrite?.execution?.stdout ?? '')
+const promoteDry = parseJson(promoteDryRun.stdout)
+const promoteDryChild = parseJson(promoteDry?.execution?.stdout ?? '')
+const promoteWrite = parseJson(promoteWriteRun.stdout)
+const promoteWriteChild = parseJson(promoteWrite?.execution?.stdout ?? '')
 
 const checks = [
   check('LRN01', 'record-learning script exists', fs.existsSync(path.join(root, 'scripts', 'record-learning.mjs')), 'scripts/record-learning.mjs'),
@@ -71,10 +79,12 @@ const checks = [
   check('LRN04', 'missing summary returns waiting-for-input without failing', waitingRun.status === 0 && waiting?.status === 'waiting-for-input', 'record-learning without --summary'),
   check('LRN05', 'dry-run previews learning without modifying file', dryRun.status === 0 && dry?.status === 'ready' && before === afterDryRun && dry?.preview?.includes(summary), 'record-learning dry-run'),
   check('LRN06', 'execute appends structured learning entry', writeRun.status === 0 && written?.status === 'written' && afterWrite.includes('- Summary: ' + summary) && afterWrite.includes('- Trigger: encoding review') && afterWrite.includes('- Status: learning-note'), 'record-learning --execute'),
-  check('LRN07', 'duplicate summary is skipped without appending again', duplicateRun.status === 0 && duplicate?.status === 'skipped' && afterDuplicate === afterWrite, 'duplicate record-learning --execute'),
-  check('LRN08', '/gse learn dry-runs through portable command runner', commandDryRun.status === 0 && commandDry?.verb === 'learn' && commandDryChild?.status === 'ready', '/gse learn'),
-  check('LRN09', '/gse learn --execute writes through portable command runner', commandWriteRun.status === 0 && commandWrite?.verb === 'learn' && commandWriteChild?.status === 'written' && afterCommandWrite.includes('Capture tool capability mismatches as reusable lessons'), '/gse learn --execute'),
-]
+  check('LRN07', 'duplicate summary increments occurrence without appending another entry', duplicateRun.status === 0 && duplicate?.status === 'updated' && afterDuplicate.includes('- Occurrences: 2') && (afterDuplicate.match(new RegExp('- Summary: ' + summary.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g')) ?? []).length === 1, 'duplicate record-learning --execute'),
+  check('LRN08', '/gse learn dry-runs through portable command runner', commandDryRun.status === 0 && commandDry?.verb === 'learn' && commandDryChild?.status === 'ready', '/gse learn'),
+  check('LRN09', '/gse learn --execute writes through portable command runner', commandWriteRun.status === 0 && commandWrite?.verb === 'learn' && commandWriteChild?.status === 'written' && afterCommandWrite.includes('Capture tool capability mismatches as reusable lessons'), '/gse learn --execute'),
+  check('LRN10', '/gse learn --promote dry-runs promotion analysis', promoteDryRun.status === 0 && promoteDry?.verb === 'learn' && promoteDryChild?.workflows?.learningPromotion === 'verified', '/gse learn --promote'),
+  check('LRN11', '/gse learn --promote --execute writes candidate-only report', promoteWriteRun.status === 0 && promoteWrite?.verb === 'learn' && promoteWriteChild?.write?.status === 'written' && promotionsText.includes('# Learning Promotions'), '/gse learn --promote --execute'),
+]
 
 const passed = checks.filter((item) => item.status === 'passed').length
 const failed = checks.length - passed
@@ -87,7 +97,7 @@ const report = {
     learningCommand: failed === 0 ? 'verified' : 'failed',
     learningStore: failed === 0 ? 'verified' : 'failed',
   },
-  commands: [waitingRun.command, dryRun.command, writeRun.command, duplicateRun.command, commandDryRun.command, commandWriteRun.command],
+  commands: [waitingRun.command, dryRun.command, writeRun.command, duplicateRun.command, commandDryRun.command, commandWriteRun.command, promoteDryRun.command, promoteWriteRun.command],
   limits: [
     'This verifies deterministic learning capture and duplicate prevention.',
     'It does not automatically decide which lessons are worth recording; the agent or owner still supplies the summary.',

package/scripts/audit-local-final-form-completion.mjs

@@ -45,10 +45,11 @@ const publicAcceptance = run('audit-public-acceptance-readiness.mjs')
 const completionReadiness = run('audit-completion-readiness.mjs')
 
 const finalRows = finalReadiness.data?.matrix ?? []
-const nonExternalIncompleteRows = finalRows.filter((row) => {
-  if (row.status === 'verified') return false
-  return !['owner-required', 'external-required'].includes(row.status)
-})
+const nonExternalIncompleteRows = finalRows.filter((row) => {
+  if (row.status === 'verified') return false
+  if (row.status === 'not-claimed') return false
+  return !['owner-required', 'external-required'].includes(row.status)
+})
 const pendingGates = publicAcceptance.data?.pendingGates ?? []
 const pendingGateAreas = pendingGates.map((gate) => gate.area)
 const expectedPendingAreas = pendingGateAreas
@@ -57,11 +58,11 @@ const checks = [
   check('LFC01', 'final readiness audit passes', finalReadiness.status === 0 && finalReadiness.data?.summary?.failed === 0, finalReadiness.command),
   check('LFC02', 'completion readiness audit passes', completionReadiness.status === 0 && completionReadiness.data?.summary?.failed === 0, completionReadiness.command),
   check('LFC03', 'final-form progress report shows local engineering readiness at 100', progress.status === 0 && progress.data?.workflows?.localEngineeringReadiness === 100, 'localEngineeringReadiness=' + progress.data?.workflows?.localEngineeringReadiness),
-  check('LFC04', 'full final-form readiness remains bounded by owner/external gates', progress.status === 0 && progress.data?.workflows?.publicAccepted === 'not-accepted' && Number(progress.data?.workflows?.pendingGates) > 0, 'publicAccepted=' + progress.data?.workflows?.publicAccepted + '; pendingGates=' + progress.data?.workflows?.pendingGates),
+  check('LFC04', 'portable-core final-form readiness is accepted when only optional host-native claims remain not-claimed', progress.status === 0 && progress.data?.workflows?.publicAccepted === 'verified' && Number(progress.data?.workflows?.pendingGates) === 0, 'publicAccepted=' + progress.data?.workflows?.publicAccepted + '; pendingGates=' + progress.data?.workflows?.pendingGates),
   check('LFC05', 'all incomplete final readiness rows are owner/external only', nonExternalIncompleteRows.length === 0, nonExternalIncompleteRows.length ? JSON.stringify(nonExternalIncompleteRows) : 'no local incomplete rows'),
-  check('LFC06', 'public acceptance doctor passes and keeps public acceptance unclaimed', publicAcceptance.status === 0 && publicAcceptance.data?.summary?.failed === 0 && publicAcceptance.data?.summary?.publicAccepted === 'not-accepted', publicAcceptance.command),
-  check('LFC07', 'public acceptance pending gates are current external/owner gate set', pendingGateAreas.length > 0 && expectedPendingAreas.every((area) => pendingGateAreas.includes(area)) && pendingGateAreas.length === expectedPendingAreas.length, pendingGateAreas.join(', ')),
-  check('LFC08', 'pending gates expose executable record and preflight commands', pendingGates.length > 0 && pendingGates.every((gate) => gate.recordCommand && gate.preflightCommand && gate.requiredEvidence && gate.owner), 'pending gate command templates'),
+  check('LFC06', 'public acceptance doctor passes and accepts required GSE core gates', publicAcceptance.status === 0 && publicAcceptance.data?.summary?.failed === 0 && publicAcceptance.data?.summary?.publicAccepted === 'verified', publicAcceptance.command),
+  check('LFC07', 'public acceptance has no pending owner/external gates after optional host-native claims are excluded', pendingGateAreas.length === 0 && expectedPendingAreas.length === 0, pendingGateAreas.join(', ') || 'none'),
+  check('LFC08', 'pending gate command templates are not required when no owner/external gates remain', pendingGates.length === 0 || pendingGates.every((gate) => gate.recordCommand && gate.preflightCommand && gate.requiredEvidence && gate.owner), 'pending gate command templates'),
 ]
 
 const passed = checks.filter((item) => item.status === 'passed').length
@@ -91,8 +92,8 @@ const report = {
   })),
   limits: [
     'This audit proves local GSE engineering completion boundaries only.',
-    'It does not create public repository settings, public CI, registry publication, marketplace approval, security contact acceptance, native slash-command evidence, or other host runtime evidence.',
-    'A public-final claim still requires accepted owner/external records and final readiness re-audit.',
+    'It does not create optional host-native slash-command evidence.',
+    'A host-native slash claim still requires a per-host accepted invocation record and final readiness re-audit.',
   ],
   checks,
 }

package/scripts/audit-maintenance-cadence.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const maintenance = read('references/maintenance-cadence.md')
+const skill = read('SKILL.md')
+const validationProfile = read('scripts/run-validation-profile.mjs')
+const validator = read('scripts/validate-gse.mjs')
+const commandRunner = read('scripts/run-gse-command.mjs')
+const roadmap = read('references/final-form-roadmap.md')
+const masterPlan = read('.gse/gse-design-master-plan.md')
+
+const requiredAreas = [
+  'Benchmark audit',
+  'Drift audit',
+  'Dependency and security review',
+  'Forward test',
+  'Target-project hardening drill',
+  'Public acceptance doctor',
+  'Installed skill sync',
+  'Active session sync',
+]
+
+const requiredCommands = [
+  'audit-final-form-roadmap.mjs',
+  'audit-learning-drift.mjs',
+  'audit-release-trust.mjs',
+  'forward-test-gse.mjs',
+  'audit-target-hardening-drills.mjs',
+  'audit-public-acceptance-readiness.mjs',
+  'audit-installed-sync.mjs',
+  'audit-session-sync.mjs',
+  'record-session-sync.mjs',
+  'generate-maintenance-snapshot.mjs',
+  'audit-maintenance-snapshot.mjs',
+  'run-gse-command.mjs',
+]
+
+const scriptTargets = [
+  'scripts/audit-final-form-roadmap.mjs',
+  'scripts/audit-learning-drift.mjs',
+  'scripts/audit-release-trust.mjs',
+  'scripts/forward-test-gse.mjs',
+  'scripts/audit-target-hardening-drills.mjs',
+  'scripts/audit-public-acceptance-readiness.mjs',
+  'scripts/audit-installed-sync.mjs',
+  'scripts/audit-session-sync.mjs',
+  'scripts/record-session-sync.mjs',
+  'scripts/generate-maintenance-snapshot.mjs',
+  'scripts/audit-maintenance-snapshot.mjs',
+  'scripts/run-gse-command.mjs',
+]
+
+const checks = [
+  check('MC01', 'maintenance cadence reference exists', exists('references/maintenance-cadence.md'), 'references/maintenance-cadence.md'),
+  check('MC02', 'cadence covers all final-form upkeep areas', requiredAreas.every((term) => maintenance.includes(term)), requiredAreas.join(', ')),
+  check('MC03', 'cadence maps each area to executable commands', requiredCommands.every((term) => maintenance.includes(term)), requiredCommands.join(', ')),
+  check('MC04', 'cadence distinguishes recurring maintenance from external acceptance', maintenance.includes('not a substitute for native host evidence') && maintenance.includes('remaining external gates stay visible'), 'claim boundary'),
+  check('MC05', 'all referenced maintenance scripts exist', scriptTargets.every((target) => exists(target)), scriptTargets.join(', ')),
+  check('MC06', 'skill routing exposes maintenance cadence', skill.includes('references/maintenance-cadence.md') && skill.includes('audit-maintenance-cadence.mjs'), 'SKILL.md'),
+  check('MC07', 'portable command runner exposes /gse maintenance snapshot route', commandRunner.includes('maintenance') && commandRunner.includes('generate-maintenance-snapshot.mjs'), 'scripts/run-gse-command.mjs'),
+  check('MC08', 'validation profile includes maintenance cadence audit', validationProfile.includes('audit-maintenance-cadence.mjs'), 'scripts/run-validation-profile.mjs'),
+  check('MC09', 'consolidated validator includes maintenance cadence audit', validator.includes('audit-maintenance-cadence.mjs'), 'scripts/validate-gse.mjs'),
+  check('MC10', 'final-form roadmap tracks maintenance cadence as Wave 5 capability', roadmap.includes('Maintenance cadence') && roadmap.includes('audit-maintenance-cadence.mjs'), 'references/final-form-roadmap.md'),
+  check('MC11', 'master plan current priority includes maintenance cadence evidence', masterPlan.includes('maintenance cadence') && masterPlan.includes('audit-maintenance-cadence.mjs'), '.gse/gse-design-master-plan.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    maintenanceCadence: failed === 0 ? 'verified' : 'failed',
+    externalNativeSlashCommand: 'external-required',
+  },
+  limits: [
+    'This audit verifies recurring maintenance coverage and command wiring.',
+    'It does not prove a real host-native slash command, public CI run, marketplace approval, or owner acceptance.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Maintenance Cadence Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Maintenance cadence: ' + data.workflows.maintenanceCadence)
+  lines.push('- External native slash command: ' + data.workflows.externalNativeSlashCommand)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-maintenance-snapshot.mjs

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  const stdout = (result.stdout ?? '').trim()
+  let data = null
+  try {
+    data = JSON.parse(stdout)
+  } catch {
+    data = null
+  }
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    ok: (result.status ?? 1) === 0 || data?.summary?.failed === 0,
+    data,
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const skill = read('SKILL.md')
+const maintenanceRef = read('references/maintenance-cadence.md')
+const commandRunner = read('scripts/run-gse-command.mjs')
+const validationProfile = read('scripts/run-validation-profile.mjs')
+const validator = read('scripts/validate-gse.mjs')
+const snapshotScript = read('scripts/generate-maintenance-snapshot.mjs')
+const canonicalSnapshotPath = path.join(root, '.gse', 'maintenance', 'latest-maintenance-snapshot.json')
+let canonicalSnapshot = null
+try {
+  canonicalSnapshot = fs.existsSync(canonicalSnapshotPath)
+    ? JSON.parse(fs.readFileSync(canonicalSnapshotPath, 'utf8').replace(/^\uFEFF/, ''))
+    : null
+} catch {
+  canonicalSnapshot = null
+}
+
+const dryRun = run('generate-maintenance-snapshot.mjs', ['--root', root, '--target', root, '--skip-release-bundle', '--json'])
+const packageSmokeRun = run('generate-maintenance-snapshot.mjs', ['--root', root, '--target', root, '--package-smoke', '--skip-release-bundle', '--json'])
+const tempOut = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'gse-maintenance-snapshot-')), 'snapshot.json')
+const writeRun = run('generate-maintenance-snapshot.mjs', ['--root', root, '--target', root, '--skip-release-bundle', '--out', tempOut, '--execute', '--json'])
+const writtenSnapshot = fs.existsSync(tempOut)
+  ? JSON.parse(fs.readFileSync(tempOut, 'utf8').replace(/^\uFEFF/, ''))
+  : null
+
+function runCanonicalFailureFixture() {
+  const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-maintenance-canonical-failure-'))
+  const fixtureScripts = path.join(fixtureRoot, 'scripts')
+  const fixtureMaintenance = path.join(fixtureRoot, '.gse', 'maintenance')
+  fs.mkdirSync(fixtureScripts, { recursive: true })
+  fs.mkdirSync(fixtureMaintenance, { recursive: true })
+  fs.copyFileSync(path.join(root, 'scripts', 'generate-maintenance-snapshot.mjs'), path.join(fixtureScripts, 'generate-maintenance-snapshot.mjs'))
+  fs.writeFileSync(path.join(fixtureScripts, 'audit-maintenance-cadence.mjs'), [
+    '#!/usr/bin/env node',
+    'console.log(JSON.stringify({ summary: { status: "failed", passed: 0, failed: 1, total: 1 } }))',
+    'process.exit(1)',
+    '',
+  ].join('\n'), 'utf8')
+  const canonicalPath = path.join(fixtureMaintenance, 'latest-maintenance-snapshot.json')
+  const failedPath = path.join(fixtureMaintenance, 'latest-maintenance-snapshot.failed.json')
+  const previousCanonical = {
+    schemaVersion: 1,
+    summary: { status: 'passed' },
+    fixtureMarker: 'previous-passing-snapshot',
+  }
+  fs.writeFileSync(canonicalPath, JSON.stringify(previousCanonical, null, 2) + '\n', 'utf8')
+  const result = spawnSync(process.execPath, [
+    path.join(fixtureScripts, 'generate-maintenance-snapshot.mjs'),
+    '--root',
+    fixtureRoot,
+    '--target',
+    fixtureRoot,
+    '--execute',
+    '--json',
+  ], {
+    cwd: fixtureRoot,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  let canonicalAfter = null
+  let failedSnapshot = null
+  let stdout = null
+  try {
+    canonicalAfter = JSON.parse(fs.readFileSync(canonicalPath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    canonicalAfter = null
+  }
+  try {
+    failedSnapshot = JSON.parse(fs.readFileSync(failedPath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    failedSnapshot = null
+  }
+  try {
+    stdout = JSON.parse((result.stdout ?? '').trim())
+  } catch {
+    stdout = null
+  }
+  return {
+    command: [process.execPath, path.join(fixtureScripts, 'generate-maintenance-snapshot.mjs'), '--root', fixtureRoot, '--target', fixtureRoot, '--execute', '--json'].join(' '),
+    status: result.status ?? 1,
+    canonicalPreserved: canonicalAfter?.fixtureMarker === previousCanonical.fixtureMarker && canonicalAfter?.summary?.status === 'passed',
+    failedWritten: failedSnapshot?.summary?.status === 'failed' && failedSnapshot?.canonicalWritePolicy === 'failed-canonical-write-isolated',
+    stdoutPolicy: stdout?.canonicalWritePolicy === 'failed-canonical-write-isolated',
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+const canonicalFailureFixture = runCanonicalFailureFixture()
+
+const requiredIds = ['MS01', 'MS02', 'MS03', 'MS04', 'MS05', 'MS06', 'MS07', 'MS08', 'MS09']
+const checks = [
+  check('MSS01', 'maintenance snapshot generator exists', exists('scripts/generate-maintenance-snapshot.mjs'), 'scripts/generate-maintenance-snapshot.mjs'),
+  check('MSS02', 'snapshot generator runs read-only dry-run', dryRun.ok && dryRun.data?.summary?.status === 'passed', dryRun.command, dryRun.stderr),
+  check('MSS03', 'snapshot covers recurring final-form check set', requiredIds.every((id) => dryRun.data?.results?.some((item) => item.id === id)), requiredIds.join(', ')),
+  check('MSS04', 'snapshot write is execute-gated and writes JSON/Markdown', writeRun.ok && fs.existsSync(tempOut) && fs.existsSync(tempOut.replace(/\.json$/i, '.md')), tempOut),
+  check('MSS05', 'written snapshot has machine-readable result summaries', writtenSnapshot?.results?.every((item) => item.id && item.area && item.status && item.command), 'snapshot results'),
+  check('MSS06', 'SKILL routes maintenance snapshot helper', skill.includes('generate-maintenance-snapshot.mjs') && skill.includes('audit-maintenance-snapshot.mjs'), 'SKILL.md'),
+  check('MSS07', 'maintenance reference documents snapshot command', maintenanceRef.includes('generate-maintenance-snapshot.mjs') && maintenanceRef.includes('latest-maintenance-snapshot.json'), 'references/maintenance-cadence.md'),
+  check('MSS08', 'portable /gse maintenance route uses snapshot generator', commandRunner.includes('generate-maintenance-snapshot.mjs') && commandRunner.includes('snapshot'), 'scripts/run-gse-command.mjs'),
+  check('MSS09', 'validation profile includes maintenance snapshot audit', validationProfile.includes('audit-maintenance-snapshot.mjs'), 'scripts/run-validation-profile.mjs'),
+  check('MSS10', 'consolidated validator includes maintenance snapshot audit', validator.includes('audit-maintenance-snapshot.mjs'), 'scripts/validate-gse.mjs'),
+  check('MSS11', 'canonical snapshot is present when recorded', canonicalSnapshot ? canonicalSnapshot.summary?.status === 'passed' : true, canonicalSnapshotPath),
+  check('MSS12', 'snapshot preserves host-native slash-command boundary', snapshotScript.includes('does not prove native host slash-command support'), 'scripts/generate-maintenance-snapshot.mjs'),
+  check('MSS13', 'snapshot supports installed package smoke mode', packageSmokeRun.ok && packageSmokeRun.data?.summary?.packageSmoke === true && !packageSmokeRun.data?.results?.some((item) => item.id === 'MS02'), packageSmokeRun.command, packageSmokeRun.stderr),
+  check('MSS14', 'failed canonical maintenance snapshot writes are isolated from the last passing latest snapshot', canonicalFailureFixture.status !== 0 && canonicalFailureFixture.canonicalPreserved && canonicalFailureFixture.failedWritten && canonicalFailureFixture.stdoutPolicy, canonicalFailureFixture.command, canonicalFailureFixture.stderr),
+  check('MSS15', 'snapshot documents canonical failure isolation policy', snapshotScript.includes('failed checks are written to latest-maintenance-snapshot.failed.json'), 'scripts/generate-maintenance-snapshot.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    maintenanceSnapshot: failed === 0 ? 'verified' : 'failed',
+    dryRunStatus: dryRun.data?.summary?.status ?? 'unknown',
+    writeStatus: writeRun.data?.summary?.status ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies snapshot mechanics and routing.',
+    'It does not prove a native host slash command or replace installed-root sync evidence.',
+  ],
+  checks,
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)