@t275005746/gse 0.1.0 → 0.1.2

package/scripts/audit-marketplace-discovery.mjs

@@ -1,122 +1,122 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function readJson(relativePath) {
-  try {
-    return JSON.parse(read(relativePath))
-  } catch {
-    return null
-  }
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const listingText = read('assets/marketplace/gse-listing.json')
-const listing = readJson('assets/marketplace/gse-listing.json')
-const marketplaceRef = read('references/marketplace-discovery.md')
-const packaging = read('references/packaging.md')
-const openai = read('agents/openai.yaml')
-const validate = read('scripts/validate-gse.mjs')
-
-const keywords = new Set(Array.isArray(listing?.keywords) ? listing.keywords : [])
-const categories = new Set(Array.isArray(listing?.categories) ? listing.categories : [])
-const entrypoints = new Set(Array.isArray(listing?.entrypoints) ? listing.entrypoints : [])
-const verification = Array.isArray(listing?.verification) ? listing.verification : []
-const hostSupport = Array.isArray(listing?.hostSupport) ? listing.hostSupport : []
-const boundaries = Array.isArray(listing?.boundaries) ? listing.boundaries.join('\n') : ''
-const privateLeakPattern = new RegExp(
-  [
-    ['C:', 'Users', 'Admin'].join('[\\\\\\\\/]'),
-    ['D:', 'codex'].join('[\\\\\\\\/]'),
-    ['hermes', 'workspace'].join('[-_]'),
-    ['node', 'banana'].join('[-_]'),
-  ].join('|'),
-  'i',
-)
-const noPrivateOrLocalLeak =
-  !privateLeakPattern.test(listingText) &&
-  !privateLeakPattern.test(marketplaceRef)
-
-const checks = [
-  check('MD01', 'marketplace listing metadata exists and parses', Boolean(listing), 'assets/marketplace/gse-listing.json'),
-  check('MD02', 'listing has searchable identity and summary', listing?.name === 'gse' && listing?.displayName === 'GSE' && typeof listing?.tagline === 'string' && listing.tagline.length > 20 && typeof listing?.summary === 'string' && listing.summary.includes('Goal-Spec-Evidence'), 'name, displayName, tagline, summary'),
-  check('MD03', 'listing uses natural ecosystem keywords', ['agentic engineering', 'spec-driven development', 'SDD', 'AI coding agent workflow', 'evidence gates', 'goal map'].every((item) => keywords.has(item)), 'keywords'),
-  check('MD04', 'listing classifies project category without keyword stuffing block', categories.has('agentic engineering') && categories.has('software development workflow') && marketplaceRef.includes('Do not add isolated search-term blocks'), 'categories and marketplace reference'),
-  check('MD05', 'listing exposes human and machine entrypoints', ['SKILL.md', 'README.md', 'README.zh-CN.md', 'scripts/run-gse-command.mjs', 'scripts/validate-gse.mjs'].every((item) => entrypoints.has(item)), 'entrypoints'),
-  check('MD06', 'listing exposes validation commands', verification.some((item) => item.includes('validate-gse.mjs')) && verification.some((item) => item.includes('audit-marketplace-discovery.mjs')) && verification.some((item) => item.includes('audit-host-ui-invocation.mjs')), 'verification commands'),
-  check('MD07', 'listing separates host support status from proof', hostSupport.some((item) => item.host.includes('Codex') && item.status === 'documented') && hostSupport.some((item) => item.host.includes('Claude') && item.status === 'documented') && boundaries.includes('native host UI invocation require separate evidence'), 'hostSupport and boundaries'),
-  check('MD08', 'release trust and distribution references are linked', listing?.distribution?.packageScript === 'scripts/package-gse.mjs' && listing?.distribution?.trustPolicy === 'references/release-trust.md' && packaging.includes('references/marketplace-discovery.md'), 'distribution metadata and packaging reference'),
-  check('MD09', 'OpenAI host metadata remains present', openai.includes('display_name: "GSE"') && openai.includes('default_prompt'), 'agents/openai.yaml'),
-  check('MD10', 'validator includes marketplace discovery audit', validate.includes('audit-marketplace-discovery.mjs'), 'scripts/validate-gse.mjs'),
-  check('MD11', 'metadata avoids local/private project leakage', noPrivateOrLocalLeak, 'listing and marketplace reference'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { marketplaceDiscovery: failed === 0 ? 'verified' : 'failed' },
-  acceptedBy: 'not accepted; this audit verifies metadata readiness but does not publish to or receive approval from a marketplace',
-  limits: [
-    'This audit verifies local discovery metadata, not marketplace approval.',
-    'It does not prove maintainer identity, public registry publication, ranking, search indexing, or host-native installation.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Marketplace Discovery Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Marketplace discovery: ' + data.workflows.marketplaceDiscovery)
-  lines.push('- Accepted by: ' + data.acceptedBy)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function readJson(relativePath) {
+  try {
+    return JSON.parse(read(relativePath))
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const listingText = read('assets/marketplace/gse-listing.json')
+const listing = readJson('assets/marketplace/gse-listing.json')
+const marketplaceRef = read('references/marketplace-discovery.md')
+const packaging = read('references/packaging.md')
+const openai = read('agents/openai.yaml')
+const validate = read('scripts/validate-gse.mjs')
+
+const keywords = new Set(Array.isArray(listing?.keywords) ? listing.keywords : [])
+const categories = new Set(Array.isArray(listing?.categories) ? listing.categories : [])
+const entrypoints = new Set(Array.isArray(listing?.entrypoints) ? listing.entrypoints : [])
+const verification = Array.isArray(listing?.verification) ? listing.verification : []
+const hostSupport = Array.isArray(listing?.hostSupport) ? listing.hostSupport : []
+const boundaries = Array.isArray(listing?.boundaries) ? listing.boundaries.join('\n') : ''
+const privateLeakPattern = new RegExp(
+  [
+    ['C:', 'Users', 'Admin'].join('[\\\\\\\\/]'),
+    ['D:', 'codex'].join('[\\\\\\\\/]'),
+    ['hermes', 'workspace'].join('[-_]'),
+    ['node', 'banana'].join('[-_]'),
+  ].join('|'),
+  'i',
+)
+const noPrivateOrLocalLeak =
+  !privateLeakPattern.test(listingText) &&
+  !privateLeakPattern.test(marketplaceRef)
+
+const checks = [
+  check('MD01', 'marketplace listing metadata exists and parses', Boolean(listing), 'assets/marketplace/gse-listing.json'),
+  check('MD02', 'listing has searchable identity and summary', listing?.name === 'gse' && listing?.displayName === 'GSE' && typeof listing?.tagline === 'string' && listing.tagline.length > 20 && typeof listing?.summary === 'string' && listing.summary.includes('Goal-Spec-Evidence'), 'name, displayName, tagline, summary'),
+  check('MD03', 'listing uses natural ecosystem keywords', ['agentic engineering', 'spec-driven development', 'SDD', 'AI coding agent workflow', 'evidence gates', 'goal map'].every((item) => keywords.has(item)), 'keywords'),
+  check('MD04', 'listing classifies project category without keyword stuffing block', categories.has('agentic engineering') && categories.has('software development workflow') && marketplaceRef.includes('Do not add isolated search-term blocks'), 'categories and marketplace reference'),
+  check('MD05', 'listing exposes human and machine entrypoints', ['SKILL.md', 'README.md', 'README.zh-CN.md', 'scripts/run-gse-command.mjs', 'scripts/validate-gse.mjs'].every((item) => entrypoints.has(item)), 'entrypoints'),
+  check('MD06', 'listing exposes validation commands', verification.some((item) => item.includes('validate-gse.mjs')) && verification.some((item) => item.includes('audit-marketplace-discovery.mjs')) && verification.some((item) => item.includes('audit-host-ui-invocation.mjs')), 'verification commands'),
+  check('MD07', 'listing separates host support status from proof', hostSupport.some((item) => item.host.includes('Codex') && item.status === 'documented') && hostSupport.some((item) => item.host.includes('Claude') && item.status === 'documented') && boundaries.includes('native host UI invocation require separate evidence'), 'hostSupport and boundaries'),
+  check('MD08', 'release trust and distribution references are linked', listing?.distribution?.packageScript === 'scripts/package-gse.mjs' && listing?.distribution?.trustPolicy === 'references/release-trust.md' && packaging.includes('references/marketplace-discovery.md'), 'distribution metadata and packaging reference'),
+  check('MD09', 'OpenAI host metadata remains present', openai.includes('display_name: "GSE"') && openai.includes('default_prompt'), 'agents/openai.yaml'),
+  check('MD10', 'validator includes marketplace discovery audit', validate.includes('audit-marketplace-discovery.mjs'), 'scripts/validate-gse.mjs'),
+  check('MD11', 'metadata avoids local/private project leakage', noPrivateOrLocalLeak, 'listing and marketplace reference'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { marketplaceDiscovery: failed === 0 ? 'verified' : 'failed' },
+  acceptedBy: 'not accepted; this audit verifies metadata readiness but does not publish to or receive approval from a marketplace',
+  limits: [
+    'This audit verifies local discovery metadata, not marketplace approval.',
+    'It does not prove maintainer identity, public registry publication, ranking, search indexing, or host-native installation.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Marketplace Discovery Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Marketplace discovery: ' + data.workflows.marketplaceDiscovery)
+  lines.push('- Accepted by: ' + data.acceptedBy)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-npm-package-metadata.mjs

@@ -1,155 +1,161 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function readJson(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  if (!fs.existsSync(fullPath)) return null
-  try {
-    return JSON.parse(fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, ''))
-  } catch {
-    return null
-  }
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function run(command, commandArgs) {
-  const result = spawnSync(command, commandArgs, {
-    cwd: root,
-    encoding: 'utf8',
-    windowsHide: true,
-  })
-  return {
-    command: [command, ...commandArgs].join(' '),
-    status: result.status ?? 1,
-    stdout: (result.stdout ?? '').trim(),
-    stderr: (result.stderr ?? '').trim(),
-  }
-}
-
-function parseJson(text) {
-  try {
-    return JSON.parse(text)
-  } catch {
-    return null
-  }
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const pkg = readJson('package.json')
-const packRun = process.platform === 'win32'
-  ? run('cmd', ['/c', 'npm', 'pack', '--dry-run', '--json'])
-  : run('npm', ['pack', '--dry-run', '--json'])
-const packData = parseJson(packRun.stdout)
-const packFiles = new Set((Array.isArray(packData) ? packData[0]?.files : []).map((item) => item.path))
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function readJson(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  if (!fs.existsSync(fullPath)) return null
+  try {
+    return JSON.parse(fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    return null
+  }
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const pkg = readJson('package.json')
+const packRun = process.platform === 'win32'
+  ? run('cmd', ['/c', 'npm', 'pack', '--dry-run', '--json'])
+  : run('npm', ['pack', '--dry-run', '--json'])
+const packData = parseJson(packRun.stdout)
+const packFiles = new Set((Array.isArray(packData) ? packData[0]?.files : []).map((item) => item.path))
 const packageFiles = new Set(pkg?.files ?? [])
-const requiredPackageFiles = [
-  'SKILL.md',
-  'README.md',
-  'README.zh-CN.md',
-  'LICENSE',
-  'package.json',
-  'scripts/gse.mjs',
-  'scripts/audit-npm-tarball-install.mjs',
-  'scripts/validate-gse.mjs',
-  'scripts/run-gse-command.mjs',
-  'references/commands.md',
-  'references/packaging.md',
-]
-const requiredFilesWhitelist = [
-  'SKILL.md',
-  'README.md',
-  'README.zh-CN.md',
-  'LICENSE',
-  'scripts',
-  'references',
-]
-
-const checks = [
-  check('NPM01', 'package.json exists and parses', Boolean(pkg), 'package.json'),
-  check('NPM02', 'package uses the accepted MIT license', pkg?.license === 'MIT' && exists('LICENSE'), 'license=' + (pkg?.license ?? 'missing')),
-  check('NPM03', 'package declares ESM and Node runtime floor', pkg?.type === 'module' && /^>=18\b/.test(pkg?.engines?.node ?? ''), 'type=' + (pkg?.type ?? 'missing') + ', node=' + (pkg?.engines?.node ?? 'missing')),
-  check('NPM04', 'package exposes gse CLI bin entrypoint', pkg?.bin?.gse === 'scripts/gse.mjs' && exists('scripts/gse.mjs'), 'bin.gse=' + (pkg?.bin?.gse ?? 'missing')),
-  check('NPM05', 'package exposes validation and npm audit scripts', pkg?.scripts?.validate?.includes('validate-gse.mjs') && pkg?.scripts?.['audit:npm']?.includes('audit-npm-package-metadata.mjs') && pkg?.scripts?.['audit:npm-install']?.includes('audit-npm-tarball-install.mjs'), 'scripts.validate, scripts.audit:npm, and scripts.audit:npm-install'),
-  check('NPM06', 'files whitelist includes core skill content', requiredFilesWhitelist.every((item) => packageFiles.has(item)), requiredFilesWhitelist.join(', ')),
-  check('NPM07', 'npm pack dry-run succeeds', packRun.status === 0 && Array.isArray(packData) && packData.length === 1, packRun.command, packRun.stderr),
-  check('NPM08', 'npm pack dry-run includes required runtime files', requiredPackageFiles.every((item) => packFiles.has(item)), requiredPackageFiles.filter((item) => !packFiles.has(item)).join(', ') || 'all required files present'),
-  check('NPM09', 'npm package metadata does not claim registry publication', !pkg?.publishConfig && !pkg?.repository, 'no publishConfig or repository claim until public repo/channel evidence exists'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: {
-    npmPackageMetadata: failed === 0 ? 'verified' : 'failed',
-    npmPackDryRun: packRun.status === 0 ? 'verified' : 'failed',
-  },
-  package: pkg
-    ? {
-        name: pkg.name,
-        version: pkg.version,
-        bin: pkg.bin,
-        license: pkg.license,
-        files: pkg.files?.length ?? 0,
-      }
-    : null,
-  commands: [packRun.command],
-  limits: [
-    'This audit verifies Node package metadata and npm pack dry-run only.',
-    'It does not publish GSE to npm, prove package name ownership, prove public repository settings, or prove marketplace approval.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE npm Package Metadata Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- npm package metadata: ' + data.workflows.npmPackageMetadata)
-  lines.push('- npm pack dry-run: ' + data.workflows.npmPackDryRun)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+const repositoryUrl = typeof pkg?.repository === 'string' ? pkg.repository : pkg?.repository?.url
+const expectedRepositoryUrls = new Set([
+  'git+https://github.com/275005746/gse.git',
+  'https://github.com/275005746/gse.git',
+  'https://github.com/275005746/gse',
+])
+const requiredPackageFiles = [
+  'SKILL.md',
+  'README.md',
+  'README.zh-CN.md',
+  'LICENSE',
+  'package.json',
+  'scripts/gse.mjs',
+  'scripts/audit-npm-tarball-install.mjs',
+  'scripts/validate-gse.mjs',
+  'scripts/run-gse-command.mjs',
+  'references/commands.md',
+  'references/packaging.md',
+]
+const requiredFilesWhitelist = [
+  'SKILL.md',
+  'README.md',
+  'README.zh-CN.md',
+  'LICENSE',
+  'scripts',
+  'references',
+]
+
+const checks = [
+  check('NPM01', 'package.json exists and parses', Boolean(pkg), 'package.json'),
+  check('NPM02', 'package uses the accepted MIT license', pkg?.license === 'MIT' && exists('LICENSE'), 'license=' + (pkg?.license ?? 'missing')),
+  check('NPM03', 'package declares ESM and Node runtime floor', pkg?.type === 'module' && /^>=18\b/.test(pkg?.engines?.node ?? ''), 'type=' + (pkg?.type ?? 'missing') + ', node=' + (pkg?.engines?.node ?? 'missing')),
+  check('NPM04', 'package exposes gse CLI bin entrypoint', pkg?.bin?.gse === 'scripts/gse.mjs' && exists('scripts/gse.mjs'), 'bin.gse=' + (pkg?.bin?.gse ?? 'missing')),
+  check('NPM05', 'package exposes validation and npm audit scripts', pkg?.scripts?.validate?.includes('validate-gse.mjs') && pkg?.scripts?.['audit:npm']?.includes('audit-npm-package-metadata.mjs') && pkg?.scripts?.['audit:npm-install']?.includes('audit-npm-tarball-install.mjs'), 'scripts.validate, scripts.audit:npm, and scripts.audit:npm-install'),
+  check('NPM06', 'files whitelist includes core skill content', requiredFilesWhitelist.every((item) => packageFiles.has(item)), requiredFilesWhitelist.join(', ')),
+  check('NPM07', 'npm pack dry-run succeeds', packRun.status === 0 && Array.isArray(packData) && packData.length === 1, packRun.command, packRun.stderr),
+  check('NPM08', 'npm pack dry-run includes required runtime files', requiredPackageFiles.every((item) => packFiles.has(item)), requiredPackageFiles.filter((item) => !packFiles.has(item)).join(', ') || 'all required files present'),
+  check('NPM09', 'npm package metadata points at the public GSE repository without publishConfig overrides', !pkg?.publishConfig && expectedRepositoryUrls.has(repositoryUrl), 'repository=' + (repositoryUrl ?? 'missing') + ', publishConfig=' + (pkg?.publishConfig ? 'present' : 'absent')),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    npmPackageMetadata: failed === 0 ? 'verified' : 'failed',
+    npmPackDryRun: packRun.status === 0 ? 'verified' : 'failed',
+  },
+  package: pkg
+    ? {
+        name: pkg.name,
+        version: pkg.version,
+        bin: pkg.bin,
+        license: pkg.license,
+        files: pkg.files?.length ?? 0,
+      }
+    : null,
+  commands: [packRun.command],
+  limits: [
+    'This audit verifies Node package metadata and npm pack dry-run only.',
+    'It does not publish GSE to npm, prove package name ownership, prove public repository settings, or prove marketplace approval.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE npm Package Metadata Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- npm package metadata: ' + data.workflows.npmPackageMetadata)
+  lines.push('- npm pack dry-run: ' + data.workflows.npmPackDryRun)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)