@t275005746/gse 0.1.0 → 0.1.2

package/scripts/audit-open-source-readiness.mjs

@@ -1,97 +1,97 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const contributing = read('CONTRIBUTING.md')
-const security = read('SECURITY.md')
-const support = read('SUPPORT.md')
-const readme = read('README.md')
-const readmeZh = read('README.zh-CN.md')
-const communityChannels = read('references/community-channels.md')
-const publicRelease = read('references/public-release.md')
-const packaging = read('references/packaging.md')
-const validate = read('scripts/validate-gse.mjs')
-const changelog = read('CHANGELOG.md')
-const ciWorkflow = read('.github/workflows/validate-gse.yml')
-const prTemplate = read('.github/PULL_REQUEST_TEMPLATE.md')
-
-const checks = [
-  check('OS01', 'contributing guide exists', exists('CONTRIBUTING.md') && contributing.includes('Validation') && contributing.includes('Evidence') && contributing.includes('Do not claim support'), 'CONTRIBUTING.md'),
-  check('OS02', 'security policy exists without fake public contact', exists('SECURITY.md') && security.includes('Until a public security contact is chosen') && security.includes('release trust') && security.includes('No public vulnerability disclosure address has been owner-approved yet'), 'SECURITY.md'),
-  check('OS03', 'support guide exists with first diagnostic commands and community entry', exists('SUPPORT.md') && support.includes('validate-gse.mjs') && support.includes('audit-target-project.mjs') && support.includes('GateHub (`https://gatehub.top/`)'), 'SUPPORT.md'),
-  check('OS04', 'open-source readiness keeps license owner-gated', publicRelease.includes('GSE must not choose a license by guessing') && changelog.includes('Open-source license selection remains an owner decision'), 'references/public-release.md, CHANGELOG.md'),
-  check('OS05', 'package boundary includes open-source docs', packaging.includes('CONTRIBUTING.md') && packaging.includes('SECURITY.md') && packaging.includes('SUPPORT.md'), 'references/packaging.md'),
-  check('OS06', 'validator includes open-source readiness audit', validate.includes('audit-open-source-readiness.mjs'), 'scripts/validate-gse.mjs'),
-  check('OS07', 'public repository CI workflow is present and audited', ciWorkflow.includes('node scripts/validate-gse.mjs --root . --skip-skill-validator --json') && validate.includes('audit-ci-readiness.mjs'), '.github/workflows/validate-gse.yml, scripts/validate-gse.mjs'),
-  check('OS08', 'public collaboration templates require GSE evidence fields', prTemplate.includes('## Outcome') && prTemplate.includes('## Evidence') && validate.includes('audit-public-collaboration-templates.mjs'), '.github/PULL_REQUEST_TEMPLATE.md, scripts/validate-gse.mjs'),
-  check('OS09', 'community support channel is documented with release boundaries', exists('references/community-channels.md') && readme.includes('GateHub ([gatehub.top](https://gatehub.top/))') && readmeZh.includes('GateHub（[gatehub.top](https://gatehub.top/)）') && support.includes('GateHub (`https://gatehub.top/`)') && publicRelease.includes('references/community-channels.md') && communityChannels.includes('Do not describe GateHub as') && communityChannels.includes('vulnerability disclosure channel'), 'README.md, README.zh-CN.md, SUPPORT.md, references/community-channels.md, references/public-release.md'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { openSourceReadiness: failed === 0 ? 'verified' : 'failed' },
-  limits: [
-    'This audit verifies repository collaboration, security, and support documents.',
-    'It does not choose a license, create a public security address, publish to GitHub, or approve a marketplace listing.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Open Source Readiness Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Open source readiness: ' + data.workflows.openSourceReadiness)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const contributing = read('CONTRIBUTING.md')
+const security = read('SECURITY.md')
+const support = read('SUPPORT.md')
+const readme = read('README.md')
+const readmeZh = read('README.zh-CN.md')
+const communityChannels = read('references/community-channels.md')
+const publicRelease = read('references/public-release.md')
+const packaging = read('references/packaging.md')
+const validate = read('scripts/validate-gse.mjs')
+const changelog = read('CHANGELOG.md')
+const ciWorkflow = read('.github/workflows/validate-gse.yml')
+const prTemplate = read('.github/PULL_REQUEST_TEMPLATE.md')
+
+const checks = [
+  check('OS01', 'contributing guide exists', exists('CONTRIBUTING.md') && contributing.includes('Validation') && contributing.includes('Evidence') && contributing.includes('Do not claim support'), 'CONTRIBUTING.md'),
+  check('OS02', 'security policy exists without fake public contact', exists('SECURITY.md') && security.includes('Until a public security contact is chosen') && security.includes('release trust') && security.includes('No public vulnerability disclosure address has been owner-approved yet'), 'SECURITY.md'),
+  check('OS03', 'support guide exists with first diagnostic commands and community entry', exists('SUPPORT.md') && support.includes('validate-gse.mjs') && support.includes('audit-target-project.mjs') && support.includes('GateHub (`https://gatehub.top/`)'), 'SUPPORT.md'),
+  check('OS04', 'open-source readiness keeps license owner-gated', publicRelease.includes('GSE must not choose a license by guessing') && changelog.includes('Open-source license selection remains an owner decision'), 'references/public-release.md, CHANGELOG.md'),
+  check('OS05', 'package boundary includes open-source docs', packaging.includes('CONTRIBUTING.md') && packaging.includes('SECURITY.md') && packaging.includes('SUPPORT.md'), 'references/packaging.md'),
+  check('OS06', 'validator includes open-source readiness audit', validate.includes('audit-open-source-readiness.mjs'), 'scripts/validate-gse.mjs'),
+  check('OS07', 'public repository CI workflow is present and audited', ciWorkflow.includes('node scripts/validate-gse.mjs --root . --skip-skill-validator --json') && validate.includes('audit-ci-readiness.mjs'), '.github/workflows/validate-gse.yml, scripts/validate-gse.mjs'),
+  check('OS08', 'public collaboration templates require GSE evidence fields', prTemplate.includes('## Outcome') && prTemplate.includes('## Evidence') && validate.includes('audit-public-collaboration-templates.mjs'), '.github/PULL_REQUEST_TEMPLATE.md, scripts/validate-gse.mjs'),
+  check('OS09', 'community support channel is documented with release boundaries', exists('references/community-channels.md') && readme.includes('GateHub ([gatehub.top](https://gatehub.top/))') && readmeZh.includes('GateHub（[gatehub.top](https://gatehub.top/)）') && support.includes('GateHub (`https://gatehub.top/`)') && publicRelease.includes('references/community-channels.md') && communityChannels.includes('Do not describe GateHub as') && communityChannels.includes('vulnerability disclosure channel'), 'README.md, README.zh-CN.md, SUPPORT.md, references/community-channels.md, references/public-release.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { openSourceReadiness: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies repository collaboration, security, and support documents.',
+    'It does not choose a license, create a public security address, publish to GitHub, or approve a marketplace listing.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Open Source Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Open source readiness: ' + data.workflows.openSourceReadiness)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-owner-external-gate-kit.mjs

@@ -120,10 +120,11 @@ const skill = read('SKILL.md')
 const validate = read('scripts/validate-gse.mjs')
 const bundleGenerator = read('scripts/generate-release-bundle.mjs')
 const bundleAudit = read('scripts/audit-release-bundle.mjs')
-const expectedAreas = (manifest?.gates ?? []).map((gate) => gate.area)
-const expectedScripts = [...new Set((manifest?.gates ?? [])
-  .map((gate) => String(gate.recordCommand ?? '').match(/node scripts\/([^ ]+)/)?.[1] ?? '')
-  .filter(Boolean))]
+const expectedAreas = (manifest?.gates ?? []).map((gate) => gate.area)
+const hasPendingGates = expectedAreas.length > 0
+const expectedScripts = [...new Set((manifest?.gates ?? [])
+  .map((gate) => String(gate.recordCommand ?? '').match(/node scripts\/([^ ]+)/)?.[1] ?? '')
+  .filter(Boolean))]
 const kitRecordTemplatesAreComplete = !commands.includes('--invocation-status') &&
   !finalPacket.includes('--invocation-status') &&
   !publicHandoff.includes('--invocation-status') &&
@@ -138,7 +139,7 @@ const kitRecordTemplatesAreComplete = !commands.includes('--invocation-status')
   !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(publicHandoff) &&
   !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(releaseOwnerActionPlan) &&
   !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(hostHandoff) &&
-  commands.includes('--status accepted')
+  (hasPendingGates ? commands.includes('--status accepted') : manifest?.publicAccepted === 'verified')
 const kitVerificationCommandsAreShellSafe = !/(audit-[a-z-]+|validate-gse|generate-release-status-manifest)\.mjs[^\n`]*[<>]/.test(verificationCommands) &&
   !/(audit-[a-z-]+|validate-gse)\.mjs[^\n`]*[<>]/.test(releaseStatusManifest) &&
   !/(audit-[a-z-]+|validate-gse|generate-release-status-manifest)\.mjs[^\n`]*[<>]/.test(releaseOwnerActionPlan) &&
@@ -148,22 +149,22 @@ const checks = [
   check('OEG01', 'owner/external gate kit generator exists', exists('scripts/generate-owner-external-gate-kit.mjs'), 'scripts/generate-owner-external-gate-kit.mjs'),
   check('OEG02', 'generator produces the kit directory', generated?.status === 0 && generatedData?.status === 'written', generated?.stderr || out),
   check('OEG03', 'kit includes required files', requiredKitFilesPresent, requiredKitFiles.join(', ')),
-  check('OEG04', 'machine-readable pending gates cover current final owner/external gates', expectedAreas.length > 0 && expectedAreas.every((area) => manifest?.gates?.some((gate) => gate.area === area)) && !manifest?.gates?.some((gate) => gate.area === 'License decision'), expectedAreas.join(', ') + '; License decision resolved'),
-  check('OEG05', 'record commands map to real scripts', expectedScripts.length > 0 && expectedScripts.every((script) => commands.includes(script)) && !commands.includes('proves-public-registry-publication') && (!commands.includes('record-public-channel-publication.mjs') || commands.includes('--proves-registry-publication true') || commands.includes('--proves-marketplace-approval true')), expectedScripts.join(', ')),
-  check('OEG05b', 'record commands include dry-run preflight commands for accepted evidence', commands.includes('Preflight command') && commands.includes('--dry-run --json'), 'record-commands.md'),
+  check('OEG04', 'machine-readable pending gates cover current final owner/external gates', (hasPendingGates ? expectedAreas.every((area) => manifest?.gates?.some((gate) => gate.area === area)) : manifest?.pendingGateCount === 0 && manifest?.publicAccepted === 'verified') && !manifest?.gates?.some((gate) => gate.area === 'License decision'), hasPendingGates ? expectedAreas.join(', ') + '; License decision resolved' : '0 pending gates; publicAccepted verified; License decision resolved'),
+  check('OEG05', 'record commands map to real scripts', hasPendingGates ? (expectedScripts.length > 0 && expectedScripts.every((script) => commands.includes(script)) && !commands.includes('proves-public-registry-publication') && (!commands.includes('record-public-channel-publication.mjs') || commands.includes('--proves-registry-publication true') || commands.includes('--proves-marketplace-approval true'))) : commands.includes('GSE Owner / External Gate Record Commands'), expectedScripts.join(', ')),
+  check('OEG05b', 'record commands include dry-run preflight commands for accepted evidence', hasPendingGates ? (commands.includes('Preflight command') && commands.includes('--dry-run --json')) : !commands.includes('Preflight command'), 'record-commands.md'),
   check('OEG05c', 'kit uses complete record command templates', kitRecordTemplatesAreComplete, 'no ellipsis, no stale host invocation flag, host records use --status accepted'),
   check('OEG06', 'kit preserves anti-overclaim boundaries', readme.includes('does not choose a license') && readme.includes('Do not claim native slash-command support') && verificationCommands.includes('Local fixture drills, pointer adapters, and generated handoff files do not count as external acceptance'), 'README.md, verification-commands.md'),
   check('OEG07', 'kit verification commands include portable probe, final readiness, preflight drill, and close gate', verificationCommands.includes('run-gse-command.mjs') && verificationCommands.includes('/gse probe') && !verificationCommands.includes('node scripts/probe-public-external-gates.mjs') && verificationCommands.includes('audit-final-readiness.mjs') && verificationCommands.includes('audit-public-acceptance-readiness.mjs') && verificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs') && verificationCommands.includes('audit-close-gate.mjs'), 'verification-commands.md'),
-  check('OEG08', 'kit contains fresh final acceptance, public handoff, host handoff, manifest, and owner action plan', finalPacket.includes('GSE Final Acceptance Packet') && publicHandoff.includes('GSE Public Acceptance Handoff') && hostHandoff.includes('GSE Host Runtime Evidence Handoff') && releaseStatusManifest.includes('"publicAccepted": "not-accepted"') && releaseOwnerActionPlan.includes('GSE Release Owner Action Plan'), 'generated kit artifacts'),
+  check('OEG08', 'kit contains fresh final acceptance, public handoff, host handoff, manifest, and owner action plan', finalPacket.includes('GSE Final Acceptance Packet') && publicHandoff.includes('GSE Public Acceptance Handoff') && hostHandoff.includes('GSE Host Runtime Evidence Handoff') && releaseStatusManifest.includes('"publicAccepted": "' + (manifest?.publicAccepted ?? 'unknown') + '"') && releaseOwnerActionPlan.includes('GSE Release Owner Action Plan'), 'generated kit artifacts'),
   check('OEG09', 'kit manifest marks generated handoff artifacts as fresh', manifest?.generatedFresh?.finalAcceptancePacket === true && manifest?.generatedFresh?.publicAcceptanceHandoff === true && manifest?.generatedFresh?.hostRuntimeEvidenceHandoff === true && manifest?.generatedFresh?.releaseStatusManifest === true && manifest?.generatedFresh?.releaseOwnerActionPlan === true, 'kit-manifest.json'),
-  check('OEG09b', 'kit manifest carries preflight commands for every pending gate', (manifest?.gates?.length ?? 0) > 0 && manifest.gates.every((gate) => gate.preflightCommand?.includes('--dry-run --json')), 'kit-manifest.json'),
+  check('OEG09b', 'kit manifest carries preflight commands for every pending gate', hasPendingGates ? manifest.gates.every((gate) => gate.preflightCommand?.includes('--dry-run --json')) : manifest?.pendingGateCount === 0, 'kit-manifest.json'),
   check('OEG10', 'skill routes users to the owner/external gate kit', skill.includes('generate-owner-external-gate-kit.mjs') && skill.includes('audit-owner-external-gate-kit.mjs'), 'SKILL.md'),
   check('OEG11', 'validator includes owner/external gate kit audit', validate.includes('audit-owner-external-gate-kit.mjs'), 'scripts/validate-gse.mjs'),
   check('OEG12', 'release bundle includes owner/external gate kit', bundleGenerator.includes('generate-owner-external-gate-kit.mjs') && bundleAudit.includes('owner-external-gate-kit'), 'release bundle generator/audit'),
   check('OEG13', 'kit verification commands use shell-safe placeholders', kitVerificationCommandsAreShellSafe, 'verification commands use __GSE__ instead of <gse>'),
   check('OEG14', 'canonical owner/external gate kit exists', canonicalRequiredKitFilesPresent, '.gse/acceptance/owner-external-gate-kit/'),
   check('OEG15', 'canonical owner/external gate kit matches current generated gate snapshot', canonicalManifest?.publicAccepted === manifest?.publicAccepted && canonicalManifest?.pendingGateCount === manifest?.pendingGateCount && sameJson(stableGateSnapshot(canonicalManifest), stableGateSnapshot(manifest)), '.gse/acceptance/owner-external-gate-kit/kit-manifest.json'),
-  check('OEG16', 'canonical owner/external gate kit preserves current handoff commands and boundaries', canonicalReadme.includes('GSE Owner / External Gate Kit') && canonicalActionPacket.includes('Public accepted: ' + (manifest?.publicAccepted ?? 'unknown')) && canonicalCommands.includes('--dry-run --json') && canonicalCommands.includes('--status accepted') && canonicalVerificationCommands.includes('run-gse-command.mjs') && canonicalVerificationCommands.includes('/gse probe') && !canonicalVerificationCommands.includes('node scripts/probe-public-external-gates.mjs') && canonicalVerificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs') && canonicalVerificationCommands.includes('__GSE__'), '.gse/acceptance/owner-external-gate-kit/'),
+  check('OEG16', 'canonical owner/external gate kit preserves current handoff commands and boundaries', canonicalReadme.includes('GSE Owner / External Gate Kit') && canonicalActionPacket.includes('Public accepted: ' + (manifest?.publicAccepted ?? 'unknown')) && (hasPendingGates ? (canonicalCommands.includes('--dry-run --json') && canonicalCommands.includes('--status accepted')) : !canonicalCommands.includes('Preflight command')) && canonicalVerificationCommands.includes('run-gse-command.mjs') && canonicalVerificationCommands.includes('/gse probe') && !canonicalVerificationCommands.includes('node scripts/probe-public-external-gates.mjs') && canonicalVerificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs') && canonicalVerificationCommands.includes('__GSE__'), '.gse/acceptance/owner-external-gate-kit/'),
 ]
 
 const passed = checks.filter((item) => item.status === 'passed').length

package/scripts/audit-project-guards.mjs

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function parseGuardTable(text) {
+  const rows = []
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('|')) continue
+    if (/^\|\s*-+/.test(trimmed)) continue
+    if (/^\|\s*ID\s*\|/i.test(trimmed)) continue
+    const cells = trimmed
+      .slice(1, trimmed.endsWith('|') ? -1 : undefined)
+      .split('|')
+      .map((cell) => cell.trim())
+    if (cells.length < 6) continue
+    rows.push({
+      id: cells[0],
+      guard: cells[1],
+      severity: cells[2],
+      trigger: cells[3],
+      check: cells[4],
+      status: cells[5],
+    })
+  }
+  return rows
+}
+
+export function readProjectGuards(target) {
+  const filePath = path.join(target, '.gse', 'project-guards.md')
+  const exists = fs.existsSync(filePath)
+  const text = exists ? readText(filePath) : ''
+  const guards = parseGuardTable(text)
+  const active = guards.filter((guard) => guard.status.toLowerCase() === 'active')
+  const requiredIds = ['WIN-SHELL', 'SPARSE-GIT', 'UTF8-DOC', 'EVIDENCE-STALE', 'UI-EVIDENCE', 'SUBAGENT-HONEST', 'SYNC-NO-INTERRUPT']
+  const ids = new Set(guards.map((guard) => guard.id))
+  const missingDefaultIds = requiredIds.filter((id) => !ids.has(id))
+  const incomplete = guards.filter((guard) =>
+    !guard.id ||
+    !guard.guard ||
+    !guard.severity ||
+    !guard.trigger ||
+    !guard.check ||
+    !guard.status,
+  )
+  const invalidSeverity = guards.filter((guard) => !['low', 'medium', 'high', 'critical'].includes(guard.severity.toLowerCase()))
+  const invalidStatus = guards.filter((guard) => !['active', 'inactive', 'candidate'].includes(guard.status.toLowerCase()))
+  const status = !exists
+    ? 'warning'
+    : guards.length === 0 || incomplete.length > 0 || invalidSeverity.length > 0 || invalidStatus.length > 0
+      ? 'failed'
+      : missingDefaultIds.length > 0
+        ? 'warning'
+        : 'passed'
+  return {
+    path: '.gse/project-guards.md',
+    exists,
+    status,
+    guards,
+    active,
+    summary: {
+      total: guards.length,
+      active: active.length,
+      missingDefaultIds,
+      incomplete: incomplete.map((guard) => guard.id || '(blank)'),
+      invalidSeverity: invalidSeverity.map((guard) => guard.id),
+      invalidStatus: invalidStatus.map((guard) => guard.id),
+    },
+  }
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-project-guards-'))
+  const init = run('init-project.mjs', ['--target', dir, '--mode', 'lite', '--json'])
+  return { dir, init }
+}
+
+function audit(target) {
+  const resolvedTarget = path.resolve(target)
+  const guardResult = readProjectGuards(resolvedTarget)
+  const checks = [
+    check('PG01', 'project guard file is present or reported as warning', guardResult.exists || guardResult.status === 'warning', guardResult.exists ? guardResult.path : 'missing guard file warning'),
+    check('PG02', 'guard table parses at least one active guard when file exists', !guardResult.exists || guardResult.active.length > 0, `${guardResult.active.length} active guard(s)`),
+    check('PG03', 'guard rows have valid severity and status values', guardResult.summary.invalidSeverity.length === 0 && guardResult.summary.invalidStatus.length === 0, 'severity/status vocabulary'),
+    check('PG04', 'default guard IDs are present when scaffolded', !guardResult.exists || guardResult.summary.missingDefaultIds.length === 0, guardResult.summary.missingDefaultIds.join(', ') || 'default guards present'),
+    check('PG05', 'guard audit keeps missing file as warning instead of hard failure', true, 'missing file policy is warning'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? guardResult.status : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      projectGuards: guardResult.status === 'failed' ? 'failed' : 'verified',
+      continuePreflightGuardSection: 'available',
+    },
+    projectGuards: guardResult,
+    checks,
+    limits: [
+      'Project guards are soft continuation preflight rules in this slice.',
+      'Broken state or evidence index remains the hard /gse continue failure.',
+      'AION and MuseFlow lessons are examples; this audit does not hardcode product-specific behavior.',
+    ],
+  }
+}
+
+function selfTestReport() {
+  const fixture = createFixture()
+  const fixtureReport = audit(fixture.dir)
+  const missingDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-project-guards-missing-'))
+  fs.mkdirSync(path.join(missingDir, '.gse'), { recursive: true })
+  const missingReport = audit(missingDir)
+  fs.rmSync(fixture.dir, { recursive: true, force: true })
+  fs.rmSync(missingDir, { recursive: true, force: true })
+  const checks = [
+    check('PGA01', 'init-project creates project guards', fixture.init.status === 0 && fixtureReport.projectGuards.exists, 'scripts/init-project.mjs'),
+    check('PGA02', 'default scaffold contains seven active guards', fixtureReport.projectGuards.summary.active === 7, `${fixtureReport.projectGuards.summary.active} active guard(s)`),
+    check('PGA03', 'missing guard file is warning, not hard failure', missingReport.projectGuards.status === 'warning', 'missing fixture'),
+    check('PGA04', 'default guard set includes real-project lesson categories', ['WIN-SHELL', 'SPARSE-GIT', 'UTF8-DOC', 'EVIDENCE-STALE', 'UI-EVIDENCE', 'SUBAGENT-HONEST', 'SYNC-NO-INTERRUPT'].every((id) => fixtureReport.projectGuards.guards.some((guard) => guard.id === id)), 'default guard IDs'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    root,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      projectGuards: failed === 0 ? 'verified' : 'failed',
+      initProjectGuardScaffold: failed === 0 ? 'verified' : 'failed',
+    },
+    fixture: {
+      scaffoldStatus: fixtureReport.projectGuards.status,
+      missingStatus: missingReport.projectGuards.status,
+      activeGuards: fixtureReport.projectGuards.active.map((guard) => guard.id),
+    },
+    checks,
+    limits: [
+      'This audit verifies guard scaffold and parsing mechanics.',
+      'It does not prove every project-specific guard has been promoted yet.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const report = targetArg ? audit(targetArg) : selfTestReport()
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}