@t275005746/gse 0.1.0 → 0.1.2

package/scripts/audit-target-hardening-drills.mjs

@@ -0,0 +1,267 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function readAllArgs(name) {
+  const values = []
+  for (let index = 0; index < args.length; index += 1) {
+    if (args[index] === name && args[index + 1]) values.push(args[index + 1])
+  }
+  return values
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const strictWarnings = args.includes('--strict-warnings')
+
+function run(script, commandArgs, options = {}) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+    ...options,
+  })
+  const stdout = (result.stdout ?? '').trim()
+  let parsed = null
+  try {
+    parsed = JSON.parse(stdout)
+  } catch {
+    parsed = null
+  }
+  return {
+    script,
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout,
+    stderr: (result.stderr ?? '').trim(),
+    parsed,
+  }
+}
+
+function check(id, label, status, evidence, recommendation = '') {
+  return { id, label, status, evidence, recommendation }
+}
+
+function parseTargets() {
+  const explicitTargets = readAllArgs('--target')
+  const namedTargets = [
+    { id: 'aion', root: readArg('--aion-target', process.env.GSE_AION_TARGET || null) },
+    { id: 'museflow', root: readArg('--museflow-target', process.env.GSE_MUSEFLOW_TARGET || null) },
+  ].filter((item) => item.root)
+  const explicit = explicitTargets.map((target, index) => ({
+    id: `target-${index + 1}`,
+    root: target,
+  }))
+  return [...namedTargets, ...explicit].map((item) => ({
+    ...item,
+    root: path.resolve(item.root),
+  }))
+}
+
+function statusFromRun(runResult) {
+  if (!runResult.parsed) return runResult.status === 0 ? 'passed' : 'failed'
+  const summaryStatus = runResult.parsed.summary?.status
+  if (summaryStatus === 'failed' || summaryStatus === 'not-ready') return 'failed'
+  if (summaryStatus === 'warning' || summaryStatus === 'ready-with-warnings') return 'warning'
+  if ((runResult.parsed.summary?.failed ?? 0) > 0) return 'failed'
+  if ((runResult.parsed.summary?.warnings ?? 0) > 0) return 'warning'
+  return runResult.status === 0 ? 'passed' : 'failed'
+}
+
+function evidenceFromRun(runResult) {
+  const summary = runResult.parsed?.summary
+  if (!summary) return runResult.stderr || runResult.stdout.slice(0, 160) || `exit:${runResult.status}`
+  const parts = []
+  if (summary.status) parts.push(`status:${summary.status}`)
+  if (Number.isFinite(summary.passed) && Number.isFinite(summary.total)) parts.push(`checks:${summary.passed}/${summary.total}`)
+  if (Number.isFinite(summary.warnings)) parts.push(`warnings:${summary.warnings}`)
+  if (Number.isFinite(summary.failed)) parts.push(`failed:${summary.failed}`)
+  if (Number.isFinite(summary.blockedGates)) parts.push(`blockedGates:${summary.blockedGates}`)
+  if (Number.isFinite(summary.highUnenforced)) parts.push(`highUnenforced:${summary.highUnenforced}`)
+  return parts.join(', ') || `exit:${runResult.status}`
+}
+
+function createFixture(label) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), `gse-hardening-${label}-`))
+  const init = run('init-project.mjs', ['--target', dir, '--mode', 'enterprise', '--json'])
+  fs.mkdirSync(path.join(dir, 'docs'), { recursive: true })
+  fs.writeFileSync(path.join(dir, 'docs', 'productization-architecture.md'), `# ${label} Productization\n`, 'utf8')
+
+  const statePath = path.join(dir, '.gse', 'state.json')
+  const state = JSON.parse(fs.readFileSync(statePath, 'utf8'))
+  state.canonicalPlan = 'docs/productization-architecture.md'
+  state.phase = 'verify'
+  state.currentSlice = {
+    id: `${label}-hardening-fixture`,
+    outcome: `${label} hardening fixture.`,
+    status: 'verified',
+    nextAction: 'Continue target hardening drill.',
+  }
+  state.lastEvidence = '.gse/evidence/2026-07-09.md'
+  state.residualRisks = []
+  fs.writeFileSync(statePath, JSON.stringify(state, null, 2) + '\n', 'utf8')
+  fs.appendFileSync(path.join(dir, '.gse', 'README.md'), '\nCanonical plan: `docs/productization-architecture.md`.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-09.md'), '# Evidence\n\nFixture hardening evidence.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', 'index.jsonl'), JSON.stringify({
+    date: '2026-07-09',
+    recordType: 'slice',
+    status: 'verified',
+    evidenceLevel: 'verified-unit',
+    requiredEvidenceLevel: 'verified-unit',
+    summary: `${label} hardening fixture evidence.`,
+    evidenceFile: '.gse/evidence/2026-07-09.md',
+    commands: ['node scripts/audit-target-hardening-drills.mjs --self-test'],
+    nextAction: 'Continue target hardening drill.',
+  }) + '\n', 'utf8')
+  spawnSync('git', ['init'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  spawnSync('git', ['config', 'user.email', 'gse-fixture@example.local'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  spawnSync('git', ['config', 'user.name', 'GSE Fixture'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  spawnSync('git', ['add', '.'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  spawnSync('git', ['commit', '-m', 'fixture'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  return { dir, init }
+}
+
+function auditTarget(target) {
+  const commandRuns = {
+    doctor: run('audit-target-project.mjs', ['--root', root, '--target', target.root, '--json']),
+    continue: run('run-gse-command.mjs', ['--root', root, '--target', target.root, '--command', '/gse continue', '--json', '--compact']),
+    close: run('audit-close-gate.mjs', ['--target', target.root, '--json']),
+    hostCapabilities: run('audit-host-capabilities.mjs', ['--root', root, '--target', target.root, '--json']),
+    learningDrift: run('audit-learning-drift.mjs', ['--root', root, '--target', target.root, '--json']),
+  }
+  const checks = [
+    check(`${target.id}-doctor`, 'target project doctor has no hard failures', statusFromRun(commandRuns.doctor), evidenceFromRun(commandRuns.doctor), 'Repair target .gse adoption drift before claiming GSE-ready status.'),
+    check(`${target.id}-continue`, '/gse continue hard preflight returns a usable packet', statusFromRun(commandRuns.continue), evidenceFromRun(commandRuns.continue), 'Repair hard preflight failures before implementation starts.'),
+    check(`${target.id}-close`, 'close gate exposes close readiness and ownership state', statusFromRun(commandRuns.close), evidenceFromRun(commandRuns.close), 'Resolve close-gate failures before claiming the slice complete.'),
+    check(`${target.id}-host`, 'host capability records are audited with claim boundaries', statusFromRun(commandRuns.hostCapabilities), evidenceFromRun(commandRuns.hostCapabilities), 'Record missing host capability facts or keep unknown/external-required boundaries explicit.'),
+    check(`${target.id}-learning`, 'learning drift is audited for promoted guard candidates', statusFromRun(commandRuns.learningDrift), evidenceFromRun(commandRuns.learningDrift), 'Promote high-severity learning drift into guards, gates, or scripts before close.'),
+  ]
+  const failed = checks.filter((item) => item.status === 'failed')
+  const warnings = checks.filter((item) => item.status === 'warning')
+  return {
+    id: target.id,
+    root: target.root,
+    status: failed.length > 0 ? 'failed' : warnings.length > 0 ? 'warning' : 'passed',
+    checks,
+    commands: Object.values(commandRuns).map((item) => item.command),
+    summaries: Object.fromEntries(Object.entries(commandRuns).map(([key, value]) => [key, value.parsed?.summary ?? { exit: value.status }])),
+  }
+}
+
+function runConfiguredTargets() {
+  const targets = parseTargets()
+  if (targets.length === 0) return null
+  return {
+    targets,
+    cleanup: () => {},
+  }
+}
+
+function runSelfTestTargets() {
+  const primary = createFixture('primary')
+  const secondary = createFixture('secondary')
+  return {
+    targets: [
+      { id: 'fixture-primary', root: primary.dir },
+      { id: 'fixture-secondary', root: secondary.dir },
+    ],
+    cleanup: () => {
+      fs.rmSync(primary.dir, { recursive: true, force: true })
+      fs.rmSync(secondary.dir, { recursive: true, force: true })
+    },
+  }
+}
+
+function buildReport() {
+  const configured = runConfiguredTargets()
+  const targetSet = configured ?? runSelfTestTargets()
+  try {
+    const reports = targetSet.targets.map(auditTarget)
+    const checks = reports.flatMap((report) => report.checks)
+    const hardFailures = checks.filter((item) => item.status === 'failed')
+    const warnings = checks.filter((item) => item.status === 'warning')
+    const passed = checks.filter((item) => item.status === 'passed').length
+    const failed = hardFailures.length
+    const warningCount = warnings.length
+    const status = failed > 0 || (strictWarnings && warningCount > 0) ? 'failed' : warningCount > 0 ? 'warning' : 'passed'
+    return {
+      root,
+      generatedAt: new Date().toISOString(),
+      summary: {
+        status,
+        mode: configured ? 'configured-targets' : 'self-test',
+        passed,
+        warnings: warningCount,
+        failed,
+        hardFailures: failed,
+        total: checks.length,
+        targets: reports.length,
+      },
+      workflows: {
+        targetHardeningDrills: status === 'failed' ? 'failed' : 'verified',
+        closeGateHardening: hardFailures.length === 0 ? 'verified' : 'failed',
+        hostCapabilityBoundaries: hardFailures.length === 0 ? 'verified' : 'failed',
+        learningDriftCoverage: hardFailures.length === 0 ? 'verified' : 'failed',
+      },
+      targets: reports,
+      checks,
+      limits: [
+        'Target hardening drills are read-only for target projects.',
+        'They run GSE doctor, /gse continue, close gate, host capability audit, and learning drift audit.',
+        'Warnings mean the project can continue only if the current slice accepts that residual risk; hard failures must be fixed before close.',
+        'This drill does not run product tests, browser smokes, CI, or native host slash-command invocation.',
+      ],
+    }
+  } finally {
+    targetSet.cleanup()
+  }
+}
+
+function renderMarkdown(report) {
+  const lines = []
+  lines.push('# GSE Target Hardening Drills')
+  lines.push('')
+  lines.push('Generated: ' + report.generatedAt)
+  lines.push('Root: ' + report.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + report.summary.status)
+  lines.push('- Mode: ' + report.summary.mode)
+  lines.push('- Targets: ' + report.summary.targets)
+  lines.push('- Checks: ' + report.summary.passed + ' passed, ' + report.summary.warnings + ' warnings, ' + report.summary.hardFailures + ' hard failures, ' + report.summary.total + ' total')
+  lines.push('')
+  lines.push('## Targets')
+  lines.push('')
+  for (const target of report.targets) {
+    lines.push('- ' + target.id + ': ' + target.status + ' at ' + target.root)
+  }
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of report.checks) {
+    const marker = item.status === 'passed' ? '[x]' : item.status === 'warning' ? '[!]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of report.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+const report = buildReport()
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (report.summary.status === 'failed') process.exit(1)