@t275005746/gse 0.1.0 → 0.1.2

package/scripts/audit-tool-fallback-policy.mjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(target, relativePath) {
+  return fs.existsSync(path.join(target, relativePath))
+}
+
+function check(id, label, ok, evidence, severity = 'hard', recommendation = '') {
+  return {
+    id,
+    label,
+    status: ok ? 'passed' : severity === 'soft' ? 'warning' : 'failed',
+    severity,
+    evidence,
+    recommendation,
+  }
+}
+
+function includesAll(text, phrases) {
+  const normalized = text.toLowerCase()
+  return phrases.every((phrase) => normalized.includes(phrase.toLowerCase()))
+}
+
+export function auditToolFallbackPolicy(target) {
+  const resolvedTarget = path.resolve(target)
+  const toolAdapters = readText(path.join(root, 'references', 'tool-adapters.md'))
+  const router = readText(path.join(root, 'references', 'router.md'))
+  const modelRouting = readText(path.join(root, 'references', 'model-routing.md'))
+  const hostAdapters = readText(path.join(root, 'references', 'host-adapters.md'))
+  const compatibility = readText(path.join(root, 'references', 'compatibility.md'))
+  const designBasis = readText(path.join(root, 'references', 'design-basis.md'))
+  const projectProfile = readText(path.join(root, 'references', 'project-profile.md'))
+  const initProject = readText(path.join(root, 'scripts', 'init-project.mjs'))
+  const updateProjectState = readText(path.join(root, 'scripts', 'update-project-state.mjs'))
+  const generateCommandAdapter = readText(path.join(root, 'scripts', 'generate-command-adapter.mjs'))
+  const generateContinuePacket = readText(path.join(root, 'scripts', 'generate-continue-packet.mjs'))
+
+  const checks = [
+    check(
+      'TFP01',
+      'tool adapters keep optional tools non-blocking and portable',
+      includesAll(toolAdapters, [
+        'few hard requirements',
+        'tools enhance the workflow when available',
+        'use markdown fallback when optional tools are unavailable',
+      ]),
+      'references/tool-adapters.md',
+      'hard',
+      'Keep markdown fallback available when a tool is missing.',
+    ),
+    check(
+      'TFP02',
+      'router keeps optional tools on the markdown fallback path',
+      includesAll(router, [
+        'use markdown fallback when optional tools are unavailable',
+        'do not treat optional tools as hard prerequisites',
+      ]),
+      'references/router.md',
+      'hard',
+      'Route around missing tools instead of blocking the slice.',
+    ),
+    check(
+      'TFP03',
+      'model routing preserves a portable fallback path',
+      includesAll(modelRouting, [
+        'preserve a portable fallback path',
+        'fallback policy',
+      ]),
+      'references/model-routing.md',
+      'hard',
+      'Keep provider and tool fallback policy in project profile docs.',
+    ),
+    check(
+      'TFP04',
+      'host adapters keep .gse as the source of truth and unknown capability claims explicit',
+      includesAll(hostAdapters, [
+        '.gse/` is the portable source of truth',
+        'host-specific folders are adapters',
+        'document it as `unknown`',
+      ]),
+      'references/host-adapters.md',
+      'hard',
+      'Keep host/tool capability claims evidence-gated in the portable layer.',
+    ),
+    check(
+      'TFP05',
+      'project profile records fallback policy and model/tool ids',
+      includesAll(projectProfile, [
+        'model routing',
+        'fallback policy',
+        'model/tool ids',
+      ]),
+      'references/project-profile.md',
+      'hard',
+      'Keep the project-approved fallback path visible in profile docs.',
+    ),
+    check(
+      'TFP06',
+      'generated command adapters keep unsupported host claims unknown until evidence exists',
+      includesAll(generateCommandAdapter, [
+        'unknown until',
+        'current host records evidence',
+        'skill/text-command pointer',
+      ]),
+      'scripts/generate-command-adapter.mjs',
+      'hard',
+      'Do not let generated adapters become runtime proof.',
+    ),
+    check(
+      'TFP07',
+      'project bootstrap and state update keep commands and host tools unknown until verified',
+      includesAll(initProject, ['project commands and host tools are unknown until verified in this repository']) &&
+        includesAll(updateProjectState, ['project-specific tool statuses remain unknown until verified']),
+      'scripts/init-project.mjs and scripts/update-project-state.mjs',
+      'hard',
+      'Leave capability status unknown until the project records it.',
+    ),
+    check(
+      'TFP08',
+      'continue packet surfaces fallback policy as a compact preflight concern',
+      includesAll(generateContinuePacket, [
+        'toolfallbackpolicy',
+        'host capabilities',
+        'optional tools',
+      ]),
+      'scripts/generate-continue-packet.mjs',
+      'soft',
+      'Expose the fallback policy in /gse continue so future sessions can see the boundary.',
+    ),
+  ]
+
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: {
+      status: failed === 0 ? 'passed' : 'failed',
+      passed,
+      failed,
+      total: checks.length,
+    },
+    workflows: {
+      optionalToolFallbackPolicy: failed === 0 ? 'verified' : 'failed',
+    },
+    checks,
+    limits: [
+      'This audit verifies portable fallback policy and claim boundaries.',
+      'It does not prove actual browser, MCP, LSP, subagent, or CI availability.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const report = auditToolFallbackPolicy(targetArg ?? root)
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}

package/scripts/audit-ui-browser-evidence-policy.mjs

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { analyzeEvidenceLevels } from './audit-evidence-levels.mjs'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const target = path.resolve(targetArg || root)
+const jsonOnly = args.includes('--json')
+
+function read(relativePath, base = root) {
+  const fullPath = path.join(base, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function readJsonl(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, records: [], error: 'missing' }
+  const lines = fs.readFileSync(filePath, 'utf8')
+    .replace(/^\uFEFF/, '')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+  const records = []
+  for (const [index, line] of lines.entries()) {
+    try {
+      records.push(JSON.parse(line))
+    } catch (error) {
+      return { exists: true, ok: false, records, error: `line ${index + 1}: ${error.message}` }
+    }
+  }
+  return { exists: true, ok: true, records, error: '' }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-ui-evidence-policy-'))
+  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+  const records = [
+    {
+      date: '2026-07-09',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'verified-component',
+      requiredEvidenceLevel: 'verified-browser',
+      summary: 'Component-only proof for visible UI behavior.',
+      evidenceFile: '.gse/evidence/2026-07-09.md',
+      commands: ['pnpm test component'],
+      nextAction: 'Run browser smoke before release.',
+    },
+    {
+      date: '2026-07-09',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'verified-browser',
+      requiredEvidenceLevel: 'verified-browser',
+      summary: 'Browser-backed proof for visible UI behavior.',
+      evidenceFile: '.gse/evidence/2026-07-09.md',
+      commands: ['pnpm smoke browser', 'playwright screenshot'],
+      nextAction: 'Close slice.',
+    },
+  ]
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', 'index.jsonl'), records.map((record) => JSON.stringify(record)).join('\n') + '\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-09.md'), '# Evidence\n', 'utf8')
+  return dir
+}
+
+const qualityGates = read('references/quality-gates.md')
+const taxonomy = read('references/evidence-taxonomy.md')
+const template = read('assets/templates/evidence.md')
+const continuePacket = read('scripts/generate-continue-packet.mjs')
+const closeGate = read('scripts/audit-close-gate.mjs')
+const validationProfile = read('scripts/run-validation-profile.mjs')
+const validator = read('scripts/validate-gse.mjs')
+const roadmap = read('references/final-form-roadmap.md')
+const fixture = createFixture()
+const fixtureAnalysis = analyzeEvidenceLevels(readJsonl(path.join(fixture, '.gse', 'evidence', 'index.jsonl')).records)
+const targetEvidence = readJsonl(path.join(target, '.gse', 'evidence', 'index.jsonl'))
+const targetAnalysis = analyzeEvidenceLevels(targetEvidence.records)
+
+const checks = [
+  check(
+    'UIE01',
+    'quality gates distinguish component proof from browser proof',
+    qualityGates.includes('verified-component') &&
+      qualityGates.includes('verified-browser') &&
+      qualityGates.includes('Do not describe `verified-component` or `verified-api` as `verified-browser`') &&
+      qualityGates.includes('Screenshot or visual inspection for layout-sensitive work'),
+    'references/quality-gates.md',
+  ),
+  check(
+    'UIE02',
+    'evidence taxonomy defines browser proof and downgrade examples',
+    taxonomy.includes('A UI component test can be `status: verified` with `evidenceLevel: verified-component`') &&
+      taxonomy.includes('A Playwright smoke can be `status: verified` with `evidenceLevel: verified-browser`') &&
+      taxonomy.includes('requiredEvidenceLevel'),
+    'references/evidence-taxonomy.md',
+  ),
+  check(
+    'UIE03',
+    'evidence template requires status, level, and required level',
+    template.includes('Evidence status') &&
+      template.includes('Evidence level') &&
+      template.includes('Required evidence level'),
+    'assets/templates/evidence.md',
+  ),
+  check(
+    'UIE04',
+    'continue preflight exposes evidence level downgrades before implementation',
+    continuePacket.includes('evidenceLevels') &&
+      continuePacket.includes('downgraded') &&
+      continuePacket.includes('verified-component') &&
+      continuePacket.includes('verified-browser'),
+    'scripts/generate-continue-packet.mjs',
+  ),
+  check(
+    'UIE05',
+    'close gate surfaces evidence downgrade before close',
+    closeGate.includes('CG09') &&
+      closeGate.includes('evidence level') &&
+      closeGate.includes('downgrade'),
+    'scripts/audit-close-gate.mjs',
+  ),
+  check(
+    'UIE06',
+    'fixture labels component proof downgrade from required browser proof',
+    fixtureAnalysis.downgraded.length === 1 &&
+      fixtureAnalysis.downgraded[0]?.evidenceLevel === 'verified-component' &&
+      fixtureAnalysis.downgraded[0]?.requiredEvidenceLevel === 'verified-browser',
+    `${fixtureAnalysis.downgraded.length} downgrade(s)`,
+  ),
+  check(
+    'UIE07',
+    'target evidence has no invalid evidence levels',
+    targetEvidence.ok && targetAnalysis.invalidLevel.length === 0,
+    targetEvidence.ok ? `${targetAnalysis.invalidLevel.length} invalid level(s), ${targetAnalysis.downgraded.length} downgrade(s)` : targetEvidence.error,
+  ),
+  check(
+    'UIE08',
+    'validation profiles include UI/browser evidence policy audit',
+    validationProfile.includes('audit-ui-browser-evidence-policy.mjs') &&
+      validator.includes('audit-ui-browser-evidence-policy.mjs'),
+    'scripts/run-validation-profile.mjs + scripts/validate-gse.mjs',
+  ),
+  check(
+    'UIE09',
+    'final-form roadmap tracks browser UI evidence policy as Wave 4 capability',
+    roadmap.includes('Done: Browser/UI evidence policy') &&
+      roadmap.includes('verified-component') &&
+      roadmap.includes('verified-browser'),
+    'references/final-form-roadmap.md',
+  ),
+]
+
+fs.rmSync(fixture, { recursive: true, force: true })
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  target,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    uiBrowserEvidencePolicy: failed === 0 ? 'verified' : 'failed',
+    targetDowngrades: targetAnalysis.downgraded.length,
+    targetInvalidLevels: targetAnalysis.invalidLevel.length,
+  },
+  checks,
+  limits: [
+    'This audit verifies UI/browser evidence policy and gate wiring.',
+    'It does not run a real browser, Playwright, screenshot, or visual inspection.',
+    'Only a project-specific browser/screenshot smoke can justify evidenceLevel verified-browser for visible UI behavior.',
+  ],
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-update-release-acceptance.mjs

@@ -1,136 +1,136 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function exists(relativePath) {
-  return fs.existsSync(path.join(root, relativePath))
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const template = read('assets/templates/update-release-acceptance-record.md')
-const release = read('references/release.md')
-const packaging = read('references/packaging.md')
-const evidenceTaxonomy = read('references/evidence-taxonomy.md')
-const validate = read('scripts/validate-gse.mjs')
-
-const requiredFields = [
-  'Record type:',
-  'Project path:',
-  'Goal or slice:',
-  'Release label or change id:',
-  'Evidence status:',
-  'Local decisions preserved:',
-  'Files changed:',
-  'Files intentionally not changed:',
-  'Commands run:',
-  'Focused verification:',
-  'Compatibility evidence:',
-  'Migration notes:',
-  'Rollback notes:',
-  'Owner or acceptance gate:',
-  'Accepted by:',
-  'Residual risks:',
-  'Next action:',
-]
-
-const statusTerms = ['result', 'verified', 'accepted', 'not ready']
-const antiOverclaimTerms = [
-  'Do not mark `accepted` only because `validate-gse.mjs`, tests, lint, or a local smoke passed.',
-  'release publication',
-  'package install',
-  'production rollout',
-  'host runtime support',
-  'registry access',
-  'subagent support',
-  'MCP support',
-  'browser support',
-  'owner approval',
-  'Accepted by: not accepted',
-]
-
-const referenceTerms = [
-  'assets/templates/update-release-acceptance-record.md',
-  'local decisions',
-  'changed files',
-  'rollback notes',
-  'owner gate',
-  'accepted-by status',
-  'residual risk',
-]
-
-const checks = [
-  check('URA01', 'update/release acceptance record template exists', exists('assets/templates/update-release-acceptance-record.md'), 'assets/templates/update-release-acceptance-record.md'),
-  check('URA02', 'template captures required project-local fields', requiredFields.every((item) => template.includes(item)), requiredFields.join(', ')),
-  check('URA03', 'template separates result, verified, accepted, and not ready', statusTerms.every((item) => template.includes(item)), statusTerms.join(', ')),
-  check('URA04', 'template prevents local smoke from becoming fake acceptance', antiOverclaimTerms.every((item) => template.includes(item)), 'anti-overclaim rules'),
-  check('URA05', 'template records rollback and residual risk explicitly', template.includes('Rollback notes:') && template.includes('Residual risks:') && template.includes('If rollback is unknown, say `unknown`'), 'rollback and residual risk fields'),
-  check('URA06', 'release reference routes to acceptance record template', referenceTerms.every((item) => release.includes(item)), 'references/release.md'),
-  check('URA07', 'packaging reference routes project-local updates to acceptance record', packaging.includes('assets/templates/update-release-acceptance-record.md') && packaging.includes('accepted-by status') && packaging.includes('residual risks'), 'references/packaging.md'),
-  check('URA08', 'evidence taxonomy routes update/release work to acceptance record', evidenceTaxonomy.includes('assets/templates/update-release-acceptance-record.md') && evidenceTaxonomy.includes('rollback notes') && evidenceTaxonomy.includes('accepted-by status'), 'references/evidence-taxonomy.md'),
-  check('URA09', 'consolidated validator includes this audit', validate.includes('audit-update-release-acceptance.mjs'), 'scripts/validate-gse.mjs'),
-  check('URA10', 'template examples show verified without fake acceptance', template.includes('Evidence status: verified') && template.includes('Accepted by: policy: Lite focused smoke policy') && template.includes('Accepted by: not accepted'), 'minimal examples'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { updateReleaseAcceptance: failed === 0 ? 'verified' : 'failed' },
-  limits: [
-    'This audit verifies the reusable update/release acceptance record and routing only.',
-    'It does not publish a release, run project-specific commands, approve owner acceptance, or certify arbitrary repositories.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Update/Release Acceptance Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Update/release acceptance: ' + data.workflows.updateReleaseAcceptance)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const template = read('assets/templates/update-release-acceptance-record.md')
+const release = read('references/release.md')
+const packaging = read('references/packaging.md')
+const evidenceTaxonomy = read('references/evidence-taxonomy.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const requiredFields = [
+  'Record type:',
+  'Project path:',
+  'Goal or slice:',
+  'Release label or change id:',
+  'Evidence status:',
+  'Local decisions preserved:',
+  'Files changed:',
+  'Files intentionally not changed:',
+  'Commands run:',
+  'Focused verification:',
+  'Compatibility evidence:',
+  'Migration notes:',
+  'Rollback notes:',
+  'Owner or acceptance gate:',
+  'Accepted by:',
+  'Residual risks:',
+  'Next action:',
+]
+
+const statusTerms = ['result', 'verified', 'accepted', 'not ready']
+const antiOverclaimTerms = [
+  'Do not mark `accepted` only because `validate-gse.mjs`, tests, lint, or a local smoke passed.',
+  'release publication',
+  'package install',
+  'production rollout',
+  'host runtime support',
+  'registry access',
+  'subagent support',
+  'MCP support',
+  'browser support',
+  'owner approval',
+  'Accepted by: not accepted',
+]
+
+const referenceTerms = [
+  'assets/templates/update-release-acceptance-record.md',
+  'local decisions',
+  'changed files',
+  'rollback notes',
+  'owner gate',
+  'accepted-by status',
+  'residual risk',
+]
+
+const checks = [
+  check('URA01', 'update/release acceptance record template exists', exists('assets/templates/update-release-acceptance-record.md'), 'assets/templates/update-release-acceptance-record.md'),
+  check('URA02', 'template captures required project-local fields', requiredFields.every((item) => template.includes(item)), requiredFields.join(', ')),
+  check('URA03', 'template separates result, verified, accepted, and not ready', statusTerms.every((item) => template.includes(item)), statusTerms.join(', ')),
+  check('URA04', 'template prevents local smoke from becoming fake acceptance', antiOverclaimTerms.every((item) => template.includes(item)), 'anti-overclaim rules'),
+  check('URA05', 'template records rollback and residual risk explicitly', template.includes('Rollback notes:') && template.includes('Residual risks:') && template.includes('If rollback is unknown, say `unknown`'), 'rollback and residual risk fields'),
+  check('URA06', 'release reference routes to acceptance record template', referenceTerms.every((item) => release.includes(item)), 'references/release.md'),
+  check('URA07', 'packaging reference routes project-local updates to acceptance record', packaging.includes('assets/templates/update-release-acceptance-record.md') && packaging.includes('accepted-by status') && packaging.includes('residual risks'), 'references/packaging.md'),
+  check('URA08', 'evidence taxonomy routes update/release work to acceptance record', evidenceTaxonomy.includes('assets/templates/update-release-acceptance-record.md') && evidenceTaxonomy.includes('rollback notes') && evidenceTaxonomy.includes('accepted-by status'), 'references/evidence-taxonomy.md'),
+  check('URA09', 'consolidated validator includes this audit', validate.includes('audit-update-release-acceptance.mjs'), 'scripts/validate-gse.mjs'),
+  check('URA10', 'template examples show verified without fake acceptance', template.includes('Evidence status: verified') && template.includes('Accepted by: policy: Lite focused smoke policy') && template.includes('Accepted by: not accepted'), 'minimal examples'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { updateReleaseAcceptance: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies the reusable update/release acceptance record and routing only.',
+    'It does not publish a release, run project-specific commands, approve owner acceptance, or certify arbitrary repositories.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Update/Release Acceptance Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Update/release acceptance: ' + data.workflows.updateReleaseAcceptance)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)