@t275005746/gse 0.1.0 → 0.1.2

package/scripts/audit-validation-profiles.mjs

@@ -1,125 +1,127 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-import { spawnSync } from 'node:child_process'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const jsonOnly = args.includes('--json')
-
-function read(relativePath) {
-  const fullPath = path.join(root, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
-}
-
-function run(commandArgs) {
-  const result = spawnSync(process.execPath, [path.join(root, 'scripts', 'run-validation-profile.mjs'), ...commandArgs], {
-    cwd: root,
-    encoding: 'utf8',
-    windowsHide: true,
-  })
-  let parsed = null
-  try {
-    parsed = JSON.parse((result.stdout ?? '').trim())
-  } catch {
-    parsed = null
-  }
-  return {
-    command: [process.execPath, path.join(root, 'scripts', 'run-validation-profile.mjs'), ...commandArgs].join(' '),
-    status: result.status ?? 1,
-    parsed,
-    stdout: (result.stdout ?? '').trim(),
-    stderr: (result.stderr ?? '').trim(),
-  }
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-const runnerSource = read('scripts/run-validation-profile.mjs')
-const skill = read('SKILL.md')
-const commands = read('references/commands.md')
-const qualityGates = read('references/quality-gates.md')
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function run(commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', 'run-validation-profile.mjs'), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  let parsed = null
+  try {
+    parsed = JSON.parse((result.stdout ?? '').trim())
+  } catch {
+    parsed = null
+  }
+  return {
+    command: [process.execPath, path.join(root, 'scripts', 'run-validation-profile.mjs'), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    parsed,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const runnerSource = read('scripts/run-validation-profile.mjs')
+const skill = read('SKILL.md')
+const commands = read('references/commands.md')
+const qualityGates = read('references/quality-gates.md')
 const lite = run(['--root', root, '--target', root, '--profile', 'lite', '--json'])
 const standard = run(['--root', root, '--target', root, '--profile', 'standard', '--json'])
-const releaseProfileScripts = [
-  'audit-command-execution.mjs',
-  'audit-npm-package-metadata.mjs',
-  'audit-npm-tarball-install.mjs',
-  'audit-signing.mjs',
-  'audit-release-bundle.mjs',
-  'audit-distribution.mjs',
-  'audit-remote-distribution.mjs',
-  'audit-public-acceptance-readiness.mjs',
-  'audit-final-readiness.mjs',
-  'audit-final-acceptance-packet.mjs',
-  'audit-owner-external-gate-kit.mjs',
-]
-
-const checks = [
-  check('VP01', 'validation profile runner exists', fs.existsSync(path.join(root, 'scripts', 'run-validation-profile.mjs')), 'scripts/run-validation-profile.mjs'),
-  check('VP02', 'runner defines lite, standard, enterprise, and release profiles', ['lite', 'standard', 'enterprise', 'release'].every((item) => runnerSource.includes(`'${item}'`)), 'profile names'),
-  check('VP03', 'lite profile avoids release/distribution heavy gates', lite.status === 0 && lite.parsed?.summary?.status === 'passed' && !lite.stdout.includes('audit-distribution.mjs') && !lite.stdout.includes('audit-release-bundle.mjs'), 'lite profile output'),
-  check('VP04', 'standard profile passes without forcing close gate during in-progress work', standard.status === 0 && standard.parsed?.summary?.status === 'passed' && !standard.stdout.includes('audit-close-gate.mjs') && !standard.stdout.includes('audit-distribution.mjs'), 'standard profile output'),
-  check('VP05', 'quality gates document full validation as enterprise/release-grade work', qualityGates.includes('Full validation belongs here, not on every small product slice') && qualityGates.includes('Use the lightest gate profile'), 'references/quality-gates.md'),
-  check('VP06', 'skill exposes validation profile runner', skill.includes('run-validation-profile.mjs'), 'SKILL.md'),
-  check('VP07', 'command docs expose profile-based verify', commands.includes('/gse verify --profile lite') && commands.includes('run-validation-profile.mjs'), 'references/commands.md'),
-  check('VP08', 'release profile includes install, signing, bundle, final readiness, and owner handoff gates', releaseProfileScripts.every((item) => runnerSource.includes(item)) && runnerSource.includes("--profile', 'full'"), releaseProfileScripts.join(', ')),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  root,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: {
-    validationProfiles: failed === 0 ? 'verified' : 'failed',
-    liteChecks: lite.parsed?.summary ?? null,
-    standardChecks: standard.parsed?.summary ?? null,
-  },
-  limits: [
-    'This audit verifies validation profile routing and fast profile behavior.',
-    'It does not run the release profile because that profile is intentionally heavy and should be selected only for release/install claims.',
-  ],
-  checks,
-}
-
-function renderMarkdown(data) {
-  const lines = []
-  lines.push('# GSE Validation Profiles Audit')
-  lines.push('')
-  lines.push('Generated: ' + data.generatedAt)
-  lines.push('Root: ' + data.root)
-  lines.push('')
-  lines.push('## Summary')
-  lines.push('')
-  lines.push('- Status: ' + data.summary.status)
-  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
-  lines.push('- Validation profiles: ' + data.workflows.validationProfiles)
-  lines.push('')
-  lines.push('## Checks')
-  lines.push('')
-  for (const item of data.checks) {
-    const marker = item.status === 'passed' ? '[x]' : '[ ]'
-    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
-  }
-  lines.push('')
-  lines.push('## Limits')
-  lines.push('')
-  for (const item of data.limits) lines.push('- ' + item)
-  return lines.join('\n') + '\n'
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(renderMarkdown(report))
-
-if (failed > 0) process.exit(1)
+const liteScripts = new Set((lite.parsed?.results ?? []).map((item) => item.script))
+const standardScripts = new Set((standard.parsed?.results ?? []).map((item) => item.script))
+const releaseProfileScripts = [
+  'audit-command-execution.mjs',
+  'audit-npm-package-metadata.mjs',
+  'audit-npm-tarball-install.mjs',
+  'audit-signing.mjs',
+  'audit-release-bundle.mjs',
+  'audit-distribution.mjs',
+  'audit-remote-distribution.mjs',
+  'audit-public-acceptance-readiness.mjs',
+  'audit-final-readiness.mjs',
+  'audit-final-acceptance-packet.mjs',
+  'audit-owner-external-gate-kit.mjs',
+]
+
+const checks = [
+  check('VP01', 'validation profile runner exists', fs.existsSync(path.join(root, 'scripts', 'run-validation-profile.mjs')), 'scripts/run-validation-profile.mjs'),
+  check('VP02', 'runner defines lite, standard, enterprise, and release profiles', ['lite', 'standard', 'enterprise', 'release'].every((item) => runnerSource.includes(`'${item}'`)), 'profile names'),
+  check('VP03', 'lite profile avoids release/distribution heavy gates', lite.status === 0 && lite.parsed?.summary?.status === 'passed' && !liteScripts.has('audit-distribution.mjs') && !liteScripts.has('audit-release-bundle.mjs'), 'lite profile output'),
+  check('VP04', 'standard profile passes without forcing close gate during in-progress work', standard.status === 0 && standard.parsed?.summary?.status === 'passed' && !standardScripts.has('audit-close-gate.mjs') && !standardScripts.has('audit-distribution.mjs'), 'standard profile output'),
+  check('VP05', 'quality gates document full validation as enterprise/release-grade work', qualityGates.includes('Full validation belongs here, not on every small product slice') && qualityGates.includes('Use the lightest gate profile'), 'references/quality-gates.md'),
+  check('VP06', 'skill exposes validation profile runner', skill.includes('run-validation-profile.mjs'), 'SKILL.md'),
+  check('VP07', 'command docs expose profile-based verify', commands.includes('/gse verify --profile lite') && commands.includes('run-validation-profile.mjs'), 'references/commands.md'),
+  check('VP08', 'release profile includes install, signing, bundle, final readiness, and owner handoff gates', releaseProfileScripts.every((item) => runnerSource.includes(item)) && runnerSource.includes("--profile', 'full'"), releaseProfileScripts.join(', ')),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    validationProfiles: failed === 0 ? 'verified' : 'failed',
+    liteChecks: lite.parsed?.summary ?? null,
+    standardChecks: standard.parsed?.summary ?? null,
+  },
+  limits: [
+    'This audit verifies validation profile routing and fast profile behavior.',
+    'It does not run the release profile because that profile is intentionally heavy and should be selected only for release/install claims.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Validation Profiles Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Validation profiles: ' + data.workflows.validationProfiles)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/backfill-evidence-levels.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const execute = args.includes('--execute')
+const jsonOnly = args.includes('--json')
+const defaultLevel = readArg('--default-level', 'result')
+const evidenceIndexPath = path.join(root, '.gse', 'evidence', 'index.jsonl')
+const allowedLevels = new Set([
+  'result',
+  'verified-unit',
+  'verified-component',
+  'verified-api',
+  'verified-browser',
+  'verified-ci',
+  'accepted-owner',
+  'accepted-release',
+  'external-required',
+])
+
+function parseJsonl(filePath) {
+  if (!fs.existsSync(filePath)) return { records: [], errors: [{ line: 0, error: 'missing evidence index' }] }
+  const lines = fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '').split(/\r?\n/)
+  const records = []
+  const errors = []
+  lines.forEach((line, index) => {
+    if (!line.trim()) return
+    try {
+      records.push(JSON.parse(line))
+    } catch (error) {
+      errors.push({ line: index + 1, error: error.message })
+    }
+  })
+  return { records, errors }
+}
+
+function summarize(record) {
+  return record.summary || record.recordType || '(unknown)'
+}
+
+if (!allowedLevels.has(defaultLevel)) {
+  console.error(`--default-level must be one of: ${[...allowedLevels].join(', ')}`)
+  process.exit(1)
+}
+
+const { records, errors } = parseJsonl(evidenceIndexPath)
+const missingBefore = records.filter((record) => !record.evidenceLevel)
+const updatedRecords = records.map((record) => {
+  if (record.evidenceLevel) return record
+  return {
+    ...record,
+    evidenceLevel: defaultLevel,
+    requiredEvidenceLevel: record.requiredEvidenceLevel || defaultLevel,
+    evidenceLevelBackfill: 'conservative-historical-default',
+  }
+})
+const missingAfter = updatedRecords.filter((record) => !record.evidenceLevel)
+const invalidAfter = updatedRecords.filter((record) => !allowedLevels.has(record.evidenceLevel))
+
+const report = {
+  root,
+  evidenceIndexPath,
+  execute,
+  defaultLevel,
+  summary: {
+    status: errors.length || invalidAfter.length ? 'failed' : execute ? 'written' : 'dry-run',
+    records: records.length,
+    missingBefore: missingBefore.length,
+    missingAfter: missingAfter.length,
+    invalidAfter: invalidAfter.length,
+  },
+  changed: missingBefore.slice(0, 20).map((record) => summarize(record)),
+  omittedChangedCount: Math.max(0, missingBefore.length - 20),
+  errors,
+  limits: [
+    'This script only fills missing historical evidenceLevel fields with a conservative default.',
+    'The default level should stay result unless a human or focused audit can prove a stronger level.',
+    'It does not rewrite evidence status or claim that old records were verified by a stronger proof type.',
+  ],
+}
+
+if (errors.length === 0 && invalidAfter.length === 0 && execute && missingBefore.length > 0) {
+  fs.writeFileSync(evidenceIndexPath, updatedRecords.map((record) => JSON.stringify(record)).join('\n') + '\n', 'utf8')
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (report.summary.status === 'failed') process.exit(1)

package/scripts/check-encoding.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { TextDecoder } from 'node:util'
+import { spawnSync } from 'node:child_process'
+
+const root = path.resolve(process.cwd())
+const decoder = new TextDecoder('utf-8', { fatal: true })
+const textExtensions = new Set([
+  '.md',
+  '.json',
+  '.jsonl',
+  '.mjs',
+  '.js',
+  '.ts',
+  '.tsx',
+  '.yml',
+  '.yaml',
+  '.txt',
+  '.svg',
+  '.html',
+  '.css',
+  '.xml',
+])
+
+function gitFiles() {
+  const result = spawnSync('git', ['ls-files'], { cwd: root, encoding: 'utf8', windowsHide: true })
+  if ((result.status ?? 1) !== 0) {
+    throw new Error((result.stderr || result.stdout || 'git ls-files failed').trim())
+  }
+  return (result.stdout || '')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+}
+
+function isTextFile(filePath) {
+  const ext = path.extname(filePath).toLowerCase()
+  return textExtensions.has(ext) || filePath === 'package.json' || filePath === 'README' || filePath.endsWith('.md')
+}
+
+const files = gitFiles().filter(isTextFile)
+const issues = []
+
+for (const file of files) {
+  const fullPath = path.join(root, file)
+  const buffer = fs.readFileSync(fullPath)
+  try {
+    decoder.decode(buffer)
+  } catch (error) {
+    issues.push({ file, issue: 'invalid-utf8', detail: error.message })
+    continue
+  }
+  if (buffer.length >= 3 && buffer[0] === 0xef && buffer[1] === 0xbb && buffer[2] === 0xbf) {
+    issues.push({ file, issue: 'bom', detail: 'UTF-8 BOM present' })
+  }
+}
+
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: {
+    status: issues.length === 0 ? 'passed' : 'failed',
+    passed: files.length - issues.length,
+    failed: issues.length,
+    total: files.length,
+  },
+  issues,
+}
+
+console.log(JSON.stringify(report, null, 2))
+if (issues.length > 0) process.exit(1)

package/scripts/close-change.mjs

@@ -1,116 +1,116 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const target = path.resolve(readArg('--target', process.cwd()))
-const changeId = String(readArg('--change-id', '')).trim().toLowerCase()
-const status = readArg('--status', 'verified')
-const date = readArg('--date', new Date().toISOString().slice(0, 10))
-const dryRun = args.includes('--dry-run')
-const force = args.includes('--force')
-const jsonOnly = args.includes('--json')
-
-const validStatus = new Set(['result', 'verified', 'accepted'])
-if (!changeId) {
-  console.error('Missing --change-id.')
-  process.exit(1)
-}
-if (!validStatus.has(status)) {
-  console.error('Invalid --status value. Expected result, verified, or accepted.')
-  process.exit(1)
-}
-
-const changeDir = path.join(target, '.gse', 'changes', changeId)
-const archiveDir = path.join(target, '.gse', 'archive', `${date}-${changeId}`)
-const evidenceIndex = path.join(target, '.gse', 'evidence', 'index.jsonl')
-const requiredFiles = [
-  'brief.md',
-  'spec.md',
-  'tasks.md',
-  'evidence.md',
-  'review.md',
-]
-
-function read(relativePath) {
-  const fullPath = path.join(changeDir, relativePath)
-  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
-}
-
-function fail(message, extra = {}) {
-  const report = { target, changeId, status: 'failed', message, ...extra }
-  console.error(JSON.stringify(report, null, 2))
-  process.exit(1)
-}
-
-if (!fs.existsSync(changeDir)) fail('Change directory does not exist.', { changeDir })
-if (fs.existsSync(archiveDir) && !force) fail('Archive directory already exists. Use --force to overwrite.', { archiveDir })
-
-const missing = requiredFiles.filter((file) => !fs.existsSync(path.join(changeDir, file)))
-if (missing.length) fail('Required change files are missing.', { missing })
-
-const evidence = read('evidence.md')
-const review = read('review.md')
-const hasEvidenceStatus = ['result', 'verified', 'accepted'].some((term) => evidence.toLowerCase().includes(term))
-const hasReviewClosure = review.includes('## Closure')
-if (!hasEvidenceStatus) fail('Evidence file does not include result/verified/accepted status vocabulary.', { file: 'evidence.md' })
-if (!hasReviewClosure) fail('Review file does not include closure section.', { file: 'review.md' })
-
-const archiveRecord = `# Change Archive Record
-
-Change ID: ${changeId}
-Closed At: ${new Date().toISOString()}
-Status: ${status}
-Source: .gse/changes/${changeId}
-Archive: .gse/archive/${date}-${changeId}
-
-## Closure Rules
-
-- Required change files were present.
-- Evidence status vocabulary was present.
-- Review closure section was present.
-- Source change folder was moved to archive.
-`
-
-const indexRecord = {
-  date,
-  recordType: 'change-archive',
-  changeId,
-  status,
-  summary: `Archived GSE change ${changeId}.`,
-  evidenceFile: `.gse/archive/${date}-${changeId}/evidence.md`,
-  archivePath: `.gse/archive/${date}-${changeId}`,
-  commands: [
-    `node scripts/close-change.mjs --target ${target} --change-id ${changeId} --status ${status} --date ${date} --json`,
-  ],
-  nextAction: 'Continue from .gse/state.json and the current goal map.',
-}
-
-if (!dryRun) {
-  fs.mkdirSync(path.dirname(archiveDir), { recursive: true })
-  fs.rmSync(archiveDir, { recursive: true, force: true })
-  fs.renameSync(changeDir, archiveDir)
-  fs.writeFileSync(path.join(archiveDir, 'archive-record.md'), archiveRecord.replace(/\n/g, '\r\n'), 'utf8')
-  fs.mkdirSync(path.dirname(evidenceIndex), { recursive: true })
-  fs.appendFileSync(evidenceIndex, JSON.stringify(indexRecord) + '\n', 'utf8')
-}
-
-const report = {
-  target,
-  changeId,
-  status: 'passed',
-  evidenceStatus: status,
-  dryRun,
-  source: changeDir,
-  archive: archiveDir,
-  indexRecord,
-}
-
-console.log(JSON.stringify(report, null, 2))
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const target = path.resolve(readArg('--target', process.cwd()))
+const changeId = String(readArg('--change-id', '')).trim().toLowerCase()
+const status = readArg('--status', 'verified')
+const date = readArg('--date', new Date().toISOString().slice(0, 10))
+const dryRun = args.includes('--dry-run')
+const force = args.includes('--force')
+const jsonOnly = args.includes('--json')
+
+const validStatus = new Set(['result', 'verified', 'accepted'])
+if (!changeId) {
+  console.error('Missing --change-id.')
+  process.exit(1)
+}
+if (!validStatus.has(status)) {
+  console.error('Invalid --status value. Expected result, verified, or accepted.')
+  process.exit(1)
+}
+
+const changeDir = path.join(target, '.gse', 'changes', changeId)
+const archiveDir = path.join(target, '.gse', 'archive', `${date}-${changeId}`)
+const evidenceIndex = path.join(target, '.gse', 'evidence', 'index.jsonl')
+const requiredFiles = [
+  'brief.md',
+  'spec.md',
+  'tasks.md',
+  'evidence.md',
+  'review.md',
+]
+
+function read(relativePath) {
+  const fullPath = path.join(changeDir, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function fail(message, extra = {}) {
+  const report = { target, changeId, status: 'failed', message, ...extra }
+  console.error(JSON.stringify(report, null, 2))
+  process.exit(1)
+}
+
+if (!fs.existsSync(changeDir)) fail('Change directory does not exist.', { changeDir })
+if (fs.existsSync(archiveDir) && !force) fail('Archive directory already exists. Use --force to overwrite.', { archiveDir })
+
+const missing = requiredFiles.filter((file) => !fs.existsSync(path.join(changeDir, file)))
+if (missing.length) fail('Required change files are missing.', { missing })
+
+const evidence = read('evidence.md')
+const review = read('review.md')
+const hasEvidenceStatus = ['result', 'verified', 'accepted'].some((term) => evidence.toLowerCase().includes(term))
+const hasReviewClosure = review.includes('## Closure')
+if (!hasEvidenceStatus) fail('Evidence file does not include result/verified/accepted status vocabulary.', { file: 'evidence.md' })
+if (!hasReviewClosure) fail('Review file does not include closure section.', { file: 'review.md' })
+
+const archiveRecord = `# Change Archive Record
+
+Change ID: ${changeId}
+Closed At: ${new Date().toISOString()}
+Status: ${status}
+Source: .gse/changes/${changeId}
+Archive: .gse/archive/${date}-${changeId}
+
+## Closure Rules
+
+- Required change files were present.
+- Evidence status vocabulary was present.
+- Review closure section was present.
+- Source change folder was moved to archive.
+`
+
+const indexRecord = {
+  date,
+  recordType: 'change-archive',
+  changeId,
+  status,
+  summary: `Archived GSE change ${changeId}.`,
+  evidenceFile: `.gse/archive/${date}-${changeId}/evidence.md`,
+  archivePath: `.gse/archive/${date}-${changeId}`,
+  commands: [
+    `node scripts/close-change.mjs --target ${target} --change-id ${changeId} --status ${status} --date ${date} --json`,
+  ],
+  nextAction: 'Continue from .gse/state.json and the current goal map.',
+}
+
+if (!dryRun) {
+  fs.mkdirSync(path.dirname(archiveDir), { recursive: true })
+  fs.rmSync(archiveDir, { recursive: true, force: true })
+  fs.renameSync(changeDir, archiveDir)
+  fs.writeFileSync(path.join(archiveDir, 'archive-record.md'), archiveRecord.replace(/\n/g, '\r\n'), 'utf8')
+  fs.mkdirSync(path.dirname(evidenceIndex), { recursive: true })
+  fs.appendFileSync(evidenceIndex, JSON.stringify(indexRecord) + '\n', 'utf8')
+}
+
+const report = {
+  target,
+  changeId,
+  status: 'passed',
+  evidenceStatus: status,
+  dryRun,
+  source: changeDir,
+  archive: archiveDir,
+  indexRecord,
+}
+
+console.log(JSON.stringify(report, null, 2))