@t275005746/gse 0.1.0 → 0.1.2

package/scripts/record-public-security-contact.mjs

@@ -1,157 +1,157 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-import { rejectPlaceholderEvidence } from './lib/evidence-placeholders.mjs'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = '') {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-function hasArg(name) {
-  return args.includes(name)
-}
-
-const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
-const contactStatus = readArg('--contact-status', 'pending')
-const contactType = readArg('--contact-type', 'unknown')
-const contactValue = readArg('--contact-value', '')
-const policyPath = readArg('--policy-path', 'SECURITY.md')
-const evidenceOwner = readArg('--evidence-owner', '')
-const evidenceDate = readArg('--evidence-date', '')
-const evidenceUrl = readArg('--evidence-url', '')
-const isPublic = readArg('--is-public', 'unknown')
-const policyUpdated = readArg('--security-policy-updated', 'unknown')
-const privateFallback = readArg('--private-fallback-channel', 'owner private coordination channel')
-const responseExpectation = readArg('--response-expectation', 'pending owner policy')
-const disclosureNotes = readArg('--disclosure-notes', 'Do not publish exploit details until the public contact is owner-accepted.')
-const verificationCommand = readArg('--verification-command', 'node scripts/audit-open-source-readiness.mjs --root . --json')
-const verificationResult = readArg('--verification-result', 'pending')
-const evidenceStatus = readArg('--evidence-status', contactStatus === 'accepted' ? 'accepted' : 'pending')
-const acceptedBy = readArg('--accepted-by', '')
-const acceptedAt = readArg('--accepted-at', '')
-const residualRisk = readArg('--residual-risk', 'Public security contact is not accepted until owner evidence is attached.')
-const nextAction = readArg('--next-action', 'Attach owner-approved public security contact evidence and re-run final readiness.')
-const out = path.resolve(readArg('--out', path.join(root, '.gse', 'releases', 'public-security-contact-owner-required.md')))
-const dryRun = hasArg('--dry-run')
-const force = hasArg('--force')
-const jsonOnly = hasArg('--json')
-
-const validStatuses = new Set(['pending', 'accepted'])
-const validContactTypes = new Set(['email', 'url', 'github-security-advisory', 'other', 'unknown'])
-const validTriState = new Set(['true', 'false', 'unknown'])
-const validEvidenceStatuses = new Set(['pending', 'accepted'])
-const errors = []
-
-function requireField(value, message) {
-  if (!String(value).trim()) errors.push(message)
-}
-
-if (!validStatuses.has(contactStatus)) errors.push('--contact-status must be pending or accepted')
-if (!validContactTypes.has(contactType)) errors.push('--contact-type must be email, url, github-security-advisory, other, or unknown')
-if (!validTriState.has(isPublic)) errors.push('--is-public must be true, false, or unknown')
-if (!validTriState.has(policyUpdated)) errors.push('--security-policy-updated must be true, false, or unknown')
-if (!validEvidenceStatuses.has(evidenceStatus)) errors.push('--evidence-status must be pending or accepted')
-
-if (contactStatus === 'accepted') {
-  if (contactType === 'unknown') errors.push('accepted security contact requires --contact-type')
-  requireField(contactValue, 'accepted security contact requires --contact-value')
-  requireField(evidenceOwner, 'accepted security contact requires --evidence-owner')
-  requireField(evidenceDate, 'accepted security contact requires --evidence-date')
-  requireField(evidenceUrl, 'accepted security contact requires --evidence-url')
-  requireField(acceptedBy, 'accepted security contact requires --accepted-by')
-  requireField(acceptedAt, 'accepted security contact requires --accepted-at')
-  if (isPublic !== 'true') errors.push('accepted security contact requires --is-public true')
-  if (policyUpdated !== 'true') errors.push('accepted security contact requires --security-policy-updated true')
-  if (evidenceStatus !== 'accepted') errors.push('accepted security contact requires --evidence-status accepted')
-  if (!dryRun) {
-    rejectPlaceholderEvidence(errors, contactValue, '--contact-value')
-    rejectPlaceholderEvidence(errors, evidenceOwner, '--evidence-owner')
-    rejectPlaceholderEvidence(errors, evidenceUrl, '--evidence-url')
-    rejectPlaceholderEvidence(errors, acceptedBy, '--accepted-by')
-  }
-}
-
-const lines = [
-  '# Public Security Contact Record',
-  '',
-  'Contact status: ' + contactStatus,
-  '',
-  'Contact type: ' + contactType,
-  '',
-  'Contact value: ' + contactValue,
-  '',
-  'Policy path: `' + policyPath + '`',
-  '',
-  'Evidence owner: ' + evidenceOwner,
-  '',
-  'Evidence date: ' + evidenceDate,
-  '',
-  'Evidence URL or run id: ' + evidenceUrl,
-  '',
-  '## Public Disclosure Policy',
-  '',
-  '- Is this contact public? ' + isPublic,
-  '- Security policy updated? ' + policyUpdated,
-  '- Private fallback channel: ' + privateFallback,
-  '- Response expectation: ' + responseExpectation,
-  '- Embargo or disclosure notes: ' + disclosureNotes,
-  '',
-  '## Verification',
-  '',
-  'Verification command: ' + verificationCommand,
-  '',
-  'Verification result: ' + verificationResult,
-  '',
-  '## Acceptance',
-  '',
-  'Evidence status: ' + evidenceStatus,
-  '',
-  'Accepted by: ' + acceptedBy,
-  '',
-  'Accepted at: ' + acceptedAt,
-  '',
-  '## Residual Risk',
-  '',
-  '- ' + residualRisk,
-  '',
-  '## Next Action',
-  '',
-  '- ' + nextAction,
-  '',
-]
-
-const report = {
-  root,
-  out,
-  dryRun,
-  contactStatus,
-  evidenceStatus,
-  status: errors.length ? 'failed' : dryRun ? 'ready' : 'written',
-  errors,
-}
-
-if (!errors.length && !dryRun) {
-  if (fs.existsSync(out) && !force) {
-    report.status = 'exists'
-    report.errors.push('output exists; use --force or choose another --out path')
-  } else {
-    fs.mkdirSync(path.dirname(out), { recursive: true })
-    fs.writeFileSync(out, lines.join('\n'), 'utf8')
-  }
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else {
-  console.log('Public security contact record status: ' + report.status)
-  console.log('Output: ' + report.out)
-  if (report.errors.length) {
-    console.log('Errors:')
-    for (const error of report.errors) console.log('- ' + error)
-  }
-}
-
-if (report.status === 'failed' || report.status === 'exists') process.exit(1)
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { rejectPlaceholderEvidence } from './lib/evidence-placeholders.mjs'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = '') {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function hasArg(name) {
+  return args.includes(name)
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const contactStatus = readArg('--contact-status', 'pending')
+const contactType = readArg('--contact-type', 'unknown')
+const contactValue = readArg('--contact-value', '')
+const policyPath = readArg('--policy-path', 'SECURITY.md')
+const evidenceOwner = readArg('--evidence-owner', '')
+const evidenceDate = readArg('--evidence-date', '')
+const evidenceUrl = readArg('--evidence-url', '')
+const isPublic = readArg('--is-public', 'unknown')
+const policyUpdated = readArg('--security-policy-updated', 'unknown')
+const privateFallback = readArg('--private-fallback-channel', 'owner private coordination channel')
+const responseExpectation = readArg('--response-expectation', 'pending owner policy')
+const disclosureNotes = readArg('--disclosure-notes', 'Do not publish exploit details until the public contact is owner-accepted.')
+const verificationCommand = readArg('--verification-command', 'node scripts/audit-open-source-readiness.mjs --root . --json')
+const verificationResult = readArg('--verification-result', 'pending')
+const evidenceStatus = readArg('--evidence-status', contactStatus === 'accepted' ? 'accepted' : 'pending')
+const acceptedBy = readArg('--accepted-by', '')
+const acceptedAt = readArg('--accepted-at', '')
+const residualRisk = readArg('--residual-risk', 'Public security contact is not accepted until owner evidence is attached.')
+const nextAction = readArg('--next-action', 'Attach owner-approved public security contact evidence and re-run final readiness.')
+const out = path.resolve(readArg('--out', path.join(root, '.gse', 'releases', 'public-security-contact-owner-required.md')))
+const dryRun = hasArg('--dry-run')
+const force = hasArg('--force')
+const jsonOnly = hasArg('--json')
+
+const validStatuses = new Set(['pending', 'accepted'])
+const validContactTypes = new Set(['email', 'url', 'github-security-advisory', 'other', 'unknown'])
+const validTriState = new Set(['true', 'false', 'unknown'])
+const validEvidenceStatuses = new Set(['pending', 'accepted'])
+const errors = []
+
+function requireField(value, message) {
+  if (!String(value).trim()) errors.push(message)
+}
+
+if (!validStatuses.has(contactStatus)) errors.push('--contact-status must be pending or accepted')
+if (!validContactTypes.has(contactType)) errors.push('--contact-type must be email, url, github-security-advisory, other, or unknown')
+if (!validTriState.has(isPublic)) errors.push('--is-public must be true, false, or unknown')
+if (!validTriState.has(policyUpdated)) errors.push('--security-policy-updated must be true, false, or unknown')
+if (!validEvidenceStatuses.has(evidenceStatus)) errors.push('--evidence-status must be pending or accepted')
+
+if (contactStatus === 'accepted') {
+  if (contactType === 'unknown') errors.push('accepted security contact requires --contact-type')
+  requireField(contactValue, 'accepted security contact requires --contact-value')
+  requireField(evidenceOwner, 'accepted security contact requires --evidence-owner')
+  requireField(evidenceDate, 'accepted security contact requires --evidence-date')
+  requireField(evidenceUrl, 'accepted security contact requires --evidence-url')
+  requireField(acceptedBy, 'accepted security contact requires --accepted-by')
+  requireField(acceptedAt, 'accepted security contact requires --accepted-at')
+  if (isPublic !== 'true') errors.push('accepted security contact requires --is-public true')
+  if (policyUpdated !== 'true') errors.push('accepted security contact requires --security-policy-updated true')
+  if (evidenceStatus !== 'accepted') errors.push('accepted security contact requires --evidence-status accepted')
+  if (!dryRun) {
+    rejectPlaceholderEvidence(errors, contactValue, '--contact-value')
+    rejectPlaceholderEvidence(errors, evidenceOwner, '--evidence-owner')
+    rejectPlaceholderEvidence(errors, evidenceUrl, '--evidence-url')
+    rejectPlaceholderEvidence(errors, acceptedBy, '--accepted-by')
+  }
+}
+
+const lines = [
+  '# Public Security Contact Record',
+  '',
+  'Contact status: ' + contactStatus,
+  '',
+  'Contact type: ' + contactType,
+  '',
+  'Contact value: ' + contactValue,
+  '',
+  'Policy path: `' + policyPath + '`',
+  '',
+  'Evidence owner: ' + evidenceOwner,
+  '',
+  'Evidence date: ' + evidenceDate,
+  '',
+  'Evidence URL or run id: ' + evidenceUrl,
+  '',
+  '## Public Disclosure Policy',
+  '',
+  '- Is this contact public? ' + isPublic,
+  '- Security policy updated? ' + policyUpdated,
+  '- Private fallback channel: ' + privateFallback,
+  '- Response expectation: ' + responseExpectation,
+  '- Embargo or disclosure notes: ' + disclosureNotes,
+  '',
+  '## Verification',
+  '',
+  'Verification command: ' + verificationCommand,
+  '',
+  'Verification result: ' + verificationResult,
+  '',
+  '## Acceptance',
+  '',
+  'Evidence status: ' + evidenceStatus,
+  '',
+  'Accepted by: ' + acceptedBy,
+  '',
+  'Accepted at: ' + acceptedAt,
+  '',
+  '## Residual Risk',
+  '',
+  '- ' + residualRisk,
+  '',
+  '## Next Action',
+  '',
+  '- ' + nextAction,
+  '',
+]
+
+const report = {
+  root,
+  out,
+  dryRun,
+  contactStatus,
+  evidenceStatus,
+  status: errors.length ? 'failed' : dryRun ? 'ready' : 'written',
+  errors,
+}
+
+if (!errors.length && !dryRun) {
+  if (fs.existsSync(out) && !force) {
+    report.status = 'exists'
+    report.errors.push('output exists; use --force or choose another --out path')
+  } else {
+    fs.mkdirSync(path.dirname(out), { recursive: true })
+    fs.writeFileSync(out, lines.join('\n'), 'utf8')
+  }
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log('Public security contact record status: ' + report.status)
+  console.log('Output: ' + report.out)
+  if (report.errors.length) {
+    console.log('Errors:')
+    for (const error of report.errors) console.log('- ' + error)
+  }
+}
+
+if (report.status === 'failed' || report.status === 'exists') process.exit(1)

package/scripts/record-session-sync.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const execute = args.includes('--execute')
+const jsonOnly = args.includes('--json')
+const recordPath = path.join(root, '.gse', 'session-sync.jsonl')
+
+function requiredArg(name) {
+  const value = readArg(name)
+  if (!value) {
+    console.error(`${name} is required`)
+    process.exit(1)
+  }
+  return value
+}
+
+function normalizeStatus(value) {
+  return String(value || '').trim().toLowerCase()
+}
+
+const allowedStatuses = new Set([
+  'sent',
+  'installed-sync',
+  'skipped',
+  'failed',
+  'archived',
+  'unavailable',
+])
+
+const status = normalizeStatus(requiredArg('--status'))
+if (!allowedStatuses.has(status)) {
+  console.error(`--status must be one of: ${[...allowedStatuses].join(', ')}`)
+  process.exit(1)
+}
+
+const record = {
+  schemaVersion: 1,
+  recordedAt: new Date().toISOString(),
+  capability: readArg('--capability', 'gse-capability-sync'),
+  status,
+  method: requiredArg('--method'),
+  threadId: readArg('--thread-id', null),
+  project: readArg('--project', null),
+  workspace: readArg('--workspace', null),
+  evidence: requiredArg('--evidence'),
+  messageSummary: readArg('--message-summary', ''),
+  limits: [
+    'This record proves a sync attempt or installed-copy parity record, not that the target session adopted the capability.',
+    'A thread sync is accepted only when the transport returned success or when the failure/archived status is recorded honestly.',
+  ],
+}
+
+const report = {
+  root,
+  recordPath,
+  execute,
+  summary: {
+    status: execute ? 'written' : 'dry-run',
+    threadId: record.threadId,
+    syncStatus: record.status,
+    method: record.method,
+  },
+  record,
+}
+
+if (execute) {
+  fs.mkdirSync(path.dirname(recordPath), { recursive: true })
+  fs.appendFileSync(recordPath, JSON.stringify(record) + '\n', 'utf8')
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log(`GSE session sync record: ${report.summary.status}`)
+  console.log(`Status: ${record.status}`)
+  console.log(`Method: ${record.method}`)
+  if (record.threadId) console.log(`Thread: ${record.threadId}`)
+}

package/scripts/run-gse-command.mjs

@@ -95,26 +95,31 @@ const commandMap = {
     effect: 'read-only',
     summary: 'Show GSE commands and project entry files.',
   },
-  continue: {
-    route: 'scripts/generate-session-prompt.mjs',
-    effect: 'read-only',
-    summary: 'Generate a continuation packet from project state.',
-  },
-  next: {
-    route: 'scripts/generate-session-prompt.mjs',
-    effect: 'read-only',
-    summary: 'Alias for /gse continue.',
+  continue: {
+    route: 'scripts/generate-continue-packet.mjs',
+    effect: 'read-only',
+    summary: 'Run a hard continuation preflight and generate a compact state packet.',
+  },
+  next: {
+    route: 'scripts/generate-continue-packet.mjs',
+    effect: 'read-only',
+    summary: 'Alias for /gse continue.',
   },
   status: {
     route: 'scripts/generate-final-form-progress-report.mjs or .gse/state.json',
     effect: 'read-only',
     summary: 'Show project state, or GSE final-form progress when the target is the GSE skill.',
   },
-  doctor: {
-    route: 'scripts/audit-public-acceptance-readiness.mjs or scripts/audit-target-project.mjs',
-    effect: 'read-only',
-    summary: 'Diagnose final-form public/host acceptance blockers for GSE, or target-project GSE readiness for normal projects.',
-  },
+  doctor: {
+    route: 'scripts/audit-public-acceptance-readiness.mjs or scripts/audit-target-project.mjs',
+    effect: 'read-only',
+    summary: 'Diagnose final-form public/host claim evidence for GSE, or target-project GSE readiness for normal projects.',
+  },
+  repair: {
+    route: 'scripts/audit-state-repair.mjs',
+    effect: 'read-only by default; reversible risk compaction with --execute',
+    summary: 'Diagnose or safely repair stale state, broken evidence JSONL, and overlong residual risks.',
+  },
   acceptance: {
     route: 'scripts/audit-public-acceptance-readiness.mjs or scripts/audit-target-project.mjs',
     effect: 'read-only',
@@ -145,11 +150,16 @@ const commandMap = {
     effect: 'read-only by default; write-with-execute for install target writes',
     summary: 'Dry-run or install GSE from a local package path or URL-shaped package source.',
   },
-  'public-release': {
-    route: 'scripts/generate-public-release-checklist.mjs or scripts/audit-public-release-checklist.mjs',
-    effect: 'read-only by default; write-with-execute for canonical checklist generation',
-    summary: 'Dry-run or generate the ordered owner/public release checklist.',
-  },
+  'public-release': {
+    route: 'scripts/generate-public-release-checklist.mjs or scripts/audit-public-release-checklist.mjs',
+    effect: 'read-only by default; write-with-execute for canonical checklist generation',
+    summary: 'Dry-run or generate the ordered owner/public release checklist.',
+  },
+  maintenance: {
+    route: 'scripts/generate-maintenance-snapshot.mjs',
+    effect: 'read-only',
+    summary: 'Generate a recurring maintenance snapshot for benchmark, drift, evidence, installed sync, session sync, and release freshness checks.',
+  },
   owner: {
     route: 'scripts/audit-public-acceptance-readiness.mjs',
     effect: 'read-only',
@@ -170,11 +180,11 @@ const commandMap = {
     effect: 'read-only',
     summary: 'Select and run focused verification according to project quality gates.',
   },
-  learn: {
-    route: 'scripts/record-learning.mjs',
-    effect: 'read-only by default; write-with-execute for .gse/learnings.md',
-    summary: 'Record a reusable project lesson and skip duplicate summaries.',
-  },
+  learn: {
+    route: 'scripts/record-learning.mjs or scripts/audit-learning-promotion.mjs',
+    effect: 'read-only by default; write-with-execute for .gse/learnings.md or candidate-only .gse/learning-promotions.md',
+    summary: 'Record a reusable project lesson, or run promotion analysis with --promote.',
+  },
   slice: {
     route: 'references/spec-workflow.md',
     effect: 'read-only',
@@ -207,8 +217,8 @@ if (execute && verb === 'init') {
   const changeId = rest.find((item) => !item.startsWith('--')) ?? 'gse-change'
   const level = rest.includes('--level') ? rest[rest.indexOf('--level') + 1] : 'standard'
   execution = runNode('init-change.mjs', ['--target', target, '--change-id', changeId, '--level', level, '--json'])
-} else if (verb === 'continue' || verb === 'next') {
-  execution = runNode('generate-session-prompt.mjs', ['--target', target, '--json'])
+} else if (verb === 'continue' || verb === 'next') {
+  execution = runNode('generate-continue-packet.mjs', ['--root', root, '--target', target, '--json'])
 } else if (verb === 'status') {
   const targetHasFinalFormReport = fs.existsSync(path.join(target, 'scripts', 'generate-final-form-progress-report.mjs'))
     && fs.existsSync(path.join(target, 'references', 'final-readiness.md'))
@@ -238,13 +248,19 @@ if (execute && verb === 'init') {
         }),
         stderr: state ? '' : '.gse/state.json is missing or invalid',
       }
-} else if (verb === 'doctor' || verb === 'acceptance') {
+} else if (verb === 'doctor' || verb === 'acceptance') {
   const targetHasPublicAcceptanceDoctor = fs.existsSync(path.join(target, 'scripts', 'audit-public-acceptance-readiness.mjs'))
     && fs.existsSync(path.join(target, 'references', 'final-readiness.md'))
   execution = targetHasPublicAcceptanceDoctor
     ? runNode('audit-public-acceptance-readiness.mjs', ['--root', target, '--json'])
-    : runNode('audit-target-project.mjs', ['--target', target, '--json'])
-} else if (verb === 'owner-actions' || verb === 'owner') {
+    : runNode('audit-target-project.mjs', ['--target', target, '--json'])
+} else if (verb === 'repair') {
+  const repairArgs = ['--root', root, '--target', target, '--json']
+  if (execute) repairArgs.push('--write')
+  const maxRiskIndex = rest.indexOf('--max-active-risks')
+  if (maxRiskIndex !== -1) repairArgs.push('--max-active-risks', rest[maxRiskIndex + 1] || '6')
+  execution = runNode('audit-state-repair.mjs', repairArgs)
+} else if (verb === 'owner-actions' || verb === 'owner') {
   const targetHasPublicAcceptanceDoctor = fs.existsSync(path.join(target, 'scripts', 'audit-public-acceptance-readiness.mjs'))
     && fs.existsSync(path.join(target, 'references', 'final-readiness.md'))
   if (targetHasPublicAcceptanceDoctor) {
@@ -445,7 +461,7 @@ if (execute && verb === 'init') {
       stderr: 'target does not expose scripts/install-gse.mjs',
     }
   }
-} else if (verb === 'public-release') {
+} else if (verb === 'public-release') {
   const targetHasPublicReleaseChecklist = fs.existsSync(path.join(target, 'scripts', 'generate-public-release-checklist.mjs'))
     && fs.existsSync(path.join(target, 'scripts', 'audit-public-release-checklist.mjs'))
   if (targetHasPublicReleaseChecklist) {
@@ -471,9 +487,19 @@ if (execute && verb === 'init') {
         error: '/gse public-release is only available for GSE skill packages that include public release checklist scripts.',
       }),
       stderr: 'target does not expose scripts/generate-public-release-checklist.mjs and scripts/audit-public-release-checklist.mjs',
-    }
-  }
-} else if (verb === 'audit') {
+    }
+  }
+} else if (verb === 'maintenance') {
+  const maintenanceArgs = ['--root', target, '--target', target, '--json']
+  const installedRootIndex = rest.indexOf('--installed-root')
+  if (installedRootIndex !== -1 && rest[installedRootIndex + 1]) maintenanceArgs.push('--installed-root', rest[installedRootIndex + 1])
+  const outIndex = rest.indexOf('--out')
+  if (outIndex !== -1 && rest[outIndex + 1]) maintenanceArgs.push('--out', path.resolve(rest[outIndex + 1]))
+  if (rest.includes('--skip-release-bundle')) maintenanceArgs.push('--skip-release-bundle')
+  if (rest.includes('--package-smoke')) maintenanceArgs.push('--package-smoke')
+  if (execute) maintenanceArgs.push('--execute')
+  execution = runNode('generate-maintenance-snapshot.mjs', maintenanceArgs)
+} else if (verb === 'audit') {
   execution = runNode('audit-target-project.mjs', ['--target', target, '--json'])
 } else if (verb === 'close') {
   execution = runNode('audit-close-gate.mjs', ['--target', target, '--json'])
@@ -481,20 +507,26 @@ if (execute && verb === 'init') {
   const profileIndex = rest.indexOf('--profile')
   const profile = profileIndex === -1 ? 'lite' : (rest[profileIndex + 1] || 'lite')
   execution = runNode('run-validation-profile.mjs', ['--target', target, '--profile', profile, '--json'])
-} else if (verb === 'learn') {
-  const learningArgs = [
-    '--target', target,
-    '--summary', readRestValue(rest, '--summary'),
-    '--trigger', readRestValue(rest, '--trigger', 'reusable lesson'),
-    '--source', readRestValue(rest, '--source', 'run-gse-command'),
-    '--promotion', readRestValue(rest, '--promotion', 'first occurrence: learning note'),
-    '--json',
-  ]
-  const impact = readRestValue(rest, '--impact')
-  if (impact) learningArgs.push('--impact', impact)
-  if (execute) learningArgs.push('--execute')
-  execution = runNode('record-learning.mjs', learningArgs)
-}
+} else if (verb === 'learn') {
+  if (rest.includes('--promote')) {
+    const promotionArgs = ['--root', root, '--target', target, '--json']
+    if (execute) promotionArgs.push('--write')
+    execution = runNode('audit-learning-promotion.mjs', promotionArgs)
+  } else {
+    const learningArgs = [
+      '--target', target,
+      '--summary', readRestValue(rest, '--summary'),
+      '--trigger', readRestValue(rest, '--trigger', 'reusable lesson'),
+      '--source', readRestValue(rest, '--source', 'run-gse-command'),
+      '--promotion', readRestValue(rest, '--promotion', 'first occurrence: learning note'),
+      '--json',
+    ]
+    const impact = readRestValue(rest, '--impact')
+    if (impact) learningArgs.push('--impact', impact)
+    if (execute) learningArgs.push('--execute')
+    execution = runNode('record-learning.mjs', learningArgs)
+  }
+}
 
 const report = {
   root,

package/scripts/run-validation-profile.mjs

@@ -48,11 +48,30 @@ function run(script, commandArgs) {
 }
 
 function commandList(selectedProfile) {
-  const common = [
-    ['audit-commands.mjs', ['--root', root, '--json']],
-    ['audit-command-execution.mjs', ['--root', root, '--profile', 'lite', '--json']],
-    ['audit-learning-system.mjs', ['--root', root, '--json']],
-  ]
+  const common = [
+    ['audit-commands.mjs', ['--root', root, '--json']],
+    ['audit-continue-preflight.mjs', ['--root', root, '--json']],
+    ['audit-completion-plan-drill.mjs', ['--root', root, '--json']],
+    ['audit-project-guards.mjs', ['--root', root, '--json']],
+    ['backfill-evidence-levels.mjs', ['--root', target, '--json']],
+    ['audit-evidence-levels.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-evidence-review-queue.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-ui-browser-evidence-policy.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-role-dispatch-fallback.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-close-gate-hardening.mjs', ['--root', root, '--json']],
+    ['audit-state-repair.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-learning-promotion.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-learning-drift.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-host-capabilities.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-tool-fallback-policy.mjs', ['--root', root, '--target', target, '--json']],
+    ['audit-target-hardening-drills.mjs', ['--root', root, '--json']],
+    ['audit-maintenance-cadence.mjs', ['--root', root, '--json']],
+    ['audit-maintenance-snapshot.mjs', ['--root', root, '--json']],
+    ['audit-installed-sync.mjs', ['--root', root, '--json']],
+    ['audit-session-sync.mjs', ['--root', root, '--json']],
+    ['audit-command-execution.mjs', ['--root', root, '--profile', 'lite', '--json']],
+    ['audit-learning-system.mjs', ['--root', root, '--json']],
+  ]
 
   const targetChecks = target === root
     ? []