@t275005746/gse 0.1.0 → 0.1.2

package/scripts/validate-gse.mjs

@@ -590,6 +590,18 @@ checks.push({
     : null,
   stderr: roadmapConsistency.stderr,
 })
+const finalFormRoadmap = run(process.execPath, [path.join(root, 'scripts', 'audit-final-form-roadmap.mjs'), '--root', root, '--json'])
+const finalFormRoadmapData = parseJson(finalFormRoadmap.stdout)
+checks.push({
+  id: 'validate-14b',
+  label: 'final-form roadmap contract audit',
+  status: finalFormRoadmap.status === 0 ? 'passed' : 'failed',
+  command: finalFormRoadmap.command,
+  summary: finalFormRoadmapData
+    ? { status: finalFormRoadmapData.summary?.status, checks: finalFormRoadmapData.summary ? finalFormRoadmapData.summary.passed + '/' + finalFormRoadmapData.summary.total : null, finalFormRoadmap: finalFormRoadmapData.workflows?.finalFormRoadmap }
+    : null,
+  stderr: finalFormRoadmap.stderr,
+})
 if (skipCompletionReadiness) {
   checks.push({
     id: 'validate-15',
@@ -983,6 +995,114 @@ checks.push({
     : null,
   stderr: commandSemantics.stderr,
 })
+const continuePreflight = run(process.execPath, [path.join(root, 'scripts', 'audit-continue-preflight.mjs'), '--root', root, '--json'])
+const continuePreflightData = parseJson(continuePreflight.stdout)
+checks.push({
+  id: 'validate-22a',
+  label: '/gse continue hard preflight audit',
+  status: continuePreflight.status === 0 ? 'passed' : 'failed',
+  command: continuePreflight.command,
+  summary: continuePreflightData
+    ? { status: continuePreflightData.summary?.status, checks: continuePreflightData.summary ? continuePreflightData.summary.passed + '/' + continuePreflightData.summary.total : null, continueHardPreflight: continuePreflightData.workflows?.continueHardPreflight, stateCompaction: continuePreflightData.workflows?.stateCompaction }
+    : null,
+  stderr: continuePreflight.stderr,
+})
+const completionPlanDrill = run(process.execPath, [path.join(root, 'scripts', 'audit-completion-plan-drill.mjs'), '--root', root, '--json'])
+const completionPlanDrillData = parseJson(completionPlanDrill.stdout)
+checks.push({
+  id: 'validate-22a1',
+  label: '/gse continue completion plan drill audit',
+  status: completionPlanDrill.status === 0 ? 'passed' : 'failed',
+  command: completionPlanDrill.command,
+  summary: completionPlanDrillData
+    ? { status: completionPlanDrillData.summary?.status, checks: completionPlanDrillData.summary ? completionPlanDrillData.summary.passed + '/' + completionPlanDrillData.summary.total : null, completionPlanDrill: completionPlanDrillData.workflows?.completionPlanDrill, cleanWorktreeFalsePositiveGuard: completionPlanDrillData.workflows?.cleanWorktreeFalsePositiveGuard }
+    : null,
+  stderr: completionPlanDrill.stderr,
+})
+const projectGuards = run(process.execPath, [path.join(root, 'scripts', 'audit-project-guards.mjs'), '--root', root, '--json'])
+const projectGuardsData = parseJson(projectGuards.stdout)
+checks.push({
+  id: 'validate-22a2',
+  label: 'project guard preflight audit',
+  status: projectGuards.status === 0 ? 'passed' : 'failed',
+  command: projectGuards.command,
+  summary: projectGuardsData
+    ? { status: projectGuardsData.summary?.status, checks: projectGuardsData.summary ? projectGuardsData.summary.passed + '/' + projectGuardsData.summary.total : null, projectGuards: projectGuardsData.workflows?.projectGuards, initProjectGuardScaffold: projectGuardsData.workflows?.initProjectGuardScaffold }
+    : null,
+  stderr: projectGuards.stderr,
+})
+const evidenceLevels = run(process.execPath, [path.join(root, 'scripts', 'audit-evidence-levels.mjs'), '--root', root, '--target', root, '--json'])
+const evidenceLevelsData = parseJson(evidenceLevels.stdout)
+checks.push({
+  id: 'validate-22a3',
+  label: 'explicit evidence level taxonomy audit',
+  status: evidenceLevels.status === 0 ? 'passed' : 'failed',
+  command: evidenceLevels.command,
+  summary: evidenceLevelsData
+    ? { status: evidenceLevelsData.summary?.status, checks: evidenceLevelsData.summary ? evidenceLevelsData.summary.passed + '/' + evidenceLevelsData.summary.total : null, evidenceLevels: evidenceLevelsData.workflows?.evidenceLevels, downgraded: evidenceLevelsData.workflows?.downgraded, missingLevel: evidenceLevelsData.workflows?.missingLevel }
+    : null,
+  stderr: evidenceLevels.stderr,
+})
+const evidenceReviewQueue = run(process.execPath, [path.join(root, 'scripts', 'audit-evidence-review-queue.mjs'), '--root', root, '--target', root, '--json'])
+const evidenceReviewQueueData = parseJson(evidenceReviewQueue.stdout)
+checks.push({
+  id: 'validate-22a3a',
+  label: 'historical evidence review queue audit',
+  status: evidenceReviewQueue.status === 0 ? 'passed' : 'failed',
+  command: evidenceReviewQueue.command,
+  summary: evidenceReviewQueueData
+    ? { status: evidenceReviewQueueData.summary?.status, checks: evidenceReviewQueueData.summary ? evidenceReviewQueueData.summary.passed + '/' + evidenceReviewQueueData.summary.total : null, evidenceReviewQueue: evidenceReviewQueueData.workflows?.evidenceReviewQueue, needsReview: evidenceReviewQueueData.reviewQueue?.needsReview, eligibleForStrongerReview: evidenceReviewQueueData.reviewQueue?.eligibleForStrongerReview }
+    : null,
+  stderr: evidenceReviewQueue.stderr,
+})
+const uiBrowserEvidencePolicy = run(process.execPath, [path.join(root, 'scripts', 'audit-ui-browser-evidence-policy.mjs'), '--root', root, '--target', root, '--json'])
+const uiBrowserEvidencePolicyData = parseJson(uiBrowserEvidencePolicy.stdout)
+checks.push({
+  id: 'validate-22a3b',
+  label: 'UI/browser evidence policy audit',
+  status: uiBrowserEvidencePolicy.status === 0 ? 'passed' : 'failed',
+  command: uiBrowserEvidencePolicy.command,
+  summary: uiBrowserEvidencePolicyData
+    ? { status: uiBrowserEvidencePolicyData.summary?.status, checks: uiBrowserEvidencePolicyData.summary ? uiBrowserEvidencePolicyData.summary.passed + '/' + uiBrowserEvidencePolicyData.summary.total : null, uiBrowserEvidencePolicy: uiBrowserEvidencePolicyData.workflows?.uiBrowserEvidencePolicy, targetDowngrades: uiBrowserEvidencePolicyData.workflows?.targetDowngrades }
+    : null,
+  stderr: uiBrowserEvidencePolicy.stderr,
+})
+const roleDispatchFallback = run(process.execPath, [path.join(root, 'scripts', 'audit-role-dispatch-fallback.mjs'), '--root', root, '--target', root, '--json'])
+const roleDispatchFallbackData = parseJson(roleDispatchFallback.stdout)
+checks.push({
+  id: 'validate-22a4',
+  label: 'role dispatch fallback packet audit',
+  status: roleDispatchFallback.status === 0 ? 'passed' : 'failed',
+  command: roleDispatchFallback.command,
+  summary: roleDispatchFallbackData
+    ? { status: roleDispatchFallbackData.summary?.status, checks: roleDispatchFallbackData.summary ? roleDispatchFallbackData.summary.passed + '/' + roleDispatchFallbackData.summary.total : null, roleDispatchFallback: roleDispatchFallbackData.workflows?.roleDispatchFallback, packets: roleDispatchFallbackData.workflows?.packets, sequentialFallbackRoles: roleDispatchFallbackData.workflows?.sequentialFallbackRoles }
+    : null,
+  stderr: roleDispatchFallback.stderr,
+})
+const closeGateHardening = run(process.execPath, [path.join(root, 'scripts', 'audit-close-gate-hardening.mjs'), '--root', root, '--json'])
+const closeGateHardeningData = parseJson(closeGateHardening.stdout)
+checks.push({
+  id: 'validate-22a6',
+  label: 'close gate fake-dispatch and file-ownership hardening audit',
+  status: closeGateHardening.status === 0 ? 'passed' : 'failed',
+  command: closeGateHardening.command,
+  summary: closeGateHardeningData
+    ? { status: closeGateHardeningData.summary?.status, checks: closeGateHardeningData.summary ? closeGateHardeningData.summary.passed + '/' + closeGateHardeningData.summary.total : null, fakeDispatchCloseGate: closeGateHardeningData.workflows?.fakeDispatchCloseGate, fileOwnershipCloseGate: closeGateHardeningData.workflows?.fileOwnershipCloseGate }
+    : null,
+  stderr: closeGateHardening.stderr,
+})
+const stateRepair = run(process.execPath, [path.join(root, 'scripts', 'audit-state-repair.mjs'), '--root', root, '--target', root, '--json'])
+const stateRepairData = parseJson(stateRepair.stdout)
+checks.push({
+  id: 'validate-22a5',
+  label: 'state and evidence repair path audit',
+  status: stateRepair.status === 0 ? 'passed' : 'failed',
+  command: stateRepair.command,
+  summary: stateRepairData
+    ? { status: stateRepairData.summary?.status, actions: stateRepairData.summary?.actions, hard: stateRepairData.summary?.hard, warnings: stateRepairData.summary?.warnings, writes: stateRepairData.summary?.writes }
+    : null,
+  stderr: stateRepair.stderr,
+})
 const learningSystem = run(process.execPath, [path.join(root, 'scripts', 'audit-learning-system.mjs'), '--root', root, '--json'])
 const learningSystemData = parseJson(learningSystem.stdout)
 checks.push({
@@ -995,6 +1115,102 @@ checks.push({
     : null,
   stderr: learningSystem.stderr,
 })
+const learningPromotion = run(process.execPath, [path.join(root, 'scripts', 'audit-learning-promotion.mjs'), '--root', root, '--target', root, '--json'])
+const learningPromotionData = parseJson(learningPromotion.stdout)
+checks.push({
+  id: 'validate-22c',
+  label: 'learning promotion automation audit',
+  status: learningPromotion.status === 0 ? 'passed' : 'failed',
+  command: learningPromotion.command,
+  summary: learningPromotionData
+    ? { status: learningPromotionData.summary?.status, checks: learningPromotionData.summary ? learningPromotionData.summary.passed + '/' + learningPromotionData.summary.total : null, promoted: learningPromotionData.summary?.promoted, guardCandidates: learningPromotionData.summary?.guardCandidates }
+    : null,
+  stderr: learningPromotion.stderr,
+})
+const learningDrift = run(process.execPath, [path.join(root, 'scripts', 'audit-learning-drift.mjs'), '--root', root, '--target', root, '--json'])
+const learningDriftData = parseJson(learningDrift.stdout)
+checks.push({
+  id: 'validate-22c2',
+  label: 'learning promotion drift audit',
+  status: learningDrift.status === 0 ? 'passed' : 'failed',
+  command: learningDrift.command,
+  summary: learningDriftData
+    ? { status: learningDriftData.summary?.status, checks: learningDriftData.summary ? learningDriftData.summary.passed + '/' + learningDriftData.summary.total : null, candidates: learningDriftData.summary?.candidates, enforced: learningDriftData.summary?.enforced, highUnenforced: learningDriftData.summary?.highUnenforced }
+    : null,
+  stderr: learningDrift.stderr,
+})
+const hostCapabilities = run(process.execPath, [path.join(root, 'scripts', 'audit-host-capabilities.mjs'), '--root', root, '--target', root, '--json'])
+const hostCapabilitiesData = parseJson(hostCapabilities.stdout)
+checks.push({
+  id: 'validate-22d',
+  label: 'host capability record audit',
+  status: hostCapabilities.status === 0 ? 'passed' : 'failed',
+  command: hostCapabilities.command,
+  summary: hostCapabilitiesData
+    ? { status: hostCapabilitiesData.summary?.status, checks: hostCapabilitiesData.summary ? hostCapabilitiesData.summary.passed + '/' + hostCapabilitiesData.summary.total : null, hostCapabilityRecords: hostCapabilitiesData.workflows?.hostCapabilityRecords, nativeSlashCommandBoundary: hostCapabilitiesData.workflows?.nativeSlashCommandBoundary }
+    : null,
+  stderr: hostCapabilities.stderr,
+})
+const toolFallbackPolicy = run(process.execPath, [path.join(root, 'scripts', 'audit-tool-fallback-policy.mjs'), '--root', root, '--target', root, '--json'])
+const toolFallbackPolicyData = parseJson(toolFallbackPolicy.stdout)
+checks.push({
+  id: 'validate-22d2',
+  label: 'optional tool fallback policy audit',
+  status: toolFallbackPolicy.status === 0 ? 'passed' : 'failed',
+  command: toolFallbackPolicy.command,
+  summary: toolFallbackPolicyData
+    ? { status: toolFallbackPolicyData.summary?.status, checks: toolFallbackPolicyData.summary ? toolFallbackPolicyData.summary.passed + '/' + toolFallbackPolicyData.summary.total : null, optionalToolFallbackPolicy: toolFallbackPolicyData.workflows?.optionalToolFallbackPolicy }
+    : null,
+  stderr: toolFallbackPolicy.stderr,
+})
+const targetHardeningDrills = run(process.execPath, [path.join(root, 'scripts', 'audit-target-hardening-drills.mjs'), '--root', root, '--json'])
+const targetHardeningDrillsData = parseJson(targetHardeningDrills.stdout)
+checks.push({
+  id: 'validate-22e',
+  label: 'target project hardening drill audit',
+  status: targetHardeningDrills.status === 0 ? 'passed' : 'failed',
+  command: targetHardeningDrills.command,
+  summary: targetHardeningDrillsData
+    ? { status: targetHardeningDrillsData.summary?.status, checks: targetHardeningDrillsData.summary ? targetHardeningDrillsData.summary.passed + '/' + targetHardeningDrillsData.summary.total : null, mode: targetHardeningDrillsData.summary?.mode, targetHardeningDrills: targetHardeningDrillsData.workflows?.targetHardeningDrills }
+    : null,
+  stderr: targetHardeningDrills.stderr,
+})
+const maintenanceCadence = run(process.execPath, [path.join(root, 'scripts', 'audit-maintenance-cadence.mjs'), '--root', root, '--json'])
+const maintenanceCadenceData = parseJson(maintenanceCadence.stdout)
+checks.push({
+  id: 'validate-22f',
+  label: 'maintenance cadence audit',
+  status: maintenanceCadence.status === 0 ? 'passed' : 'failed',
+  command: maintenanceCadence.command,
+  summary: maintenanceCadenceData
+    ? { status: maintenanceCadenceData.summary?.status, checks: maintenanceCadenceData.summary ? maintenanceCadenceData.summary.passed + '/' + maintenanceCadenceData.summary.total : null, maintenanceCadence: maintenanceCadenceData.workflows?.maintenanceCadence }
+    : null,
+  stderr: maintenanceCadence.stderr,
+})
+const maintenanceSnapshot = run(process.execPath, [path.join(root, 'scripts', 'audit-maintenance-snapshot.mjs'), '--root', root, '--json'])
+const maintenanceSnapshotData = parseJson(maintenanceSnapshot.stdout)
+checks.push({
+  id: 'validate-22f2',
+  label: 'maintenance snapshot audit',
+  status: maintenanceSnapshot.status === 0 ? 'passed' : 'failed',
+  command: maintenanceSnapshot.command,
+  summary: maintenanceSnapshotData
+    ? { status: maintenanceSnapshotData.summary?.status, checks: maintenanceSnapshotData.summary ? maintenanceSnapshotData.summary.passed + '/' + maintenanceSnapshotData.summary.total : null, maintenanceSnapshot: maintenanceSnapshotData.workflows?.maintenanceSnapshot }
+    : null,
+  stderr: maintenanceSnapshot.stderr,
+})
+const installedSync = run(process.execPath, [path.join(root, 'scripts', 'audit-installed-sync.mjs'), '--root', root, '--json'])
+const installedSyncData = parseJson(installedSync.stdout)
+checks.push({
+  id: 'validate-22g',
+  label: 'installed sync freshness audit',
+  status: installedSync.status === 0 ? 'passed' : 'failed',
+  command: installedSync.command,
+  summary: installedSyncData
+    ? { status: installedSyncData.summary?.status, checks: installedSyncData.summary ? installedSyncData.summary.passed + '/' + installedSyncData.summary.total : null, freshPackage: installedSyncData.workflows?.freshPackage, installedSync: installedSyncData.workflows?.installedSync }
+    : null,
+  stderr: installedSync.stderr,
+})
 const readmeDocs = run(process.execPath, [path.join(root, 'scripts', 'audit-readme-docs.mjs'), '--root', root, '--json'])
 const readmeDocsData = parseJson(readmeDocs.stdout)
 checks.push({

package/scripts/verify-gse-package.mjs

@@ -1,85 +1,85 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-import crypto from 'node:crypto'
-
-const args = process.argv.slice(2)
-
-function readArg(name, fallback = null) {
-  const index = args.indexOf(name)
-  if (index === -1) return fallback
-  return args[index + 1] ?? fallback
-}
-
-const packageDir = path.resolve(readArg('--package', process.cwd()))
-const publicKeyPath = path.resolve(readArg('--public-key', path.join(packageDir, 'gse-signing-public.pem')))
-const signaturePath = path.resolve(readArg('--signature', path.join(packageDir, 'gse-package-signature.json')))
-const jsonOnly = args.includes('--json')
-
-function sha256(filePath) {
-  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
-}
-
-function fingerprint(pem) {
-  return crypto.createHash('sha256').update(pem).digest('hex')
-}
-
-function check(id, label, ok, evidence, risk = '') {
-  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
-}
-
-function readJson(filePath) {
-  if (!fs.existsSync(filePath)) return null
-  return JSON.parse(fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, ''))
-}
-
-const manifestPath = path.join(packageDir, 'gse-package-manifest.json')
-const manifest = readJson(manifestPath)
-const signatureRecord = readJson(signaturePath)
-const publicKeyPem = fs.existsSync(publicKeyPath) ? fs.readFileSync(publicKeyPath, 'utf8') : ''
-
-const files = manifest?.files ?? []
-const hashMismatches = []
-for (const relativePath of files) {
-  const fullPath = path.join(packageDir, relativePath)
-  const expected = manifest?.fileHashes?.[relativePath]
-  const actual = fs.existsSync(fullPath) ? sha256(fullPath) : null
-  if (!expected || actual !== expected) hashMismatches.push({ relativePath, expected, actual })
-}
-const recomputedDigest = manifest
-  ? crypto.createHash('sha256').update(JSON.stringify({ files: manifest.files, fileHashes: manifest.fileHashes })).digest('hex')
-  : null
-const payloadText = signatureRecord?.payload ? JSON.stringify(signatureRecord.payload) : ''
-let signatureOk = false
-try {
-  signatureOk = Boolean(publicKeyPem && signatureRecord?.signature && crypto.verify(null, Buffer.from(payloadText), publicKeyPem, Buffer.from(signatureRecord.signature, 'base64')))
-} catch {
-  signatureOk = false
-}
-
-const checks = [
-  check('SIG01', 'manifest exists', Boolean(manifest), manifestPath),
-  check('SIG02', 'signature record exists', Boolean(signatureRecord), signaturePath),
-  check('SIG03', 'public key exists', Boolean(publicKeyPem), publicKeyPath),
-  check('SIG04', 'all file hashes match manifest', hashMismatches.length === 0, hashMismatches.length ? JSON.stringify(hashMismatches.slice(0, 5)) : 'all files'),
-  check('SIG05', 'manifest package digest matches file hash table', Boolean(manifest?.integrity?.packageDigest && recomputedDigest === manifest.integrity.packageDigest), 'integrity.packageDigest'),
-  check('SIG06', 'signature payload matches manifest digest', Boolean(signatureRecord?.payload?.packageDigest && signatureRecord.payload.packageDigest === manifest?.integrity?.packageDigest), 'signature payload packageDigest'),
-  check('SIG07', 'signature verifies with public key', signatureOk, 'ed25519 signature'),
-  check('SIG08', 'public key fingerprint matches signature record', Boolean(publicKeyPem && signatureRecord?.publicKeyFingerprint === fingerprint(publicKeyPem)), 'public key fingerprint'),
-]
-
-const passed = checks.filter((item) => item.status === 'passed').length
-const failed = checks.length - passed
-const report = {
-  packageDir,
-  generatedAt: new Date().toISOString(),
-  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
-  workflows: { packageSignature: failed === 0 ? 'verified' : 'failed' },
-  checks,
-}
-
-if (jsonOnly) console.log(JSON.stringify(report, null, 2))
-else console.log(JSON.stringify(report, null, 2))
-
-if (failed > 0) process.exit(1)
-
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const packageDir = path.resolve(readArg('--package', process.cwd()))
+const publicKeyPath = path.resolve(readArg('--public-key', path.join(packageDir, 'gse-signing-public.pem')))
+const signaturePath = path.resolve(readArg('--signature', path.join(packageDir, 'gse-package-signature.json')))
+const jsonOnly = args.includes('--json')
+
+function sha256(filePath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
+}
+
+function fingerprint(pem) {
+  return crypto.createHash('sha256').update(pem).digest('hex')
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function readJson(filePath) {
+  if (!fs.existsSync(filePath)) return null
+  return JSON.parse(fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, ''))
+}
+
+const manifestPath = path.join(packageDir, 'gse-package-manifest.json')
+const manifest = readJson(manifestPath)
+const signatureRecord = readJson(signaturePath)
+const publicKeyPem = fs.existsSync(publicKeyPath) ? fs.readFileSync(publicKeyPath, 'utf8') : ''
+
+const files = manifest?.files ?? []
+const hashMismatches = []
+for (const relativePath of files) {
+  const fullPath = path.join(packageDir, relativePath)
+  const expected = manifest?.fileHashes?.[relativePath]
+  const actual = fs.existsSync(fullPath) ? sha256(fullPath) : null
+  if (!expected || actual !== expected) hashMismatches.push({ relativePath, expected, actual })
+}
+const recomputedDigest = manifest
+  ? crypto.createHash('sha256').update(JSON.stringify({ files: manifest.files, fileHashes: manifest.fileHashes })).digest('hex')
+  : null
+const payloadText = signatureRecord?.payload ? JSON.stringify(signatureRecord.payload) : ''
+let signatureOk = false
+try {
+  signatureOk = Boolean(publicKeyPem && signatureRecord?.signature && crypto.verify(null, Buffer.from(payloadText), publicKeyPem, Buffer.from(signatureRecord.signature, 'base64')))
+} catch {
+  signatureOk = false
+}
+
+const checks = [
+  check('SIG01', 'manifest exists', Boolean(manifest), manifestPath),
+  check('SIG02', 'signature record exists', Boolean(signatureRecord), signaturePath),
+  check('SIG03', 'public key exists', Boolean(publicKeyPem), publicKeyPath),
+  check('SIG04', 'all file hashes match manifest', hashMismatches.length === 0, hashMismatches.length ? JSON.stringify(hashMismatches.slice(0, 5)) : 'all files'),
+  check('SIG05', 'manifest package digest matches file hash table', Boolean(manifest?.integrity?.packageDigest && recomputedDigest === manifest.integrity.packageDigest), 'integrity.packageDigest'),
+  check('SIG06', 'signature payload matches manifest digest', Boolean(signatureRecord?.payload?.packageDigest && signatureRecord.payload.packageDigest === manifest?.integrity?.packageDigest), 'signature payload packageDigest'),
+  check('SIG07', 'signature verifies with public key', signatureOk, 'ed25519 signature'),
+  check('SIG08', 'public key fingerprint matches signature record', Boolean(publicKeyPem && signatureRecord?.publicKeyFingerprint === fingerprint(publicKeyPem)), 'public key fingerprint'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  packageDir,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { packageSignature: failed === 0 ? 'verified' : 'failed' },
+  checks,
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)
+