@t275005746/gse 0.1.0

package/references/task-levels.md

@@ -0,0 +1,81 @@
+# Task Levels
+
+Classify before choosing process weight.
+
+## Level 1 - Lite
+
+Use for small bugs, small UI/copy changes, scripts, docs, and narrow refactors.
+
+Required artifacts:
+
+- Inline `Outcome / Scope / Acceptance / Evidence / Next action`
+- Focused verification command or manual evidence
+- Learning only when reusable
+
+No change folder required.
+
+Gate profile:
+
+- Run the narrowest focused test, smoke, structural check, or manual evidence that proves the changed behavior.
+- Do not run build/typecheck/browser/full close gates by default unless the changed file or failure mode specifically requires them.
+- Keep evidence inline or in the existing slice log; do not create long process artifacts for tiny state-only changes.
+
+## Level 2 - Standard
+
+Use for user-visible features, API changes, state-machine branches, cross-file behavior, or work expected to take more than one focused slice.
+
+Required artifacts:
+
+- Goal-map binding or project issue link
+- `.gse/changes/<change-id>/brief.md`
+- Acceptance and evidence log
+- Focused tests or smoke verification
+
+Use OpenSpec or Comet when available and suitable.
+
+Gate profile:
+
+- Run focused tests for changed behavior and one integration/API/UI smoke when the user-visible path needs it.
+- Run build/typecheck before commit when the slice touches shared TypeScript contracts, Next routing/build-time code, generated package shape, or release/install paths.
+- Prefer combining several tiny state-only changes into one user-visible product chain instead of committing each micro-state transition separately.
+
+## Level 3 - Enterprise
+
+Use for long-running product work, security, payments, data migrations, public contracts, release readiness, multi-agent coordination, or architecture changes.
+
+Required artifacts:
+
+- Goal-map node
+- Spec or RFC
+- Design notes, state machine, or risk matrix when relevant
+- Quality gates and rollback plan
+- Review and evidence
+- Learning review after completion
+
+Use OpenSpec, Comet, subagents, CI gates, browser automation, and ADRs when available.
+
+Gate profile:
+
+- Run focused verification plus the relevant hard gate for the risk: build, browser smoke, API smoke, install/distribution audit, security check, migration check, or close gate.
+- Use full validation only for release, public contract, scaffold/skill, install, cross-host, or high-blast-radius changes.
+- Keep evidence concise even when gates are heavy; link or summarize outputs instead of pasting logs.
+
+## Upgrade Triggers
+
+Upgrade one level when:
+
+- Scope touches 3+ modules.
+- A public API, data model, security boundary, or release process changes.
+- Failure would block users or corrupt data.
+- The same issue recurred.
+- The task needs multiple agents or multiple sessions.
+
+## Slice Sizing
+
+Prefer a slice that proves one user-visible chain or one production capability boundary.
+
+- Too small: only flips an internal status with no visible capability, no contract change, and no risk reduction.
+- Healthy: covers a coherent path such as `bundle ShotSpec -> shot acceptance -> QA seed`, with focused tests proving the path.
+- Too large: mixes unrelated product flows, broad refactors, and release/process changes that cannot be verified in one evidence pass.
+
+For long-running productization, merge adjacent tiny state-machine steps when they are only meaningful together, but keep the acceptance proof focused.

package/references/tool-adapters.md

@@ -0,0 +1,73 @@
+# Tool Adapters
+
+GSE has few hard requirements. Tools enhance the workflow when available.
+
+## Minimum Tools
+
+- Git
+- A shell
+- Project build/test commands when present
+
+Recommended:
+
+- `rg` / `rg --files` for search
+- LSP for symbol navigation
+- Browser or Playwright for UI verification
+
+## Context and Code Location
+
+Use in order:
+
+1. Project rules: `AGENTS.md`, `CLAUDE.md`, README, or equivalent.
+2. `.gse/project-profile.md` for project-specific standards, commands, tools, and permissions.
+3. `.gse/README.md` and `goal-map.md` when present.
+4. `rg --files` and `rg` to find relevant code.
+5. LSP or code index when available.
+6. Existing tests and recent commits.
+
+Avoid broad reads of generated outputs, logs, lockfiles, or historical archives unless required.
+
+## Project-Specific Tools
+
+Use `references/drift-audit.md` when recorded tool status, command assumptions, MCP, LSP/index, browser, CI, package manager, or deployment facts may be stale.
+
+Use `project-profile.md` to record tool connections and status.
+
+Status vocabulary:
+
+- `verified`: command/config was tested or documented in a trusted project file.
+- `documented`: project docs mention it, but this session has not tested it.
+- `unknown`: not confirmed.
+- `unavailable`: expected but missing or failing.
+
+Project-specific commands and standards override generic recommendations. If the project says to use `pnpm`, `bun`, `make`, a custom smoke script, a specific LSP/index, or a private MCP server, follow that after verifying it is present or documenting its status.
+
+## Model Routing
+
+Use `references/model-routing.md` when choosing model, provider, hosted tool, worker, or role-specific agent capability. Record documented vs verified behavior separately.
+
+## Host Adapters
+
+Use `references/host-adapters.md` and `references/compatibility.md` when a project has `.codex/`, `.claude/`, `.agents/`, Hermes/AION-style runtime folders, WorkBuddy settings, MCP configs, hooks, local skills, or other host-specific workflow files.
+
+Host adapters are pointers and capability maps. They should not duplicate `.gse/goal-map.md`, `.gse/quality-gates.md`, or `.gse/evidence/`.
+
+## OpenSpec
+
+Use for capability specs and acceptance deltas. Fall back to `.gse/changes/` markdown when unavailable.
+
+## Comet
+
+Use for full change lifecycle when installed and suitable. Fall back to GSE change folders when unavailable.
+
+## Superpowers
+
+Use for complex plans, subagent-driven execution, and staged review. Do not force it on Level 1 work.
+
+## Self-Improvement
+
+Use when a user correction, repeated failure, tool gap, non-obvious root cause, or better recurring method is discovered.
+
+## Subagents
+
+Use when actual tools exist, such as `spawn_agent` / `wait_agent` or thread dispatch equivalents. Do not claim delegation when the tools are absent.

package/scripts/audit-acceptance-execution-packet.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const template = read('assets/templates/acceptance-execution-packet.md')
+const forwardTest = read('references/forward-test.md')
+const recipes = read('references/adoption-recipes.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const fields = [
+  'Acceptance path:',
+  'Target project or session:',
+  'Purpose:',
+  'Required inputs:',
+  'Allowed files:',
+  'Forbidden files:',
+  'Allowed commands:',
+  'Forbidden commands:',
+  'Expected output:',
+  'Evidence record path:',
+  'Acceptance gate:',
+  'Accepted by:',
+  'Stop conditions:',
+  'Residual risk if incomplete:',
+  'Next action after completion:',
+]
+
+const freshInputs = [
+  'SKILL.md',
+  '.gse/gse-design-master-plan.md',
+  '.gse/goal-map.md',
+  '.gse/current-slice.md',
+  'references/forward-test.md',
+  'references/evidence-taxonomy.md',
+]
+
+const projectInputs = [
+  'Project owner approval text or issue/task link.',
+  'references/adoption-recipes.md',
+  'assets/templates/target-adoption-evidence.md',
+  'assets/templates/update-release-acceptance-record.md',
+]
+
+const antiOverclaim = [
+  'Do not write `Accepted by: fresh-session` unless a separate session actually ran the packet.',
+  'Do not write `Accepted by: owner` unless owner approval is explicit and recorded.',
+  'Do not treat a generated packet, local validation, fixture audit, or read-only discovery as acceptance.',
+  'Evidence status: not ready',
+  'Accepted by: not accepted',
+]
+
+const checks = [
+  check('AEP01', 'acceptance execution packet template exists', exists('assets/templates/acceptance-execution-packet.md'), 'assets/templates/acceptance-execution-packet.md'),
+  check('AEP02', 'packet captures execution boundaries', fields.every((item) => template.includes(item)), fields.join(', ')),
+  check('AEP03', 'fresh-session path uses documented GSE inputs', freshInputs.every((item) => template.includes(item)), freshInputs.join(', ')),
+  check('AEP04', 'owner-approved path requires explicit owner evidence and project templates', projectInputs.every((item) => template.includes(item)), projectInputs.join(', ')),
+  check('AEP05', 'packet limits default project writes to .gse artifacts', template.includes('.gse/project-profile.md') && template.includes('.gse/evidence/YYYY-MM-DD.md') && template.includes('Source code, lockfiles, secrets'), 'allowed and forbidden file sections'),
+  check('AEP06', 'packet prevents fake acceptance', antiOverclaim.every((item) => template.includes(item)), 'anti-overclaim rules'),
+  check('AEP07', 'forward-test reference supports fresh-session acceptance boundary', forwardTest.includes('Use `accepted by: fresh-session` only when a separate agent/session actually ran the path.'), 'references/forward-test.md'),
+  check('AEP08', 'adoption recipes support target adoption evidence template', recipes.includes('assets/templates/target-adoption-evidence.md'), 'references/adoption-recipes.md'),
+  check('AEP09', 'consolidated validator includes this audit', validate.includes('audit-acceptance-execution-packet.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { acceptanceExecutionPacket: failed === 0 ? 'verified' : 'failed' },
+  acceptedBy: 'not accepted; this audit verifies packet readiness only',
+  limits: [
+    'This audit verifies acceptance packet readiness only.',
+    'It does not create a separate session, write to a target project, or record owner acceptance.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Acceptance Execution Packet Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Acceptance execution packet: ' + data.workflows.acceptanceExecutionPacket)
+  lines.push('- Accepted by: ' + data.acceptedBy)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-adoption-recipes.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const recipes = read('references/adoption-recipes.md')
+const skill = read('SKILL.md')
+const bootstrap = read('references/project-bootstrap.md')
+const packaging = read('references/packaging.md')
+const examples = read('examples/README.md')
+
+const recipeNames = ['Fresh Project Install', 'Existing Repo Adoption', 'Update Existing GSE', 'Host Adapter Adoption', 'CLI Or Package Project Adoption']
+const recordFields = ['Adoption recipe:', 'Project path:', 'Mode or host:', 'Project rules read:', 'Commands run:', 'Files created or changed:', 'Preserved project-specific rules:', 'Host/tool statuses:', 'Validation evidence:', 'Evidence status:', 'Residual risk:', 'Next action:']
+const commands = ['init-project.mjs', 'discover-project-profile.mjs', 'generate-command-adapter.mjs', 'audit-command-adapters.mjs', 'generate-host-adapter.mjs', 'audit-project.mjs', 'audit-adoption.mjs', 'audit-host-adapters.mjs', 'audit-fixtures.mjs', 'validate-gse.mjs']
+const statusTerms = ['result', 'verified', 'accepted', 'not ready', 'unknown', 'documented', 'unavailable']
+
+const checks = [
+  check('AR01', 'adoption recipes reference exists', exists('references/adoption-recipes.md'), 'references/adoption-recipes.md'),
+  check('AR02', 'SKILL routes adoption recipes', skill.includes('references/adoption-recipes.md'), 'SKILL.md Reference Routing'),
+  check('AR03', 'bootstrap, packaging, and examples route to recipes', bootstrap.includes('references/adoption-recipes.md') && packaging.includes('references/adoption-recipes.md') && examples.includes('references/adoption-recipes.md'), 'project-bootstrap.md, packaging.md, examples/README.md'),
+  check('AR04', 'core adoption recipes are present', recipeNames.every((item) => recipes.includes(item)), recipeNames.join(', ')),
+  check('AR05', 'fresh install includes mode selection and init command', recipes.includes('--mode <mode>') && recipes.includes('node <gse-skill>/scripts/init-project.mjs --target <project-root> --mode <mode>'), 'Fresh Project Install'),
+  check('AR06', 'existing repo adoption protects pre-existing project files', recipes.includes('Do not overwrite') && recipes.includes('--force') && recipes.includes('documented`, not `verified`'), 'Existing Repo Adoption'),
+  check('AR07', 'update recipe preserves local decisions and validates skill package', recipes.includes('Preserve local project decisions') && recipes.includes('node <gse-skill>/scripts/validate-gse.mjs --root <gse-skill>'), 'Update Existing GSE'),
+  check('AR08', 'host adapter recipe uses current command adapter path and keeps .gse source of truth', recipes.includes('Keep `.gse/` as the source of truth') && recipes.includes('generate-command-adapter.mjs') && recipes.includes('claude|codex|hermes|workbuddy|copilot|gemini|generic|all') && recipes.includes('legacy fixture helper') && recipes.includes('verified`, `documented`, `unknown`, or `unavailable`'), 'Host Adapter Adoption'),
+  check('AR09', 'adoption record has required fields', recordFields.every((item) => recipes.includes(item)), recordFields.join(', ')),
+  check('AR10', 'verification command list covers adoption scripts', commands.every((item) => recipes.includes(item)), commands.join(', ')),
+  check('AR11', 'status vocabulary avoids overclaiming', statusTerms.every((item) => recipes.includes(item)) && recipes.includes('do not certify arbitrary production repositories'), 'status and certification boundary'),
+  check('AR12', 'recipes are host-neutral and require project evidence', recipes.includes('host-neutral') && recipes.includes('project-specific evidence') && recipes.includes('unknown` until checked'), 'host-neutral project evidence rules'),
+  check('AR13', 'CLI/package adoption keeps release and install claims evidence-bound', recipes.includes('CLI Or Package Project Adoption') && recipes.includes('npm pack --dry-run') && recipes.includes('registry access') && recipes.includes('global install') && recipes.includes('shell completion require project-specific evidence'), 'CLI/package adoption recipe'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { adoptionRecipes: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'Adoption recipe audit verifies reusable recipe coverage and routing; it does not install GSE into arbitrary production repositories.',
+    'Real adoption still needs project-specific inspection, focused smokes, and host/tool evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Adoption Recipe Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Adoption recipes: ' + data.workflows.adoptionRecipes)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-adoption.mjs

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const keepTemp = args.includes('--keep-temp')
+const tempRootArg = readArg('--temp-root', null)
+const tempRoot = tempRootArg ? path.resolve(tempRootArg) : fs.mkdtempSync(path.join(os.tmpdir(), 'gse-adoption-audit-'))
+const target = path.join(tempRoot, 'existing-repo')
+const discoveryScript = path.join(root, 'scripts', 'discover-project-profile.mjs')
+
+function write(relativePath, content) {
+  const fullPath = path.join(target, relativePath)
+  fs.mkdirSync(path.dirname(fullPath), { recursive: true })
+  fs.writeFileSync(fullPath, content.trimStart().replace(/\n/g, '\r\n'), 'utf8')
+}
+
+function runNode(script, commandArgs) {
+  return spawnSync(process.execPath, [script, ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function setupFixture() {
+  fs.rmSync(target, { recursive: true, force: true })
+  fs.mkdirSync(target, { recursive: true })
+  write('AGENTS.md', '# Existing Repo Rules\n\n- Prefer focused tests.\n- Do not overwrite existing project workflow files without explicit force.\n')
+  write('README.md', '# Existing Repo Fixture\n\nRepresentative repository shape for GSE adoption smoke.\n')
+  write('package.json', JSON.stringify({
+    name: 'gse-existing-repo-fixture',
+    private: true,
+    scripts: { dev: 'vite', test: 'vitest run', 'test:e2e': 'playwright test', typecheck: 'tsc --noEmit', build: 'vite build' },
+    dependencies: { react: '^19.0.0', vite: '^6.0.0' },
+    devDependencies: { typescript: '^5.0.0', '@playwright/test': '^1.0.0', vitest: '^2.0.0', eslint: '^9.0.0' },
+  }, null, 2))
+  write('playwright.config.ts', 'export default {}\n')
+  write('.env.example', 'PUBLIC_API_URL=https://example.invalid\n')
+  write('.github/workflows/ci.yml', 'name: ci\non: [push]\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - run: npm test\n')
+  write('.gse/project-profile.md', '# Existing Project Profile\n\nDo not overwrite me without --force.\n')
+  write('.gse/goal-map.md', '# Existing Goal Map\n\nExisting project goal map.\n')
+}
+
+if (!fs.existsSync(discoveryScript)) {
+  console.error('Missing discover-project-profile.mjs at ' + discoveryScript)
+  process.exit(1)
+}
+
+setupFixture()
+const profilePath = path.join(target, '.gse', 'project-profile.md')
+const beforeProfile = fs.readFileSync(profilePath, 'utf8')
+
+const discovery = runNode(discoveryScript, ['--target', target, '--json'])
+const model = discovery.status === 0 ? parseJson(discovery.stdout) : null
+const noForceWrite = runNode(discoveryScript, ['--target', target, '--write'])
+const afterNoForce = fs.readFileSync(profilePath, 'utf8')
+const forceWrite = runNode(discoveryScript, ['--target', target, '--write', '--force'])
+const afterForce = fs.readFileSync(profilePath, 'utf8')
+
+const frameworks = new Set(model?.identity?.frameworks ?? [])
+const toolConnections = model?.toolConnections ?? []
+const statuses = new Set(toolConnections.map((item) => item.status))
+const verifiedTools = toolConnections.filter((item) => item.status === 'verified')
+const scriptNames = new Set((model?.scripts ?? []).map((item) => item.name))
+
+const checks = [
+  check('A01', 'controlled existing repo fixture was created', fs.existsSync(path.join(target, 'package.json')) && fs.existsSync(profilePath), 'package.json and pre-existing .gse/project-profile.md'),
+  check('A02', 'discovery reads real project files', discovery.status === 0 && Boolean(model), 'discover-project-profile --json'),
+  check('A03', 'discovery detects representative existing repo shape', frameworks.has('React') && frameworks.has('Vite') && frameworks.has('TypeScript') && frameworks.has('Playwright'), 'frameworks: ' + [...frameworks].join(', ')),
+  check('A04', 'discovery captures focused commands from package.json', scriptNames.has('test') && scriptNames.has('test:e2e') && scriptNames.has('typecheck') && scriptNames.has('build'), 'scripts: ' + [...scriptNames].join(', ')),
+  check('A05', 'tool statuses stay documented or unknown, not invented verified', statuses.has('documented') && statuses.has('unknown') && verifiedTools.length === 0, 'tool statuses: ' + [...statuses].join(', ')),
+  check('A06', 'write without force refuses to overwrite existing profile', noForceWrite.status === 2 && afterNoForce === beforeProfile, 'exit ' + noForceWrite.status + '; profile unchanged'),
+  check('A07', 'write with force explicitly overwrites profile', forceWrite.status === 0 && afterForce !== beforeProfile && afterForce.includes('Generated:') && afterForce.includes('Tool Connections'), 'force write exit ' + forceWrite.status),
+  check('A08', 'generated profile preserves documented-not-verified warning', afterForce.includes('Tool presence from config is marked documented, not verified'), '.gse/project-profile.md known gotcha'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  target,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    existingRepoDiscovery: checks.filter((item) => ['A02', 'A03', 'A04', 'A05'].includes(item.id)).every((item) => item.status === 'passed') ? 'verified' : 'failed',
+    nonOverwriteSafety: checks.filter((item) => ['A06', 'A07'].includes(item.id)).every((item) => item.status === 'passed') ? 'verified' : 'failed',
+  },
+  limits: [
+    'Adoption audit uses a controlled existing-repo fixture in a temporary directory, not arbitrary production repositories.',
+    'Config and script presence is treated as documented unless commands are actually run.',
+    'No package install, CI, browser, MCP, LSP, or external service is executed.',
+  ],
+  checks,
+}
+
+if (!keepTemp) fs.rmSync(tempRoot, { recursive: true, force: true })
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Existing Repo Adoption Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Temp root: ' + data.tempRoot)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Existing repo discovery: ' + data.workflows.existingRepoDiscovery)
+  lines.push('- Non-overwrite safety: ' + data.workflows.nonOverwriteSafety)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-change-lifecycle.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const target = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-change-lifecycle-'))
+const initScript = path.join(root, 'scripts', 'init-change.mjs')
+const closeScript = path.join(root, 'scripts', 'close-change.mjs')
+
+function run(script, commandArgs) {
+  return spawnSync(process.execPath, [script, ...commandArgs], { cwd: root, encoding: 'utf8', windowsHide: true })
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+fs.mkdirSync(path.join(target, '.gse', 'evidence'), { recursive: true })
+fs.writeFileSync(path.join(target, '.gse', 'goal-map.md'), '# Goal Map\n', 'utf8')
+fs.writeFileSync(path.join(target, '.gse', 'quality-gates.md'), '# Quality Gates\n', 'utf8')
+fs.writeFileSync(path.join(target, '.gse', 'evidence', 'index.jsonl'), '', 'utf8')
+
+const init = run(initScript, ['--target', target, '--change-id', 'Archive Me', '--level', 'standard', '--json'])
+const dryRun = run(closeScript, ['--target', target, '--change-id', 'archive-me', '--status', 'verified', '--date', '2026-07-06', '--dry-run', '--json'])
+const dryRunPreservedSource = fs.existsSync(path.join(target, '.gse', 'changes', 'archive-me'))
+const close = run(closeScript, ['--target', target, '--change-id', 'archive-me', '--status', 'verified', '--date', '2026-07-06', '--json'])
+const closeJson = parseJson(close.stdout)
+const archiveDir = path.join(target, '.gse', 'archive', '2026-07-06-archive-me')
+const sourceDir = path.join(target, '.gse', 'changes', 'archive-me')
+const indexText = fs.readFileSync(path.join(target, '.gse', 'evidence', 'index.jsonl'), 'utf8')
+const archiveRecord = fs.existsSync(path.join(archiveDir, 'archive-record.md')) ? fs.readFileSync(path.join(archiveDir, 'archive-record.md'), 'utf8') : ''
+
+const checks = [
+  check('CHGLC01', 'close-change script exists', fs.existsSync(closeScript), 'scripts/close-change.mjs'),
+  check('CHGLC02', 'init-change creates closeable change pack', init.status === 0, 'scripts/init-change.mjs fixture run'),
+  check('CHGLC03', 'dry-run reports pass without moving source folder', dryRun.status === 0 && dryRunPreservedSource, 'close-change --dry-run'),
+  check('CHGLC04', 'close moves change folder into archive', close.status === 0 && fs.existsSync(archiveDir) && !fs.existsSync(sourceDir), '.gse/archive/YYYY-MM-DD-change-id'),
+  check('CHGLC05', 'archive record captures closure metadata', archiveRecord.includes('Status: verified') && archiveRecord.includes('Source: .gse/changes/archive-me'), 'archive-record.md'),
+  check('CHGLC06', 'evidence index receives schema-complete change-archive record', indexText.includes('"recordType":"change-archive"') && indexText.includes('"changeId":"archive-me"') && indexText.includes('"commands":') && indexText.includes('"nextAction":'), '.gse/evidence/index.jsonl'),
+  check('CHGLC07', 'close output preserves evidence status and archive path', closeJson?.evidenceStatus === 'verified' && closeJson?.indexRecord?.archivePath === '.gse/archive/2026-07-06-archive-me', 'close-change JSON'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { changeArchiveLifecycle: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies local change archive mechanics in a fixture.',
+    'It does not certify the product correctness of a real target-project change.',
+  ],
+  checks,
+}
+
+fs.rmSync(target, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)