@t275005746/gse 0.1.0

package/scripts/audit-change-system.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const initScript = path.join(root, 'scripts', 'init-change.mjs')
+
+function runNode(script, runArgs, cwd = root) {
+  return spawnSync(process.execPath, [script, ...runArgs], {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function read(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : ''
+}
+
+function exists(filePath) {
+  return fs.existsSync(filePath)
+}
+
+function check(id, label, ok, evidence, recommendation = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, recommendation }
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-change-system-'))
+fs.mkdirSync(path.join(tempRoot, '.gse'), { recursive: true })
+fs.writeFileSync(path.join(tempRoot, '.gse', 'goal-map.md'), '# Goal Map\n', 'utf8')
+fs.writeFileSync(path.join(tempRoot, '.gse', 'quality-gates.md'), '# Quality Gates\n', 'utf8')
+
+const firstRun = runNode(initScript, ['--target', tempRoot, '--change-id', 'Add User Login!', '--level', 'enterprise', '--json'])
+const first = parseJson(firstRun.stdout)
+const secondRun = runNode(initScript, ['--target', tempRoot, '--change-id', 'Add User Login!', '--level', 'enterprise', '--json'])
+const second = parseJson(secondRun.stdout)
+const changeDir = path.join(tempRoot, '.gse', 'changes', 'add-user-login')
+const requiredFiles = [
+  'brief.md',
+  'spec.md',
+  'design.md',
+  'tasks.md',
+  'evidence.md',
+  'review.md',
+  'execution-quality-pack.md',
+]
+const missing = requiredFiles.filter((file) => !exists(path.join(changeDir, file)))
+const spec = read(path.join(changeDir, 'spec.md'))
+const design = read(path.join(changeDir, 'design.md'))
+const tasks = read(path.join(changeDir, 'tasks.md'))
+const evidence = read(path.join(changeDir, 'evidence.md'))
+const review = read(path.join(changeDir, 'review.md'))
+const executionPack = read(path.join(changeDir, 'execution-quality-pack.md'))
+
+const checks = [
+  check('CHG01', 'init-change script exists', exists(initScript), 'scripts/init-change.mjs'),
+  check('CHG02', 'first run writes full change pack', firstRun.status === 0 && first?.summary?.written === requiredFiles.length && missing.length === 0, `written:${first?.summary?.written ?? 'unknown'}, missing:${missing.join(', ') || 'none'}`),
+  check('CHG03', 'rerun is non-overwriting by default', secondRun.status === 0 && second?.summary?.skipped === requiredFiles.length, `skipped:${second?.summary?.skipped ?? 'unknown'}`),
+  check('CHG04', 'spec includes behavior, state, recovery, privacy, acceptance, and non-goals', ['## Behavior', '## State / Data Flow', '## Error and Recovery', '## Permissions and Privacy', '## Acceptance Criteria', '## Non-goals'].every((term) => spec.includes(term)), 'spec.md'),
+  check('CHG05', 'design includes contracts, rollback, alternatives, and open questions', ['## Interfaces And Contracts', '## Rollback', '## Alternatives Considered', '## Open Questions'].every((term) => design.includes(term)), 'design.md'),
+  check('CHG06', 'tasks enforce verifiable slice execution', ['Locate existing patterns', 'Run focused verification', 'Record evidence'].every((term) => tasks.includes(term)), 'tasks.md'),
+  check('CHG07', 'evidence preserves result/verified/accepted distinction', evidence.includes('result | verified | accepted | not ready'), 'evidence.md'),
+  check('CHG08', 'review covers spec, quality, architecture, security, regression, and evidence', ['## Spec Compliance', '## Code Quality', '## Architecture / Ownership', '## Security / Privacy', '## Regression Risk', '## Evidence Review'].every((term) => review.includes(term)), 'review.md'),
+  check('CHG09', 'execution pack maps skills, tools, quality gates, evidence, and closure', ['## Required Skills Or Roles', '## Tool Routing', 'OpenSpec', 'Superpowers', '## Quality Gates Selected', '## Evidence Plan', '## Review And Closure'].every((term) => executionPack.includes(term)), 'execution-quality-pack.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    changeSpecPack: failed === 0 ? 'verified' : 'failed',
+    executionQualityPack: failed === 0 ? 'verified' : 'failed',
+  },
+  limits: [
+    'This audit verifies GSE native change/spec and execution-quality pack structure in a fixture.',
+    'It does not run OpenSpec, Superpowers, project tests, browser smokes, or real target-project changes.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Change System Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Change spec pack: ' + data.workflows.changeSpecPack)
+  lines.push('- Execution quality pack: ' + data.workflows.executionQualityPack)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-ci-readiness.mjs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const workflowPath = '.github/workflows/validate-gse.yml'
+const workflow = read(workflowPath)
+const packaging = read('references/packaging.md')
+const openSourceAudit = read('scripts/audit-open-source-readiness.mjs')
+const validate = read('scripts/validate-gse.mjs')
+
+const requiredWorkflowTerms = [
+  'name: Validate GSE',
+  'pull_request:',
+  'push:',
+  'workflow_dispatch:',
+  'actions/checkout@v4',
+  'actions/setup-node@v4',
+  'node-version: "20"',
+  'node scripts/validate-gse.mjs --root . --skip-skill-validator --json',
+  'node scripts/audit-final-readiness.mjs --root . --json',
+  'node scripts/audit-final-acceptance-packet.mjs --root . --json',
+]
+
+const checks = [
+  check('CI01', 'GitHub Actions validation workflow exists', exists(workflowPath), workflowPath),
+  check('CI02', 'workflow covers pull request, push, and manual dispatch', ['pull_request:', 'push:', 'workflow_dispatch:'].every((term) => workflow.includes(term)), 'workflow triggers'),
+  check('CI03', 'workflow uses pinned major official actions and Node 20', workflow.includes('actions/checkout@v4') && workflow.includes('actions/setup-node@v4') && workflow.includes('node-version: "20"'), 'checkout/setup-node/node version'),
+  check('CI04', 'workflow runs full GSE validation with CI-safe skill validator boundary', workflow.includes('node scripts/validate-gse.mjs --root . --skip-skill-validator --json'), 'validate-gse CI command'),
+  check('CI05', 'workflow audits final readiness and final acceptance boundaries', workflow.includes('audit-final-readiness.mjs') && workflow.includes('audit-final-acceptance-packet.mjs'), 'final readiness and packet audits'),
+  check('CI06', 'workflow contains all required terms', requiredWorkflowTerms.every((term) => workflow.includes(term)), requiredWorkflowTerms.join(', ')),
+  check('CI07', 'packaging docs include CI workflow in package boundary', packaging.includes('.github/workflows/validate-gse.yml'), 'references/packaging.md'),
+  check('CI08', 'open-source readiness audit includes CI readiness', openSourceAudit.includes('audit-ci-readiness.mjs') || openSourceAudit.includes('.github/workflows/validate-gse.yml'), 'scripts/audit-open-source-readiness.mjs'),
+  check('CI09', 'consolidated validator includes CI readiness audit', validate.includes('audit-ci-readiness.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    ciWorkflowTemplate: failed === 0 ? 'verified' : 'failed',
+    publicCiRun: 'external-required',
+  },
+  limits: [
+    'This audit verifies the repository CI workflow template and local wiring.',
+    'It does not prove a public GitHub Actions run, branch protection, required checks, or marketplace CI policy.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE CI Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- CI workflow template: ' + data.workflows.ciWorkflowTemplate)
+  lines.push('- Public CI run: ' + data.workflows.publicCiRun)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-close-gate.mjs

@@ -0,0 +1,323 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const jsonOnly = args.includes('--json')
+const selfTest = args.includes('--self-test') || !args.includes('--target')
+const targetArg = readArg('--target')
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function readJson(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, data: null, error: 'missing' }
+  try {
+    return { exists: true, ok: true, data: JSON.parse(readText(filePath)), error: '' }
+  } catch (error) {
+    return { exists: true, ok: false, data: null, error: error.message }
+  }
+}
+
+function readJsonl(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, records: [], error: 'missing' }
+  const lines = readText(filePath)
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+  const records = []
+  for (const [index, line] of lines.entries()) {
+    try {
+      records.push(JSON.parse(line))
+    } catch (error) {
+      return { exists: true, ok: false, records, error: `line ${index + 1}: ${error.message}` }
+    }
+  }
+  return { exists: true, ok: true, records, error: '' }
+}
+
+function exists(target, relativePath) {
+  return fs.existsSync(path.join(target, relativePath))
+}
+
+function runGit(target, commandArgs) {
+  const result = spawnSync('git', commandArgs, {
+    cwd: target,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function statusFrom(ok, warn = false) {
+  if (ok) return 'passed'
+  if (warn) return 'warning'
+  return 'failed'
+}
+
+function check(id, label, status, evidence, recommendation = '') {
+  return { id, label, status, evidence, recommendation }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-close-gate-'))
+  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+  fs.writeFileSync(path.join(dir, '.gse', 'README.md'), '# GSE\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'project-profile.md'), '# Project Profile\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'goal-map.md'), '# Goal Map\n\nNext action: archive slice.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'quality-gates.md'), '# Quality Gates\n\n## Universal\n\n- Evidence required.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-06.md'), '# Evidence\n\nEvidence status: verified.\n', 'utf8')
+  fs.writeFileSync(
+    path.join(dir, '.gse', 'state.json'),
+    JSON.stringify(
+      {
+        schemaVersion: 1,
+        projectName: 'fixture-product',
+        mode: 'standard',
+        canonicalPlan: '',
+        phase: 'verify',
+        currentSlice: {
+          id: 'fixture-close',
+          outcome: 'Fixture close gate.',
+          status: 'verified',
+          nextAction: 'Archive slice.',
+        },
+        toolStatuses: {
+          browser: 'unknown',
+          lsp: 'unknown',
+          mcp: 'unknown',
+          subagents: 'unknown',
+          ci: 'unknown',
+        },
+        lastEvidence: '.gse/evidence/2026-07-06.md',
+        residualRisks: ['Fixture residual risk.'],
+      },
+      null,
+      2,
+    ) + '\n',
+    'utf8',
+  )
+  fs.writeFileSync(
+    path.join(dir, '.gse', 'evidence', 'index.jsonl'),
+    JSON.stringify({
+      date: '2026-07-06',
+      recordType: 'slice',
+      status: 'verified',
+      summary: 'Fixture close gate evidence.',
+      evidenceFile: '.gse/evidence/2026-07-06.md',
+      commands: ['node scripts/audit-close-gate.mjs --self-test'],
+      nextAction: 'Archive slice.',
+    }) + '\n',
+    'utf8',
+  )
+  runGit(dir, ['init'])
+  runGit(dir, ['config', 'user.email', 'gse-fixture@example.local'])
+  runGit(dir, ['config', 'user.name', 'GSE Fixture'])
+  runGit(dir, ['add', '.'])
+  runGit(dir, ['commit', '-m', 'fixture'])
+  return dir
+}
+
+function auditCloseGate(target) {
+  const resolvedTarget = path.resolve(target)
+  const gseDir = path.join(resolvedTarget, '.gse')
+  const state = readJson(path.join(gseDir, 'state.json'))
+  const evidenceIndex = readJsonl(path.join(gseDir, 'evidence', 'index.jsonl'))
+  const checks = []
+
+  checks.push(
+    check(
+      'CG01',
+      '.gse directory exists',
+      statusFrom(exists(resolvedTarget, '.gse')),
+      exists(resolvedTarget, '.gse') ? '.gse exists' : '.gse missing',
+      exists(resolvedTarget, '.gse') ? '' : 'Initialize or adopt GSE before closing a slice.',
+    ),
+  )
+
+  const stateValid =
+    state.ok &&
+    state.data?.schemaVersion === 1 &&
+    typeof state.data?.phase === 'string' &&
+    typeof state.data?.currentSlice?.status === 'string' &&
+    typeof state.data?.currentSlice?.nextAction === 'string'
+  checks.push(
+    check(
+      'CG02',
+      'state.json is valid',
+      statusFrom(stateValid),
+      state.exists ? state.ok ? `phase:${state.data.phase}, status:${state.data.currentSlice?.status}` : 'invalid ' + state.error : 'missing',
+      stateValid ? '' : 'Repair .gse/state.json before closing the slice.',
+    ),
+  )
+
+  const indexValid =
+    evidenceIndex.ok &&
+    evidenceIndex.records.length > 0 &&
+    evidenceIndex.records.every(
+      (record) =>
+        typeof record.date === 'string' &&
+        typeof record.recordType === 'string' &&
+        typeof record.status === 'string' &&
+        typeof record.summary === 'string' &&
+        typeof record.evidenceFile === 'string' &&
+        Array.isArray(record.commands) &&
+        typeof record.nextAction === 'string',
+    )
+  checks.push(
+    check(
+      'CG03',
+      'evidence index is valid',
+      statusFrom(indexValid),
+      evidenceIndex.exists ? evidenceIndex.ok ? `${evidenceIndex.records.length} record(s)` : 'invalid ' + evidenceIndex.error : 'missing',
+      indexValid ? '' : 'Record at least one evidence index entry before closing.',
+    ),
+  )
+
+  const closeableState = ['verified', 'accepted'].includes(state.data?.currentSlice?.status)
+  checks.push(
+    check(
+      'CG04',
+      'current slice status is closeable',
+      statusFrom(closeableState),
+      `currentSlice.status:${state.data?.currentSlice?.status ?? 'unknown'}`,
+      closeableState ? '' : 'Set currentSlice.status to verified or accepted only after focused evidence exists.',
+    ),
+  )
+
+  const closeableEvidenceRecords = evidenceIndex.records.filter((record) => ['verified', 'accepted'].includes(record.status))
+  const evidenceFilesExist =
+    closeableEvidenceRecords.length > 0 &&
+    closeableEvidenceRecords.every((record) => exists(resolvedTarget, record.evidenceFile))
+  checks.push(
+    check(
+      'CG05',
+      'verified or accepted evidence record exists',
+      statusFrom(evidenceFilesExist),
+      closeableEvidenceRecords.length
+        ? closeableEvidenceRecords.map((record) => `${record.status}:${record.evidenceFile}:${exists(resolvedTarget, record.evidenceFile) ? 'exists' : 'missing'}`).join('; ')
+        : 'no verified/accepted evidence index record',
+      evidenceFilesExist ? '' : 'Add verified evidence and ensure the referenced evidence file exists.',
+    ),
+  )
+
+  const requiredDocs = ['.gse/README.md', '.gse/project-profile.md', '.gse/goal-map.md', '.gse/quality-gates.md']
+  const missingDocs = requiredDocs.filter((relativePath) => !exists(resolvedTarget, relativePath))
+  checks.push(
+    check(
+      'CG06',
+      'required workflow docs exist',
+      statusFrom(missingDocs.length === 0),
+      missingDocs.length ? 'missing: ' + missingDocs.join(', ') : `${requiredDocs.length}/${requiredDocs.length} present`,
+      missingDocs.length ? 'Restore required workflow docs before closing.' : '',
+    ),
+  )
+
+  const residualRisksOk = Array.isArray(state.data?.residualRisks)
+  checks.push(
+    check(
+      'CG07',
+      'residual risks are explicit',
+      statusFrom(residualRisksOk),
+      residualRisksOk ? `${state.data.residualRisks.length} residual risk(s)` : 'missing residualRisks array',
+      residualRisksOk ? '' : 'Use an empty array if there is no known residual risk.',
+    ),
+  )
+
+  const gitRoot = runGit(resolvedTarget, ['rev-parse', '--show-toplevel'])
+  const isGitRepo = gitRoot.status === 0
+  const gseStatus = isGitRepo ? runGit(resolvedTarget, ['status', '--short', '.gse']) : { status: 1, stdout: '', stderr: 'not a git repository' }
+  checks.push(
+    check(
+      'CG08',
+      '.gse git state is known',
+      isGitRepo ? (gseStatus.stdout ? 'warning' : 'passed') : 'warning',
+      isGitRepo ? gseStatus.stdout || 'clean' : 'not a git repository',
+      isGitRepo && gseStatus.stdout ? 'Review and intentionally stage/commit or document project-local GSE changes.' : '',
+    ),
+  )
+
+  const failed = checks.filter((item) => item.status === 'failed').length
+  const warnings = checks.filter((item) => item.status === 'warning').length
+  const passed = checks.filter((item) => item.status === 'passed').length
+
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: {
+      status: failed > 0 ? 'not-ready' : warnings > 0 ? 'ready-with-warnings' : 'ready',
+      passed,
+      warnings,
+      failed,
+      total: checks.length,
+    },
+    workflows: {
+      closeGate: failed > 0 ? 'not-ready' : warnings > 0 ? 'ready-with-warnings' : 'ready',
+    },
+    state: {
+      exists: state.exists,
+      valid: stateValid,
+      phase: state.data?.phase ?? null,
+      currentSliceStatus: state.data?.currentSlice?.status ?? null,
+      nextAction: state.data?.currentSlice?.nextAction ?? null,
+    },
+    evidenceIndex: {
+      exists: evidenceIndex.exists,
+      valid: indexValid,
+      records: evidenceIndex.records.length,
+      closeableRecords: closeableEvidenceRecords.length,
+    },
+    checks,
+    limits: [
+      'Close gate is diagnostic. It reports ready/not-ready and does not modify files.',
+      'A ready close gate does not replace user, reviewer, release, or owner acceptance when the project requires it.',
+      'Project tests, browser smokes, CI, MCP, LSP, subagents, and release checks must still be run according to project quality gates.',
+    ],
+  }
+}
+
+function renderMarkdown(report) {
+  const lines = []
+  lines.push('# GSE Close Gate')
+  lines.push('')
+  lines.push('Generated: ' + report.generatedAt)
+  lines.push('Target: ' + report.target)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + report.summary.status)
+  lines.push('- Checks: ' + report.summary.passed + ' passed, ' + report.summary.warnings + ' warnings, ' + report.summary.failed + ' failed, ' + report.summary.total + ' total')
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of report.checks) {
+    const marker = item.status === 'passed' ? '[x]' : item.status === 'warning' ? '[!]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+    if (item.recommendation) lines.push('  - Recommendation: ' + item.recommendation)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of report.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+const target = selfTest ? createFixture() : targetArg
+const report = auditCloseGate(target)
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))

package/scripts/audit-command-adapters.mjs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const target = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-command-adapter-'))
+const script = path.join(root, 'scripts', 'generate-command-adapter.mjs')
+
+function run(commandArgs) {
+  return spawnSync(process.execPath, [script, ...commandArgs], { cwd: root, encoding: 'utf8', windowsHide: true })
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function read(relativePath) {
+  const fullPath = path.join(target, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const firstRun = run(['--target', target, '--host', 'all', '--json'])
+const first = parseJson(firstRun.stdout)
+const secondRun = run(['--target', target, '--host', 'all', '--json'])
+const second = parseJson(secondRun.stdout)
+const invalidRun = run(['--target', target, '--host', 'unknown'])
+const claudeCommand = read(path.join('.claude', 'commands', 'gse.md'))
+const codexPointer = read(path.join('.codex', 'gse-command.md'))
+const hermesPointer = read(path.join('.gse', 'host-adapters', 'hermes-runtime.md'))
+const workbuddyPointer = read(path.join('.gse', 'host-adapters', 'workbuddy.md'))
+const genericPointer = read(path.join('.gse', 'host-adapters', 'generic-agent.md'))
+const copilotPointer = read(path.join('.github', 'copilot-instructions.md'))
+const geminiPointer = read('GEMINI.md')
+const expectedHosts = ['claude', 'codex', 'hermes', 'workbuddy', 'copilot', 'gemini', 'generic']
+const pointerHosts = ['codex', 'hermes', 'workbuddy', 'copilot', 'gemini', 'generic']
+const firstResultByHost = new Map((first?.results ?? []).map((item) => [item.host, item]))
+
+const checks = [
+  check('CMDAD01', 'command adapter generator exists', fs.existsSync(script), 'scripts/generate-command-adapter.mjs'),
+  check('CMDAD02', 'first run writes all supported command adapters', firstRun.status === 0 && first?.results?.length === expectedHosts.length && expectedHosts.every((host) => firstResultByHost.get(host)?.status === 'written'), 'first run written count: ' + expectedHosts.length),
+  check('CMDAD03', 'Claude adapter creates native slash-command path', claudeCommand.includes('# /gse') && first?.results?.some((item) => item.host === 'claude' && item.nativeSlashCommand === true && item.relativePath === '.claude/commands/gse.md'), '.claude/commands/gse.md'),
+  check('CMDAD04', 'Codex adapter is honest pointer, not false native claim', codexPointer.includes('not proof of a native project-level /gse slash-command mechanism') && first?.results?.some((item) => item.host === 'codex' && item.nativeSlashCommand === false), '.codex/gse-command.md'),
+  check('CMDAD05', 'adapters route back to portable GSE files', [claudeCommand, codexPointer, hermesPointer, workbuddyPointer, copilotPointer, geminiPointer, genericPointer].every((content) => content.includes('.gse/project-profile.md') && content.includes('.gse/state.json') && content.includes('.gse/goal-map.md') && content.includes('.gse/quality-gates.md')), 'adapter contents'),
+  check('CMDAD06', 'rerun skips existing adapters by default', secondRun.status === 0 && second?.results?.every((item) => item.status === 'skipped'), 'second run skipped'),
+  check('CMDAD07', 'unsupported host fails clearly', invalidRun.status === 1, 'invalid host exit 1'),
+  check('CMDAD08', 'portable pointer adapters are generated for Hermes, WorkBuddy, Copilot, Gemini, and generic hosts', hermesPointer.includes('Hermes/AION Runtime GSE Adapter') && workbuddyPointer.includes('WorkBuddy GSE Adapter') && copilotPointer.includes('GitHub Copilot GSE Adapter') && geminiPointer.includes('Gemini GSE Adapter') && genericPointer.includes('Generic Agent GSE Adapter'), 'portable adapter files'),
+  check('CMDAD09', 'non-Claude adapters do not claim native slash-command support', pointerHosts.every((host) => firstResultByHost.get(host)?.nativeSlashCommand === false) && [codexPointer, hermesPointer, workbuddyPointer, copilotPointer, geminiPointer, genericPointer].every((content) => content.includes('does not prove native /gse slash-command support') || content.includes('not proof of a native project-level /gse slash-command mechanism')), 'nativeSlashCommand false for portable pointers'),
+  check('CMDAD10', 'portable pointers require current-session evidence before verified host tool claims', [hermesPointer, workbuddyPointer, copilotPointer, geminiPointer, genericPointer].every((content) => content.includes('unknown until') || content.includes('unless this host/session produced current evidence')), 'host capability honesty'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    claudeNativeSlashCommandAdapter: failed === 0 ? 'verified' : 'failed',
+    codexCommandPointerAdapter: failed === 0 ? 'verified' : 'failed',
+    portableHostPointerAdapters: failed === 0 ? 'verified' : 'failed',
+  },
+  limits: [
+    'This audit verifies generated adapter files and command routing.',
+    'It does not execute Claude Code or Codex host runtimes.',
+    'Codex project-level native slash-command support remains unverified.',
+    'Hermes, WorkBuddy, Copilot, Gemini, and generic adapters are pointer files only until runtime invocation records exist.',
+  ],
+  checks,
+}
+
+fs.rmSync(target, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)