@t275005746/gse 0.1.0

package/scripts/audit-command-execution.mjs

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const profile = readArg('--profile', 'lite')
+const target = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-command-exec-'))
+
+if (!['lite', 'full'].includes(profile)) {
+  console.error(`Unknown command execution audit profile: ${profile}`)
+  process.exit(1)
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function diagnosticOk(runResult, report) {
+  if (runResult.status === 0 && report?.execution?.ok) return true
+  if (report?.execution?.diagnosticSummary?.failed === 0) return true
+  const child = parseJson(report?.execution?.stdout || '')
+  return child?.summary?.failed === 0
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function maybeRun(enabled, script, commandArgs) {
+  return enabled ? run(script, commandArgs) : null
+}
+
+fs.mkdirSync(target, { recursive: true })
+fs.writeFileSync(path.join(target, 'AGENTS.md'), '# Test Project\n', 'utf8')
+
+const initRun = run('init-project.mjs', ['--target', target, '--mode', 'standard', '--json'])
+fs.mkdirSync(path.join(target, 'docs'), { recursive: true })
+fs.writeFileSync(path.join(target, 'docs', 'productization-architecture.md'), '# Productization Architecture\n', 'utf8')
+fs.appendFileSync(path.join(target, '.gse', 'README.md'), '\nCanonical plan: `docs/productization-architecture.md`.\n', 'utf8')
+
+const adapterRun = run('generate-command-adapter.mjs', ['--target', target, '--host', 'all', '--json'])
+const helpRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse help', '--json'])
+const continueRun = run('run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse continue', '--json'])
+const shortCliRun = run('gse.mjs', ['status', '--target', target, '--json'])
+
+const full = profile === 'full'
+const statusRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse status', '--json'])
+const doctorRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse doctor', '--json'])
+const acceptanceRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse acceptance', '--json'])
+const ownerActionsRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse owner-actions', '--json'])
+const ownerActionsCompactRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse owner-actions', '--json', '--compact'])
+const probeWaitingRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse probe', '--json'])
+const probeRejectRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse probe --public-repo-url https://github.com/example/gse', '--json'])
+const releaseDryRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse release --label command-exec-release', '--json'])
+const releaseExecuteOut = path.join(target, 'release-bundle-command-exec')
+const releaseExecuteRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', `/gse release --label command-exec-release --out ${releaseExecuteOut}`, '--execute', '--json'])
+const packageDryRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse package --label command-exec-package', '--json'])
+const packageExecuteOut = path.join(target, 'package-command-exec')
+const packageExecuteRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', `/gse package --label command-exec-package --out ${packageExecuteOut}`, '--execute', '--json'])
+const installDryRunTarget = path.join(target, 'install-dry-run-command-exec')
+const installDryRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', `/gse install --source ${packageExecuteOut} --install-target ${installDryRunTarget}`, '--json'])
+const installExecuteTarget = path.join(target, 'install-command-exec')
+const installExecuteRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', `/gse install --source ${packageExecuteOut} --install-target ${installExecuteTarget}`, '--execute', '--json'])
+const publicReleaseDryRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse public-release', '--json'])
+const publicReleaseExecuteOut = path.join(target, 'public-release-checklist-command-exec.md')
+const publicReleaseExecuteRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', `/gse public-release --out ${publicReleaseExecuteOut}`, '--execute', '--json'])
+const doctorTargetRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse doctor', '--json'])
+const verifyRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', root, '--command', '/gse verify --profile lite', '--json'])
+const auditRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse audit', '--json'])
+const closeRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse close', '--json'])
+const changeRun = maybeRun(full, 'run-gse-command.mjs', ['--root', root, '--target', target, '--command', '/gse change add-login --level lite', '--execute', '--json'])
+
+const help = parseJson(helpRun.stdout)
+const cont = parseJson(continueRun.stdout)
+const status = statusRun ? parseJson(statusRun.stdout) : null
+const doctor = doctorRun ? parseJson(doctorRun.stdout) : null
+const acceptance = acceptanceRun ? parseJson(acceptanceRun.stdout) : null
+const ownerActions = ownerActionsRun ? parseJson(ownerActionsRun.stdout) : null
+const ownerActionsCompact = ownerActionsCompactRun ? parseJson(ownerActionsCompactRun.stdout) : null
+const probeWaiting = probeWaitingRun ? parseJson(probeWaitingRun.stdout) : null
+const probeReject = probeRejectRun ? parseJson(probeRejectRun.stdout) : null
+const releaseDryRunReport = releaseDryRun ? parseJson(releaseDryRun.stdout) : null
+const releaseExecuteReport = releaseExecuteRun ? parseJson(releaseExecuteRun.stdout) : null
+const doctorTarget = doctorTargetRun ? parseJson(doctorTargetRun.stdout) : null
+const verify = verifyRun ? parseJson(verifyRun.stdout) : null
+const audit = auditRun ? parseJson(auditRun.stdout) : null
+const close = closeRun ? parseJson(closeRun.stdout) : null
+const change = changeRun ? parseJson(changeRun.stdout) : null
+const doctorData = doctor ? parseJson(doctor.execution?.stdout ?? '') : null
+const ownerActionsData = ownerActions ? parseJson(ownerActions.execution?.stdout ?? '') : null
+const probeWaitingData = probeWaiting ? parseJson(probeWaiting.execution?.stdout ?? '') : null
+const probeRejectData = probeReject ? parseJson(probeReject.execution?.stdout ?? '') : null
+const releaseDryRunData = releaseDryRunReport ? parseJson(releaseDryRunReport.execution?.stdout ?? '') : null
+const releaseExecuteData = releaseExecuteReport ? parseJson(releaseExecuteReport.execution?.stdout ?? '') : null
+const packageDryRunReport = packageDryRun ? parseJson(packageDryRun.stdout) : null
+const packageExecuteReport = packageExecuteRun ? parseJson(packageExecuteRun.stdout) : null
+const installDryRunReport = installDryRun ? parseJson(installDryRun.stdout) : null
+const installExecuteReport = installExecuteRun ? parseJson(installExecuteRun.stdout) : null
+const packageDryRunData = packageDryRunReport ? parseJson(packageDryRunReport.execution?.stdout ?? '') : null
+const packageExecuteData = packageExecuteReport ? parseJson(packageExecuteReport.execution?.stdout ?? '') : null
+const installDryRunData = installDryRunReport ? parseJson(installDryRunReport.execution?.stdout ?? '') : null
+const installExecuteData = installExecuteReport ? parseJson(installExecuteReport.execution?.stdout ?? '') : null
+const publicReleaseDryRunReport = publicReleaseDryRun ? parseJson(publicReleaseDryRun.stdout) : null
+const publicReleaseExecuteReport = publicReleaseExecuteRun ? parseJson(publicReleaseExecuteRun.stdout) : null
+const publicReleaseDryRunData = publicReleaseDryRunReport ? parseJson(publicReleaseDryRunReport.execution?.stdout ?? '') : null
+const publicReleaseExecuteData = publicReleaseExecuteReport ? parseJson(publicReleaseExecuteReport.execution?.stdout ?? '') : null
+
+const claudeCommand = fs.existsSync(path.join(target, '.claude', 'commands', 'gse.md'))
+  ? fs.readFileSync(path.join(target, '.claude', 'commands', 'gse.md'), 'utf8')
+  : ''
+const codexPointer = fs.existsSync(path.join(target, '.codex', 'gse-command.md'))
+  ? fs.readFileSync(path.join(target, '.codex', 'gse-command.md'), 'utf8')
+  : ''
+const copilotPointer = fs.existsSync(path.join(target, '.github', 'copilot-instructions.md'))
+  ? fs.readFileSync(path.join(target, '.github', 'copilot-instructions.md'), 'utf8')
+  : ''
+const geminiPointer = fs.existsSync(path.join(target, 'GEMINI.md'))
+  ? fs.readFileSync(path.join(target, 'GEMINI.md'), 'utf8')
+  : ''
+
+const liteChecks = [
+  check('CMDX01', 'portable command runner exists', fs.existsSync(path.join(root, 'scripts', 'run-gse-command.mjs')), 'scripts/run-gse-command.mjs'),
+  check('CMDX02', 'target project initializes for command smoke', initRun.status === 0, initRun.command),
+  check('CMDX03', 'host command adapters are generated', adapterRun.status === 0 && claudeCommand.includes('run-gse-command.mjs') && codexPointer.includes('run-gse-command.mjs') && copilotPointer.includes('GitHub Copilot GSE Adapter') && geminiPointer.includes('Gemini GSE Adapter'), 'generated supported host adapters'),
+  check('CMDX04', '/gse help resolves command reference', helpRun.status === 0 && help?.route?.route === 'references/commands.md', '/gse help'),
+  check('CMDX05', '/gse continue executes session prompt generator', continueRun.status === 0 && cont?.execution?.status === 0 && cont?.execution?.stdout?.includes('Use GSE to continue'), '/gse continue'),
+  check('CMDX05b', 'short CLI wrapper routes to portable command runner', shortCliRun.status === 0 && shortCliRun.stdout.includes('"/gse status"') && shortCliRun.stdout.includes('"stateValid": true'), 'scripts/gse.mjs status --target <target> --json'),
+]
+
+const fullChecks = full
+  ? [
+      check('CMDX06', '/gse status exposes GSE final-form progress when target is GSE skill', statusRun.status === 0 && status?.execution?.status === 0 && status?.execution?.stdout?.includes('fullFinalFormReadiness') && status?.execution?.stdout?.includes('pendingGateCount'), '/gse status'),
+      check('CMDX07', '/gse doctor exposes GSE public acceptance blockers when target is GSE skill', doctorRun.status === 0 && doctor?.execution?.status === 0 && doctorData?.workflows?.publicAcceptanceDoctor === 'verified' && doctorData?.summary?.pendingGates > 0 && doctorData?.summary?.publicAccepted === 'not-accepted', '/gse doctor'),
+      check('CMDX08', '/gse acceptance aliases the public acceptance doctor', acceptanceRun.status === 0 && acceptance?.execution?.status === 0 && acceptance?.execution?.stdout?.includes('"publicAcceptanceDoctor": "verified"'), '/gse acceptance'),
+      check('CMDX08b', '/gse owner-actions exposes compact owner/external action commands without claiming acceptance', ownerActionsRun.status === 0 && ownerActions?.execution?.status === 0 && ownerActionsData?.pendingGateCount === 7 && ownerActionsData?.publicAccepted === 'not-accepted' && ownerActionsData.actions?.every((item) => item.recordCommand && item.preflightCommand), '/gse owner-actions'),
+      check('CMDX08c', '/gse owner-actions --compact returns owner packet without wrapper path noise', ownerActionsCompactRun.status === 0 && ownerActionsCompact?.pendingGateCount === 7 && ownerActionsCompact?.publicAccepted === 'not-accepted' && !ownerActionsCompactRun.stdout.includes(root) && !ownerActionsCompactRun.stdout.includes(process.execPath), '/gse owner-actions --json --compact'),
+      check('CMDX08c2', '/gse owner-actions --compact routes probe verification through portable command runner', ownerActionsCompactRun.status === 0 && ownerActionsCompact?.verificationCommands?.some((command) => command.includes('run-gse-command.mjs') && command.includes('/gse probe')) && !ownerActionsCompact?.verificationCommands?.some((command) => command.startsWith('node scripts/probe-public-external-gates.mjs')), '/gse owner-actions compact verificationCommands'),
+      check('CMDX08d', '/gse probe runs as a waiting diagnostic without evidence inputs', probeWaitingRun.status === 0 && probeWaiting?.execution?.status === 0 && probeWaitingData?.status === 'waiting-for-input' && probeWaitingData?.summary?.checked === 0, '/gse probe'),
+      check('CMDX08e', '/gse probe rejects placeholder public evidence through portable command runner', probeRejectRun.status !== 0 && probeReject?.execution?.status !== 0 && probeRejectData?.status === 'failed' && probeRejectData?.probes?.some((item) => item.errors?.some((error) => error.includes('not a placeholder'))), '/gse probe --public-repo-url https://github.com/example/gse'),
+      check('CMDX08f', '/gse release dry-runs release bundle generation without writing canonical output', releaseDryRun.status === 0 && releaseDryRunReport?.execution?.status === 0 && ['ready', 'dry-run'].includes(releaseDryRunData?.status) && releaseDryRunData?.dryRun === true && releaseDryRunData?.validation?.status === 'passed', '/gse release'),
+      check('CMDX08g', '/gse release --execute writes a release bundle to the requested output path', releaseExecuteRun.status === 0 && releaseExecuteReport?.execution?.status === 0 && releaseExecuteData?.status === 'written' && releaseExecuteData?.dryRun === false && fs.existsSync(path.join(releaseExecuteOut, 'bundle-manifest.json')), '/gse release --execute --out <tmp>'),
+      check('CMDX08g2', '/gse package dry-runs local package generation without writing package output', packageDryRun.status === 0 && packageDryRunReport?.execution?.status === 0 && packageDryRunData?.status === 'ready' && packageDryRunData?.dryRun === true && packageDryRunData?.fileCount > 20 && !fs.existsSync(path.join(root, '.gse', 'packages', 'command-exec-package')), '/gse package'),
+      check('CMDX08g3', '/gse package --execute writes a package manifest to the requested output path', packageExecuteRun.status === 0 && packageExecuteReport?.execution?.status === 0 && packageExecuteData?.status === 'written' && packageExecuteData?.dryRun === false && fs.existsSync(path.join(packageExecuteOut, 'gse-package-manifest.json')), '/gse package --execute --out <tmp>'),
+      check('CMDX08g4', '/gse install dry-runs package installation without writing the install target', installDryRun.status === 0 && installDryRunReport?.execution?.status === 0 && installDryRunData?.status === 'passed' && installDryRunData?.dryRun === true && installDryRunData?.summary?.written > 20 && !fs.existsSync(path.join(installDryRunTarget, 'SKILL.md')), '/gse install --source <package> --install-target <tmp>'),
+      check('CMDX08g5', '/gse install --execute writes an install target with the GSE skill entrypoint', installExecuteRun.status === 0 && installExecuteReport?.execution?.status === 0 && installExecuteData?.status === 'passed' && installExecuteData?.dryRun === false && fs.existsSync(path.join(installExecuteTarget, 'SKILL.md')) && fs.existsSync(path.join(installExecuteTarget, 'scripts', 'gse.mjs')), '/gse install --execute --source <package> --install-target <tmp>'),
+      check('CMDX08h', '/gse public-release dry-runs the ordered public release checklist without writing canonical output', publicReleaseDryRun.status === 0 && publicReleaseDryRunReport?.execution?.status === 0 && publicReleaseDryRunData?.status === 'ready' && publicReleaseDryRunData?.dryRun === true && publicReleaseDryRunData?.publicReleaseChecklist === 'ready', '/gse public-release'),
+      check('CMDX08i', '/gse public-release --execute writes the requested checklist output', publicReleaseExecuteRun.status === 0 && publicReleaseExecuteReport?.execution?.status === 0 && publicReleaseExecuteData?.status === 'written' && publicReleaseExecuteData?.dryRun === false && fs.existsSync(publicReleaseExecuteOut) && fs.readFileSync(publicReleaseExecuteOut, 'utf8').includes('GSE Public Release Checklist'), '/gse public-release --execute --out <tmp>'),
+      check('CMDX09', '/gse doctor falls back to target project doctor for normal projects', diagnosticOk(doctorTargetRun, doctorTarget) && doctorTarget?.execution?.command?.includes('audit-target-project.mjs'), '/gse doctor on fixture target'),
+      check('CMDX10', '/gse verify executes validation profile runner', verifyRun.status === 0 && verify?.execution?.status === 0 && verify?.execution?.stdout?.includes('"profile": "lite"') && verify?.execution?.stdout?.includes('"validationProfile": "verified"'), '/gse verify --profile lite'),
+      check('CMDX11', '/gse audit executes target project doctor', diagnosticOk(auditRun, audit), '/gse audit'),
+      check('CMDX12', '/gse close executes close gate', diagnosticOk(closeRun, close), '/gse close'),
+      check('CMDX13', '/gse change executes change pack creation only with --execute', changeRun.status === 0 && change?.execution?.status === 0 && fs.existsSync(path.join(target, '.gse', 'changes', 'add-login', 'brief.md')), '/gse change --execute'),
+    ]
+  : []
+
+const checks = [...liteChecks, ...fullChecks]
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const commandRuns = [initRun, adapterRun, helpRun, continueRun, shortCliRun, statusRun, doctorRun, acceptanceRun, ownerActionsRun, ownerActionsCompactRun, probeWaitingRun, probeRejectRun, releaseDryRun, releaseExecuteRun, packageDryRun, packageExecuteRun, installDryRun, installExecuteRun, publicReleaseDryRun, publicReleaseExecuteRun, doctorTargetRun, verifyRun, auditRun, closeRun, changeRun].filter(Boolean)
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  target,
+  profile,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    portableCommandExecution: failed === 0 ? 'verified' : 'failed',
+    generatedHostCommandPointers: failed === 0 ? 'verified' : 'failed',
+    profile,
+  },
+  commands: commandRuns.map((item) => item.command),
+  limits: [
+    'Lite profile verifies portable command entry and generated host command pointers.',
+    'Full profile verifies every portable command path, including heavier status, doctor, verify, audit, close, and change paths.',
+    'This audit does not prove Claude Code, Codex, Hermes, WorkBuddy, Copilot, Gemini, or generic UI runtimes invoked the command natively.',
+  ],
+  checks,
+}
+
+fs.rmSync(target, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-commands.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const skill = read('SKILL.md')
+const commands = read('references/commands.md')
+const router = read('references/router.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const requiredCommands = [
+  '/gse help',
+  '/gse init',
+  '/gse adopt',
+  '/gse continue',
+  '/gse status',
+  '/gse doctor',
+  '/gse acceptance',
+  '/gse owner-actions',
+  '/gse probe',
+  '/gse release',
+  '/gse package',
+  '/gse install',
+  '/gse public-release',
+  '/gse change',
+  '/gse slice',
+  '/gse verify',
+  '/gse learn',
+  '/gse audit',
+  '/gse close',
+]
+
+const checks = [
+  check('CMD01', 'commands reference exists', exists('references/commands.md'), 'references/commands.md'),
+  check('CMD02', 'SKILL routes command-style usage to commands reference', skill.includes('references/commands.md') && skill.includes('/gse ...'), 'SKILL.md'),
+  check('CMD03', 'all required commands are documented', requiredCommands.every((item) => commands.includes(item)), requiredCommands.join(', ')),
+  check('CMD04', 'commands preserve host-neutral slash-command boundary', commands.includes('host-neutral command semantics') && commands.includes('do not prove that the current host has native slash-command support'), 'references/commands.md'),
+  check('CMD05', 'commands preserve evidence and acceptance boundaries', commands.includes('result -> verified -> accepted') && commands.includes('/gse close` is read-only in the portable command runner') && commands.includes('archive a named change pack after evidence exists'), 'references/commands.md'),
+  check('CMD06', 'router references command-style usage', router.includes('references/commands.md') && router.includes('/gse'), 'references/router.md'),
+  check('CMD07', 'validate-gse runs command audit', validate.includes('audit-commands.mjs'), 'scripts/validate-gse.mjs'),
+  check('CMD08', 'short CLI wrapper exists and is documented', exists('scripts/gse.mjs') && skill.includes('scripts/gse.mjs') && commands.includes('scripts/gse.mjs') && read('README.md').includes('scripts/gse.mjs') && read('README.zh-CN.md').includes('scripts/gse.mjs'), 'scripts/gse.mjs, SKILL.md, README.md, README.zh-CN.md, references/commands.md'),
+  check('CMD09', 'owner-actions compact output is documented for owner handoff', skill.includes('/gse owner-actions" --json --compact') && commands.includes('/gse owner-actions" --json --compact') && commands.includes('without local runner diagnostics'), 'SKILL.md, references/commands.md'),
+  check('CMD10', 'probe command is documented as owner/external evidence preflight', skill.includes('/gse probe --public-repo-url') && commands.includes('/gse probe --public-repo-url') && commands.includes('waiting-for-input') && commands.includes('does not publish, approve, configure, or accept'), 'SKILL.md, references/commands.md'),
+  check('CMD11', 'release command is documented as dry-run by default and write-only with execute', commands.includes('/gse release') && commands.includes('dry-run') && commands.includes('Only write a bundle when the command is run with `--execute`') && commands.includes('does not publish a package'), 'references/commands.md'),
+  check('CMD12', 'public-release command is documented as checklist/runway and not acceptance', skill.includes('/gse public-release') && commands.includes('/gse public-release') && commands.includes('ordered public release checklist') && commands.includes('does not publish, approve, configure, or accept'), 'SKILL.md, references/commands.md'),
+  check('CMD13', 'package/install commands expose installability without claiming publication', skill.includes('/gse package') && skill.includes('/gse install') && commands.includes('/gse package') && commands.includes('/gse install') && commands.includes('Only write a package when the command is run with `--execute`') && commands.includes('Only write the install target when the command is run with `--execute`') && commands.includes('does not publish to a registry'), 'SKILL.md, references/commands.md'),
+  check('CMD14', 'close command is documented as read-only readiness check', commands.includes('| `/gse close` | Check whether the current slice is ready to close') && commands.includes('/gse close` is read-only in the portable command runner') && commands.includes('close-change.mjs --target <project-root> --change-id <change-id>'), 'references/commands.md'),
+  check('CMD15', 'learn command is documented as execute-gated learning capture', commands.includes('| `/gse learn` | Record a reusable lesson') && commands.includes('/gse learn --summary') && commands.includes('Append the entry only when `--execute` is supplied') && skill.includes('scripts/record-learning.mjs'), 'SKILL.md, references/commands.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { commandSemantics: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies GSE command semantics, not native slash-command support in any host.',
+    'Host-specific command adapters still need project/session-specific evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Command Semantics Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Command semantics: ' + data.workflows.commandSemantics)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-compatibility.mjs

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const compatibilityPath = path.join(root, 'references', 'compatibility.md')
+const hostAdaptersPath = path.join(root, 'references', 'host-adapters.md')
+const toolAdaptersPath = path.join(root, 'references', 'tool-adapters.md')
+const generatedCodexAdapter = path.join(root, 'examples', 'agent-runtime-host', '.codex', 'gse-adapter.md')
+const generatedClaudeAdapter = path.join(root, 'examples', 'agent-runtime-host', '.claude', 'gse-adapter.md')
+
+function read(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : ''
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const compatibility = read(compatibilityPath)
+const hostAdapters = read(hostAdaptersPath)
+const toolAdapters = read(toolAdaptersPath)
+const codexAdapter = read(generatedCodexAdapter)
+const claudeAdapter = read(generatedClaudeAdapter)
+
+const requiredHosts = [
+  'Codex-style',
+  'Claude Code-style',
+  'Hermes/AION-style runtime',
+  'WorkBuddy/other IDE agents',
+  'Copilot/Gemini-style assistants',
+  'Unknown or custom host',
+]
+const allowedStatuses = ['verified', 'documented', 'unknown', 'unavailable']
+const riskyCapabilities = ['Subagents', 'MCP', 'LSP/index', 'Browser/Playwright', 'Hooks/plugins']
+
+function extractTableRows(markdown, heading) {
+  const lines = markdown.split(/\r?\n/)
+  const start = lines.findIndex((line) => line.trim() === '## ' + heading)
+  if (start === -1) return []
+  const rows = []
+  for (let index = start + 1; index < lines.length; index += 1) {
+    const line = lines[index].trim()
+    if (line.startsWith('## ')) break
+    if (!line.startsWith('|')) continue
+    if (/^\|\s*-/.test(line)) continue
+    rows.push(line)
+  }
+  return rows
+}
+
+function rowCells(row) {
+  return row
+    .split('|')
+    .slice(1, -1)
+    .map((cell) => cell.trim())
+}
+
+function statusesInText(text) {
+  const matches = text.match(/`([^`]+)`/g) ?? []
+  return matches.map((item) => item.slice(1, -1)).filter((item) => allowedStatuses.includes(item))
+}
+
+const hostRows = extractTableRows(compatibility, 'Host Matrix')
+const capabilityRows = extractTableRows(compatibility, 'Capability Matrix')
+const hostRowText = hostRows.join('\n')
+const capabilityMap = new Map(capabilityRows.map((row) => {
+  const cells = rowCells(row)
+  return [cells[0], cells]
+}))
+
+const codexHostRow = hostRows.find((row) => row.includes('| Codex-style |')) ?? ''
+const claudeHostRow = hostRows.find((row) => row.includes('| Claude Code-style |')) ?? ''
+const riskyRows = riskyCapabilities.map((name) => ({ name, cells: capabilityMap.get(name) ?? [] }))
+const riskyVerifiedRows = riskyRows.filter((row) => row.cells.slice(1, 6).some((cell) => cell.includes('`verified`')))
+const statusBackticks = new Set((hostRows.join('\n') + '\n' + capabilityRows.join('\n') + '\n' + compatibility.match(/## Status Vocabulary[\s\S]*?## Portable Source Of Truth/)?.[0]).match(/`([^`]+)`/g)?.map((item) => item.slice(1, -1)) ?? [])
+const suspiciousStatusLabels = [...statusBackticks].filter((item) => {
+  if (allowedStatuses.includes(item)) return false
+  if (item === '.gse/' || item.startsWith('examples/') || item.startsWith('scripts/') || item.startsWith('references/') || item.startsWith('assets/')) return false
+  return /verified|documented|unknown|unavailable/i.test(item)
+})
+
+const checks = [
+  check('C01', 'compatibility reference exists', fs.existsSync(compatibilityPath), 'references/compatibility.md'),
+  check('C02', 'required host families are represented', requiredHosts.every((host) => hostRowText.includes(host)), requiredHosts.join(', ')),
+  check('C03', 'status vocabulary is defined', allowedStatuses.every((status) => compatibility.includes('`' + status + '`')), allowedStatuses.join(', ')),
+  check('C04', 'no suspicious status labels appear', suspiciousStatusLabels.length === 0, suspiciousStatusLabels.length === 0 ? 'only allowed status labels detected' : suspiciousStatusLabels.join(', ')),
+  check('C05', 'portable source-of-truth rule is present', compatibility.includes('`.gse/` is the portable source of truth') && hostAdapters.includes('`.gse/` is the portable source of truth'), 'compatibility.md and host-adapters.md'),
+  check('C06', 'generated Codex and Claude adapters point to .gse', codexAdapter.includes('Source of truth: `.gse/`.') && claudeAdapter.includes('Source of truth: `.gse/`.'), 'examples/agent-runtime-host host adapters'),
+  check('C07', 'Codex/Claude verified claims cite local evidence', codexHostRow.includes('`verified`') && codexHostRow.includes('examples/agent-runtime-host/.codex/gse-adapter.md') && claudeHostRow.includes('`verified`') && claudeHostRow.includes('examples/agent-runtime-host/.claude/gse-adapter.md'), 'host matrix evidence cells'),
+  check('C08', 'risky host capabilities are not marked verified without current evidence', riskyVerifiedRows.length === 0, riskyVerifiedRows.length === 0 ? 'subagents/MCP/LSP/browser/hooks remain non-verified' : riskyVerifiedRows.map((row) => row.name).join(', ')),
+  check('C09', 'adoption rules require current-session verification', compatibility.includes('Record host-specific commands, hooks, MCP servers, subagents, models, browser tools, and indexes as `unknown` until checked in that project/session.') && compatibility.includes('Use `verified` only when current evidence proves the claim.'), 'Adoption Rules'),
+  check('C10', 'related references route through compatibility matrix', hostAdapters.includes('references/compatibility.md') && toolAdapters.includes('references/compatibility.md'), 'host-adapters.md and tool-adapters.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { compatibilityMatrix: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'Compatibility audit verifies documented support claims and source-of-truth invariants; it does not prove runtime host capabilities.',
+    'Generated host pointer claims are allowed as verified by current local evidence; runtime execution still requires host invocation records.',
+    'Subagents, MCP, LSP/index, browser, hooks/plugins, and provider model routing remain project/session-specific until separately verified.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Compatibility Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Compatibility matrix: ' + data.workflows.compatibilityMatrix)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)