@t275005746/gse 0.1.0

package/scripts/audit-completion-readiness.mjs

@@ -0,0 +1,292 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const masterPlan = read('.gse/gse-design-master-plan.md')
+const goalMap = read('.gse/goal-map.md')
+const currentSlice = read('.gse/current-slice.md')
+const evidence = read('.gse/evidence/2026-07-05.md')
+const validate = read('scripts/validate-gse.mjs')
+const ownerAcceptanceRecorded =
+  evidence.includes('Owner-approved AION project-local GSE adoption acceptance') &&
+  evidence.includes('Evidence status: accepted') &&
+  evidence.includes('Accepted by: owner-approved project write policy')
+
+const localCapabilityAudits = [
+  'audit-gse.mjs',
+  'audit-project.mjs',
+  'audit-fixtures.mjs',
+  'audit-adoption.mjs',
+  'audit-host-adapters.mjs',
+  'audit-compatibility.mjs',
+  'audit-fresh-session-readiness.mjs',
+  'audit-release-readiness.mjs',
+  'audit-npm-package-metadata.mjs',
+  'audit-update-release-acceptance.mjs',
+  'audit-target-adoption-evidence.mjs',
+  'audit-target-project.mjs',
+  'audit-acceptance-execution-packet.mjs',
+  'audit-roadmap-consistency.mjs',
+  'audit-recovery-readiness.mjs',
+  'audit-domain-quality-gates.mjs',
+  'audit-adoption-recipes.mjs',
+  'audit-commands.mjs',
+  'audit-readme-docs.mjs',
+  'generate-session-prompt.mjs',
+  'run-gse-command.mjs',
+  'audit-command-execution.mjs',
+  'audit-close-gate.mjs',
+  'update-project-state.mjs',
+  'audit-v1-target-validation.mjs',
+  'audit-command-adapters.mjs',
+  'audit-change-lifecycle.mjs',
+  'audit-remote-distribution.mjs',
+  'audit-signing.mjs',
+  'audit-release-trust.mjs',
+  'audit-open-source-defaults.mjs',
+  'audit-public-release-metadata.mjs',
+  'record-public-release.mjs',
+  'audit-public-release-decision.mjs',
+  'audit-evidence-placeholders.mjs',
+  'record-public-ci-run.mjs',
+  'audit-public-ci-run.mjs',
+  'audit-release-bundle.mjs',
+  'generate-release-bundle.mjs',
+  'audit-open-source-readiness.mjs',
+  'audit-ci-readiness.mjs',
+  'audit-public-collaboration-templates.mjs',
+  'record-public-security-contact.mjs',
+  'audit-public-security-contact.mjs',
+  'record-public-repository-settings.mjs',
+  'audit-public-repository-settings.mjs',
+  'record-public-channel-publication.mjs',
+  'audit-public-channel-publication.mjs',
+  'audit-marketplace-discovery.mjs',
+  'audit-validation-profiles.mjs',
+  'audit-host-ui-invocation.mjs',
+  'audit-host-runtime-invocations.mjs',
+  'audit-host-runtime-invocation-drill.mjs',
+  'audit-final-readiness.mjs',
+  'audit-final-readiness-promotion.mjs',
+  'audit-public-acceptance-readiness.mjs',
+  'audit-public-acceptance-command-dry-run-drill.mjs',
+  'audit-public-external-gate-probe.mjs',
+  'audit-public-acceptance-handoff.mjs',
+  'audit-release-status-manifest.mjs',
+  'audit-release-owner-action-plan.mjs',
+  'audit-public-release-checklist.mjs',
+  'audit-release-owner-action-plan-drill.mjs',
+  'audit-final-form-progress-report.mjs',
+  'audit-local-final-form-completion.mjs',
+  'audit-final-form-stale-copy.mjs',
+  'audit-npm-tarball-install.mjs',
+  'audit-npm-publish-dry-run.mjs',
+  'audit-host-runtime-evidence-handoff.mjs',
+  'audit-owner-external-gate-kit.mjs',
+  'generate-final-acceptance-packet.mjs',
+  'audit-final-acceptance-packet.mjs',
+]
+
+const requiredArtifacts = [
+  'SKILL.md',
+  '.gse/gse-design-master-plan.md',
+  '.gse/goal-map.md',
+  '.gse/current-slice.md',
+  'assets/templates/acceptance-execution-packet.md',
+  'assets/templates/target-adoption-evidence.md',
+  'assets/templates/update-release-acceptance-record.md',
+  'references/evidence-taxonomy.md',
+  'references/forward-test.md',
+  'references/adoption-recipes.md',
+  'references/commands.md',
+  'README.md',
+  'README.zh-CN.md',
+  'CONTRIBUTING.md',
+  'SECURITY.md',
+  'SUPPORT.md',
+  '.github/workflows/validate-gse.yml',
+  '.github/PULL_REQUEST_TEMPLATE.md',
+  '.github/ISSUE_TEMPLATE/bug_report.yml',
+  '.github/ISSUE_TEMPLATE/change_request.yml',
+  'assets/templates/public-channel-publication-record.md',
+  'assets/templates/public-ci-run-record.md',
+  'assets/templates/public-security-contact-record.md',
+  'assets/templates/public-repository-settings-record.md',
+  '.gse/state.json',
+  '.gse/evidence/index.jsonl',
+  'scripts/generate-session-prompt.mjs',
+  'scripts/run-gse-command.mjs',
+  'scripts/audit-command-execution.mjs',
+  'scripts/audit-close-gate.mjs',
+  'scripts/update-project-state.mjs',
+  'scripts/audit-v1-target-validation.mjs',
+  'scripts/package-gse.mjs',
+  'scripts/install-gse.mjs',
+  'scripts/audit-npm-package-metadata.mjs',
+  'scripts/generate-command-adapter.mjs',
+  'scripts/audit-command-adapters.mjs',
+  'scripts/close-change.mjs',
+  'scripts/audit-change-lifecycle.mjs',
+  'scripts/audit-remote-distribution.mjs',
+  'scripts/sign-gse-package.mjs',
+  'scripts/verify-gse-package.mjs',
+  'scripts/audit-signing.mjs',
+  'references/release-trust.md',
+  'assets/templates/release-trust-record.md',
+  'scripts/audit-release-trust.mjs',
+  'scripts/audit-open-source-defaults.mjs',
+  'references/public-release.md',
+  'assets/templates/public-release-record.md',
+  'scripts/audit-public-release-metadata.mjs',
+  'scripts/record-public-release.mjs',
+  'scripts/audit-public-release-decision.mjs',
+  'scripts/audit-evidence-placeholders.mjs',
+  'scripts/record-public-ci-run.mjs',
+  'scripts/audit-public-ci-run.mjs',
+  'scripts/generate-release-bundle.mjs',
+  'scripts/audit-release-bundle.mjs',
+  'scripts/audit-open-source-readiness.mjs',
+  'scripts/audit-ci-readiness.mjs',
+  'scripts/audit-public-collaboration-templates.mjs',
+  'scripts/record-public-security-contact.mjs',
+  'scripts/audit-public-security-contact.mjs',
+  'scripts/record-public-repository-settings.mjs',
+  'scripts/audit-public-repository-settings.mjs',
+  'scripts/record-public-channel-publication.mjs',
+  'scripts/audit-public-channel-publication.mjs',
+  '.gse/releases/public-release-owner-required.md',
+  '.gse/releases/public-security-contact-owner-required.md',
+  'references/marketplace-discovery.md',
+  'assets/marketplace/gse-listing.json',
+  'scripts/audit-marketplace-discovery.mjs',
+  'scripts/audit-validation-profiles.mjs',
+  'scripts/run-validation-profile.mjs',
+  'assets/templates/host-ui-invocation-record.md',
+  'scripts/audit-host-ui-invocation.mjs',
+  'scripts/record-host-invocation.mjs',
+  'scripts/audit-host-runtime-invocations.mjs',
+  'scripts/audit-host-runtime-invocation-drill.mjs',
+  'references/final-readiness.md',
+  'scripts/audit-final-readiness.mjs',
+  'scripts/audit-final-readiness-promotion.mjs',
+  'scripts/audit-public-acceptance-readiness.mjs',
+  'scripts/audit-public-acceptance-command-dry-run-drill.mjs',
+  'scripts/probe-public-external-gates.mjs',
+  'scripts/audit-public-external-gate-probe.mjs',
+  'scripts/generate-public-acceptance-handoff.mjs',
+  'scripts/audit-public-acceptance-handoff.mjs',
+  'scripts/generate-release-status-manifest.mjs',
+  'scripts/audit-release-status-manifest.mjs',
+  'scripts/generate-release-owner-action-plan.mjs',
+  'scripts/audit-release-owner-action-plan.mjs',
+  'scripts/generate-public-release-checklist.mjs',
+  'scripts/audit-public-release-checklist.mjs',
+  'scripts/audit-release-owner-action-plan-drill.mjs',
+  'scripts/generate-final-form-progress-report.mjs',
+  'scripts/audit-final-form-progress-report.mjs',
+  'scripts/audit-local-final-form-completion.mjs',
+  'scripts/audit-final-form-stale-copy.mjs',
+  'scripts/audit-npm-tarball-install.mjs',
+  'scripts/audit-npm-publish-dry-run.mjs',
+  'scripts/generate-host-runtime-evidence-handoff.mjs',
+  'scripts/audit-host-runtime-evidence-handoff.mjs',
+  'scripts/generate-owner-external-gate-kit.mjs',
+  'scripts/audit-owner-external-gate-kit.mjs',
+  'scripts/generate-final-acceptance-packet.mjs',
+  'scripts/audit-final-acceptance-packet.mjs',
+  '.gse/acceptance/final-form-progress-report.md',
+  '.gse/acceptance/final-form-progress-report.json',
+  '.gse/acceptance/public-acceptance-handoff.md',
+  '.gse/acceptance/release-status-manifest.json',
+  '.gse/acceptance/release-owner-action-plan.md',
+  '.gse/acceptance/public-release-checklist.md',
+  '.gse/acceptance/owner-external-gate-kit/README.md',
+  '.gse/acceptance/owner-external-gate-kit/kit-manifest.json',
+  '.gse/release-bundles/gse-release-bundle-audit/installable-package/gse-package-manifest.json',
+  '.gse/release-bundles/gse-release-bundle-audit/public-release-checklist.md',
+  '.gse/release-bundles/gse-release-bundle-audit/provenance.json',
+  '.gse/release-bundles/gse-release-bundle-audit/checksums.sha256',
+]
+
+const checks = [
+  check('CR01', 'completion readiness audit is wired into validator', validate.includes('audit-completion-readiness.mjs'), 'scripts/validate-gse.mjs'),
+  check('CR02', 'all local capability audits are wired into validator', localCapabilityAudits.every((item) => validate.includes(item)), localCapabilityAudits.join(', ')),
+  check('CR03', 'required completion artifacts exist', requiredArtifacts.every(exists), requiredArtifacts.join(', ')),
+  check('CR04', 'master plan records verified v1 execution-state target validation and current license state', masterPlan.includes('owner-approved AION project-write acceptance is executed') && masterPlan.includes('Status: verified.') && masterPlan.includes('AION/MuseFlow v1 target validation are verified') && masterPlan.includes('MIT license decision') && !masterPlan.includes('owner license selection remains required before an accepted public release'), '.gse/gse-design-master-plan.md'),
+  check('CR05', 'current slice preserves required GSE slice fields after acceptance', currentSlice.includes('## Outcome') && currentSlice.includes('## Scope') && currentSlice.includes('## Acceptance') && currentSlice.includes('## Evidence Plan') && currentSlice.includes('## Risk') && currentSlice.includes('## Next Action'), '.gse/current-slice.md'),
+  check('CR06', 'goal map records v1 execution-state work as verified', goalMap.includes('GSE-008') && goalMap.includes('Productize v1.0 execution-state workflow') && goalMap.includes('verified') && goalMap.includes('audit-v1-target-validation.mjs'), '.gse/goal-map.md'),
+  check('CR07', 'evidence log records owner-approved external acceptance', ownerAcceptanceRecorded, '.gse/evidence/2026-07-05.md'),
+  check('CR08', 'final-form limits are explicit after current scope can be claimed', masterPlan.includes('Remaining final-form work is real public security contact approval, real public repository settings, public CI run, real public registry publication, real public marketplace approval, host-native slash-command support, and other host runtime invocation records.') && goalMap.includes('Final-form gaps'), 'control docs keep final-form limits scoped'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { completionReadiness: failed === 0 ? 'current-scope-validated' : 'failed' },
+  completionStatus: failed === 0 ? 'complete for current verified scope: target validation, local distribution, npm package metadata, npm tarball installability, remote URL distribution with integrity, package signing/verification, portable command execution, validation profiles, release trust policy, open-source defaults, public release metadata workflow, MIT license decision, public release decision lifecycle, public evidence placeholder rejection, public CI run record mechanics, public channel publication record mechanics, public external gate live probe mechanics, release bundle generation, release status manifest, release owner action plan, release owner action plan drill, open-source repository readiness, CI workflow readiness, public collaboration templates, public security contact record mechanics, public repository settings record mechanics, marketplace discovery metadata, host runtime invocation record mechanics, host runtime invocation fixture drill, host runtime evidence handoff, final readiness matrix, final readiness accepted-record promotion, public acceptance doctor, public acceptance command dry-run drill, public acceptance handoff, final-form progress report, final acceptance packet, owner/external gate kit and canonical freshness audit, final-form stale-copy audit, Codex text-command host invocation, command-adapter generation, and real-workspace change archive lifecycle are verified; public security contact acceptance, public repository settings evidence, public CI run, public registry publication, public marketplace approval, native slash-command support, and other host runtime invocation records remain external or owner-gated work' : 'not ready: roadmap or evidence state is inconsistent',
+  limits: [
+    'This audit verifies GSE scaffold readiness and v1 execution-state target validation tracking.',
+    'It does not certify arbitrary repositories, public registry publication, marketplace install, CI, MCP, LSP, subagent runtime, or fresh-session execution.',
+    'It does not certify real remote-machine network conditions, marketplace approval, native slash-command execution, other host runtime invocation, or arbitrary repositories.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Completion Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Completion readiness: ' + data.workflows.completionReadiness)
+  lines.push('- Completion status: ' + data.completionStatus)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-distribution.mjs

@@ -0,0 +1,251 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const profile = readArg('--profile', 'full')
+if (!['smoke', 'full'].includes(profile)) {
+  console.error('Unsupported --profile. Expected smoke or full.')
+  process.exit(1)
+}
+const smokeProfile = profile === 'smoke'
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function skipped(id, label, evidence, risk = '') {
+  return { id, label, status: 'skipped', evidence, risk }
+}
+
+function runInstalledPackageValidation(target) {
+  const validationCommands = [
+    ['audit-gse.mjs', ['--root', target, '--json']],
+    ['audit-project.mjs', ['--root', target, '--json']],
+    ['audit-fixtures.mjs', ['--root', target, '--json']],
+    ['audit-commands.mjs', ['--root', target, '--json']],
+    ['audit-command-execution.mjs', ['--root', target, '--profile', 'lite', '--json']],
+    ['audit-readme-docs.mjs', ['--root', target, '--json']],
+    ['audit-open-source-readiness.mjs', ['--root', target, '--json']],
+    ['audit-marketplace-discovery.mjs', ['--root', target, '--json']],
+    ['generate-session-prompt.mjs', ['--root', target, '--json']],
+  ]
+  const results = validationCommands.map(([script, commandArgs]) => {
+    const result = run(process.execPath, [path.join(target, 'scripts', script), ...commandArgs], target)
+    const parsed = parseJson(result.stdout)
+    const failed = parsed?.summary?.failed
+    const ok = result.status === 0 || failed === 0
+    return {
+      script,
+      command: result.command,
+      status: result.status,
+      ok,
+      summary: parsed?.summary ?? null,
+      stderr: result.stderr,
+    }
+  })
+  const passed = results.filter((item) => item.ok).length
+  const failed = results.length - passed
+  return {
+    command: 'installed package validation: ' + validationCommands.map(([script]) => script).join(', '),
+    status: failed === 0 ? 0 : 1,
+    stdout: JSON.stringify({
+      summary: {
+        status: failed === 0 ? 'passed' : 'failed',
+        passed,
+        failed,
+        total: results.length,
+      },
+      results,
+      limits: [
+        'Installed-package validation checks portable skill structure, bootstrap fixtures, command semantics, lite command execution, README docs, open-source readiness, marketplace metadata, and session prompt generation.',
+        'It intentionally excludes source-workspace-only roadmap, long evidence logs, release-bundle cache, and owner/external acceptance artifacts.',
+      ],
+    }),
+    stderr: results.filter((item) => !item.ok).map((item) => item.script + ': ' + item.stderr).filter(Boolean).join('\n'),
+  }
+}
+
+const scanExtensions = new Set(['.md', '.json', '.mjs', '.yaml', '.yml', '.txt'])
+const forbiddenContentPatterns = [
+  { id: 'winUserHome', pattern: new RegExp(['C:', 'Users', 'Admin'].join('[\\\\\\\\/]'), 'i') },
+  { id: 'posixUserHome', pattern: new RegExp(['C:', 'Users', 'Admin'].join('/'), 'i') },
+  { id: 'workspaceRoot', pattern: new RegExp(['D:', 'codex'].join('[\\\\\\\\/]'), 'i') },
+  { id: 'aionWorkspace', pattern: new RegExp(['hermes', 'workspace'].join('[-_]'), 'i') },
+  { id: 'museflowWorkspace', pattern: new RegExp(['node', 'banana'].join('[-_]'), 'i') },
+]
+
+function scanPackageLeaks(scanRoot) {
+  const findings = []
+
+  function visit(itemPath) {
+    if (!fs.existsSync(itemPath)) return
+    const stat = fs.statSync(itemPath)
+    if (stat.isDirectory()) {
+      for (const child of fs.readdirSync(itemPath)) visit(path.join(itemPath, child))
+      return
+    }
+    if (!stat.isFile()) return
+    const ext = path.extname(itemPath)
+    if (!scanExtensions.has(ext) && path.basename(itemPath) !== 'SKILL.md') return
+    const content = fs.readFileSync(itemPath, 'utf8')
+    for (const item of forbiddenContentPatterns) {
+      if (item.pattern.test(content)) {
+        findings.push({
+          file: path.relative(scanRoot, itemPath).replace(/\\/g, '/'),
+          pattern: item.id,
+        })
+      }
+    }
+  }
+
+  visit(scanRoot)
+  return findings
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-distribution-'))
+const packageOut = path.join(tempRoot, 'package')
+const installTarget = path.join(tempRoot, 'installed-gse')
+
+const packageRun = run(process.execPath, [
+  path.join(root, 'scripts', 'package-gse.mjs'),
+  '--root',
+  root,
+  '--out',
+  packageOut,
+  '--label',
+  'gse-audit',
+  '--json',
+])
+const packageData = parseJson(packageRun.stdout)
+const installRun = run(process.execPath, [
+  path.join(root, 'scripts', 'install-gse.mjs'),
+  '--source',
+  packageOut,
+  '--target',
+  installTarget,
+  '--json',
+])
+const installData = parseJson(installRun.stdout)
+const installedValidate = smokeProfile
+  ? { status: 0, command: 'skipped by --profile smoke', stdout: '', stderr: '' }
+  : runInstalledPackageValidation(installTarget)
+const installedValidateData = parseJson(installedValidate.stdout)
+const installedCli = run(process.execPath, [
+  path.join(installTarget, 'scripts', 'gse.mjs'),
+  'status',
+  '--target',
+  installTarget,
+  '--json',
+], installTarget)
+const installedCliData = parseJson(installedCli.stdout)
+
+const manifestPath = path.join(packageOut, 'gse-package-manifest.json')
+const manifestData = fs.existsSync(manifestPath) ? parseJson(fs.readFileSync(manifestPath, 'utf8')) : null
+const packageLeakFindings = fs.existsSync(packageOut) ? scanPackageLeaks(packageOut) : []
+const checks = [
+  check('D01', 'package script exists', fs.existsSync(path.join(root, 'scripts', 'package-gse.mjs')), 'scripts/package-gse.mjs'),
+  check('D02', 'install script exists', fs.existsSync(path.join(root, 'scripts', 'install-gse.mjs')), 'scripts/install-gse.mjs'),
+  check('D03', 'package command succeeds', packageRun.status === 0 && packageData?.status === 'written', packageRun.command),
+  check('D04', 'package manifest exists and includes core files', fs.existsSync(manifestPath) && packageData?.fileCount > 20, manifestPath),
+  check('D04b', 'package manifest does not expose local source root', manifestData && !Object.hasOwn(manifestData, 'sourceRoot') && !JSON.stringify(manifestData).includes(root), 'gse-package-manifest.json'),
+  check('D04c', 'package content does not expose local or pilot project paths', packageLeakFindings.length === 0, packageLeakFindings.length ? JSON.stringify(packageLeakFindings.slice(0, 10)) : 'no findings'),
+  check('D05', 'install command succeeds', installRun.status === 0 && installData?.status === 'passed', installRun.command),
+  check('D06', 'installed package has skill entrypoint', fs.existsSync(path.join(installTarget, 'SKILL.md')), 'installed SKILL.md'),
+  check('D07', 'installed package has validation script', fs.existsSync(path.join(installTarget, 'scripts', 'validate-gse.mjs')), 'installed validate-gse.mjs'),
+  smokeProfile
+    ? skipped('D08', 'installed package passes install-safe validation', installedValidate.command, 'Run --profile full for installed-copy validation.')
+    : check('D08', 'installed package passes install-safe validation', installedValidate.status === 0 && installedValidateData?.summary?.failed === 0, installedValidate.command),
+  check('D09', 'package manifest exposes short CLI entrypoint', manifestData?.entrypoints?.cli === 'scripts/gse.mjs' && fs.existsSync(path.join(installTarget, 'scripts', 'gse.mjs')), 'gse-package-manifest.json entrypoints.cli'),
+  check('D10', 'installed short CLI wrapper runs status command', installedCli.status === 0 && installedCliData?.command === '/gse status' && installedCliData?.project?.stateValid === true, installedCli.command),
+  check('D11', 'package and installed copy include Node package metadata', manifestData?.entrypoints?.nodePackage === 'package.json' && manifestData?.entrypoints?.npmPackageAudit === 'scripts/audit-npm-package-metadata.mjs' && fs.existsSync(path.join(installTarget, 'package.json')), 'package.json and npm package audit entrypoint'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const skippedCount = checks.filter((item) => item.status === 'skipped').length
+const failed = checks.filter((item) => item.status === 'failed').length
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  profile,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, skipped: skippedCount, total: checks.length },
+  workflows: {
+    localPackage: packageRun.status === 0 ? 'verified' : 'failed',
+    localInstall: installRun.status === 0 ? 'verified' : 'failed',
+    installedValidation: smokeProfile ? 'skipped' : installedValidate.status === 0 ? 'verified' : 'failed',
+  },
+  commands: [packageRun.command, installRun.command, installedValidate.command, installedCli.command],
+  limits: [
+    'This audit verifies local file-based package, install, and installed-copy validation.',
+    'Use --profile smoke for routine package/install/CLI checks; use --profile full before release or when installed-package validation matters.',
+    'Installed-package validation intentionally excludes source-workspace-only roadmap, long evidence logs, release-bundle cache, and owner/external acceptance artifacts.',
+    'It does not publish to a registry, verify marketplace discovery, sign artifacts, or test remote machine installation.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Distribution Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Temp root: ' + data.tempRoot)
+  lines.push('Profile: ' + data.profile)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + ' passed, ' + data.summary.failed + ' failed, ' + data.summary.skipped + ' skipped, ' + data.summary.total + ' total')
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : item.status === 'skipped' ? '[-]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-domain-quality-gates.mjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const domain = read('references/domain-quality-gates.md')
+const quality = read('references/quality-gates.md')
+const review = read('references/review.md')
+const architecture = read('references/architecture-health.md')
+const skill = read('SKILL.md')
+
+const domains = [
+  'Security/privacy',
+  'Performance/cost',
+  'Accessibility',
+  'Resilience/recovery',
+  'UI/browser',
+  'API/state',
+  'Data/migration',
+  'Model/tool routing',
+  'Release/operations',
+]
+const evidenceTerms = ['File inspection', 'Focused tests', 'API smokes', 'Browser smokes', 'Architecture/review scans']
+const outputFields = ['Domain gates selected:', 'Why selected:', 'Evidence run:', 'Evidence status:', 'Unverified tools:', 'Residual risk:', 'Next action:']
+const scaleTerms = ['Lite', 'Standard', 'Enterprise']
+
+const checks = [
+  check('DQ01', 'domain quality gates reference exists', exists('references/domain-quality-gates.md'), 'references/domain-quality-gates.md'),
+  check('DQ02', 'SKILL routes domain quality gates', skill.includes('references/domain-quality-gates.md'), 'SKILL.md Reference Routing'),
+  check('DQ03', 'quality-gates routes to domain gates', quality.includes('references/domain-quality-gates.md') && quality.includes('## Domain Gates'), 'references/quality-gates.md'),
+  check('DQ04', 'review protocol routes to domain gates', review.includes('references/domain-quality-gates.md'), 'references/review.md'),
+  check('DQ05', 'all required domains are represented', domains.every((item) => domain.includes(item)), domains.join(', ')),
+  check('DQ06', 'scale adaptation is explicit', scaleTerms.every((item) => domain.includes(item)) && domain.includes('Lite work should not inherit every gate by default'), 'Lite, Standard, Enterprise'),
+  check('DQ07', 'evidence taxonomy routing is explicit', domain.includes('references/evidence-taxonomy.md') && domain.includes('result') && domain.includes('verified') && domain.includes('accepted'), 'evidence taxonomy labels'),
+  check('DQ08', 'tool execution is not faked', domain.includes('Do not claim scan, benchmark, browser, accessibility, security, or resilience results unless') && domain.includes('actually executed'), 'tool execution claim rule'),
+  check('DQ09', 'minimum evidence mapping covers major evidence modes', evidenceTerms.every((item) => domain.includes(item)), evidenceTerms.join(', ')),
+  check('DQ10', 'output format includes selected gates and residual risk', outputFields.every((item) => domain.includes(item)), outputFields.join(', ')),
+  check('DQ11', 'architecture health covers performance and resilience risk', architecture.includes('Performance And Resilience') && architecture.includes('migration') && architecture.includes('release'), 'references/architecture-health.md'),
+  check('DQ12', 'quality gates remain risk-based instead of mandatory for every task', domain.includes('Pick only the gates that match the changed behavior and project risk') && quality.includes('Do not force all gates onto Lite tasks'), 'risk-based gate language'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { domainQualityGates: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'Domain quality gate audit verifies reusable guidance and routing; it does not run project-specific security scans, benchmarks, accessibility tools, browser tests, or API smokes.',
+    'Projects must still execute the selected gates with their own commands, tools, owners, and evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Domain Quality Gate Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Domain quality gates: ' + data.workflows.domainQualityGates)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)