@t275005746/gse 0.1.0

package/scripts/audit-evidence-placeholders.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { isPlaceholderEvidence, placeholderEvidenceError } from './lib/evidence-placeholders.mjs'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const placeholderCases = [
+  '__PLACEHOLDER__',
+  '<placeholder>',
+  'fixture-owner',
+  'todo',
+  'https://example.com/security',
+  'https://github.com/example/gse/actions/runs/123',
+  'https://registry.example/gse',
+  'http://localhost:3000/result',
+  'http://127.0.0.1/result',
+  'security@example.com',
+  'https://release.local/gse',
+]
+
+const realCases = [
+  'gse-maintainer',
+  'security@gse.dev',
+  'https://github.com/gse-org/gse/actions/runs/123',
+  'https://registry.npmjs.org/@t275005746/gse',
+  'https://marketplace.openai.com/gse',
+  'sha256:0123456789abcdef',
+]
+
+const recordScripts = [
+  'scripts/record-public-ci-run.mjs',
+  'scripts/record-public-repository-settings.mjs',
+  'scripts/record-public-security-contact.mjs',
+  'scripts/record-public-channel-publication.mjs',
+]
+
+const localFunctionRegex = /function\s+(isPlaceholderEvidence|rejectPlaceholderEvidence)\s*\(/
+const importNeedle = "from './lib/evidence-placeholders.mjs'"
+
+const helperSource = read('scripts/lib/evidence-placeholders.mjs')
+const scriptSources = recordScripts.map((relativePath) => ({ relativePath, source: read(relativePath) }))
+const duplicateDefinitions = scriptSources
+  .filter((item) => localFunctionRegex.test(item.source))
+  .map((item) => item.relativePath)
+const missingImports = scriptSources
+  .filter((item) => !item.source.includes(importNeedle))
+  .map((item) => item.relativePath)
+
+const checks = [
+  check('EPH01', 'shared placeholder helper exists', exists('scripts/lib/evidence-placeholders.mjs') && helperSource.includes('export function isPlaceholderEvidence'), 'scripts/lib/evidence-placeholders.mjs'),
+  check('EPH02', 'placeholder cases are rejected', placeholderCases.every((value) => isPlaceholderEvidence(value)), placeholderCases.map((value) => `${value}:${isPlaceholderEvidence(value)}`).join(', ')),
+  check('EPH03', 'real-looking public evidence cases are allowed', realCases.every((value) => !isPlaceholderEvidence(value)), realCases.map((value) => `${value}:${isPlaceholderEvidence(value)}`).join(', ')),
+  check('EPH04', 'placeholder error message stays operator-readable', placeholderEvidenceError('--evidence-url').includes('real public evidence') && placeholderEvidenceError('--evidence-url').includes('--evidence-url'), placeholderEvidenceError('--evidence-url')),
+  check('EPH05', 'public record scripts import shared helper', missingImports.length === 0, missingImports.length ? missingImports.join(', ') : recordScripts.join(', ')),
+  check('EPH06', 'public record scripts do not carry duplicate placeholder functions', duplicateDefinitions.length === 0, duplicateDefinitions.length ? duplicateDefinitions.join(', ') : 'no duplicate definitions'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    evidencePlaceholderHelper: failed === 0 ? 'verified' : 'failed',
+  },
+  limits: [
+    'This audit verifies local placeholder detection and script wiring.',
+    'It does not decide whether a real owner/external URL is valid or published.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Evidence Placeholder Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Evidence placeholder helper: ' + data.workflows.evidencePlaceholderHelper)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-final-acceptance-packet.mjs

@@ -0,0 +1,148 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: result.stdout?.trim() ?? '',
+    stderr: result.stderr?.trim() ?? '',
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const generator = read('scripts/generate-final-acceptance-packet.mjs')
+const finalReadiness = read('references/final-readiness.md')
+const validate = read('scripts/validate-gse.mjs')
+const tmp = mkdtempSync(path.join(tmpdir(), 'gse-final-acceptance-'))
+const out = path.join(tmp, 'final-acceptance-packet.md')
+const generated = run(process.execPath, [path.join(root, 'scripts', 'generate-final-acceptance-packet.mjs'), '--root', root, '--out', out, '--force', '--json'])
+let generatedJson = null
+try {
+  generatedJson = JSON.parse(generated.stdout)
+} catch {}
+const packet = fs.existsSync(out) ? fs.readFileSync(out, 'utf8') : ''
+rmSync(tmp, { recursive: true, force: true })
+const publicAcceptance = run(process.execPath, [path.join(root, 'scripts', 'audit-public-acceptance-readiness.mjs'), '--root', root, '--json'])
+let publicAcceptanceJson = null
+try {
+  publicAcceptanceJson = JSON.parse(publicAcceptance.stdout)
+} catch {}
+
+const requiredSections = [
+  '# GSE Final Acceptance Packet',
+  '## Current Claim Boundary',
+  '## Verified Local Capabilities',
+  '## Pending Acceptance Gates',
+  '## Re-Verification Commands',
+  '## Anti-Overclaim Rules',
+  '## Next Action',
+]
+const pendingTerms = [
+  ...(publicAcceptanceJson?.pendingGates ?? []).map((gate) => gate.area),
+  'audit-public-acceptance-readiness.mjs',
+  ...(publicAcceptanceJson?.pendingGates ?? []).map((gate) => String(gate.recordCommand ?? '').match(/scripts\/([\w-]+\.mjs)/)?.[1]).filter(Boolean),
+]
+const antiOverclaimTerms = [
+  'Do not claim public release acceptance',
+  'Do not claim marketplace availability',
+  'Do not claim native slash-command support',
+  'Do not claim support for a host',
+]
+const packetUsesCompleteRecordCommandTemplates = !packet.includes('--invocation-status') &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(packet) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(packet) &&
+  packet.includes('--status accepted') &&
+  packet.includes('--dry-run --json')
+
+const checks = [
+  check('FAP01', 'final acceptance packet generator exists', exists('scripts/generate-final-acceptance-packet.mjs'), 'scripts/generate-final-acceptance-packet.mjs'),
+  check('FAP02', 'generator is based on final readiness audit', generator.includes('audit-final-readiness.mjs') && generator.includes('Pending Acceptance Gates'), 'generator calls final readiness and renders pending gates'),
+  check('FAP03', 'generator produces a packet in a temporary output path', generated.status === 0 && generatedJson?.status === 'ready' && packet.length > 0, generated.stderr || out),
+  check('FAP04', 'packet contains required owner/external gate sections', requiredSections.every((term) => packet.includes(term)), requiredSections.join(', ')),
+  check('FAP05', 'packet enumerates all current pending final-form gates', pendingTerms.length > 1 && pendingTerms.every((term) => packet.includes(term)), pendingTerms.join(', ')),
+  check('FAP06', 'packet keeps anti-overclaim boundaries explicit', antiOverclaimTerms.every((term) => packet.includes(term)), antiOverclaimTerms.join(', ')),
+  check('FAP07', 'final readiness docs route users to the packet generator', finalReadiness.includes('generate-final-acceptance-packet.mjs'), 'references/final-readiness.md'),
+  check('FAP08', 'consolidated validator includes this audit', validate.includes('audit-final-acceptance-packet.mjs'), 'scripts/validate-gse.mjs'),
+  check('FAP09', 'packet uses complete record command templates', packetUsesCompleteRecordCommandTemplates, 'no ellipsis, no stale host invocation flag, includes preflight commands'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    finalAcceptancePacket: failed === 0 ? 'verified' : 'failed',
+    publicAccepted: generatedJson?.summary?.publicAccepted ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies packet generation and claim boundaries only.',
+    'It does not choose a license, approve a security contact, publish a marketplace listing, or prove host-native slash commands.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Final Acceptance Packet Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Final acceptance packet: ' + data.workflows.finalAcceptancePacket)
+  lines.push('- Public accepted: ' + data.workflows.publicAccepted)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-final-form-progress-report.mjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const tmp = mkdtempSync(path.join(tmpdir(), 'gse-final-form-progress-'))
+const out = path.join(tmp, 'final-form-progress-report.md')
+const jsonOut = path.join(tmp, 'final-form-progress-report.json')
+const generated = run(process.execPath, [
+  path.join(root, 'scripts', 'generate-final-form-progress-report.mjs'),
+  '--root', root,
+  '--out', out,
+  '--json-out', jsonOut,
+  '--force',
+  '--json',
+])
+const generatedData = parseJson(generated.stdout)
+const report = fs.existsSync(jsonOut) ? parseJson(fs.readFileSync(jsonOut, 'utf8')) : null
+const markdown = fs.existsSync(out) ? fs.readFileSync(out, 'utf8') : ''
+rmSync(tmp, { recursive: true, force: true })
+
+const skill = read('SKILL.md')
+const validate = read('scripts/validate-gse.mjs')
+const generator = read('scripts/generate-final-form-progress-report.mjs')
+const canonicalMarkdown = read('.gse/acceptance/final-form-progress-report.md')
+const canonicalReport = parseJson(read('.gse/acceptance/final-form-progress-report.json'))
+
+const blockerNames = new Set((report?.blockers ?? []).map((item) => item.area))
+const blockerSetMatchesReportCount = (report?.blockers?.length ?? -1) === report?.readiness?.pendingGateCount &&
+  (report?.blockers?.length ?? 0) > 0 &&
+  [...blockerNames].every(Boolean)
+const verifiedNames = new Set((report?.verifiedCapabilities ?? []).map((item) => item.area))
+const licenseDecisionResolved = verifiedNames.has('License decision')
+const blockerCommandsAreCompleteTemplates = (report?.blockers?.length ?? 0) > 0 &&
+  report.blockers.every((blocker) =>
+    !String(blocker.recordCommand ?? '').includes('...') &&
+    !String(blocker.preflightCommand ?? '').includes('...') &&
+    !/[<>]/.test(String(blocker.recordCommand ?? '')) &&
+    !/[<>]/.test(String(blocker.preflightCommand ?? '')) &&
+    !String(blocker.recordCommand ?? '').includes('--invocation-status') &&
+    !String(blocker.preflightCommand ?? '').includes('--invocation-status') &&
+    (String(blocker.recordCommand ?? '').includes('record-host-invocation.mjs') ? String(blocker.recordCommand).includes('--status accepted') : true),
+  ) &&
+  !markdown.includes('--invocation-status') &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(markdown) &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(markdown)
+
+const checks = [
+  check('FFP01', 'progress report generator exists and writes markdown/json', generated.status === 0 && generatedData?.status === 'written' && Boolean(report) && markdown.includes('# GSE Final-Form Progress Report'), generated.stderr || `${out}, ${jsonOut}`),
+  check('FFP02', 'report derives status from final readiness, public acceptance, and command dry-run drill audits', generator.includes('audit-final-readiness.mjs') && generator.includes('audit-public-acceptance-readiness.mjs') && generator.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'generator source audits'),
+  check('FFP03', 'report separates local engineering and full final-form readiness', report?.scores?.scoringBasis?.includes('local engineering excludes owner-required and external-required') && report?.scores?.localEngineeringReadiness === 100 && report?.scores?.fullFinalFormReadiness < 100 && report?.claimBoundary?.mayClaimPublicAcceptedFinalForm === false, `local=${report?.scores?.localEngineeringReadiness}; full=${report?.scores?.fullFinalFormReadiness}; publicAccepted=${report?.readiness?.publicAccepted}`),
+  check('FFP04', 'report lists current owner/external blockers', blockerSetMatchesReportCount && licenseDecisionResolved && !blockerNames.has('License decision'), [...blockerNames].join(', ') + '; License decision resolved'),
+  check('FFP05', 'report lists verified local capabilities', ['Local install', 'npm tarball install', 'URL install', 'Signing', 'Portable command execution', 'Host adapters'].every((name) => verifiedNames.has(name)), 'local engineering capabilities'),
+  check('FFP06', 'report preserves native slash-command boundary', report?.hostRuntime?.nativeSlashCommandRecords === 0 && report?.claimBoundary?.cannotClaim?.some((item) => item.includes('native slash-command')), `native=${report?.hostRuntime?.nativeSlashCommandRecords}`),
+  check('FFP06b', 'report does not list resolved license decision as a cannot-claim item', licenseDecisionResolved && !report?.claimBoundary?.cannotClaim?.some((item) => item.includes('license acceptance')), 'License decision verified; cannotClaim excludes license acceptance'),
+  check('FFP07', 'human report includes claim boundary and verification commands', markdown.includes('## Claim Boundary') && markdown.includes('## Verification Commands') && markdown.includes('May claim public accepted final form: false') && markdown.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'markdown sections'),
+  check('FFP07b', 'report exposes dry-run preflight commands for blockers', (report?.blockers?.length ?? 0) > 0 && report.blockers.every((blocker) => blocker.preflightCommand?.includes('--dry-run --json')) && markdown.includes('Preflight command'), 'blocker preflight commands'),
+  check('FFP07c', 'report uses complete record command templates', blockerCommandsAreCompleteTemplates, 'no ellipsis, no stale host invocation flag, host records use --status accepted'),
+  check('FFP07d', 'canonical progress report carries command dry-run drill evidence', canonicalMarkdown.includes('audit-public-acceptance-command-dry-run-drill.mjs') && canonicalReport?.commandEvidence?.publicAcceptanceCommandDryRunDrill?.command?.includes('audit-public-acceptance-command-dry-run-drill.mjs'), '.gse/acceptance/final-form-progress-report.md, .gse/acceptance/final-form-progress-report.json'),
+  check('FFP08', 'skill routes users to final-form progress report', skill.includes('generate-final-form-progress-report.mjs'), 'SKILL.md'),
+  check('FFP09', 'validator includes final-form progress report audit', validate.includes('audit-final-form-progress-report.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const audit = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    finalFormProgressReport: failed === 0 ? 'verified' : 'failed',
+    localEngineeringReadiness: report?.scores?.localEngineeringReadiness ?? 'unknown',
+    fullFinalFormReadiness: report?.scores?.fullFinalFormReadiness ?? 'unknown',
+    pendingGates: report?.readiness?.pendingGateCount ?? 'unknown',
+    publicAccepted: report?.readiness?.publicAccepted ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies honest progress reporting from local evidence.',
+    'It does not create owner decisions, public CI, public repository settings, registry publication, marketplace approval, or native host evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Final-Form Progress Report Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Final-form progress report: ' + data.workflows.finalFormProgressReport)
+  lines.push('- Local engineering readiness: ' + data.workflows.localEngineeringReadiness + '%')
+  lines.push('- Full final-form readiness: ' + data.workflows.fullFinalFormReadiness + '%')
+  lines.push('- Pending gates: ' + data.workflows.pendingGates)
+  lines.push('- Public accepted: ' + data.workflows.publicAccepted)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(audit, null, 2))
+else console.log(renderMarkdown(audit))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-final-form-stale-copy.mjs

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const finalReadiness = run(process.execPath, [path.join(root, 'scripts', 'audit-final-readiness.mjs'), '--root', root, '--json'])
+const publicAcceptance = run(process.execPath, [path.join(root, 'scripts', 'audit-public-acceptance-readiness.mjs'), '--root', root, '--json'])
+const finalReadinessData = parseJson(finalReadiness.stdout)
+const publicAcceptanceData = parseJson(publicAcceptance.stdout)
+
+const matrix = finalReadinessData?.matrix ?? []
+const licenseRow = matrix.find((row) => row.area === 'License decision')
+const licenseVerified = licenseRow?.status === 'verified' || licenseRow?.status === 'accepted'
+const pendingGates = publicAcceptanceData?.pendingGates ?? []
+const pendingAreas = pendingGates.map((gate) => gate.area).sort()
+const expectedPendingAreas = pendingAreas
+
+const currentFiles = [
+  '.gse/gse-design-master-plan.md',
+  '.gse/goal-map.md',
+  '.gse/acceptance/final-acceptance-packet.md',
+  '.gse/acceptance/final-form-progress-report.md',
+  '.gse/acceptance/final-form-progress-report.json',
+  '.gse/acceptance/public-acceptance-handoff.md',
+  '.gse/acceptance/host-runtime-evidence-handoff.md',
+  '.gse/acceptance/release-status-manifest.json',
+  '.gse/acceptance/owner-external-gate-kit/README.md',
+  '.gse/acceptance/owner-external-gate-kit/final-acceptance-packet.md',
+  '.gse/acceptance/owner-external-gate-kit/public-acceptance-handoff.md',
+  '.gse/acceptance/owner-external-gate-kit/host-runtime-evidence-handoff.md',
+  '.gse/acceptance/owner-external-gate-kit/action-packet.md',
+  '.gse/acceptance/owner-external-gate-kit/release-status-manifest.json',
+  '.gse/acceptance/owner-external-gate-kit/kit-manifest.json',
+  '.gse/releases/public-release-owner-required.md',
+  '.gse/release-bundles/gse-release-bundle-audit/release-summary.md',
+  '.gse/release-bundles/gse-release-bundle-audit/public-release-record.md',
+  '.gse/release-bundles/gse-release-bundle-audit/public-acceptance-handoff.md',
+  '.gse/release-bundles/gse-release-bundle-audit/host-runtime-evidence-handoff.md',
+  '.gse/release-bundles/gse-release-bundle-audit/release-status-manifest.json',
+  '.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/README.md',
+  '.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/final-acceptance-packet.md',
+  '.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/public-acceptance-handoff.md',
+  '.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/host-runtime-evidence-handoff.md',
+  '.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/action-packet.md',
+  '.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/release-status-manifest.json',
+  '.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/kit-manifest.json',
+]
+
+const staleLicensePendingPhrases = [
+  'owner license selection remains required',
+  'Remaining final-form work is owner-selected license acceptance',
+  'Record owner-selected license acceptance',
+  'record owner-selected license acceptance',
+  'owner license decision before public release acceptance',
+  'owner license decision, accepted public security contact',
+  'owner-selected license acceptance, public security contact',
+  'owner-selected license acceptance or not-public decision',
+  'license decision and public security contact',
+  'Owner license decision and validation evidence required',
+  'owner-selected license acceptance unless accepted owner evidence exists',
+]
+
+function staleMatches() {
+  if (!licenseVerified) return []
+  const matches = []
+  for (const file of currentFiles) {
+    const content = read(file)
+    for (const phrase of staleLicensePendingPhrases) {
+      if (content.includes(phrase)) matches.push(`${file}: ${phrase}`)
+    }
+  }
+  return matches
+}
+
+function localPathMatches() {
+  const patterns = [
+    /C:[\\/]+Users[\\/]+Admin/gi,
+    /C:\/Users\/Admin/gi,
+  ]
+  const matches = []
+  for (const file of currentFiles) {
+    const content = read(file)
+    for (const pattern of patterns) {
+      if (pattern.test(content)) matches.push(file)
+      pattern.lastIndex = 0
+    }
+  }
+  return [...new Set(matches)]
+}
+
+function sameList(a, b) {
+  return a.length === b.length && a.every((item, index) => item === b[index])
+}
+
+function jsonFile(relativePath) {
+  return parseJson(read(relativePath))
+}
+
+const finalProgress = jsonFile('.gse/acceptance/final-form-progress-report.json')
+const releaseStatus = jsonFile('.gse/acceptance/release-status-manifest.json')
+const ownerKit = jsonFile('.gse/acceptance/owner-external-gate-kit/kit-manifest.json')
+const bundleReleaseStatus = jsonFile('.gse/release-bundles/gse-release-bundle-audit/release-status-manifest.json')
+const bundleOwnerKit = jsonFile('.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/kit-manifest.json')
+
+const artifactPendingSets = [
+  ['final progress', (finalProgress?.blockers ?? []).map((gate) => gate.area).sort()],
+  ['release status', (releaseStatus?.publicAcceptance?.pendingGates ?? []).map((gate) => gate.area).sort()],
+  ['owner kit', (ownerKit?.gates ?? []).map((gate) => gate.area).sort()],
+  ['bundle release status', (bundleReleaseStatus?.publicAcceptance?.pendingGates ?? []).map((gate) => gate.area).sort()],
+  ['bundle owner kit', (bundleOwnerKit?.gates ?? []).map((gate) => gate.area).sort()],
+]
+
+const publicReleaseRecord = read('.gse/releases/public-release-owner-required.md')
+const finalProgressCannotClaim = finalProgress?.claimBoundary?.cannotClaim ?? []
+const matches = staleMatches()
+const pathMatches = localPathMatches()
+
+const checks = [
+  check('FFSC01', 'live final readiness resolves the MIT license decision', finalReadiness.status === 0 && licenseVerified && publicReleaseRecord.includes('License status: selected') && publicReleaseRecord.includes('SPDX identifier: MIT') && publicReleaseRecord.includes('Evidence status: accepted'), 'audit-final-readiness.mjs, .gse/releases/public-release-owner-required.md'),
+  check('FFSC02', 'live public acceptance pending gates are current non-license gates', publicAcceptance.status === 0 && pendingAreas.length > 0 && sameList(pendingAreas, expectedPendingAreas) && !pendingAreas.includes('License decision'), pendingAreas.join(', ')),
+  check('FFSC03', 'current control and handoff docs do not describe resolved license decision as pending', matches.length === 0, matches.length ? matches.join('; ') : currentFiles.join(', ')),
+  check('FFSC04', 'canonical and bundled artifacts expose the same current pending gates', artifactPendingSets.every(([, areas]) => sameList(areas, expectedPendingAreas)), artifactPendingSets.map(([name, areas]) => `${name}: ${areas.join(', ')}`).join(' | ')),
+  check('FFSC05', 'public release record accepted license wording is not contradictory', publicReleaseRecord.includes('Owner license decision accepted') && !publicReleaseRecord.includes('Owner license decision and validation evidence required'), '.gse/releases/public-release-owner-required.md'),
+  check('FFSC06', 'final-form progress claim boundary excludes resolved license acceptance', finalProgress?.verifiedCapabilities?.some((item) => item.area === 'License decision' && item.status === 'verified') && !finalProgressCannotClaim.some((item) => item.includes('license acceptance')), '.gse/acceptance/final-form-progress-report.json'),
+  check('FFSC07', 'current public handoff artifacts do not expose local Windows user paths', pathMatches.length === 0, pathMatches.length ? pathMatches.join(', ') : currentFiles.join(', ')),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    finalFormStaleCopy: failed === 0 ? 'verified' : 'failed',
+    licenseDecision: licenseVerified ? 'verified' : licenseRow?.status ?? 'unknown',
+    pendingGates: pendingAreas.length,
+    publicAccepted: publicAcceptanceData?.summary?.publicAccepted ?? 'unknown',
+  },
+  limits: [
+    'This audit checks current control docs and generated handoff artifacts for stale final-form status copy.',
+    'It does not scan historical evidence logs, because older evidence may truthfully describe earlier states.',
+    'It does not create public security contact, public repository, CI, registry, marketplace, or host-runtime evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Final-Form Stale Copy Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- License decision: ' + data.workflows.licenseDecision)
+  lines.push('- Pending gates: ' + data.workflows.pendingGates)
+  lines.push('- Public accepted: ' + data.workflows.publicAccepted)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)