@t275005746/gse 0.1.0

package/scripts/audit-final-readiness-promotion.mjs

@@ -0,0 +1,255 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function copySkillFixture() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-final-readiness-promotion-'))
+  fs.cpSync(root, fixture, {
+    recursive: true,
+    filter(source) {
+      const normalized = source.replace(/\\/g, '/')
+      return !normalized.includes('/.git/') && !normalized.includes('/node_modules/')
+    },
+  })
+  fs.writeFileSync(path.join(fixture, 'LICENSE'), 'MIT License\n\nFixture only.\n', 'utf8')
+  return fixture
+}
+
+function runInFixture(fixture, relativeScript, commandArgs) {
+  return run(process.execPath, [path.join(fixture, relativeScript), '--root', fixture, ...commandArgs, '--force', '--json'], fixture)
+}
+
+const fixture = copySkillFixture()
+
+const records = [
+  runInFixture(fixture, 'scripts/record-public-release.mjs', [
+    '--license-status', 'selected',
+    '--spdx', 'MIT',
+    '--license-file', 'LICENSE',
+    '--approved-by', 'gse-maintainer',
+    '--decision-date', '2026-07-06',
+    '--evidence-status', 'accepted',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-release-selected.md'),
+  ]),
+  runInFixture(fixture, 'scripts/record-public-security-contact.mjs', [
+    '--contact-status', 'accepted',
+    '--contact-type', 'url',
+    '--contact-value', 'https://gse.dev/security',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://gse.dev/security-policy',
+    '--is-public', 'true',
+    '--security-policy-updated', 'true',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-security-contact.md'),
+  ]),
+  runInFixture(fixture, 'scripts/record-public-repository-settings.mjs', [
+    '--repository-url', 'https://github.com/gse-org/gse',
+    '--visibility', 'public',
+    '--settings-status', 'accepted',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://github.com/gse-org/gse/settings/branches',
+    '--issues-enabled', 'true',
+    '--pull-requests-enabled', 'true',
+    '--security-policy-visible', 'true',
+    '--branch-protection-enabled', 'true',
+    '--required-status-checks-enabled', 'true',
+    '--required-checks', 'Validate GSE',
+    '--require-review-before-merge', 'true',
+    '--require-conversation-resolution', 'true',
+    '--restrict-force-pushes', 'true',
+    '--restrict-deletions', 'true',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-repository-settings.md'),
+  ]),
+  runInFixture(fixture, 'scripts/record-public-ci-run.mjs', [
+    '--run-status', 'accepted',
+    '--run-conclusion', 'success',
+    '--repository-url', 'https://github.com/gse-org/gse',
+    '--workflow-name', 'Validate GSE',
+    '--workflow-file', '.github/workflows/validate-gse.yml',
+    '--run-url', 'https://github.com/gse-org/gse/actions/runs/123',
+    '--commit-sha', '0123456789abcdef0123456789abcdef01234567',
+    '--branch', 'main',
+    '--required-checks', 'Validate GSE',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://github.com/gse-org/gse/actions/runs/123',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--proves-public-ci-run', 'true',
+    '--proves-required-checks', 'true',
+    '--proves-release-commit', 'true',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-ci-run.md'),
+  ]),
+  runInFixture(fixture, 'scripts/record-public-channel-publication.mjs', [
+    '--publication-status', 'accepted',
+    '--channel-type', 'package-registry',
+    '--channel-name', 'npm',
+    '--channel-url', 'https://registry.npmjs.org/gse',
+    '--version', '1.0.0',
+    '--artifact-digest', 'sha256:fixture',
+    '--review-status', 'published',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://registry.npmjs.org/gse/1.0.0',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--proves-registry-publication', 'true',
+    '--proves-channel-installability', 'true',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-registry-publication.md'),
+  ]),
+  runInFixture(fixture, 'scripts/record-public-channel-publication.mjs', [
+    '--publication-status', 'accepted',
+    '--channel-type', 'marketplace',
+    '--channel-name', 'Codex Marketplace',
+    '--channel-url', 'https://marketplace.openai.com/gse',
+    '--version', '1.0.0',
+    '--review-status', 'approved',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://marketplace.openai.com/gse/review',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--proves-marketplace-approval', 'true',
+    '--proves-channel-installability', 'true',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-marketplace-approval.md'),
+  ]),
+  runInFixture(fixture, 'scripts/record-host-invocation.mjs', [
+    '--host', 'Fixture Native Host',
+    '--invocation-method', 'native-slash-command',
+    '--command', '/gse help',
+    '--status', 'accepted',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence', 'fixture native slash-command transcript',
+    '--verification-command', 'node scripts/audit-final-readiness.mjs --root __GSE__ --json',
+    '--native-slash-command', 'true',
+    '--portable-text-command', 'false',
+    '--generated-pointer', 'false',
+    '--owner-acceptance-required', 'false',
+    '--out', path.join(fixture, '.gse', 'evidence', 'host-invocations', 'fixture-native-host.md'),
+  ]),
+]
+
+const finalReadiness = run(process.execPath, [path.join(fixture, 'scripts', 'audit-final-readiness.mjs'), '--root', fixture, '--json'], fixture)
+const finalReadinessData = parseJson(finalReadiness.stdout)
+const matrix = finalReadinessData?.matrix ?? []
+const promotedAreas = [
+  'License decision',
+  'Public security contact',
+  'Public repository settings',
+  'Public CI run',
+  'Public registry publication',
+  'Marketplace approval',
+  'Native slash command',
+  'Other host runtime invocation',
+]
+const areaStatus = new Map(matrix.map((row) => [row.area, row.status]))
+const areaEvidence = new Map(matrix.map((row) => [row.area, row.evidence]))
+const recordFailures = records.filter((item) => item.status !== 0)
+
+const checks = [
+  check('FRP01', 'accepted fixture records are generated', recordFailures.length === 0, recordFailures.map((item) => item.stderr || item.stdout || item.command).join('; ') || 'all accepted records written'),
+  check('FRP02', 'final readiness audit runs on accepted-record fixture', finalReadiness.status === 0 && finalReadinessData?.summary?.status === 'passed', finalReadiness.stderr || 'audit-final-readiness fixture run'),
+  check('FRP03', 'owner/external rows promote to verified from accepted records', promotedAreas.every((area) => areaStatus.get(area) === 'verified'), promotedAreas.map((area) => `${area}:${areaStatus.get(area) ?? 'missing'}`).join(', ')),
+  check('FRP04', 'promoted rows cite concrete record evidence', promotedAreas.every((area) => String(areaEvidence.get(area) ?? '').includes('.gse/')), promotedAreas.map((area) => `${area}:${areaEvidence.get(area) ?? 'missing'}`).join(', ')),
+  check('FRP05', 'public accepted becomes verified when every final row has accepted evidence', finalReadinessData?.workflows?.publicAccepted === 'verified', finalReadinessData?.workflows?.publicAccepted ?? 'unknown'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  fixtureRoot: fixture,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    finalReadinessPromotion: failed === 0 ? 'verified' : 'failed',
+    publicAcceptedFixture: finalReadinessData?.workflows?.publicAccepted ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies promotion mechanics with fixture accepted records.',
+    'It does not create real owner decisions, public CI runs, public repository settings, registry publications, marketplace approvals, or native host invocations.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Final Readiness Promotion Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Fixture root: ' + data.fixtureRoot)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Final readiness promotion: ' + data.workflows.finalReadinessPromotion)
+  lines.push('- Public accepted fixture: ' + data.workflows.publicAcceptedFixture)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-final-readiness.mjs

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function listMarkdown(relativeDir) {
+  const fullDir = path.join(root, relativeDir)
+  if (!fs.existsSync(fullDir)) return []
+  return fs.readdirSync(fullDir)
+    .filter((item) => item.endsWith('.md'))
+    .map((item) => path.join(fullDir, item))
+}
+
+function relative(filePath) {
+  return path.relative(root, filePath).replace(/\\/g, '/')
+}
+
+function parseRecord(filePath, label) {
+  const text = fs.readFileSync(filePath, 'utf8')
+  const prefix = label.endsWith('?') ? '- ' + label + ' ' : '- ' + label + ':'
+  const line = text.split(/\r?\n/).find((item) => item.trimStart().startsWith(prefix))
+  return line ? line.slice(line.indexOf(prefix) + prefix.length).trim() : ''
+}
+
+function recordText(filePath) {
+  return fs.readFileSync(filePath, 'utf8')
+}
+
+function hasRecordLine(text, label, value) {
+  const prefix = label.endsWith('?') ? '- ' + label + ' ' : label + ':'
+  return text.split(/\r?\n/).some((line) => {
+    const trimmed = line.trim()
+    const unlisted = trimmed.startsWith('- ') ? trimmed.slice(2).trim() : trimmed
+    return trimmed === `${prefix} ${value}` ||
+      trimmed === `${prefix}${value}` ||
+      unlisted === `${prefix} ${value}` ||
+      unlisted === `${prefix}${value}`
+  })
+}
+
+function findReleaseRecord(predicate) {
+  return releaseRecords.find((record) => predicate(record.text))
+}
+
+const finalReadiness = read('references/final-readiness.md')
+const validate = read('scripts/validate-gse.mjs')
+const completion = read('scripts/audit-completion-readiness.mjs')
+const roadmap = read('scripts/audit-roadmap-consistency.mjs')
+const state = read('.gse/state.json')
+const goalMap = read('.gse/goal-map.md')
+const publicReleaseRecord = read('.gse/releases/public-release-owner-required.md')
+const publicSecurityContactRecord = read('.gse/releases/public-security-contact-owner-required.md')
+const security = read('SECURITY.md')
+const marketplace = read('references/marketplace-discovery.md')
+const distributionAudit = read('scripts/audit-distribution.mjs')
+const remoteDistributionAudit = read('scripts/audit-remote-distribution.mjs')
+const npmTarballInstallAudit = read('scripts/audit-npm-tarball-install.mjs')
+const npmPublishDryRunAudit = read('scripts/audit-npm-publish-dry-run.mjs')
+const releaseRecords = listMarkdown(path.join('.gse', 'releases')).map((filePath) => ({ filePath, text: recordText(filePath) }))
+const acceptedLicenseRecord = findReleaseRecord((text) =>
+  (hasRecordLine(text, 'License status', 'selected') || hasRecordLine(text, 'License status', 'not-public')) &&
+  hasRecordLine(text, 'Evidence status', 'accepted') &&
+  Boolean(text.match(/^Accepted by:\s+\S/m)),
+)
+const acceptedSecurityContactRecord = findReleaseRecord((text) =>
+  hasRecordLine(text, 'Contact status', 'accepted') &&
+  hasRecordLine(text, 'Evidence status', 'accepted'),
+)
+const acceptedPublicCiRunRecord = findReleaseRecord((text) =>
+  hasRecordLine(text, 'Run status', 'accepted') &&
+  hasRecordLine(text, 'Run conclusion', 'success') &&
+  hasRecordLine(text, 'Evidence status', 'accepted') &&
+  hasRecordLine(text, 'Does this prove a public CI run?', 'true') &&
+  hasRecordLine(text, 'Does this prove required checks passed?', 'true'),
+)
+const acceptedRepositorySettingsRecord = findReleaseRecord((text) =>
+  hasRecordLine(text, 'Settings status', 'accepted') &&
+  hasRecordLine(text, 'Evidence status', 'accepted'),
+)
+const acceptedRegistryPublicationRecord = findReleaseRecord((text) =>
+  hasRecordLine(text, 'Publication status', 'accepted') &&
+  hasRecordLine(text, 'Channel type', 'package-registry') &&
+  hasRecordLine(text, 'Evidence status', 'accepted') &&
+  hasRecordLine(text, 'Does this prove public registry publication?', 'true'),
+)
+const acceptedMarketplaceApprovalRecord = findReleaseRecord((text) =>
+  hasRecordLine(text, 'Publication status', 'accepted') &&
+  (hasRecordLine(text, 'Channel type', 'marketplace') || hasRecordLine(text, 'Channel type', 'catalog')) &&
+  hasRecordLine(text, 'Evidence status', 'accepted') &&
+  hasRecordLine(text, 'Does this prove marketplace approval?', 'true'),
+)
+const hostRecords = listMarkdown(path.join('.gse', 'evidence', 'host-invocations'))
+const closeableHostRecords = hostRecords.filter((record) => ['verified', 'accepted'].includes(parseRecord(record, 'Status')))
+const nativeHostRecords = closeableHostRecords.filter((record) => parseRecord(record, 'Does this prove native slash-command support?') === 'true')
+const portableHostRecords = closeableHostRecords.filter((record) => parseRecord(record, 'Does this prove portable text-command routing only?') === 'true')
+const otherHostRuntimeRecords = closeableHostRecords.filter((record) =>
+  parseRecord(record, 'Does this prove portable text-command routing only?') !== 'true' &&
+  parseRecord(record, 'Does this rely on a generated pointer file?') !== 'true'
+)
+
+const matrix = [
+  { area: 'Skill structure', status: exists('SKILL.md') && exists('scripts/validate-gse.mjs') ? 'verified' : 'missing', evidence: 'SKILL.md, scripts/validate-gse.mjs' },
+  { area: 'Project scaffold', status: exists('scripts/init-project.mjs') && exists('scripts/audit-target-project.mjs') && exists('scripts/audit-close-gate.mjs') ? 'verified' : 'missing', evidence: 'init/project doctor/close gate scripts' },
+  { area: 'Local install', status: exists('scripts/package-gse.mjs') && exists('scripts/install-gse.mjs') && exists('scripts/audit-distribution.mjs') && distributionAudit.includes('installed short CLI wrapper runs status command') && distributionAudit.includes('entrypoints?.cli') ? 'verified' : 'missing', evidence: 'scripts/audit-distribution.mjs verifies package/install, installed validation, entrypoints.cli, and installed gse.mjs status' },
+  { area: 'npm tarball install', status: exists('package.json') && exists('scripts/audit-npm-tarball-install.mjs') && npmTarballInstallAudit.includes('npm pack creates one tarball') && npmTarballInstallAudit.includes('installed gse bin runs status command') && npmTarballInstallAudit.includes('installed README audit passes') ? 'verified' : 'missing', evidence: 'scripts/audit-npm-tarball-install.mjs verifies npm tarball creation, clean consumer install, installed bin execution, and installed README audit' },
+  { area: 'npm publish dry-run', status: exists('package.json') && exists('scripts/audit-npm-publish-dry-run.mjs') && npmPublishDryRunAudit.includes('npm publish dry-run command succeeds') && npmPublishDryRunAudit.includes('publish dry-run preserves CLI package metadata before publication') && npmPublishDryRunAudit.includes('publish dry-run does not auto-correct or remove package metadata') ? 'verified' : 'missing', evidence: 'scripts/audit-npm-publish-dry-run.mjs verifies publish dry-run metadata, CLI bin preservation, required files, and integrity fields' },
+  { area: 'URL install', status: exists('scripts/audit-remote-distribution.mjs') && remoteDistributionAudit.includes('remote installed short CLI wrapper runs status command') && remoteDistributionAudit.includes('tampered remote package fails integrity gate') ? 'verified' : 'missing', evidence: 'scripts/audit-remote-distribution.mjs verifies URL install, installed validation, installed gse.mjs status, and tamper rejection' },
+  { area: 'Signing', status: exists('scripts/audit-signing.mjs') && exists('scripts/sign-gse-package.mjs') && exists('scripts/verify-gse-package.mjs') ? 'verified' : 'missing', evidence: 'sign/verify/audit scripts' },
+  { area: 'Open-source collaboration', status: exists('CONTRIBUTING.md') && exists('SECURITY.md') && exists('SUPPORT.md') && exists('scripts/audit-open-source-readiness.mjs') ? 'verified' : 'missing', evidence: 'CONTRIBUTING.md, SECURITY.md, SUPPORT.md' },
+  { area: 'CI workflow template', status: exists('.github/workflows/validate-gse.yml') && exists('scripts/audit-ci-readiness.mjs') ? 'verified' : 'missing', evidence: '.github/workflows/validate-gse.yml, scripts/audit-ci-readiness.mjs' },
+  { area: 'Public CI run record', status: exists('scripts/record-public-ci-run.mjs') && exists('scripts/audit-public-ci-run.mjs') && exists('assets/templates/public-ci-run-record.md') ? 'verified' : 'missing', evidence: 'record/audit public CI run scripts and template' },
+  { area: 'Public collaboration templates', status: exists('.github/PULL_REQUEST_TEMPLATE.md') && exists('.github/ISSUE_TEMPLATE/bug_report.yml') && exists('.github/ISSUE_TEMPLATE/change_request.yml') && exists('scripts/audit-public-collaboration-templates.mjs') ? 'verified' : 'missing', evidence: '.github/PULL_REQUEST_TEMPLATE.md, .github/ISSUE_TEMPLATE/, scripts/audit-public-collaboration-templates.mjs' },
+  { area: 'Public repository settings record', status: exists('scripts/record-public-repository-settings.mjs') && exists('scripts/audit-public-repository-settings.mjs') && exists('assets/templates/public-repository-settings-record.md') ? 'verified' : 'missing', evidence: 'record/audit public repository settings scripts and template' },
+  { area: 'Public CI run', status: acceptedPublicCiRunRecord ? 'verified' : 'external-required', evidence: acceptedPublicCiRunRecord ? relative(acceptedPublicCiRunRecord.filePath) : 'no public GitHub Actions run is claimed' },
+  { area: 'Public repository settings', status: acceptedRepositorySettingsRecord ? 'verified' : 'external-required', evidence: acceptedRepositorySettingsRecord ? relative(acceptedRepositorySettingsRecord.filePath) : 'no real public repository settings evidence is claimed' },
+  { area: 'License decision', status: acceptedLicenseRecord ? 'verified' : publicReleaseRecord.includes('License status: owner-required') ? 'owner-required' : publicReleaseRecord.includes('License status: selected') ? 'verified' : 'missing', evidence: acceptedLicenseRecord ? relative(acceptedLicenseRecord.filePath) : '.gse/releases/public-release-owner-required.md' },
+  { area: 'Public security contact record', status: exists('scripts/record-public-security-contact.mjs') && exists('scripts/audit-public-security-contact.mjs') && exists('assets/templates/public-security-contact-record.md') ? 'verified' : 'missing', evidence: 'record/audit public security contact scripts and template' },
+  { area: 'Public security contact', status: acceptedSecurityContactRecord ? 'verified' : security.includes('No public vulnerability disclosure address has been owner-approved yet') ? 'owner-required' : 'verified', evidence: acceptedSecurityContactRecord ? relative(acceptedSecurityContactRecord.filePath) : publicSecurityContactRecord ? '.gse/releases/public-security-contact-owner-required.md' : 'SECURITY.md' },
+  { area: 'Public channel publication record', status: exists('scripts/record-public-channel-publication.mjs') && exists('scripts/audit-public-channel-publication.mjs') && exists('assets/templates/public-channel-publication-record.md') ? 'verified' : 'missing', evidence: 'record/audit public channel publication scripts and template' },
+  { area: 'Public registry publication', status: acceptedRegistryPublicationRecord ? 'verified' : 'external-required', evidence: acceptedRegistryPublicationRecord ? relative(acceptedRegistryPublicationRecord.filePath) : 'no public registry publication record is claimed' },
+  { area: 'Marketplace approval', status: acceptedMarketplaceApprovalRecord ? 'verified' : 'external-required', evidence: acceptedMarketplaceApprovalRecord ? relative(acceptedMarketplaceApprovalRecord.filePath) : 'references/marketplace-discovery.md' },
+  { area: 'Portable command execution', status: exists('scripts/audit-command-execution.mjs') && exists('scripts/run-gse-command.mjs') ? 'verified' : 'missing', evidence: 'run-gse-command and audit-command-execution' },
+  { area: 'Host adapters', status: exists('scripts/generate-command-adapter.mjs') && exists('scripts/audit-command-adapters.mjs') ? 'verified' : 'missing', evidence: 'command adapter generator and audit' },
+  { area: 'Native slash command', status: nativeHostRecords.length > 0 ? 'verified' : 'external-required', evidence: nativeHostRecords.length > 0 ? nativeHostRecords.map(relative).join(', ') : `${nativeHostRecords.length} native host record(s)` },
+  { area: 'Other host runtime invocation', status: otherHostRuntimeRecords.length > 0 ? 'verified' : 'external-required', evidence: otherHostRuntimeRecords.length > 0 ? otherHostRuntimeRecords.map(relative).join(', ') : `${closeableHostRecords.length} verified/accepted host record(s), ${portableHostRecords.length} portable text record(s)` },
+]
+
+const allowedStatuses = new Set(['verified', 'owner-required', 'external-required', 'not-claimed'])
+const matrixStatusesHonest = matrix.every((item) => allowedStatuses.has(item.status))
+const verifiedRowsHaveEvidence = matrix.filter((item) => item.status === 'verified').every((item) => item.evidence && item.evidence !== '0')
+const publicAccepted = matrix.every((item) => item.status === 'verified')
+const ownerAndExternalRowsRemainExplicit = publicAccepted || matrix.some((item) => item.status === 'owner-required' || item.status === 'external-required')
+const finalReadinessUsesStatusSourceBoundary = finalReadiness.includes('Status source / baseline') &&
+  finalReadiness.includes('current truth is computed by `scripts/audit-final-readiness.mjs`') &&
+  finalReadiness.includes('record-driven owner gate') &&
+  finalReadiness.includes('record-driven external gate') &&
+  finalReadiness.includes('Do not read the baseline column as live status')
+
+const checks = [
+  check('FR01', 'final readiness reference exists', exists('references/final-readiness.md'), 'references/final-readiness.md'),
+  check('FR02', 'final readiness matrix covers key final-state areas', ['npm tarball install', 'npm publish dry-run', 'CI workflow template', 'Public CI run record', 'Public collaboration templates', 'Public repository settings record', 'Public CI run', 'Public repository settings', 'License decision', 'Public security contact record', 'Public security contact', 'Public channel publication record', 'Public registry publication', 'Marketplace approval', 'Native slash command', 'Other host runtime invocation'].every((term) => finalReadiness.includes(term)), 'references/final-readiness.md'),
+  check('FR03', 'final readiness audit is wired into validator and completion audits', validate.includes('audit-final-readiness.mjs') && completion.includes('audit-final-readiness.mjs') && roadmap.includes('audit-final-readiness.mjs'), 'validate, completion, roadmap audits'),
+  check('FR04', 'readiness matrix uses honest statuses only', matrixStatusesHonest, matrix.map((item) => `${item.area}:${item.status}`).join(', ')),
+  check('FR05', 'verified readiness rows have evidence labels', verifiedRowsHaveEvidence, matrix.filter((item) => item.status === 'verified').map((item) => item.area).join(', ')),
+  check('FR06', 'owner and external gates remain explicit until accepted records promote them', ownerAndExternalRowsRemainExplicit && (publicAccepted || goalMap.includes('Final-form gaps')), publicAccepted ? 'all final rows promoted by accepted records' : 'goal map, final readiness matrix'),
+  check('FR07', 'install and publish rows include CLI proof boundaries', finalReadiness.includes('installed short CLI status command') && finalReadiness.includes('installed `gse` bin execution') && finalReadiness.includes('CLI bin metadata') && finalReadiness.includes('URL-installed short CLI status command') && distributionAudit.includes('installed short CLI wrapper runs status command') && npmTarballInstallAudit.includes('installed gse bin runs status command') && npmPublishDryRunAudit.includes('publish dry-run preserves CLI package metadata before publication') && remoteDistributionAudit.includes('remote installed short CLI wrapper runs status command'), 'references/final-readiness.md, distribution audits, publish dry-run audit'),
+  check('FR08', 'final readiness reference separates baseline from live record-driven status', finalReadinessUsesStatusSourceBoundary, 'references/final-readiness.md, audit-final-readiness.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    finalReadinessMatrix: failed === 0 ? 'verified' : 'failed',
+    publicAccepted: publicAccepted ? 'verified' : 'not-accepted',
+  },
+  matrix,
+  limits: [
+    'This audit verifies that GSE has an honest final-readiness matrix.',
+    'It may pass while owner-required or external-required rows remain incomplete.',
+    'It does not publish to a registry, approve a marketplace listing, choose a license, or prove native slash-command support.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Final Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Final readiness matrix: ' + data.workflows.finalReadinessMatrix)
+  lines.push('- Public accepted: ' + data.workflows.publicAccepted)
+  lines.push('')
+  lines.push('## Matrix')
+  lines.push('')
+  for (const item of data.matrix) lines.push('- ' + item.area + ': ' + item.status + ' (' + item.evidence + ')')
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-fixtures.mjs

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function readText(relativePath) {
+  const filePath = path.join(root, relativePath)
+  if (!fs.existsSync(filePath)) return ''
+  return fs.readFileSync(filePath, 'utf8')
+}
+
+function safeJson(relativePath) {
+  const text = readText(relativePath)
+  if (!text) return null
+  try {
+    return JSON.parse(text.replace(/^\uFEFF/, ''))
+  } catch {
+    return null
+  }
+}
+
+function detectSmallAppProfile() {
+  const base = 'examples/small-app'
+  const pkg = safeJson(base + '/package.json')
+  const deps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) }
+  const scripts = pkg?.scripts ?? {}
+  const frameworks = []
+  const checks = [
+    ['react', 'React'],
+    ['vite', 'Vite'],
+    ['typescript', 'TypeScript'],
+    ['@playwright/test', 'Playwright'],
+    ['vitest', 'Vitest'],
+    ['eslint', 'ESLint'],
+    ['prettier', 'Prettier'],
+  ]
+  for (const [dep, label] of checks) {
+    if (deps[dep]) frameworks.push(label)
+  }
+  const configFiles = [
+    base + '/package.json',
+    base + '/playwright.config.ts',
+    base + '/.env.example',
+    base + '/.github/workflows/ci.yml',
+    base + '/AGENTS.md',
+  ].filter(exists)
+  return { pkg, frameworks, scripts, configFiles }
+}
+
+function detectCliToolProfile() {
+  const base = 'examples/cli-tool'
+  const pkg = safeJson(base + '/package.json')
+  const scripts = pkg?.scripts ?? {}
+  const configFiles = [
+    base + '/package.json',
+    base + '/AGENTS.md',
+    base + '/.gse/project-profile.md',
+  ].filter(exists)
+  return { pkg, scripts, configFiles }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const small = detectSmallAppProfile()
+const cli = detectCliToolProfile()
+const runtimeProfile = readText('examples/agent-runtime-host/.gse/project-profile.md')
+const codexAdapter = readText('examples/agent-runtime-host/.codex/gse-adapter.md')
+const claudeAdapter = readText('examples/agent-runtime-host/.claude/gse-adapter.md')
+const runtimeTooling = readText('examples/agent-runtime-host/.gse/tooling.md')
+const modelRouting = readText('examples/agent-runtime-host/docs/model-routing.md')
+
+const checks = [
+  check('F01', 'examples root exists', exists('examples/README.md'), 'examples/README.md'),
+  check('F02', 'small-app fixture exists', exists('examples/small-app/README.md') && exists('examples/small-app/package.json'), 'examples/small-app/README.md, package.json'),
+  check('F03', 'small-app profile discovery signals are present', small.frameworks.includes('React') && small.frameworks.includes('Vite') && small.frameworks.includes('TypeScript') && small.frameworks.includes('Playwright'), 'frameworks: ' + small.frameworks.join(', ')),
+  check('F04', 'small-app commands and evidence sources are documented', Boolean(small.scripts.test && small.scripts['test:e2e'] && small.scripts.typecheck && small.configFiles.length >= 5), 'scripts: ' + Object.keys(small.scripts).join(', ') + '; config files: ' + small.configFiles.join(', ')),
+  check('F05', 'cli-tool fixture exists', exists('examples/cli-tool/README.md') && exists('examples/cli-tool/package.json') && exists('examples/cli-tool/.gse/project-profile.md'), 'examples/cli-tool README, package.json, project-profile.md'),
+  check('F06', 'cli-tool package adoption signals are documented', Boolean(cli.pkg?.bin?.['gse-fixture'] && cli.scripts.smoke && cli.scripts['release:dry-run'] && cli.scripts.typecheck && cli.scripts.lint), 'bin and scripts: ' + Object.keys(cli.scripts).join(', ')),
+  check('F07', 'cli-tool profile keeps package capabilities evidence-bound', readText('examples/cli-tool/.gse/project-profile.md').includes('documented') && readText('examples/cli-tool/.gse/project-profile.md').includes('unknown') && readText('examples/cli-tool/.gse/project-profile.md').includes('npm pack --dry-run'), 'examples/cli-tool/.gse/project-profile.md'),
+  check('F08', 'cli-tool is listed in examples routing', readText('examples/README.md').includes('cli-tool') && readText('examples/README.md').includes('package adoption'), 'examples/README.md'),
+  check('F09', 'agent-runtime-host fixture exists', exists('examples/agent-runtime-host/README.md') && exists('examples/agent-runtime-host/.gse/project-profile.md'), 'examples/agent-runtime-host/README.md, .gse/project-profile.md'),
+  check('F10', 'host adapters point back to .gse source of truth', codexAdapter.includes('Source of truth: `.gse/`.') && claudeAdapter.includes('Source of truth: `.gse/`.'), '.codex/gse-adapter.md, .claude/gse-adapter.md'),
+  check('F11', 'host adapter fixture separates verified and unknown capability claims', runtimeProfile.includes('documented') && runtimeProfile.includes('unknown') && runtimeTooling.includes('not verified'), '.gse/project-profile.md and .gse/tooling.md status vocabulary'),
+  check('F12', 'drift audit and model routing signals are present', codexAdapter.includes('references/drift-audit.md') && modelRouting.includes('provider support from docs alone'), 'Codex adapter drift pointer and docs/model-routing.md'),
+  check('F13', 'fixture safety rules avoid secrets and bulky artifacts', readText('examples/README.md').includes('No secrets') && readText('examples/README.md').includes('No lockfiles, caches, screenshots'), 'examples/README.md safety rules'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { passed, failed, total: checks.length, status: failed === 0 ? 'passed' : 'failed' },
+  workflows: {
+    projectProfileDiscovery: checks.filter((item) => ['F02', 'F03', 'F04'].includes(item.id)).every((item) => item.status === 'passed') ? 'verified' : 'failed',
+    cliPackageAdoption: checks.filter((item) => ['F05', 'F06', 'F07', 'F08'].includes(item.id)).every((item) => item.status === 'passed') ? 'verified' : 'failed',
+    hostAdapterAndDrift: checks.filter((item) => ['F09', 'F10', 'F11', 'F12'].includes(item.id)).every((item) => item.status === 'passed') ? 'verified' : 'failed',
+  },
+  limits: [
+    'Fixture audit uses controlled example project shapes, not broad real repositories.',
+    'Fixture audit does not claim fresh-session acceptance.',
+    'Config presence is treated as documented unless a command is actually run.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Fixture Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Project profile discovery: ' + data.workflows.projectProfileDiscovery)
+  lines.push('- CLI package adoption: ' + data.workflows.cliPackageAdoption)
+  lines.push('- Host adapter and drift: ' + data.workflows.hostAdapterAndDrift)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)