@t275005746/gse 0.1.0

package/scripts/audit-fresh-session-readiness.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function section(markdown, heading) {
+  const lines = markdown.split(/\r?\n/)
+  const start = lines.findIndex((line) => line.trim() === '## ' + heading)
+  if (start === -1) return ''
+  const body = []
+  for (let index = start + 1; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (line.startsWith('## ')) break
+    body.push(line)
+  }
+  return body.join('\n').trim()
+}
+
+const requiredInputs = [
+  'SKILL.md',
+  '.gse/gse-design-master-plan.md',
+  '.gse/goal-map.md',
+  '.gse/current-slice.md',
+  'references/forward-test.md',
+  'references/evidence-taxonomy.md',
+]
+
+const skill = read('SKILL.md')
+const masterPlan = read('.gse/gse-design-master-plan.md')
+const goalMap = read('.gse/goal-map.md')
+const currentSlice = read('.gse/current-slice.md')
+const forwardTest = read('references/forward-test.md')
+const taxonomy = read('references/evidence-taxonomy.md')
+
+const outcome = section(currentSlice, 'Outcome')
+const scope = section(currentSlice, 'Scope')
+const acceptance = section(currentSlice, 'Acceptance')
+const evidence = section(currentSlice, 'Evidence') || section(currentSlice, 'Evidence Plan')
+const nextAction = section(currentSlice, 'Next Action')
+
+const probePacketLines = [
+  '# GSE Fresh-Session Probe Packet',
+  '',
+  'Purpose: verify whether a separate session can continue GSE development without hidden conversation history.',
+  '',
+  'Read these files in order:',
+  ...requiredInputs.map((item) => '- ' + item),
+  '',
+  'Task for the fresh session:',
+  '- Identify the active GSE slice from `.gse/current-slice.md`.',
+  '- State outcome, scope, acceptance, evidence, risk, and next action.',
+  '- Do not claim accepted unless a separate session actually ran the path or an explicit policy accepts it.',
+  '- Do not invent subagent, MCP, LSP, browser, model, hook, or host support.',
+  '',
+  'Expected active slice:',
+  outcome || '(missing)',
+  '',
+  'Expected next action:',
+  nextAction || '(missing)',
+  '',
+  'Required response fields:',
+  '- Forward-test level',
+  '- Scenario',
+  '- Changed behavior',
+  '- Commands or inspection',
+  '- Result evidence',
+  '- Verification evidence',
+  '- Accepted by',
+  '- Residual risk',
+  '- Next action',
+]
+const probePacket = probePacketLines.join('\n') + '\n'
+
+const checks = [
+  check('FS01', 'required startup inputs exist', requiredInputs.every(exists), requiredInputs.join(', ')),
+  check('FS02', 'SKILL routes GSE changes through control and validation', skill.includes('references/router.md') && skill.includes('scripts/validate-gse.mjs') && skill.includes('references/forward-test.md'), 'SKILL.md'),
+  check('FS03', 'master plan preserves fresh-session boundary after owner acceptance', masterPlan.includes('owner-approved AION project-write acceptance is executed') && (masterPlan.includes('fresh-session acceptance remains optional future confidence evidence') || masterPlan.includes('Marketplace discovery, public key custody, and cross-host native command execution remain final-form work') || masterPlan.includes('Marketplace discovery and real host UI invocation remain final-form work') || masterPlan.includes('Public marketplace approval, public registry publication, other host runtime invocation records, and host-native slash-command execution remain final-form work') || masterPlan.includes('Remaining final-form work is real public security contact approval, real public repository settings, public CI run, real public registry publication, real public marketplace approval, host-native slash-command support, and other host runtime invocation records.')), '.gse/gse-design-master-plan.md'),
+  check('FS04', 'goal map exposes active slice and next action without hidden history', goalMap.includes('- Active slice:') && goalMap.includes('- Next action:') && goalMap.includes('scripts/audit-fresh-session-readiness.mjs'), '.gse/goal-map.md'),
+  check('FS05', 'current slice has required GSE fields', Boolean(outcome && scope && acceptance && evidence && nextAction), 'Outcome, Scope, Acceptance, Evidence or Evidence Plan, Next Action'),
+  check('FS06', 'probe packet explicitly avoids false acceptance', probePacket.includes('Do not claim accepted unless a separate session actually ran the path or an explicit policy accepts it.'), 'generated probe packet'),
+  check('FS07', 'forward-test protocol defines fresh-session acceptance rules', forwardTest.includes('Fresh-session forward test') && forwardTest.includes('accepted by: fresh-session') && forwardTest.includes('separate agent/session actually ran the path'), 'references/forward-test.md'),
+  check('FS08', 'evidence taxonomy supports result verified accepted labels', taxonomy.includes('result -> verified -> accepted') && taxonomy.includes('Not enough for `accepted`'), 'references/evidence-taxonomy.md'),
+  check('FS09', 'probe packet uses only documented inputs', requiredInputs.every((item) => probePacket.includes(item)) && probePacket.includes('without hidden conversation history'), 'generated probe packet'),
+  check('FS10', 'probe packet asks for evidence taxonomy and residual risk', probePacket.includes('Accepted by') && probePacket.includes('Residual risk') && probePacket.includes('Do not claim accepted'), 'generated probe packet fields'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  level: 'fresh-session readiness probe',
+  scenario: 'Prepare a separate-session GSE continuation packet using documented startup inputs.',
+  changedBehavior: 'GSE now has a repeatable readiness check for fresh-session acceptance without overstating acceptance when no separate-session tool is available.',
+  evidenceStatus: failed === 0 ? 'verified' : 'result',
+  acceptedBy: 'not accepted; no separate-session tool was available to execute the probe in this run',
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { freshSessionReadiness: failed === 0 ? 'verified' : 'failed', freshSessionAcceptance: 'not accepted' },
+  commandsOrInspection: [
+    'Read documented startup inputs: ' + requiredInputs.join(', '),
+    'Generate fresh-session probe packet from current slice and forward-test rules',
+    'Verify accepted status is not claimed without a real separate-session run',
+  ],
+  probePacket,
+  residualRisk: [
+    'This readiness probe is not a true fresh-session run.',
+    'The result cannot be marked accepted until a separate session, thread, or host-specific equivalent actually follows the packet.',
+    'Host-specific thread/subagent tools must be verified before using them as acceptance evidence.',
+  ],
+  nextAction: 'When a separate-session or thread tool is available, run the probe packet and record accepted or failed evidence.',
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Fresh-Session Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Record')
+  lines.push('')
+  lines.push('- Forward-test level: ' + data.level)
+  lines.push('- Scenario: ' + data.scenario)
+  lines.push('- Changed behavior: ' + data.changedBehavior)
+  lines.push('- Result evidence: probe packet generated from documented inputs')
+  lines.push('- Verification evidence: ' + data.summary.passed + '/' + data.summary.total + ' checks passed')
+  lines.push('- Evidence status: ' + data.evidenceStatus)
+  lines.push('- Accepted by: ' + data.acceptedBy)
+  lines.push('- Next action: ' + data.nextAction)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Probe Packet')
+  lines.push('')
+  lines.push('```text')
+  lines.push(data.probePacket.trimEnd())
+  lines.push('```')
+  lines.push('')
+  lines.push('## Residual Risk')
+  lines.push('')
+  for (const item of data.residualRisk) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-gse.mjs

@@ -0,0 +1,275 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const out = readArg('--out')
+const jsonOnly = args.includes('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function anyExists(relativePaths) {
+  return relativePaths.some((relativePath) => exists(relativePath))
+}
+
+function criterion(id, label, required, note = '') {
+  const ok = Array.isArray(required) ? anyExists(required) : exists(required)
+  return {
+    id,
+    label,
+    status: ok ? 'present' : 'missing',
+    required,
+    note,
+  }
+}
+
+const capabilityAreas = [
+  {
+    id: 'GSE-C01',
+    name: 'Skill Core',
+    criteria: [
+      criterion('C01-01', 'Skill entrypoint exists', 'SKILL.md'),
+      criterion('C01-02', 'English README exists', 'README.md'),
+      criterion('C01-03', 'Chinese README exists', 'README.zh-CN.md'),
+      criterion('C01-04', 'References folder exists', 'references'),
+      criterion('C01-05', 'Scripts folder exists', 'scripts'),
+      criterion('C01-06', 'Reusable templates exist', 'assets/templates'),
+      criterion('C01-07', 'OpenAI UI metadata exists', 'agents/openai.yaml', 'Recommended by skill-creator; may be added after validator path is healthy.'),
+    ],
+  },
+  {
+    id: 'GSE-C02',
+    name: 'GSE Self-Development Governance',
+    criteria: [
+      criterion('C02-01', 'Development protocol exists', '.gse/gse-development-protocol.md'),
+      criterion('C02-02', 'Design master plan exists', '.gse/gse-design-master-plan.md'),
+      criterion('C02-03', 'Benchmark audit records exist', '.gse/benchmark-audits'),
+      criterion('C02-04', 'Evidence records exist', '.gse/evidence'),
+      criterion('C02-05', 'Self-audit script exists', 'scripts/audit-gse.mjs'),
+      criterion('C02-06', 'Release/version checklist exists', ['.gse/release.md', 'references/release.md', 'assets/templates/release.md']),
+    ],
+  },
+  {
+    id: 'GSE-C03',
+    name: 'Project Bootstrap And Profile',
+    criteria: [
+      criterion('C03-01', 'Project init script exists', 'scripts/init-project.mjs'),
+      criterion('C03-02', 'Project profile reference exists', 'references/project-profile.md'),
+      criterion('C03-03', 'Project bootstrap reference exists', 'references/project-bootstrap.md'),
+      criterion('C03-04', 'Profile discovery script exists', 'scripts/discover-project-profile.mjs'),
+    ],
+  },
+  {
+    id: 'GSE-C04',
+    name: 'Router And Workflow Selection',
+    criteria: [
+      criterion('C04-01', 'Task levels reference exists', 'references/task-levels.md'),
+      criterion('C04-02', 'Dedicated router reference exists', 'references/router.md'),
+      criterion('C04-03', 'Command semantics reference exists', 'references/commands.md'),
+      criterion('C04-04', 'Portable command runner exists', ['scripts/run-gse-command.mjs', 'scripts/audit-command-execution.mjs']),
+      criterion('C04-05', 'Machine-readable state freshness audit exists', 'scripts/audit-state-freshness.mjs'),
+    ],
+  },
+  {
+    id: 'GSE-C05',
+    name: 'Goal And Spec System',
+    criteria: [
+      criterion('C05-01', 'Goal map reference exists', 'references/goal-map.md'),
+      criterion('C05-02', 'Spec workflow reference exists', 'references/spec-workflow.md'),
+      criterion('C05-03', 'Change brief template exists', 'assets/templates/change-brief.md'),
+      criterion('C05-04', 'Spec template exists', 'assets/templates/spec.md'),
+      criterion('C05-05', 'Evidence status taxonomy exists', 'references/evidence-taxonomy.md'),
+      criterion('C05-06', 'Change pack initializer exists', 'scripts/init-change.mjs'),
+      criterion('C05-07', 'Change system audit exists', 'scripts/audit-change-system.mjs'),
+      criterion('C05-08', 'Design/tasks/review templates exist', ['assets/templates/design.md', 'assets/templates/tasks.md', 'assets/templates/review.md']),
+      criterion('C05-09', 'Change close/archive lifecycle exists', ['scripts/close-change.mjs', 'scripts/audit-change-lifecycle.mjs']),
+    ],
+  },
+  {
+    id: 'GSE-C06',
+    name: 'Project Knowledge And Domain Model',
+    criteria: [
+      criterion('C06-01', 'Project profile reference exists', 'references/project-profile.md'),
+      criterion('C06-02', 'ADR template exists', 'assets/templates/adr.md'),
+      criterion('C06-03', 'Domain model reference exists', 'references/domain-model.md'),
+    ],
+  },
+  {
+    id: 'GSE-C07',
+    name: 'Tool And Adapter Layer',
+    criteria: [
+      criterion('C07-01', 'Tool adapters reference exists', 'references/tool-adapters.md'),
+      criterion('C07-02', 'Project agent workspace reference exists', 'references/project-agent-workspace.md'),
+      criterion('C07-03', 'Host adapter templates exist', ['assets/templates/host-adapter.md', 'references/host-adapters.md']),
+      criterion('C07-04', 'Model routing reference exists', 'references/model-routing.md'),
+    ],
+  },
+  {
+    id: 'GSE-C08',
+    name: 'Multi-Agent And Role Execution',
+    criteria: [
+      criterion('C08-01', 'Agent roles reference exists', 'references/agent-roles.md'),
+      criterion('C08-02', 'Dispatch template exists', 'assets/templates/dispatch-packet.md'),
+      criterion('C08-03', 'File ownership rules exist', 'references/file-ownership.md'),
+      criterion('C08-04', 'Forward-test protocol exists', 'references/forward-test.md'),
+    ],
+  },
+  {
+    id: 'GSE-C09',
+    name: 'Implementation Discipline',
+    criteria: [
+      criterion('C09-01', 'Operating model exists', 'references/operating-model.md'),
+      criterion('C09-02', 'Quality gates exist', 'references/quality-gates.md'),
+      criterion('C09-03', 'Dirty worktree or ownership policy exists', ['references/dirty-worktree.md', 'references/file-ownership.md']),
+      criterion('C09-04', 'Execution quality pack template exists', 'assets/templates/execution-quality-pack.md'),
+    ],
+  },
+  {
+    id: 'GSE-C10',
+    name: 'Verification And Evidence Gate',
+    criteria: [
+      criterion('C10-01', 'Evidence template exists', 'assets/templates/evidence.md'),
+      criterion('C10-02', 'Quality gates reference exists', 'references/quality-gates.md'),
+      criterion('C10-03', 'Evidence taxonomy exists', 'references/evidence-taxonomy.md'),
+      criterion('C10-04', 'Audit script exists', 'scripts/audit-gse.mjs'),
+      criterion('C10-05', 'Validation profile runner exists', ['scripts/run-validation-profile.mjs', 'scripts/audit-validation-profiles.mjs']),
+    ],
+  },
+  {
+    id: 'GSE-C11',
+    name: 'Review, Quality, And Architecture Health',
+    criteria: [
+      criterion('C11-01', 'Quality gates reference exists', 'references/quality-gates.md'),
+      criterion('C11-02', 'Review reference exists', 'references/review.md'),
+      criterion('C11-03', 'Architecture health reference exists', 'references/architecture-health.md'),
+    ],
+  },
+  {
+    id: 'GSE-C12',
+    name: 'Release, Incident, And Recovery',
+    criteria: [
+      criterion('C12-01', 'Incident review template exists', 'assets/templates/incident-review.md'),
+      criterion('C12-02', 'Release reference or template exists', ['references/release.md', 'assets/templates/release.md', '.gse/release.md']),
+      criterion('C12-03', 'Recovery or handoff protocol exists', ['references/recovery.md', 'references/handoff.md']),
+      criterion('C12-04', 'Release trust and key custody policy exists', ['references/release-trust.md', 'assets/templates/release-trust-record.md', 'scripts/audit-release-trust.mjs']),
+    ],
+  },
+  {
+    id: 'GSE-C13',
+    name: 'Learning And Memory',
+    criteria: [
+      criterion('C13-01', 'Learning system reference exists', 'references/learning-system.md'),
+      criterion('C13-02', 'Learning promotion rules exist', ['references/learning-system.md']),
+      criterion('C13-03', 'Drift audit exists', 'references/drift-audit.md'),
+      criterion('C13-04', 'Learning capture command exists', ['scripts/record-learning.mjs', 'scripts/audit-learning-system.mjs']),
+    ],
+  },
+  {
+    id: 'GSE-C14',
+    name: 'Packaging, Distribution, And Maintenance',
+    criteria: [
+      criterion('C14-01', 'Validation script exists', ['scripts/audit-gse.mjs', 'scripts/validate-gse.mjs']),
+      criterion('C14-02', 'Compatibility matrix exists', ['references/compatibility.md', '.gse/gse-design-master-plan.md']),
+      criterion('C14-03', 'Example fixtures exist', ['examples', 'fixtures', 'assets/examples']),
+      criterion('C14-04', 'Release notes or changelog policy exists', ['CHANGELOG.md', 'references/release.md']),
+      criterion('C14-05', 'Command semantics audit exists', 'scripts/audit-commands.mjs'),
+      criterion('C14-06', 'README docs audit exists', 'scripts/audit-readme-docs.mjs'),
+      criterion('C14-07', 'Local package and install scripts exist', ['scripts/package-gse.mjs', 'scripts/install-gse.mjs']),
+      criterion('C14-08', 'Distribution audit exists', 'scripts/audit-distribution.mjs'),
+      criterion('C14-09', 'Host command adapter scripts exist', ['scripts/generate-command-adapter.mjs', 'scripts/audit-command-adapters.mjs']),
+      criterion('C14-10', 'Remote URL distribution and integrity audit exists', 'scripts/audit-remote-distribution.mjs'),
+      criterion('C14-11', 'Package signing and verification scripts exist', ['scripts/sign-gse-package.mjs', 'scripts/verify-gse-package.mjs', 'scripts/audit-signing.mjs']),
+      criterion('C14-12', 'Marketplace discovery metadata exists', ['assets/marketplace/gse-listing.json', 'references/marketplace-discovery.md', 'scripts/audit-marketplace-discovery.mjs']),
+      criterion('C14-13', 'Host UI invocation evidence audit exists', ['assets/templates/host-ui-invocation-record.md', 'scripts/audit-host-ui-invocation.mjs']),
+      criterion('C14-14', 'Right-sized validation profile entrypoints exist', ['scripts/run-validation-profile.mjs', 'scripts/audit-validation-profiles.mjs']),
+      criterion('C14-15', 'Open-source defaults audit exists', ['references/open-source-defaults.md', 'scripts/audit-open-source-defaults.mjs', 'LICENSE']),
+      criterion('C14-16', 'Community support channel boundaries exist', ['references/community-channels.md', 'SUPPORT.md']),
+      criterion('C14-17', 'Node package metadata and npm pack audit exist', ['package.json', 'scripts/audit-npm-package-metadata.mjs']),
+      criterion('C14-18', 'Node package tarball install audit exists', 'scripts/audit-npm-tarball-install.mjs'),
+    ],
+  },
+]
+
+function summarizeArea(area) {
+  const present = area.criteria.filter((item) => item.status === 'present').length
+  const total = area.criteria.length
+  const score = total === 0 ? 0 : present / total
+  let status = 'missing'
+  if (score === 1) status = 'strong'
+  else if (score >= 0.67) status = 'usable'
+  else if (score > 0) status = 'thin'
+  return { ...area, present, total, score: Number(score.toFixed(2)), status }
+}
+
+const areas = capabilityAreas.map(summarizeArea)
+const totals = areas.reduce(
+  (acc, area) => {
+    acc.present += area.present
+    acc.total += area.total
+    acc[area.status] += 1
+    return acc
+  },
+  { present: 0, total: 0, strong: 0, usable: 0, thin: 0, missing: 0 },
+)
+
+const summary = {
+  root,
+  generatedAt: new Date().toISOString(),
+  totals: {
+    ...totals,
+    score: totals.total === 0 ? 0 : Number((totals.present / totals.total).toFixed(2)),
+  },
+  areas,
+}
+
+function renderMarkdown(report) {
+  const lines = []
+  lines.push('# GSE Self-Audit')
+  lines.push('')
+  lines.push(`Generated: ${report.generatedAt}`)
+  lines.push(`Root: ${report.root}`)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push(`- Criteria present: ${report.totals.present}/${report.totals.total}`)
+  lines.push(`- Score: ${report.totals.score}`)
+  lines.push(`- Areas: strong ${report.totals.strong}, usable ${report.totals.usable}, thin ${report.totals.thin}, missing ${report.totals.missing}`)
+  lines.push('')
+  lines.push('## Areas')
+  lines.push('')
+  for (const area of report.areas) {
+    lines.push(`### ${area.id} - ${area.name}`)
+    lines.push('')
+    lines.push(`Status: ${area.status} (${area.present}/${area.total}, score ${area.score})`)
+    lines.push('')
+    for (const item of area.criteria) {
+      const marker = item.status === 'present' ? '[x]' : '[ ]'
+      const required = Array.isArray(item.required) ? item.required.join(' or ') : item.required
+      const note = item.note ? ` - ${item.note}` : ''
+      lines.push(`- ${marker} ${item.id}: ${item.label} (${required})${note}`)
+    }
+    lines.push('')
+  }
+  return `${lines.join('\n')}\n`
+}
+
+if (out) {
+  fs.mkdirSync(path.dirname(path.resolve(out)), { recursive: true })
+  fs.writeFileSync(path.resolve(out), renderMarkdown(summary), 'utf8')
+}
+
+if (jsonOnly || !out) {
+  console.log(JSON.stringify(summary, null, 2))
+} else {
+  console.log(`Wrote ${path.resolve(out)}`)
+}

package/scripts/audit-host-adapters.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const keepTemp = args.includes('--keep-temp')
+const tempRootArg = readArg('--temp-root', null)
+const tempRoot = tempRootArg ? path.resolve(tempRootArg) : fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-adapter-audit-'))
+const target = path.join(tempRoot, 'project')
+const generator = path.join(root, 'scripts', 'generate-host-adapter.mjs')
+
+function runNode(script, commandArgs) {
+  return spawnSync(process.execPath, [script, ...commandArgs], { cwd: root, encoding: 'utf8', windowsHide: true })
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function read(relativePath) {
+  const fullPath = path.join(target, relativePath)
+  if (!fs.existsSync(fullPath)) return ''
+  return fs.readFileSync(fullPath, 'utf8')
+}
+
+fs.rmSync(target, { recursive: true, force: true })
+fs.mkdirSync(path.join(target, '.gse'), { recursive: true })
+fs.writeFileSync(path.join(target, '.gse', 'project-profile.md'), '# Project Profile\n', 'utf8')
+fs.writeFileSync(path.join(target, '.gse', 'goal-map.md'), '# Goal Map\nSECRET_GOAL_COPY_SENTINEL\n', 'utf8')
+fs.writeFileSync(path.join(target, '.gse', 'quality-gates.md'), '# Quality Gates\nSECRET_GATE_COPY_SENTINEL\n', 'utf8')
+
+const first = runNode(generator, ['--target', target, '--host', 'all', '--json'])
+const firstJson = parseJson(first.stdout)
+const codexText = read(path.join('.codex', 'gse-adapter.md'))
+const claudeText = read(path.join('.claude', 'gse-adapter.md'))
+const second = runNode(generator, ['--target', target, '--host', 'all', '--json'])
+const secondJson = parseJson(second.stdout)
+const beforeForce = codexText
+const force = runNode(generator, ['--target', target, '--host', 'codex', '--force', '--json'])
+const forceJson = parseJson(force.stdout)
+const afterForce = read(path.join('.codex', 'gse-adapter.md'))
+
+const adapterTexts = [codexText, claudeText, afterForce]
+const checks = [
+  check('H01', 'generator exists', fs.existsSync(generator), 'scripts/generate-host-adapter.mjs'),
+  check('H02', 'first run writes Codex and Claude adapters', first.status === 0 && firstJson?.results?.filter((item) => item.status === 'written').length === 2, 'first run written count'),
+  check('H03', 'adapters point to .gse source of truth', codexText.includes('Source of truth: `.gse/`.') && claudeText.includes('Source of truth: `.gse/`.'), '.codex and .claude adapter text'),
+  check('H04', 'adapters include status vocabulary', adapterTexts.every((text) => text.includes('`verified`, `documented`, `unknown`, `unavailable`')), 'status vocabulary'),
+  check('H05', 'adapters do not copy portable goal map or quality gates', !adapterTexts.some((text) => text.includes('SECRET_GOAL_COPY_SENTINEL') || text.includes('SECRET_GATE_COPY_SENTINEL')), 'sentinel text absent'),
+  check('H06', 'second run skips existing adapters without force', second.status === 0 && secondJson?.results?.every((item) => item.status === 'skipped'), 'second run skipped'),
+  check('H07', 'force run explicitly rewrites selected adapter', force.status === 0 && forceJson?.results?.[0]?.status === 'written' && afterForce === beforeForce, 'force rewrite stable content'),
+  check('H08', 'unsupported host fails clearly', runNode(generator, ['--target', target, '--host', 'unsupported']).status === 1, 'unsupported host exit 1'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  target,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { hostAdapterGeneration: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'Host adapter audit verifies generated pointer files, not host runtime capabilities.',
+    'Codex and Claude adapter shapes are covered; other host families remain compatibility-matrix guidance until project evidence exists.',
+    'Generated adapters intentionally point back to .gse/ instead of copying portable policy.',
+  ],
+  checks,
+}
+
+if (!keepTemp) fs.rmSync(tempRoot, { recursive: true, force: true })
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Host Adapter Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Temp root: ' + data.tempRoot)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Host adapter generation: ' + data.workflows.hostAdapterGeneration)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)