@t275005746/gse 0.1.0

package/scripts/audit-host-runtime-evidence-handoff.mjs

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const generator = read('scripts/generate-host-runtime-evidence-handoff.mjs')
+const validate = read('scripts/validate-gse.mjs')
+const skill = read('SKILL.md')
+const releaseGenerator = read('scripts/generate-release-bundle.mjs')
+const releaseAudit = read('scripts/audit-release-bundle.mjs')
+const compatibility = read('references/compatibility.md')
+const tmp = mkdtempSync(path.join(tmpdir(), 'gse-host-runtime-handoff-'))
+const out = path.join(tmp, 'host-runtime-evidence-handoff.md')
+const generated = exists('scripts/generate-host-runtime-evidence-handoff.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'generate-host-runtime-evidence-handoff.mjs'), '--root', root, '--out', out, '--force', '--json'])
+  : null
+const generatedData = generated ? parseJson(generated.stdout) : null
+const handoff = fs.existsSync(out) ? fs.readFileSync(out, 'utf8') : ''
+rmSync(tmp, { recursive: true, force: true })
+
+const hostFamilies = [
+  'Codex-style',
+  'Claude Code-style',
+  'Hermes/AION-style runtime',
+  'WorkBuddy/other IDE agents',
+  'Copilot/Gemini-style assistants',
+  'Unknown or custom host',
+]
+const boundaries = [
+  'Do not claim native slash-command support',
+  'Do not claim a host is supported without a host runtime invocation record',
+  'subagents, MCP, LSP, browser tools, hooks, and plugins as host/session-specific',
+]
+const commands = [
+  'record-host-invocation.mjs',
+  'audit-host-runtime-invocations.mjs',
+  'audit-final-readiness.mjs',
+  'validate-gse.mjs',
+]
+const handoffUsesShellSafeCommandPlaceholders = !/record-host-invocation\.mjs[^\n`]*[<>]/.test(handoff) &&
+  !/audit-[a-z-]+\.mjs[^\n`]*[<>]/.test(handoff) &&
+  !/validate-gse\.mjs[^\n`]*[<>]/.test(handoff) &&
+  handoff.includes('__GSE_OR_PROJECT__') &&
+  handoff.includes('__PROJECT_OR_GSE__')
+
+const checks = [
+  check('HRH01', 'host runtime evidence handoff generator exists', exists('scripts/generate-host-runtime-evidence-handoff.mjs'), 'scripts/generate-host-runtime-evidence-handoff.mjs'),
+  check('HRH02', 'generator uses runtime audit and compatibility matrix', generator.includes('audit-host-runtime-invocations.mjs') && generator.includes('references/compatibility.md'), 'generator inputs'),
+  check('HRH03', 'generator produces a handoff file', generated?.status === 0 && generatedData?.status === 'written' && handoff.length > 0, generated?.stderr || out),
+  check('HRH04', 'handoff covers core host families', hostFamilies.every((term) => handoff.includes(term)), hostFamilies.join(', ')),
+  check('HRH04b', 'handoff limits host evidence plan to host matrix rows', generatedData?.summary?.hostFamilies === hostFamilies.length, `${generatedData?.summary?.hostFamilies ?? 'unknown'} generated host family row(s)`),
+  check('HRH05', 'handoff includes executable record and verification commands', commands.every((term) => handoff.includes(term)), commands.join(', ')),
+  check('HRH06', 'handoff preserves anti-overclaim boundaries', boundaries.every((term) => handoff.includes(term)), boundaries.join(', ')),
+  check('HRH07', 'handoff reports current native and portable runtime evidence counts', handoff.includes('Native slash-command records:') && handoff.includes('Portable text-command records:'), 'current runtime evidence summary'),
+  check('HRH08', 'skill routes users to host runtime evidence handoff', skill.includes('generate-host-runtime-evidence-handoff.mjs'), 'SKILL.md'),
+  check('HRH09', 'consolidated validator includes host runtime handoff audit', validate.includes('audit-host-runtime-evidence-handoff.mjs'), 'scripts/validate-gse.mjs'),
+  check('HRH10', 'release bundle includes host runtime evidence handoff', releaseGenerator.includes('host-runtime-evidence-handoff.md') && releaseAudit.includes('host-runtime-evidence-handoff.md'), 'release bundle generator and audit'),
+  check('HRH11', 'compatibility matrix still distinguishes documented and verified host claims', compatibility.includes('Never upgrade a host capability from `documented` to `verified`') && compatibility.includes('Host Matrix'), 'references/compatibility.md'),
+  check('HRH12', 'handoff command placeholders are shell-safe', handoffUsesShellSafeCommandPlaceholders, 'record and verification commands use __PLACEHOLDER__ style, not <placeholder> shell redirection syntax'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    hostRuntimeEvidenceHandoff: failed === 0 ? 'verified' : 'failed',
+    nativeSlashCommandRecords: generatedData?.summary?.nativeSlashCommandRecords ?? 'unknown',
+    portableTextCommandRecords: generatedData?.summary?.portableTextCommandRecords ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies handoff generation and claim boundaries only.',
+    'It does not create real runtime evidence for Claude Code, Hermes/AION-style runtimes, WorkBuddy, or native slash-command execution.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Host Runtime Evidence Handoff Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Host runtime evidence handoff: ' + data.workflows.hostRuntimeEvidenceHandoff)
+  lines.push('- Native slash-command records: ' + data.workflows.nativeSlashCommandRecords)
+  lines.push('- Portable text-command records: ' + data.workflows.portableTextCommandRecords)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-host-runtime-invocation-drill.mjs

@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const keepFixture = args.includes('--keep-fixture')
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-runtime-drill-'))
+const recordsDir = path.join(tempRoot, 'host-invocations')
+
+function run(commandArgs) {
+  const result = spawnSync(process.execPath, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [process.execPath, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function record({
+  fileName,
+  host,
+  hostVersion,
+  adapterPath,
+  invocationMethod,
+  command,
+  nativeSlashCommand,
+  portableTextCommand,
+  generatedPointer,
+}) {
+  return run([
+    path.join(root, 'scripts', 'record-host-invocation.mjs'),
+    '--root',
+    root,
+    '--host',
+    host,
+    '--host-version',
+    hostVersion,
+    '--project',
+    'GSE host runtime fixture',
+    '--adapter-path',
+    adapterPath,
+    '--invocation-method',
+    invocationMethod,
+    '--command',
+    command,
+    '--status',
+    'verified',
+    '--evidence-owner',
+    'host runtime invocation drill',
+    '--evidence',
+    'temporary fixture record; not real host runtime evidence',
+    '--files-read',
+    '.gse/README.md,.gse/project-profile.md,.gse/state.json,.gse/goal-map.md,.gse/quality-gates.md',
+    '--verification-command',
+    'node scripts/audit-host-runtime-invocations.mjs --records-dir <fixture>',
+    '--native-slash-command',
+    nativeSlashCommand,
+    '--portable-text-command',
+    portableTextCommand,
+    '--generated-pointer',
+    generatedPointer,
+    '--owner-acceptance-required',
+    'false',
+    '--residual-risk',
+    'Fixture proof only; real host runtime invocation still requires persistent project evidence.',
+    '--out',
+    path.join(recordsDir, fileName),
+    '--json',
+  ])
+}
+
+const records = [
+  record({
+    fileName: 'claude-native-fixture.md',
+    host: 'Claude Code-style',
+    hostVersion: 'fixture',
+    adapterPath: '.claude/commands/gse.md',
+    invocationMethod: 'native slash-command fixture',
+    command: '/gse continue',
+    nativeSlashCommand: 'true',
+    portableTextCommand: 'false',
+    generatedPointer: 'false',
+  }),
+  record({
+    fileName: 'codex-portable-fixture.md',
+    host: 'Codex-style',
+    hostVersion: 'fixture',
+    adapterPath: '.codex/gse-command.md',
+    invocationMethod: 'portable text command fixture',
+    command: '/gse help',
+    nativeSlashCommand: 'false',
+    portableTextCommand: 'true',
+    generatedPointer: 'true',
+  }),
+  record({
+    fileName: 'hermes-runtime-fixture.md',
+    host: 'Hermes/AION-style runtime',
+    hostVersion: 'fixture',
+    adapterPath: '.gse/host-adapters/hermes-runtime.md',
+    invocationMethod: 'runtime bridge text-command fixture',
+    command: '/gse continue AION',
+    nativeSlashCommand: 'false',
+    portableTextCommand: 'true',
+    generatedPointer: 'true',
+  }),
+  record({
+    fileName: 'workbuddy-fixture.md',
+    host: 'WorkBuddy/other IDE agents',
+    hostVersion: 'fixture',
+    adapterPath: '.gse/host-adapters/workbuddy.md',
+    invocationMethod: 'IDE command-palette text-command fixture',
+    command: '/gse continue',
+    nativeSlashCommand: 'false',
+    portableTextCommand: 'true',
+    generatedPointer: 'true',
+  }),
+  record({
+    fileName: 'generic-agent-fixture.md',
+    host: 'Unknown or custom host',
+    hostVersion: 'fixture',
+    adapterPath: '.gse/host-adapters/generic-agent.md',
+    invocationMethod: 'generic natural-language command fixture',
+    command: 'gse continue',
+    nativeSlashCommand: 'false',
+    portableTextCommand: 'true',
+    generatedPointer: 'true',
+  }),
+]
+
+const audit = run([
+  path.join(root, 'scripts', 'audit-host-runtime-invocations.mjs'),
+  '--root',
+  root,
+  '--records-dir',
+  recordsDir,
+  '--json',
+])
+const auditData = parseJson(audit.stdout)
+const recordData = records.map((item) => parseJson(item.stdout))
+const recordWrites = recordData.filter((item) => item?.status === 'written').length
+const hostSet = new Set(auditData?.inventory?.hosts ?? [])
+const expectedHosts = [
+  'Claude Code-style',
+  'Codex-style',
+  'Hermes/AION-style runtime',
+  'WorkBuddy/other IDE agents',
+  'Unknown or custom host',
+]
+
+const checks = [
+  check('HRD01', 'all fixture host records are written', records.every((item) => item.status === 0) && recordWrites === records.length, `${recordWrites}/${records.length} fixture records`),
+  check('HRD02', 'host runtime invocation audit passes over fixture records', audit.status === 0 && auditData?.summary?.status === 'passed', audit.command),
+  check('HRD03', 'fixture inventory covers expected host families', expectedHosts.every((host) => hostSet.has(host)), expectedHosts.join(', ')),
+  check('HRD04', 'native slash-command evidence stays isolated to the Claude fixture', auditData?.inventory?.nativeSlashCommandRecords === 1, `${auditData?.inventory?.nativeSlashCommandRecords ?? 'unknown'} native record(s)`),
+  check('HRD05', 'portable text-command evidence covers non-native fixtures', auditData?.inventory?.portableTextCommandRecords === 4, `${auditData?.inventory?.portableTextCommandRecords ?? 'unknown'} portable record(s)`),
+  check('HRD06', 'drill evidence is not persisted as real host evidence', !fs.existsSync(path.join(root, '.gse', 'evidence', 'host-invocations', 'claude-native-fixture.md')), 'fixture stays outside persistent evidence directory'),
+]
+
+if (!keepFixture) fs.rmSync(tempRoot, { recursive: true, force: true })
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot: keepFixture ? tempRoot : null,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    hostRuntimeInvocationDrill: failed === 0 ? 'verified' : 'failed',
+    fixtureNativeSlashCommandRecords: auditData?.inventory?.nativeSlashCommandRecords ?? 0,
+    fixturePortableTextCommandRecords: auditData?.inventory?.portableTextCommandRecords ?? 0,
+  },
+  limits: [
+    'This drill uses temporary fixture records only.',
+    'It proves record and audit mechanics across host families, not real host runtime support.',
+    'Real native slash-command or runtime support still requires persistent host invocation records from actual host sessions.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Host Runtime Invocation Drill')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Host runtime invocation drill: ' + data.workflows.hostRuntimeInvocationDrill)
+  lines.push('- Fixture native slash-command records: ' + data.workflows.fixtureNativeSlashCommandRecords)
+  lines.push('- Fixture portable text-command records: ' + data.workflows.fixturePortableTextCommandRecords)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-host-runtime-invocations.mjs

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const recordsDir = path.resolve(readArg('--records-dir', path.join(root, '.gse', 'evidence', 'host-invocations')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePathOrFullPath) {
+  const fullPath = path.isAbsolute(relativePathOrFullPath) ? relativePathOrFullPath : path.join(root, relativePathOrFullPath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function run(commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', 'record-host-invocation.mjs'), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function listRecords(dir) {
+  if (!fs.existsSync(dir)) return []
+  return fs.readdirSync(dir)
+    .filter((item) => item.endsWith('.md'))
+    .map((item) => path.join(dir, item))
+}
+
+function parseRecord(filePath) {
+  const text = read(filePath)
+  const field = (label) => {
+    const prefix = label.endsWith('?') ? '- ' + label + ' ' : '- ' + label + ':'
+    const line = text.split(/\r?\n/).find((item) => item.trimStart().startsWith(prefix))
+    return line ? line.slice(line.indexOf(prefix) + prefix.length).trim() : ''
+  }
+  return {
+    filePath,
+    text,
+    host: field('Host name'),
+    status: field('Status'),
+    nativeSlashCommand: field('Does this prove native slash-command support?'),
+    portableTextCommand: field('Does this prove portable text-command routing only?'),
+    generatedPointer: field('Does this rely on a generated pointer file?'),
+    ownerAcceptanceRequired: field('Does this require owner acceptance before being called trusted?'),
+    verificationCommand: field('Verification command'),
+  }
+}
+
+const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-invocation-audit-'))
+const fixtureOut = path.join(fixture, 'codex-record.md')
+const readyRun = run([
+  '--root',
+  root,
+  '--host',
+  'Codex',
+  '--host-version',
+  'fixture',
+  '--project',
+  'GSE fixture',
+  '--adapter-path',
+  '.codex/gse-command.md',
+  '--invocation-method',
+  'background-thread text command',
+  '--command',
+  '/gse help',
+  '--status',
+  'verified',
+  '--evidence-owner',
+  'fixture audit',
+  '--evidence',
+  'fixture transcript',
+  '--portable-text-command',
+  'true',
+  '--native-slash-command',
+  'false',
+  '--generated-pointer',
+  'true',
+  '--owner-acceptance-required',
+  'false',
+  '--out',
+  fixtureOut,
+  '--json',
+])
+const readyData = parseJson(readyRun.stdout)
+const missingRun = run(['--root', root, '--host', 'Codex', '--dry-run', '--json'])
+const missingData = parseJson(missingRun.stdout)
+const contradictoryRun = run([
+  '--root',
+  root,
+  '--host',
+  'Codex',
+  '--invocation-method',
+  'native slash command',
+  '--status',
+  'accepted',
+  '--evidence-owner',
+  'fixture audit',
+  '--evidence',
+  'fixture transcript',
+  '--native-slash-command',
+  'true',
+  '--portable-text-command',
+  'true',
+  '--generated-pointer',
+  'true',
+  '--owner-acceptance-required',
+  'false',
+  '--dry-run',
+  '--json',
+])
+const contradictoryData = parseJson(contradictoryRun.stdout)
+const acceptedPointerRun = run([
+  '--root',
+  root,
+  '--host',
+  'Generic pointer host',
+  '--invocation-method',
+  'generated pointer',
+  '--status',
+  'accepted',
+  '--evidence-owner',
+  'fixture audit',
+  '--evidence',
+  'fixture transcript',
+  '--verification-command',
+  'node scripts/audit-final-readiness.mjs --root __GSE__ --json',
+  '--native-slash-command',
+  'false',
+  '--portable-text-command',
+  'false',
+  '--generated-pointer',
+  'true',
+  '--owner-acceptance-required',
+  'false',
+  '--dry-run',
+  '--json',
+])
+const acceptedPointerData = parseJson(acceptedPointerRun.stdout)
+
+const records = listRecords(recordsDir).map(parseRecord)
+const closeableRecords = records.filter((record) => ['verified', 'accepted'].includes(record.status))
+const nativeRecords = closeableRecords.filter((record) => record.nativeSlashCommand === 'true')
+const portableRecords = closeableRecords.filter((record) => record.portableTextCommand === 'true')
+const hostNames = [...new Set(closeableRecords.map((record) => record.host).filter(Boolean))]
+const recordsHaveNoContradictoryClaims = records.every((record) => !(record.nativeSlashCommand === 'true' && (record.portableTextCommand === 'true' || record.generatedPointer === 'true')))
+const acceptedRecordsAreSelfVerifying = records.every((record) => record.status !== 'accepted' || (record.ownerAcceptanceRequired === 'false' && Boolean(record.verificationCommand)))
+const acceptedRecordsDoNotRelyOnGeneratedPointers = records.every((record) => record.status !== 'accepted' || record.generatedPointer !== 'true')
+
+const checks = [
+  check('HRI01', 'host invocation record command exists', exists('scripts/record-host-invocation.mjs'), 'scripts/record-host-invocation.mjs'),
+  check('HRI02', 'host invocation record command writes a valid fixture record', readyRun.status === 0 && readyData?.status === 'written' && fs.existsSync(fixtureOut) && read(fixtureOut).includes('Host name: Codex'), 'record-host-invocation fixture write'),
+  check('HRI03', 'host invocation record command rejects missing required fields', missingRun.status !== 0 && missingData?.status === 'failed' && missingData?.errors?.some((item) => item.includes('--invocation-method')) && missingData?.errors?.some((item) => item.includes('--evidence-owner')), 'record-host-invocation missing-fields dry-run'),
+  check('HRI04', 'host invocation template preserves boundaries', read('assets/templates/host-ui-invocation-record.md').includes('Does this prove native slash-command support?') && read('assets/templates/host-ui-invocation-record.md').includes('Does this prove portable text-command routing only?'), 'assets/templates/host-ui-invocation-record.md'),
+  check('HRI05', 'host invocation readiness audit is wired into validator', read('scripts/validate-gse.mjs').includes('audit-host-runtime-invocations.mjs'), 'scripts/validate-gse.mjs'),
+  check('HRI06', 'existing host invocation records, if present, parse with required status fields', records.every((record) => record.host && record.status && record.nativeSlashCommand && record.portableTextCommand), records.length ? `${records.length} record(s)` : 'no persistent records yet'),
+  check('HRI07', 'record command rejects contradictory native and portable claims', contradictoryRun.status !== 0 && contradictoryData?.status === 'failed' && contradictoryData?.errors?.some((item) => item.includes('native slash-command records cannot also claim portable text-command routing')) && contradictoryData?.errors?.some((item) => item.includes('native slash-command records cannot rely on a generated pointer file')), 'record-host-invocation contradictory native/portable dry-run'),
+  check('HRI08', 'persistent host invocation records do not mix native proof with portable or generated-pointer proof', recordsHaveNoContradictoryClaims, records.length ? `${records.length} record(s)` : 'no persistent records yet'),
+  check('HRI09', 'accepted persistent host invocation records carry verification commands and no pending owner acceptance', acceptedRecordsAreSelfVerifying, records.length ? `${records.length} record(s)` : 'no persistent records yet'),
+  check('HRI10', 'accepted host invocation records do not rely on generated pointer proof', acceptedPointerRun.status !== 0 && acceptedPointerData?.status === 'failed' && acceptedPointerData?.errors?.some((item) => item.includes('accepted host invocation records must not rely on a generated pointer file')) && acceptedRecordsDoNotRelyOnGeneratedPointers, records.length ? `${records.length} record(s)` : 'record-host-invocation accepted pointer dry-run'),
+]
+
+fs.rmSync(fixture, { recursive: true, force: true })
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  recordsDir,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    hostRuntimeInvocationRecords: failed === 0 ? 'verified' : 'failed',
+    realHostNativeSlashCommandRecords: nativeRecords.length,
+    realHostPortableTextCommandRecords: portableRecords.length,
+  },
+  inventory: {
+    records: records.length,
+    closeableRecords: closeableRecords.length,
+    hosts: hostNames,
+    nativeSlashCommandRecords: nativeRecords.length,
+    portableTextCommandRecords: portableRecords.length,
+  },
+  limits: [
+    'This audit verifies host invocation record mechanics and parses any persistent records under .gse/evidence/host-invocations.',
+    'It does not create runtime evidence for a host by itself.',
+    'Native slash-command support remains unverified for a host until a persistent verified or accepted record states native slash-command support true.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Host Runtime Invocation Records Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Records: ' + data.inventory.records)
+  lines.push('- Hosts: ' + (data.inventory.hosts.length ? data.inventory.hosts.join(', ') : 'none'))
+  lines.push('- Native slash-command records: ' + data.inventory.nativeSlashCommandRecords)
+  lines.push('- Portable text-command records: ' + data.inventory.portableTextCommandRecords)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)