@t275005746/gse 0.1.0

package/scripts/audit-npm-publish-dry-run.mjs

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function readJson(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  if (!fs.existsSync(fullPath)) return null
+  try {
+    return JSON.parse(fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    return null
+  }
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function npm(commandArgs) {
+  return process.platform === 'win32'
+    ? run('cmd', ['/c', 'npm', ...commandArgs])
+    : run('npm', commandArgs)
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const pkg = readJson('package.json')
+const publishRun = npm(['publish', '--dry-run', '--json'])
+const publishData = parseJson(publishRun.stdout)
+const publishFiles = new Set((publishData?.files ?? []).map((item) => item.path))
+const harmfulWarnings = [
+  /auto-corrected some errors/i,
+  /errors corrected/i,
+  /invalid and removed/i,
+  /empty "bin" was removed/i,
+  /bin\[.*\].*removed/i,
+]
+const allowedWarnings = [
+  /requires you to be logged in/i,
+  /Publishing to .* \(dry-run\)/i,
+]
+const warningLines = publishRun.stderr
+  .split(/\r?\n/)
+  .map((line) => line.trim())
+  .filter(Boolean)
+const unexpectedWarningLines = warningLines.filter((line) => {
+  if (!/^npm (warn|notice)\b/i.test(line)) return false
+  if (harmfulWarnings.some((pattern) => pattern.test(line))) return true
+  return !allowedWarnings.some((pattern) => pattern.test(line))
+})
+
+const requiredPublishFiles = [
+  'package.json',
+  'SKILL.md',
+  'README.md',
+  'README.zh-CN.md',
+  'LICENSE',
+  'scripts/gse.mjs',
+  'scripts/validate-gse.mjs',
+  'scripts/audit-npm-publish-dry-run.mjs',
+  'references/commands.md',
+  'references/packaging.md',
+]
+
+const checks = [
+  check('NPD01', 'npm publish dry-run command succeeds', publishRun.status === 0 && Boolean(publishData), publishRun.command, publishRun.stderr),
+  check('NPD02', 'publish dry-run targets the expected package identity', publishData?.name === pkg?.name && publishData?.version === pkg?.version && publishData?.id === `${pkg?.name}@${pkg?.version}`, publishData ? `${publishData.id}` : 'missing publish dry-run JSON'),
+  check('NPD03', 'publish dry-run preserves CLI package metadata before publication', pkg?.bin?.gse === 'scripts/gse.mjs' && fs.existsSync(path.join(root, 'scripts', 'gse.mjs')), 'bin.gse=' + (pkg?.bin?.gse ?? 'missing')),
+  check('NPD04', 'publish dry-run includes required runtime files', requiredPublishFiles.every((item) => publishFiles.has(item)), requiredPublishFiles.filter((item) => !publishFiles.has(item)).join(', ') || 'all required publish files present'),
+  check('NPD05', 'publish dry-run reports tarball integrity fields', typeof publishData?.shasum === 'string' && typeof publishData?.integrity === 'string' && publishData.integrity.startsWith('sha512-'), 'shasum and integrity'),
+  check('NPD06', 'publish dry-run does not auto-correct or remove package metadata', unexpectedWarningLines.length === 0, unexpectedWarningLines.join(' | ') || 'no harmful npm warnings'),
+  check('NPD07', 'package still does not claim actual registry publication', !pkg?.publishConfig && !pkg?.repository, 'no publishConfig or repository claim until public repo/channel evidence exists'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    npmPublishDryRun: failed === 0 ? 'verified' : 'failed',
+    registryPublication: 'not-published',
+  },
+  publish: publishData
+    ? {
+        id: publishData.id,
+        name: publishData.name,
+        version: publishData.version,
+        filename: publishData.filename,
+        size: publishData.size,
+        unpackedSize: publishData.unpackedSize,
+        fileCount: publishData.files?.length ?? 0,
+        integrity: publishData.integrity,
+      }
+    : null,
+  warnings: warningLines,
+  commands: [publishRun.command],
+  limits: [
+    'This audit verifies npm publish dry-run metadata only.',
+    'It does not publish GSE, reserve the package name, prove npm ownership, or create public registry evidence.',
+    'The npm login warning is allowed for dry-run; metadata auto-correction warnings are not allowed.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE npm Publish Dry-Run Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- npm publish dry-run: ' + data.workflows.npmPublishDryRun)
+  lines.push('- Registry publication: ' + data.workflows.registryPublication)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-npm-tarball-install.mjs

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const keepTemp = args.includes('--keep-temp')
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    cwd,
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function npm(commandArgs, cwd = root) {
+  return process.platform === 'win32'
+    ? run('cmd', ['/c', 'npm', ...commandArgs], cwd)
+    : run('npm', commandArgs, cwd)
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function exists(filePath) {
+  return fs.existsSync(filePath)
+}
+
+function safeReadJson(filePath) {
+  if (!exists(filePath)) return null
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    return null
+  }
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-npm-tarball-'))
+const consumerRoot = path.join(tempRoot, 'consumer')
+fs.mkdirSync(consumerRoot, { recursive: true })
+fs.writeFileSync(
+  path.join(consumerRoot, 'package.json'),
+  JSON.stringify({ name: 'gse-npm-tarball-consumer', version: '0.0.0', private: true }, null, 2) + '\n',
+  'utf8',
+)
+
+const packRun = npm(['pack', '--json', '--pack-destination', tempRoot])
+const packData = parseJson(packRun.stdout)
+const packItem = Array.isArray(packData) ? packData[0] : null
+const tarballPath = packItem?.filename ? path.join(tempRoot, packItem.filename) : null
+const installRun = tarballPath
+  ? npm(['install', tarballPath, '--ignore-scripts', '--no-audit', '--no-fund'], consumerRoot)
+  : { command: 'npm install skipped; tarball not created', cwd: consumerRoot, status: 1, stdout: '', stderr: 'tarball not created' }
+const installedRoot = path.join(consumerRoot, 'node_modules', '@t275005746', 'gse')
+const installedPkg = safeReadJson(path.join(installedRoot, 'package.json'))
+const binPath = process.platform === 'win32'
+  ? path.join(consumerRoot, 'node_modules', '.bin', 'gse.cmd')
+  : path.join(consumerRoot, 'node_modules', '.bin', 'gse')
+const binRun = exists(binPath)
+  ? process.platform === 'win32'
+    ? run('cmd', ['/c', binPath, 'status', '--target', installedRoot, '--json'], consumerRoot)
+    : run(binPath, ['status', '--target', installedRoot, '--json'], consumerRoot)
+  : { command: binPath + ' status --target ' + installedRoot + ' --json', cwd: consumerRoot, status: 1, stdout: '', stderr: 'bin missing' }
+const binData = parseJson(binRun.stdout)
+const readmeAudit = exists(path.join(installedRoot, 'scripts', 'audit-readme-docs.mjs'))
+  ? run(process.execPath, [path.join(installedRoot, 'scripts', 'audit-readme-docs.mjs'), '--root', installedRoot, '--json'], consumerRoot)
+  : { command: 'installed README audit skipped; script missing', cwd: consumerRoot, status: 1, stdout: '', stderr: 'script missing' }
+const readmeData = parseJson(readmeAudit.stdout)
+const tarballFiles = new Set((packItem?.files ?? []).map((item) => item.path))
+const requiredTarballFiles = [
+  'package.json',
+  'SKILL.md',
+  'README.md',
+  'README.zh-CN.md',
+  'LICENSE',
+  'scripts/gse.mjs',
+  'scripts/audit-readme-docs.mjs',
+  'scripts/validate-gse.mjs',
+  'references/commands.md',
+  'references/packaging.md',
+]
+
+const checks = [
+  check('NTI01', 'npm pack creates one tarball', packRun.status === 0 && Boolean(tarballPath) && exists(tarballPath), packRun.command, packRun.stderr),
+  check('NTI02', 'tarball file list includes required runtime files', requiredTarballFiles.every((item) => tarballFiles.has(item)), requiredTarballFiles.filter((item) => !tarballFiles.has(item)).join(', ') || 'all required files present'),
+  check('NTI03', 'tarball installs into a clean consumer project', installRun.status === 0 && exists(installedRoot), installRun.command, installRun.stderr),
+  check('NTI04', 'installed package metadata is intact', installedPkg?.name === '@t275005746/gse' && installedPkg?.bin?.gse === 'scripts/gse.mjs', 'installed package.json'),
+  check('NTI05', 'installed package exposes gse bin shim', exists(binPath), binPath),
+  check('NTI06', 'installed gse bin runs status command', binRun.status === 0 && binData?.command === '/gse status' && binData?.project?.stateValid === true, binRun.command, binRun.stderr),
+  check('NTI07', 'installed README audit passes', readmeAudit.status === 0 && readmeData?.summary?.failed === 0, readmeAudit.command, readmeAudit.stderr),
+  check('NTI08', 'package metadata does not claim public registry publication', !installedPkg?.publishConfig && !installedPkg?.repository, 'no publishConfig or repository claim'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  consumerRoot,
+  tarballPath,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    npmTarballPack: packRun.status === 0 ? 'verified' : 'failed',
+    npmTarballInstall: installRun.status === 0 ? 'verified' : 'failed',
+    installedBin: binRun.status === 0 ? 'verified' : 'failed',
+  },
+  package: installedPkg
+    ? {
+        name: installedPkg.name,
+        version: installedPkg.version,
+        bin: installedPkg.bin,
+        license: installedPkg.license,
+      }
+    : null,
+  commands: [packRun.command, installRun.command, binRun.command, readmeAudit.command],
+  limits: [
+    'This audit verifies local npm tarball creation and installation into a clean consumer project.',
+    'It does not publish GSE to npm, reserve a package name, prove public repository settings, or prove marketplace approval.',
+  ],
+  checks,
+}
+
+if (!keepTemp) {
+  try {
+    fs.rmSync(tempRoot, { recursive: true, force: true })
+  } catch {
+    report.cleanupWarning = 'failed to remove temp root: ' + tempRoot
+  }
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE npm Tarball Install Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Temp root: ' + data.tempRoot)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- npm tarball pack: ' + data.workflows.npmTarballPack)
+  lines.push('- npm tarball install: ' + data.workflows.npmTarballInstall)
+  lines.push('- installed bin: ' + data.workflows.installedBin)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-open-source-defaults.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const license = read('LICENSE')
+const defaults = read('references/open-source-defaults.md')
+const publicRelease = read('references/public-release.md')
+const skill = read('SKILL.md')
+const releaseRecord = read('.gse/releases/public-release-owner-required.md')
+
+const checks = [
+  check('OSD01', 'MIT license file exists', exists('LICENSE') && license.includes('MIT License') && license.includes('GSE contributors'), 'LICENSE'),
+  check('OSD02', 'open-source defaults reference exists', exists('references/open-source-defaults.md'), 'references/open-source-defaults.md'),
+  check('OSD03', 'defaults align with mainstream public release path', ['License: MIT', 'public GitHub repository', 'GitHub Actions', 'SECURITY.md', 'GitHub Release', 'portable `/gse ...` commands'].every((term) => defaults.includes(term)), 'references/open-source-defaults.md'),
+  check('OSD04', 'defaults preserve external evidence boundaries', ['public CI', 'public security contact', 'public publication', 'native slash commands'].every((term) => defaults.includes(term)), 'references/open-source-defaults.md'),
+  check('OSD05', 'public release docs route to defaults', publicRelease.includes('references/open-source-defaults.md') && publicRelease.includes('owner-approved mainstream open-source default is MIT'), 'references/public-release.md'),
+  check('OSD06', 'skill routes open-source defaults reference', skill.includes('references/open-source-defaults.md'), 'SKILL.md'),
+  check('OSD07', 'owner license decision is accepted as MIT', releaseRecord.includes('License status: selected') && releaseRecord.includes('SPDX identifier: MIT') && releaseRecord.includes('License file: LICENSE') && releaseRecord.includes('Evidence status: accepted'), '.gse/releases/public-release-owner-required.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    openSourceDefaults: failed === 0 ? 'verified' : 'failed',
+    licenseDecision: failed === 0 ? 'accepted' : 'unknown',
+  },
+  limits: [
+    'This audit verifies the owner-approved default route and MIT license record.',
+    'It does not prove public repository settings, public CI, registry publication, marketplace approval, or native host runtime invocation.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Open-Source Defaults Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Open-source defaults: ' + data.workflows.openSourceDefaults)
+  lines.push('- License decision: ' + data.workflows.licenseDecision)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-open-source-readiness.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const contributing = read('CONTRIBUTING.md')
+const security = read('SECURITY.md')
+const support = read('SUPPORT.md')
+const readme = read('README.md')
+const readmeZh = read('README.zh-CN.md')
+const communityChannels = read('references/community-channels.md')
+const publicRelease = read('references/public-release.md')
+const packaging = read('references/packaging.md')
+const validate = read('scripts/validate-gse.mjs')
+const changelog = read('CHANGELOG.md')
+const ciWorkflow = read('.github/workflows/validate-gse.yml')
+const prTemplate = read('.github/PULL_REQUEST_TEMPLATE.md')
+
+const checks = [
+  check('OS01', 'contributing guide exists', exists('CONTRIBUTING.md') && contributing.includes('Validation') && contributing.includes('Evidence') && contributing.includes('Do not claim support'), 'CONTRIBUTING.md'),
+  check('OS02', 'security policy exists without fake public contact', exists('SECURITY.md') && security.includes('Until a public security contact is chosen') && security.includes('release trust') && security.includes('No public vulnerability disclosure address has been owner-approved yet'), 'SECURITY.md'),
+  check('OS03', 'support guide exists with first diagnostic commands and community entry', exists('SUPPORT.md') && support.includes('validate-gse.mjs') && support.includes('audit-target-project.mjs') && support.includes('GateHub (`https://gatehub.top/`)'), 'SUPPORT.md'),
+  check('OS04', 'open-source readiness keeps license owner-gated', publicRelease.includes('GSE must not choose a license by guessing') && changelog.includes('Open-source license selection remains an owner decision'), 'references/public-release.md, CHANGELOG.md'),
+  check('OS05', 'package boundary includes open-source docs', packaging.includes('CONTRIBUTING.md') && packaging.includes('SECURITY.md') && packaging.includes('SUPPORT.md'), 'references/packaging.md'),
+  check('OS06', 'validator includes open-source readiness audit', validate.includes('audit-open-source-readiness.mjs'), 'scripts/validate-gse.mjs'),
+  check('OS07', 'public repository CI workflow is present and audited', ciWorkflow.includes('node scripts/validate-gse.mjs --root . --skip-skill-validator --json') && validate.includes('audit-ci-readiness.mjs'), '.github/workflows/validate-gse.yml, scripts/validate-gse.mjs'),
+  check('OS08', 'public collaboration templates require GSE evidence fields', prTemplate.includes('## Outcome') && prTemplate.includes('## Evidence') && validate.includes('audit-public-collaboration-templates.mjs'), '.github/PULL_REQUEST_TEMPLATE.md, scripts/validate-gse.mjs'),
+  check('OS09', 'community support channel is documented with release boundaries', exists('references/community-channels.md') && readme.includes('GateHub ([gatehub.top](https://gatehub.top/))') && readmeZh.includes('GateHub（[gatehub.top](https://gatehub.top/)）') && support.includes('GateHub (`https://gatehub.top/`)') && publicRelease.includes('references/community-channels.md') && communityChannels.includes('Do not describe GateHub as') && communityChannels.includes('vulnerability disclosure channel'), 'README.md, README.zh-CN.md, SUPPORT.md, references/community-channels.md, references/public-release.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { openSourceReadiness: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies repository collaboration, security, and support documents.',
+    'It does not choose a license, create a public security address, publish to GitHub, or approve a marketplace listing.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Open Source Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Open source readiness: ' + data.workflows.openSourceReadiness)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)