@t275005746/gse 0.1.0

package/scripts/audit-owner-external-gate-kit.mjs

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const tmp = mkdtempSync(path.join(tmpdir(), 'gse-owner-external-gate-kit-'))
+const out = path.join(tmp, 'kit')
+const generated = exists('scripts/generate-owner-external-gate-kit.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'generate-owner-external-gate-kit.mjs'), '--root', root, '--out', out, '--force', '--json'])
+  : null
+const generatedData = generated ? parseJson(generated.stdout) : null
+
+function readKit(fileName) {
+  const fullPath = path.join(out, fileName)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function readCanonicalKit(fileName) {
+  return read(path.join('.gse', 'acceptance', 'owner-external-gate-kit', fileName))
+}
+
+function stableGateSnapshot(data) {
+  return (data?.gates ?? []).map((gate) => ({
+    stage: gate.stage,
+    area: gate.area,
+    status: gate.status,
+    owner: gate.owner,
+    requiredEvidence: gate.requiredEvidence,
+    recordCommand: gate.recordCommand,
+    preflightCommand: gate.preflightCommand,
+  }))
+}
+
+function sameJson(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b)
+}
+
+const readme = readKit('README.md')
+const actionPacket = readKit('action-packet.md')
+const finalPacket = readKit('final-acceptance-packet.md')
+const publicHandoff = readKit('public-acceptance-handoff.md')
+const hostHandoff = readKit('host-runtime-evidence-handoff.md')
+const releaseStatusManifest = readKit('release-status-manifest.json')
+const releaseOwnerActionPlan = readKit('release-owner-action-plan.md')
+const commands = readKit('record-commands.md')
+const verificationCommands = readKit('verification-commands.md')
+const manifestText = readKit('kit-manifest.json')
+const manifest = parseJson(manifestText)
+const canonicalReadme = readCanonicalKit('README.md')
+const canonicalActionPacket = readCanonicalKit('action-packet.md')
+const canonicalCommands = readCanonicalKit('record-commands.md')
+const canonicalVerificationCommands = readCanonicalKit('verification-commands.md')
+const canonicalManifestText = readCanonicalKit('kit-manifest.json')
+const canonicalManifest = parseJson(canonicalManifestText)
+const requiredKitFiles = [
+  'README.md',
+  'action-packet.md',
+  'final-acceptance-packet.md',
+  'public-acceptance-handoff.md',
+  'host-runtime-evidence-handoff.md',
+  'release-status-manifest.json',
+  'release-owner-action-plan.md',
+  'record-commands.md',
+  'verification-commands.md',
+  'kit-manifest.json',
+]
+const requiredKitFilesPresent = requiredKitFiles.every((item) => readKit(item).length > 0)
+const canonicalRequiredKitFilesPresent = requiredKitFiles.every((item) => readCanonicalKit(item).length > 0)
+rmSync(tmp, { recursive: true, force: true })
+
+const skill = read('SKILL.md')
+const validate = read('scripts/validate-gse.mjs')
+const bundleGenerator = read('scripts/generate-release-bundle.mjs')
+const bundleAudit = read('scripts/audit-release-bundle.mjs')
+const expectedAreas = (manifest?.gates ?? []).map((gate) => gate.area)
+const expectedScripts = [...new Set((manifest?.gates ?? [])
+  .map((gate) => String(gate.recordCommand ?? '').match(/node scripts\/([^ ]+)/)?.[1] ?? '')
+  .filter(Boolean))]
+const kitRecordTemplatesAreComplete = !commands.includes('--invocation-status') &&
+  !finalPacket.includes('--invocation-status') &&
+  !publicHandoff.includes('--invocation-status') &&
+  !releaseOwnerActionPlan.includes('--invocation-status') &&
+  !hostHandoff.includes('--invocation-status') &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(commands) &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(finalPacket) &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(publicHandoff) &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(releaseOwnerActionPlan) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(commands) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(finalPacket) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(publicHandoff) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(releaseOwnerActionPlan) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(hostHandoff) &&
+  commands.includes('--status accepted')
+const kitVerificationCommandsAreShellSafe = !/(audit-[a-z-]+|validate-gse|generate-release-status-manifest)\.mjs[^\n`]*[<>]/.test(verificationCommands) &&
+  !/(audit-[a-z-]+|validate-gse)\.mjs[^\n`]*[<>]/.test(releaseStatusManifest) &&
+  !/(audit-[a-z-]+|validate-gse|generate-release-status-manifest)\.mjs[^\n`]*[<>]/.test(releaseOwnerActionPlan) &&
+  verificationCommands.includes('__GSE__')
+
+const checks = [
+  check('OEG01', 'owner/external gate kit generator exists', exists('scripts/generate-owner-external-gate-kit.mjs'), 'scripts/generate-owner-external-gate-kit.mjs'),
+  check('OEG02', 'generator produces the kit directory', generated?.status === 0 && generatedData?.status === 'written', generated?.stderr || out),
+  check('OEG03', 'kit includes required files', requiredKitFilesPresent, requiredKitFiles.join(', ')),
+  check('OEG04', 'machine-readable pending gates cover current final owner/external gates', expectedAreas.length > 0 && expectedAreas.every((area) => manifest?.gates?.some((gate) => gate.area === area)) && !manifest?.gates?.some((gate) => gate.area === 'License decision'), expectedAreas.join(', ') + '; License decision resolved'),
+  check('OEG05', 'record commands map to real scripts', expectedScripts.length > 0 && expectedScripts.every((script) => commands.includes(script)) && !commands.includes('proves-public-registry-publication') && (!commands.includes('record-public-channel-publication.mjs') || commands.includes('--proves-registry-publication true') || commands.includes('--proves-marketplace-approval true')), expectedScripts.join(', ')),
+  check('OEG05b', 'record commands include dry-run preflight commands for accepted evidence', commands.includes('Preflight command') && commands.includes('--dry-run --json'), 'record-commands.md'),
+  check('OEG05c', 'kit uses complete record command templates', kitRecordTemplatesAreComplete, 'no ellipsis, no stale host invocation flag, host records use --status accepted'),
+  check('OEG06', 'kit preserves anti-overclaim boundaries', readme.includes('does not choose a license') && readme.includes('Do not claim native slash-command support') && verificationCommands.includes('Local fixture drills, pointer adapters, and generated handoff files do not count as external acceptance'), 'README.md, verification-commands.md'),
+  check('OEG07', 'kit verification commands include portable probe, final readiness, preflight drill, and close gate', verificationCommands.includes('run-gse-command.mjs') && verificationCommands.includes('/gse probe') && !verificationCommands.includes('node scripts/probe-public-external-gates.mjs') && verificationCommands.includes('audit-final-readiness.mjs') && verificationCommands.includes('audit-public-acceptance-readiness.mjs') && verificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs') && verificationCommands.includes('audit-close-gate.mjs'), 'verification-commands.md'),
+  check('OEG08', 'kit contains fresh final acceptance, public handoff, host handoff, manifest, and owner action plan', finalPacket.includes('GSE Final Acceptance Packet') && publicHandoff.includes('GSE Public Acceptance Handoff') && hostHandoff.includes('GSE Host Runtime Evidence Handoff') && releaseStatusManifest.includes('"publicAccepted": "not-accepted"') && releaseOwnerActionPlan.includes('GSE Release Owner Action Plan'), 'generated kit artifacts'),
+  check('OEG09', 'kit manifest marks generated handoff artifacts as fresh', manifest?.generatedFresh?.finalAcceptancePacket === true && manifest?.generatedFresh?.publicAcceptanceHandoff === true && manifest?.generatedFresh?.hostRuntimeEvidenceHandoff === true && manifest?.generatedFresh?.releaseStatusManifest === true && manifest?.generatedFresh?.releaseOwnerActionPlan === true, 'kit-manifest.json'),
+  check('OEG09b', 'kit manifest carries preflight commands for every pending gate', (manifest?.gates?.length ?? 0) > 0 && manifest.gates.every((gate) => gate.preflightCommand?.includes('--dry-run --json')), 'kit-manifest.json'),
+  check('OEG10', 'skill routes users to the owner/external gate kit', skill.includes('generate-owner-external-gate-kit.mjs') && skill.includes('audit-owner-external-gate-kit.mjs'), 'SKILL.md'),
+  check('OEG11', 'validator includes owner/external gate kit audit', validate.includes('audit-owner-external-gate-kit.mjs'), 'scripts/validate-gse.mjs'),
+  check('OEG12', 'release bundle includes owner/external gate kit', bundleGenerator.includes('generate-owner-external-gate-kit.mjs') && bundleAudit.includes('owner-external-gate-kit'), 'release bundle generator/audit'),
+  check('OEG13', 'kit verification commands use shell-safe placeholders', kitVerificationCommandsAreShellSafe, 'verification commands use __GSE__ instead of <gse>'),
+  check('OEG14', 'canonical owner/external gate kit exists', canonicalRequiredKitFilesPresent, '.gse/acceptance/owner-external-gate-kit/'),
+  check('OEG15', 'canonical owner/external gate kit matches current generated gate snapshot', canonicalManifest?.publicAccepted === manifest?.publicAccepted && canonicalManifest?.pendingGateCount === manifest?.pendingGateCount && sameJson(stableGateSnapshot(canonicalManifest), stableGateSnapshot(manifest)), '.gse/acceptance/owner-external-gate-kit/kit-manifest.json'),
+  check('OEG16', 'canonical owner/external gate kit preserves current handoff commands and boundaries', canonicalReadme.includes('GSE Owner / External Gate Kit') && canonicalActionPacket.includes('Public accepted: ' + (manifest?.publicAccepted ?? 'unknown')) && canonicalCommands.includes('--dry-run --json') && canonicalCommands.includes('--status accepted') && canonicalVerificationCommands.includes('run-gse-command.mjs') && canonicalVerificationCommands.includes('/gse probe') && !canonicalVerificationCommands.includes('node scripts/probe-public-external-gates.mjs') && canonicalVerificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs') && canonicalVerificationCommands.includes('__GSE__'), '.gse/acceptance/owner-external-gate-kit/'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    ownerExternalGateKit: failed === 0 ? 'verified' : 'failed',
+    pendingGates: manifest?.pendingGateCount ?? null,
+    publicAccepted: manifest?.publicAccepted ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies owner/external gate kit generation and claim boundaries only.',
+    'It does not choose a license, publish a package, configure a repository, run public CI, approve a marketplace listing, or prove host-native slash commands.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Owner / External Gate Kit Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Owner/external gate kit: ' + data.workflows.ownerExternalGateKit)
+  lines.push('- Pending gates: ' + data.workflows.pendingGates)
+  lines.push('- Public accepted: ' + data.workflows.publicAccepted)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-project.mjs

@@ -0,0 +1,323 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const keepTemp = args.includes('--keep-temp')
+const tempRootArg = readArg('--temp-root', null)
+const baseTemp = tempRootArg ? path.resolve(tempRootArg) : fs.mkdtempSync(path.join(os.tmpdir(), 'gse-project-audit-'))
+const initScript = path.join(root, 'scripts', 'init-project.mjs')
+
+const commonFiles = [
+  '.gse/README.md',
+  '.gse/state.json',
+  '.gse/project-profile.md',
+  '.gse/goal-map.md',
+  '.gse/quality-gates.md',
+  '.gse/tooling.md',
+  '.gse/learnings.md',
+  '.gse/evidence/index.jsonl',
+  '.gse/goals/README.md',
+  '.gse/templates/change-brief.md',
+  '.gse/templates/spec.md',
+  '.gse/templates/design.md',
+  '.gse/templates/tasks.md',
+  '.gse/templates/evidence.md',
+  '.gse/templates/review.md',
+  '.gse/templates/execution-quality-pack.md',
+]
+
+const standardFiles = [
+  '.gse/agent-workspace.md',
+  '.gse/agents/roles.md',
+  '.gse/agents/dispatch.md',
+  '.gse/skills/README.md',
+  '.gse/lsp/README.md',
+]
+
+const enterpriseFiles = [
+  '.gse/hooks/README.md',
+  '.gse/mcp/README.md',
+  '.gse/plugins/README.md',
+  '.gse/release.md',
+  '.gse/incident-review.md',
+  '.gse/audit.md',
+]
+
+const modeExpectations = {
+  lite: {
+    files: commonFiles,
+    dirs: ['.gse/changes', '.gse/evidence', '.gse/templates', '.gse/goals'],
+  },
+  standard: {
+    files: [...commonFiles, ...standardFiles],
+    dirs: ['.gse/changes', '.gse/evidence', '.gse/templates', '.gse/goals', '.gse/agents', '.gse/skills', '.gse/lsp'],
+  },
+  enterprise: {
+    files: [...commonFiles, ...standardFiles, ...enterpriseFiles],
+    dirs: [
+      '.gse/changes',
+      '.gse/evidence',
+      '.gse/templates',
+      '.gse/goals',
+      '.gse/agents',
+      '.gse/skills',
+      '.gse/lsp',
+      '.gse/hooks',
+      '.gse/mcp',
+      '.gse/plugins',
+    ],
+  },
+}
+
+const autoExpectations = [
+  {
+    name: 'empty-project',
+    expectedMode: 'lite',
+    setup(target) {
+      fs.mkdirSync(target, { recursive: true })
+    },
+  },
+  {
+    name: 'standard-app',
+    expectedMode: 'standard',
+    setup(target) {
+      fs.mkdirSync(target, { recursive: true })
+      fs.writeFileSync(path.join(target, 'README.md'), '# Standard App\n', 'utf8')
+      fs.writeFileSync(
+        path.join(target, 'package.json'),
+        JSON.stringify({ scripts: { test: 'vitest run', build: 'vite build' }, devDependencies: { typescript: '^5.0.0', vitest: '^2.0.0' } }, null, 2),
+        'utf8',
+      )
+      fs.writeFileSync(path.join(target, 'tsconfig.json'), '{}\n', 'utf8')
+    },
+  },
+  {
+    name: 'enterprise-agent-runtime',
+    expectedMode: 'enterprise',
+    setup(target) {
+      fs.mkdirSync(path.join(target, '.claude'), { recursive: true })
+      fs.mkdirSync(path.join(target, '.codex'), { recursive: true })
+      fs.writeFileSync(path.join(target, '.mcp.json'), '{}\n', 'utf8')
+      fs.writeFileSync(
+        path.join(target, 'package.json'),
+        JSON.stringify({ scripts: { test: 'vitest run', release: 'node release.mjs' } }, null, 2),
+        'utf8',
+      )
+    },
+  },
+]
+
+function runNode(script, runArgs) {
+  return spawnSync(process.execPath, [script, ...runArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+}
+
+function readJsonFromRun(run) {
+  if (run.status !== 0) return null
+  try {
+    return JSON.parse(run.stdout)
+  } catch {
+    return null
+  }
+}
+
+function fileStatus(target, relativePath) {
+  const fullPath = path.join(target, relativePath)
+  if (!fs.existsSync(fullPath)) return 'missing'
+  return fs.statSync(fullPath).isFile() ? 'present' : 'not-file'
+}
+
+function dirStatus(target, relativePath) {
+  const fullPath = path.join(target, relativePath)
+  if (!fs.existsSync(fullPath)) return 'missing'
+  return fs.statSync(fullPath).isDirectory() ? 'present' : 'not-dir'
+}
+
+function collectSignatures(target, relativePaths) {
+  const signatures = new Map()
+  for (const relativePath of relativePaths) {
+    const fullPath = path.join(target, relativePath)
+    if (!fs.existsSync(fullPath) || !fs.statSync(fullPath).isFile()) continue
+    const stat = fs.statSync(fullPath)
+    const text = fs.readFileSync(fullPath, 'utf8')
+    signatures.set(relativePath, { size: stat.size, text })
+  }
+  return signatures
+}
+
+function compareSignatures(before, after) {
+  const changed = []
+  for (const [relativePath, signature] of before.entries()) {
+    const next = after.get(relativePath)
+    if (!next || next.size !== signature.size || next.text !== signature.text) changed.push(relativePath)
+  }
+  return changed
+}
+
+function auditMode(mode, tempRoot) {
+  const target = path.join(tempRoot, mode)
+  fs.mkdirSync(target, { recursive: true })
+  const expectation = modeExpectations[mode]
+  const firstRun = runNode(initScript, ['--target', target, '--mode', mode])
+  const firstJson = readJsonFromRun(firstRun)
+  const fileChecks = expectation.files.map((relativePath) => ({ relativePath, status: fileStatus(target, relativePath) }))
+  const dirChecks = expectation.dirs.map((relativePath) => ({ relativePath, status: dirStatus(target, relativePath) }))
+  const before = collectSignatures(target, expectation.files)
+  const secondRun = runNode(initScript, ['--target', target, '--mode', mode])
+  const secondJson = readJsonFromRun(secondRun)
+  const after = collectSignatures(target, expectation.files)
+  const changedOnRerun = compareSignatures(before, after)
+  const writtenCount = firstJson?.results?.filter((item) => item.status === 'written').length ?? 0
+  const skippedCount = secondJson?.results?.filter((item) => item.status === 'skipped').length ?? 0
+  const expectedWrites = expectation.files.length
+  const ok =
+    firstRun.status === 0 &&
+    secondRun.status === 0 &&
+    firstJson &&
+    secondJson &&
+    fileChecks.every((item) => item.status === 'present') &&
+    dirChecks.every((item) => item.status === 'present') &&
+    writtenCount === expectedWrites &&
+    skippedCount === expectedWrites &&
+    changedOnRerun.length === 0
+  return {
+    mode,
+    target,
+    status: ok ? 'passed' : 'failed',
+    firstRun: { status: firstRun.status, stderr: firstRun.stderr.trim(), writtenCount, expectedWrites },
+    secondRun: { status: secondRun.status, stderr: secondRun.stderr.trim(), skippedCount, expectedSkips: expectedWrites },
+    fileChecks,
+    dirChecks,
+    changedOnRerun,
+  }
+}
+
+function auditAuto(item, tempRoot) {
+  const target = path.join(tempRoot, 'auto-' + item.name)
+  fs.rmSync(target, { recursive: true, force: true })
+  item.setup(target)
+  const run = runNode(initScript, ['--target', target, '--mode', 'auto'])
+  const model = readJsonFromRun(run)
+  const expectation = modeExpectations[item.expectedMode]
+  const fileChecks = expectation.files.map((relativePath) => ({ relativePath, status: fileStatus(target, relativePath) }))
+  const dirChecks = expectation.dirs.map((relativePath) => ({ relativePath, status: dirStatus(target, relativePath) }))
+  const ok =
+    run.status === 0 &&
+    model?.requestedMode === 'auto' &&
+    model?.mode === item.expectedMode &&
+    Array.isArray(model?.selectionReasons) &&
+    model.selectionReasons.length > 0 &&
+    fileChecks.every((check) => check.status === 'present') &&
+    dirChecks.every((check) => check.status === 'present') &&
+    (item.expectedMode !== 'enterprise' || (fileStatus(target, '.codex/gse-adapter.md') === 'present' && fileStatus(target, '.claude/gse-adapter.md') === 'present'))
+  return {
+    name: item.name,
+    target,
+    expectedMode: item.expectedMode,
+    detectedMode: model?.mode ?? null,
+    selectionReasons: model?.selectionReasons ?? [],
+    status: ok ? 'passed' : 'failed',
+    run: { status: run.status, stderr: run.stderr.trim() },
+    fileChecks,
+    dirChecks,
+    hostAdapterChecks:
+      item.expectedMode === 'enterprise'
+        ? [
+            { relativePath: '.codex/gse-adapter.md', status: fileStatus(target, '.codex/gse-adapter.md') },
+            { relativePath: '.claude/gse-adapter.md', status: fileStatus(target, '.claude/gse-adapter.md') },
+          ]
+        : [],
+  }
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Project Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Temp root: ' + data.tempRoot)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Modes: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Bootstrap scaffold: ' + data.workflows.bootstrapScaffold)
+  lines.push('- Rerun safety: ' + data.workflows.rerunSafety)
+  lines.push('- Auto mode selection: ' + data.workflows.autoModeSelection)
+  lines.push('')
+  lines.push('## Modes')
+  lines.push('')
+  for (const item of data.modes) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.mode + ': files ' + item.fileChecks.filter((check) => check.status === 'present').length + '/' + item.fileChecks.length + ', dirs ' + item.dirChecks.filter((check) => check.status === 'present').length + '/' + item.dirChecks.length + ', skipped on rerun ' + item.secondRun.skippedCount + '/' + item.secondRun.expectedSkips)
+    if (item.changedOnRerun.length) lines.push('  - Changed on rerun: ' + item.changedOnRerun.join(', '))
+  }
+  lines.push('')
+  lines.push('## Auto Mode')
+  lines.push('')
+  for (const item of data.autoModes) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    const hostAdapters = item.hostAdapterChecks?.length ? ', host adapters ' + item.hostAdapterChecks.filter((check) => check.status === 'present').length + '/' + item.hostAdapterChecks.length : ''
+    lines.push('- ' + marker + ' ' + item.name + ': expected ' + item.expectedMode + ', detected ' + item.detectedMode + ', reasons ' + item.selectionReasons.join(', ') + hostAdapters)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (!fs.existsSync(initScript)) {
+  console.error('Missing init-project.mjs at ' + initScript)
+  process.exit(1)
+}
+
+fs.rmSync(baseTemp, { recursive: true, force: true })
+fs.mkdirSync(baseTemp, { recursive: true })
+
+const modes = Object.keys(modeExpectations).map((mode) => auditMode(mode, baseTemp))
+const autoModes = autoExpectations.map((item) => auditAuto(item, baseTemp))
+const passed = modes.filter((item) => item.status === 'passed').length
+const autoPassed = autoModes.filter((item) => item.status === 'passed').length
+const failed = modes.length - passed + (autoModes.length - autoPassed)
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot: baseTemp,
+  summary: { passed: passed + autoPassed, failed, total: modes.length + autoModes.length, status: failed === 0 ? 'passed' : 'failed' },
+  workflows: {
+    bootstrapScaffold: modes.every((item) => item.fileChecks.every((check) => check.status === 'present') && item.dirChecks.every((check) => check.status === 'present')) ? 'verified' : 'failed',
+    rerunSafety: modes.every((item) => item.changedOnRerun.length === 0 && item.secondRun.skippedCount === item.secondRun.expectedSkips) ? 'verified' : 'failed',
+    autoModeSelection: autoModes.every((item) => item.status === 'passed') ? 'verified' : 'failed',
+  },
+  limits: [
+    'Project audit uses temporary directories and generated scaffolds, not arbitrary real repositories.',
+    'Project audit verifies init-project scaffold and rerun safety, not tool installation, CI, package install, or fresh-session acceptance.',
+    'Use discover-project-profile and focused project checks separately for real existing repo adoption.',
+  ],
+  modes,
+  autoModes,
+}
+
+if (!keepTemp) fs.rmSync(baseTemp, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)