@t275005746/gse 0.1.0

package/scripts/audit-public-acceptance-command-dry-run-drill.mjs

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function run(command, commandArgs, options = {}) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: options.cwd ?? root,
+    encoding: 'utf8',
+    windowsHide: true,
+    shell: Boolean(options.shell),
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: options.shell ? command : [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function shellQuote(value) {
+  return JSON.stringify(String(value))
+}
+
+const fixtureValues = {
+  __GSE__: root,
+  __PUBLIC_REPO_URL__: 'https://github.com/example/gse',
+  __PUBLIC_CI_RUN_URL__: 'https://github.com/example/gse/actions/runs/123456789',
+  __COMMIT_SHA__: '0123456789abcdef0123456789abcdef01234567',
+  __BRANCH__: 'main',
+  __REQUIRED_CHECKS__: shellQuote('Validate GSE'),
+  __OWNER__: 'fixture-owner',
+  __YYYY_MM_DD__: '2026-07-07',
+  __SETTINGS_EVIDENCE_URL__: 'https://github.com/example/gse/settings/branches',
+  __URL_OR_RECORD__: 'https://example.com/security',
+  __EMAIL_URL_GITHUB_SECURITY_ADVISORY_OTHER__: 'url',
+  __PUBLIC_CONTACT__: 'https://example.com/security',
+  __REGISTRY_NAME__: 'npm',
+  __REGISTRY_PACKAGE_URL__: 'https://registry.example/gse',
+  __MARKETPLACE_NAME__: 'ExampleMarketplace',
+  __MARKETPLACE_LISTING_URL__: 'https://marketplace.example/gse',
+  __VERSION__: '1.0.0',
+  __DIGEST__: 'sha256:fixture',
+  __HOST__: 'FixtureHost',
+  __VERSION_OR_UNKNOWN__: 'fixture-host-1.0.0',
+  __HOST_ADAPTER_OR_COMMAND_PATH__: 'adapters/fixture-native-command.md',
+  __HOST_ADAPTER_OR_POINTER__: 'adapters/fixture-pointer.md',
+  __HOST_ADAPTER_OR_RUNTIME_ENTRYPOINT__: 'adapters/fixture-runtime-entrypoint.md',
+  __THREAD_TRANSCRIPT_SCREENSHOT_OR_HOST_LOG__: 'fixture-native-host-log',
+  __THREAD_TRANSCRIPT_SCREENSHOT_TERMINAL_OUTPUT_OR_HOST_LOG__: 'fixture-other-host-log',
+  __PORTABLE_TEXT_COMMAND_HOST_UI_COMMAND_RUNTIME_BRIDGE__: 'runtime-bridge',
+  __HOST_UI_COMMAND_RUNTIME_BRIDGE_PLUGIN_COMMAND_AGENT_COMMAND__: 'runtime-bridge',
+}
+
+function substituteCommand(command) {
+  let substituted = command
+  for (const [placeholder, value] of Object.entries(fixtureValues)) {
+    substituted = substituted.split(placeholder).join(value)
+  }
+  return substituted
+}
+
+function unresolvedPlaceholders(command) {
+  return [...command.matchAll(/__[A-Z0-9_]+__/g)].map((match) => match[0])
+}
+
+const readiness = run(process.execPath, [path.join(root, 'scripts', 'audit-public-acceptance-readiness.mjs'), '--root', root, '--json'])
+const readinessData = parseJson(readiness.stdout)
+const pendingGates = readinessData?.pendingGates ?? []
+const commandRuns = pendingGates.map((gate) => {
+  const template = String(gate.preflightCommand ?? '')
+  const command = substituteCommand(template)
+  const unresolved = unresolvedPlaceholders(command)
+  const hasAnglePlaceholder = /<[^>]+>/.test(command)
+  const hasDryRunJson = command.includes('--dry-run') && command.includes('--json')
+  const result = unresolved.length || hasAnglePlaceholder || !hasDryRunJson
+    ? { status: 1, stdout: '', stderr: 'command template failed pre-execution checks', command }
+    : run(command, [], { cwd: root, shell: true })
+  const output = parseJson(result.stdout)
+
+  return {
+    area: gate.area,
+    template,
+    command,
+    unresolved,
+    hasAnglePlaceholder,
+    hasDryRunJson,
+    exitStatus: result.status,
+    stdoutStatus: output?.status ?? 'unparsed',
+    errors: Array.isArray(output?.errors) ? output.errors : [],
+    stderr: result.stderr,
+  }
+})
+
+const commandCount = commandRuns.length
+const executedCount = commandRuns.filter((item) => item.exitStatus === 0).length
+const templatesAreResolved = commandRuns.every((item) => item.unresolved.length === 0 && !item.hasAnglePlaceholder)
+const templatesArePreflight = commandRuns.every((item) => item.hasDryRunJson)
+const commandsExitCleanly = commandRuns.every((item) => item.exitStatus === 0)
+const commandsReturnReady = commandRuns.every((item) => item.stdoutStatus === 'ready' && item.errors.length === 0)
+const expectedPendingBoundary = readinessData?.summary?.publicAccepted === 'verified' ? commandCount === 0 : commandCount > 0
+
+const checks = [
+  check('PACD01', 'public acceptance readiness doctor runs before command drill', readiness.status === 0 && readinessData?.summary?.status === 'passed', readiness.command, readiness.stderr),
+  check('PACD02', 'drill consumes generated pending gate preflight commands', expectedPendingBoundary && pendingGates.every((gate) => String(gate.preflightCommand ?? '').includes('--dry-run --json')), `${commandCount} command(s)`),
+  check('PACD03', 'fixture substitution resolves shell-safe placeholders', templatesAreResolved, commandRuns.map((item) => `${item.area}:${item.unresolved.join(',') || 'resolved'}`).join('; ')),
+  check('PACD04', 'all generated commands remain dry-run JSON preflights', templatesArePreflight, commandRuns.map((item) => `${item.area}:${item.hasDryRunJson}`).join('; ')),
+  check('PACD05', 'substituted preflight commands execute with exit code 0', commandsExitCleanly, commandRuns.map((item) => `${item.area}:${item.exitStatus}`).join('; ')),
+  check('PACD06', 'substituted preflight commands return ready without validation errors', commandsReturnReady, commandRuns.map((item) => `${item.area}:${item.stdoutStatus}${item.errors.length ? ':' + item.errors.join('|') : ''}`).join('; ')),
+  check('PACD07', 'drill keeps public acceptance boundary honest', readinessData?.summary?.publicAccepted !== 'verified' || commandCount === 0, `publicAccepted=${readinessData?.summary?.publicAccepted ?? 'unknown'}; commands=${commandCount}`),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: {
+    status: failed === 0 ? 'passed' : 'failed',
+    passed,
+    failed,
+    total: checks.length,
+    commandsChecked: commandCount,
+    commandsExecuted: executedCount,
+    publicAccepted: readinessData?.summary?.publicAccepted ?? 'unknown',
+    pendingGates: readinessData?.summary?.pendingGates ?? 'unknown',
+  },
+  workflows: {
+    publicAcceptanceCommandDryRunDrill: failed === 0 ? 'verified' : 'failed',
+    publicAccepted: readinessData?.summary?.publicAccepted ?? 'unknown',
+  },
+  commandRuns,
+  limits: [
+    'This drill executes generated owner/external preflight command templates after fixture substitution.',
+    'It proves command-template mechanics only; it does not create real public release, repository, CI, registry, marketplace, security, or host-runtime evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Acceptance Command Dry-Run Drill')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Commands checked: ' + data.summary.commandsChecked)
+  lines.push('- Commands executed: ' + data.summary.commandsExecuted)
+  lines.push('- Public accepted: ' + data.summary.publicAccepted)
+  lines.push('')
+  lines.push('## Commands')
+  lines.push('')
+  if (data.commandRuns.length === 0) {
+    lines.push('- None.')
+  } else {
+    for (const item of data.commandRuns) {
+      lines.push('- ' + item.area + ': exit=' + item.exitStatus + ', status=' + item.stdoutStatus)
+    }
+  }
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-public-acceptance-handoff.mjs

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const generator = read('scripts/generate-public-acceptance-handoff.mjs')
+const validate = read('scripts/validate-gse.mjs')
+const skill = read('SKILL.md')
+const tmp = mkdtempSync(path.join(tmpdir(), 'gse-public-acceptance-handoff-'))
+const out = path.join(tmp, 'public-acceptance-handoff.md')
+const generated = exists('scripts/generate-public-acceptance-handoff.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'generate-public-acceptance-handoff.mjs'), '--root', root, '--out', out, '--force', '--json'])
+  : null
+const generatedData = generated ? parseJson(generated.stdout) : null
+const handoff = fs.existsSync(out) ? fs.readFileSync(out, 'utf8') : ''
+rmSync(tmp, { recursive: true, force: true })
+
+const doctorRun = run(process.execPath, [path.join(root, 'scripts', 'audit-public-acceptance-readiness.mjs'), '--root', root, '--json'])
+const doctorData = parseJson(doctorRun.stdout)
+const currentPendingGates = doctorData?.pendingGates ?? []
+const requiredGates = currentPendingGates.map((gate) => gate.area)
+const hasRegistryGate = requiredGates.includes('Public registry publication')
+const requiredCommands = [...new Set(currentPendingGates
+  .map((gate) => String(gate.recordCommand ?? '').match(/scripts\/([\w-]+\.mjs)/)?.[1])
+  .filter(Boolean))]
+const antiOverclaim = [
+  'does not choose a license',
+  'does not choose a license, publish a package, configure a repository, approve a marketplace listing, or prove host-native slash-command support',
+  'Do not claim public release acceptance',
+  'Do not claim native slash-command support',
+]
+
+const checks = [
+  check('PAH01', 'public acceptance handoff generator exists', exists('scripts/generate-public-acceptance-handoff.mjs'), 'scripts/generate-public-acceptance-handoff.mjs'),
+  check('PAH02', 'generator is based on the public acceptance doctor', generator.includes('audit-public-acceptance-readiness.mjs') && generator.includes('pendingGates'), 'generator calls doctor and renders pending gates'),
+  check('PAH03', 'generator produces a handoff file', generated?.status === 0 && generatedData?.status === 'written' && handoff.length > 0, generated?.stderr || out),
+  check('PAH04', 'handoff covers all current final-form gates', requiredGates.length > 0 && requiredGates.every((term) => handoff.includes(term)) && !handoff.includes('### 1. Owner decision - License decision'), requiredGates.join(', ') + '; License decision resolved'),
+  check('PAH05', 'handoff reuses existing record commands', requiredCommands.every((term) => handoff.includes(term)), requiredCommands.join(', ')),
+  check('PAH05b', 'handoff registry publication command matches real record CLI when pending', !hasRegistryGate || (handoff.includes('--proves-registry-publication true') && !handoff.includes('--proves-public-registry-publication')), hasRegistryGate ? 'record-public-channel-publication.mjs uses --proves-registry-publication' : 'registry publication already verified'),
+  check('PAH05c', 'handoff includes dry-run preflight commands for accepted records', handoff.includes('Preflight command') && handoff.includes('--dry-run --json'), 'dry-run preflight commands'),
+  check('PAH06', 'handoff preserves anti-overclaim boundaries', antiOverclaim.every((term) => handoff.includes(term)), antiOverclaim.join(', ')),
+  check('PAH07', 'handoff preserves current public acceptance boundary', handoff.includes('Public accepted: not-accepted') && generatedData?.summary?.publicAccepted === 'not-accepted', 'publicAccepted not-accepted'),
+  check('PAH08', 'skill routes users to public acceptance handoff', skill.includes('generate-public-acceptance-handoff.mjs'), 'SKILL.md'),
+  check('PAH09', 'consolidated validator includes handoff audit', validate.includes('audit-public-acceptance-handoff.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicAcceptanceHandoff: failed === 0 ? 'verified' : 'failed',
+    publicAccepted: generatedData?.summary?.publicAccepted ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies handoff generation and claim boundaries only.',
+    'It does not choose a license, publish a package, configure a repository, run public CI, approve a marketplace listing, or prove host-native slash commands.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Acceptance Handoff Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public acceptance handoff: ' + data.workflows.publicAcceptanceHandoff)
+  lines.push('- Public accepted: ' + data.workflows.publicAccepted)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-public-acceptance-readiness.mjs

@@ -0,0 +1,224 @@
+#!/usr/bin/env node
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function preflightCommand(command) {
+  if (!command || command === 'No command mapping exists yet.') return 'No command mapping exists yet.'
+  if (command.includes('--dry-run')) return command
+  return command + ' --dry-run --json'
+}
+
+function shellSafePlaceholders(command) {
+  return command.replace(/<([^>]+)>/g, (_, label) => {
+    const normalized = label
+      .toUpperCase()
+      .replace(/[^A-Z0-9]+/g, '_')
+      .replace(/^_+|_+$/g, '')
+    return `__${normalized || 'VALUE'}__`
+  })
+}
+
+const gateGuidance = {
+  'License decision': {
+    owner: 'project owner',
+    command: 'node scripts/record-public-release.mjs --root <gse> --license-status selected --spdx <ID> --license-file <path> --approved-by <owner> --decision-date <YYYY-MM-DD> --evidence-status accepted',
+    requiredEvidence: 'Owner-selected SPDX license and accepted evidence, or an owner-approved not-public decision.',
+  },
+  'Public security contact': {
+    owner: 'project owner',
+    command: 'node scripts/record-public-security-contact.mjs --root <gse> --contact-status accepted --contact-type <email|url|github-security-advisory|other> --contact-value <public-contact> --is-public true --security-policy-updated true --evidence-owner <owner> --evidence-date <YYYY-MM-DD> --evidence-url <url-or-record> --accepted-by <owner> --accepted-at <YYYY-MM-DD> --evidence-status accepted --force',
+    requiredEvidence: 'Owner-approved vulnerability disclosure path, evidence URL or record, and accepted security contact status.',
+  },
+  'Public CI run': {
+    owner: 'external CI',
+    command: 'node scripts/record-public-ci-run.mjs --root <gse> --run-status accepted --run-conclusion success --repository-url <public-repo-url> --workflow-name "Validate GSE" --workflow-file .github/workflows/validate-gse.yml --run-url <public-ci-run-url> --commit-sha <commit-sha> --branch <branch> --required-checks <required-checks> --evidence-owner <owner> --evidence-date <YYYY-MM-DD> --evidence-url <public-ci-run-url> --verification-result passed --accepted-by <owner> --accepted-at <YYYY-MM-DD> --proves-public-ci-run true --proves-required-checks true --proves-release-commit true --evidence-status accepted --force',
+    requiredEvidence: 'Real public CI run URL, commit SHA, branch, required checks, successful conclusion, and accepted evidence.',
+  },
+  'Public repository settings': {
+    owner: 'repository owner',
+    command: 'node scripts/record-public-repository-settings.mjs --root <gse> --settings-status accepted --repository-url <public-repo-url> --default-branch <branch> --visibility public --issues-enabled true --pull-requests-enabled true --security-policy-visible true --branch-protection-enabled true --required-status-checks-enabled true --required-checks <required-checks> --require-review-before-merge true --require-conversation-resolution true --restrict-force-pushes true --restrict-deletions true --evidence-owner <owner> --evidence-date <YYYY-MM-DD> --evidence-url <settings-evidence-url> --verification-result passed --accepted-by <owner> --accepted-at <YYYY-MM-DD> --evidence-status accepted --force',
+    requiredEvidence: 'Real public repository URL, branch protection, required checks, maintainer policy, and accepted evidence.',
+  },
+  'Public registry publication': {
+    owner: 'external registry',
+    command: 'node scripts/record-public-channel-publication.mjs --root <gse> --publication-status accepted --channel-type package-registry --channel-name <registry-name> --channel-url <registry-package-url> --version <version> --artifact-digest <digest> --review-status published --evidence-owner <owner> --evidence-date <YYYY-MM-DD> --evidence-url <registry-package-url> --verification-result passed --accepted-by <owner> --accepted-at <YYYY-MM-DD> --proves-registry-publication true --proves-channel-installability true --evidence-status accepted --force',
+    requiredEvidence: 'Real registry package URL, version, digest, publication date, verification command, and accepted evidence.',
+  },
+  'Marketplace approval': {
+    owner: 'external marketplace',
+    command: 'node scripts/record-public-channel-publication.mjs --root <gse> --publication-status accepted --channel-type marketplace --channel-name <marketplace-name> --channel-url <marketplace-listing-url> --version <version> --review-status approved --evidence-owner <owner> --evidence-date <YYYY-MM-DD> --evidence-url <marketplace-listing-url> --verification-result passed --accepted-by <owner> --accepted-at <YYYY-MM-DD> --proves-marketplace-approval true --proves-channel-installability true --evidence-status accepted --force',
+    requiredEvidence: 'Real marketplace or catalog listing URL, approval/publication status, review date, and accepted evidence.',
+  },
+  'Native slash command': {
+    owner: 'host runtime',
+    command: 'node scripts/record-host-invocation.mjs --root <gse> --host <host> --host-version <version-or-unknown> --project gse --adapter-path <host-adapter-or-command-path> --invocation-method "native slash command" --command "/gse continue" --status accepted --evidence-owner <owner> --evidence <thread-transcript-screenshot-or-host-log> --verification-command "node scripts/audit-final-readiness.mjs --root <gse> --json" --native-slash-command true --portable-text-command false --generated-pointer false --owner-acceptance-required false --force',
+    requiredEvidence: 'Real host runtime invocation evidence proving native slash-command behavior, not portable text routing.',
+  },
+  'Other host runtime invocation': {
+    owner: 'host runtime',
+    command: 'node scripts/record-host-invocation.mjs --root <gse> --host <host> --host-version <version-or-unknown> --project gse --adapter-path <host-adapter-or-runtime-entrypoint> --invocation-method <host-ui-command|runtime-bridge|plugin-command|agent-command> --command "/gse continue" --status accepted --evidence-owner <owner> --evidence <thread-transcript-screenshot-terminal-output-or-host-log> --verification-command "node scripts/audit-final-readiness.mjs --root <gse> --json" --native-slash-command false --portable-text-command false --generated-pointer false --owner-acceptance-required false --force',
+    requiredEvidence: 'Real runtime invocation record for each claimed host, including evidence URL/path, accepted status, and no generated-pointer dependency.',
+  },
+}
+
+const finalReadiness = run(process.execPath, [path.join(root, 'scripts', 'audit-final-readiness.mjs'), '--root', root, '--json'])
+const finalReadinessData = parseJson(finalReadiness.stdout)
+const matrix = finalReadinessData?.matrix ?? []
+const pendingGates = matrix
+  .filter((row) => row.status !== 'verified')
+  .map((row) => {
+    const rawCommand = gateGuidance[row.area]?.command ?? 'No command mapping exists yet.'
+    const recordCommand = shellSafePlaceholders(rawCommand)
+    return {
+      area: row.area,
+      status: row.status,
+      currentEvidence: row.evidence,
+      recordCommand,
+      preflightCommand: preflightCommand(recordCommand),
+      requiredEvidence: gateGuidance[row.area]?.requiredEvidence ?? 'Add explicit owner/external evidence, then re-run final readiness.',
+      owner: gateGuidance[row.area]?.owner ?? 'unknown',
+      willPromoteWhenAccepted: Boolean(gateGuidance[row.area]),
+    }
+  })
+
+const expectedFinalGates = Object.keys(gateGuidance)
+const pendingGateNames = new Set(pendingGates.map((gate) => gate.area))
+const matrixGateNames = new Set(matrix.map((gate) => gate.area))
+const currentPendingRowsHaveCommands = pendingGates.every((gate) => gate.recordCommand !== 'No command mapping exists yet.')
+const currentPendingRowsHavePreflightCommands = pendingGates.every((gate) => gate.preflightCommand !== 'No command mapping exists yet.' && gate.preflightCommand.includes('--dry-run --json'))
+const pendingCommandsAreExecutableTemplates = pendingGates.every((gate) =>
+  !gate.recordCommand.includes('...') &&
+  !gate.preflightCommand.includes('...') &&
+  !/[<>]/.test(gate.recordCommand) &&
+  !/[<>]/.test(gate.preflightCommand) &&
+  !gate.recordCommand.includes('--invocation-status') &&
+  !gate.preflightCommand.includes('--invocation-status') &&
+  (gate.recordCommand.includes('record-host-invocation.mjs') ? gate.recordCommand.includes('--status accepted') : true),
+)
+const expectedGatesCoveredByMatrix = expectedFinalGates.every((gate) => matrixGateNames.has(gate))
+const ownerExternalGatesRemainHonest = matrix.every((row) => row.status === 'verified' || row.status === 'owner-required' || row.status === 'external-required')
+const publicAccepted = finalReadinessData?.workflows?.publicAccepted ?? 'unknown'
+const claimBoundaryHonest = publicAccepted === 'verified' ? pendingGates.length === 0 : pendingGates.length > 0
+
+const checks = [
+  check('PAD01', 'final readiness audit runs before public acceptance diagnosis', finalReadiness.status === 0 && finalReadinessData?.summary?.status === 'passed', finalReadiness.command, finalReadiness.stderr),
+  check('PAD02', 'public acceptance doctor covers all final owner/external gate types', expectedGatesCoveredByMatrix, expectedFinalGates.join(', ')),
+  check('PAD03', 'pending final gates have concrete record commands', currentPendingRowsHaveCommands, pendingGates.map((gate) => `${gate.area} -> ${gate.recordCommand}`).join('; ')),
+  check('PAD03b', 'pending final gates expose dry-run preflight commands', currentPendingRowsHavePreflightCommands, pendingGates.map((gate) => `${gate.area} -> ${gate.preflightCommand}`).join('; ')),
+  check('PAD03c', 'pending final gate commands are complete executable templates', pendingCommandsAreExecutableTemplates, pendingGates.map((gate) => `${gate.area} -> ${gate.recordCommand}`).join('; ')),
+  check('PAD04', 'pending final gates keep owner/external responsibility visible', pendingGates.every((gate) => gate.owner !== 'unknown'), pendingGates.map((gate) => `${gate.area}:${gate.owner}`).join(', ')),
+  check('PAD05', 'final readiness statuses remain honest until accepted records promote them', ownerExternalGatesRemainHonest && claimBoundaryHonest, `publicAccepted=${publicAccepted}; pending=${pendingGates.length}`),
+  check('PAD06', 'doctor does not claim external acceptance from local mechanics', publicAccepted !== 'verified' || pendingGates.length === 0, 'public acceptance follows final-readiness matrix only'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: {
+    status: failed === 0 ? 'passed' : 'failed',
+    passed,
+    failed,
+    total: checks.length,
+    pendingGates: pendingGates.length,
+    publicAccepted,
+  },
+  workflows: {
+    publicAcceptanceDoctor: failed === 0 ? 'verified' : 'failed',
+    publicAccepted,
+  },
+  pendingGates,
+  nextCommands: pendingGates.map((gate) => gate.recordCommand),
+  nextPreflightCommands: pendingGates.map((gate) => gate.preflightCommand),
+  limits: [
+    'This doctor identifies missing owner/external evidence and record commands.',
+    'It does not choose a license, publish a package, configure a public repository, run public CI, approve a marketplace listing, or prove host-native slash commands.',
+    'A gate is accepted only after a real accepted record is created and final readiness is re-audited.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Acceptance Doctor')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public accepted: ' + data.summary.publicAccepted)
+  lines.push('- Pending gates: ' + data.summary.pendingGates)
+  lines.push('')
+  lines.push('## Pending Gates')
+  lines.push('')
+  if (data.pendingGates.length === 0) {
+    lines.push('- None. Re-run final readiness and close gate before claiming public acceptance.')
+  } else {
+    for (const gate of data.pendingGates) {
+      lines.push('- ' + gate.area + ': ' + gate.status)
+      lines.push('  - Owner: ' + gate.owner)
+      lines.push('  - Current evidence: ' + gate.currentEvidence)
+      lines.push('  - Required evidence: ' + gate.requiredEvidence)
+      lines.push('  - Preflight command: `' + gate.preflightCommand + '`')
+      lines.push('  - Record command: `' + gate.recordCommand + '`')
+    }
+  }
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)