@t275005746/gse 0.1.0

package/scripts/audit-public-channel-publication.mjs

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-public-channel-publication-'))
+  fs.mkdirSync(path.join(fixture, '.gse', 'releases'), { recursive: true })
+  return fixture
+}
+
+const recordScript = path.join(root, 'scripts', 'record-public-channel-publication.mjs')
+const template = read('assets/templates/public-channel-publication-record.md')
+const publicRelease = read('references/public-release.md')
+const marketplace = read('references/marketplace-discovery.md')
+const packaging = read('references/packaging.md')
+const finalReadiness = read('references/final-readiness.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const fixture = exists('scripts/record-public-channel-publication.mjs') ? createFixture() : null
+const pending = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--publication-status', 'pending', '--dry-run', '--json']) : null
+const registryOk = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--publication-status', 'accepted',
+  '--channel-type', 'package-registry',
+  '--channel-name', 'npm',
+  '--channel-url', 'https://registry.example/gse',
+  '--version', '1.0.0',
+  '--artifact-digest', 'sha256:fixture',
+  '--review-status', 'published',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://registry.example/gse/1.0.0',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--proves-registry-publication', 'true',
+  '--proves-channel-installability', 'true',
+  '--dry-run',
+  '--json',
+]) : null
+const marketplaceOk = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--publication-status', 'accepted',
+  '--channel-type', 'marketplace',
+  '--channel-name', 'Example Marketplace',
+  '--channel-url', 'https://marketplace.example/gse',
+  '--version', '1.0.0',
+  '--review-status', 'approved',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://marketplace.example/gse/review',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--proves-marketplace-approval', 'true',
+  '--proves-channel-installability', 'true',
+  '--dry-run',
+  '--json',
+]) : null
+const registryMissingInstallability = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--publication-status', 'accepted',
+  '--channel-type', 'package-registry',
+  '--channel-name', 'npm',
+  '--channel-url', 'https://registry.example/gse',
+  '--version', '1.0.0',
+  '--artifact-digest', 'sha256:fixture',
+  '--review-status', 'published',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://registry.example/gse/1.0.0',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--proves-registry-publication', 'true',
+  '--proves-channel-installability', 'false',
+  '--dry-run',
+  '--json',
+]) : null
+const marketplaceMissingInstallability = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--publication-status', 'accepted',
+  '--channel-type', 'marketplace',
+  '--channel-name', 'Example Marketplace',
+  '--channel-url', 'https://marketplace.example/gse',
+  '--version', '1.0.0',
+  '--review-status', 'approved',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://marketplace.example/gse/review',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--proves-marketplace-approval', 'true',
+  '--proves-channel-installability', 'false',
+  '--dry-run',
+  '--json',
+]) : null
+const acceptedMissing = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--publication-status', 'accepted', '--evidence-status', 'pending', '--dry-run', '--json']) : null
+const registryPlaceholderWrite = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--publication-status', 'accepted',
+  '--channel-type', 'package-registry',
+  '--channel-name', 'npm',
+  '--channel-url', 'https://registry.example/gse',
+  '--version', '1.0.0',
+  '--artifact-digest', 'sha256:fixture',
+  '--review-status', 'published',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://registry.example/gse/1.0.0',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--proves-registry-publication', 'true',
+  '--proves-channel-installability', 'true',
+  '--json',
+]) : null
+
+const pendingData = pending ? parseJson(pending.stdout) : null
+const registryOkData = registryOk ? parseJson(registryOk.stdout) : null
+const marketplaceOkData = marketplaceOk ? parseJson(marketplaceOk.stdout) : null
+const registryMissingInstallabilityData = registryMissingInstallability ? parseJson(registryMissingInstallability.stdout) : null
+const marketplaceMissingInstallabilityData = marketplaceMissingInstallability ? parseJson(marketplaceMissingInstallability.stdout) : null
+const acceptedMissingData = acceptedMissing ? parseJson(acceptedMissing.stdout) : null
+const registryPlaceholderWriteData = registryPlaceholderWrite ? parseJson(registryPlaceholderWrite.stdout) : null
+
+const checks = [
+  check('PCP01', 'public channel publication record command exists', exists('scripts/record-public-channel-publication.mjs'), 'scripts/record-public-channel-publication.mjs'),
+  check('PCP02', 'public channel publication template exists', exists('assets/templates/public-channel-publication-record.md') && template.includes('Channel type') && template.includes('Does this prove public registry publication?'), 'assets/templates/public-channel-publication-record.md'),
+  check('PCP03', 'pending publication path remains writable without external proof', pending?.status === 0 && pendingData?.status === 'ready' && pendingData?.publicationStatus === 'pending' && pendingData?.evidenceStatus === 'pending', 'record-public-channel-publication pending dry-run'),
+  check('PCP04', 'accepted registry path requires and accepts digest/publication evidence', registryOk?.status === 0 && registryOkData?.status === 'ready' && registryOkData?.channelType === 'package-registry' && registryOkData?.evidenceStatus === 'accepted', 'record-public-channel-publication package-registry dry-run'),
+  check('PCP05', 'accepted marketplace path requires and accepts approval evidence', marketplaceOk?.status === 0 && marketplaceOkData?.status === 'ready' && marketplaceOkData?.channelType === 'marketplace' && marketplaceOkData?.evidenceStatus === 'accepted', 'record-public-channel-publication marketplace dry-run'),
+  check('PCP06', 'accepted registry path rejects missing channel installability proof', registryMissingInstallability?.status !== 0 && registryMissingInstallabilityData?.status === 'failed' && registryMissingInstallabilityData?.errors?.some((item) => item.includes('--proves-channel-installability true')), 'record-public-channel-publication package-registry installability guard'),
+  check('PCP07', 'accepted marketplace path rejects missing channel installability proof', marketplaceMissingInstallability?.status !== 0 && marketplaceMissingInstallabilityData?.status === 'failed' && marketplaceMissingInstallabilityData?.errors?.some((item) => item.includes('--proves-channel-installability true')), 'record-public-channel-publication marketplace installability guard'),
+  check('PCP08', 'accepted publication rejects missing external evidence', acceptedMissing?.status !== 0 && acceptedMissingData?.status === 'failed' && acceptedMissingData?.errors?.some((item) => item.includes('--channel-url')) && acceptedMissingData?.errors?.some((item) => item.includes('--accepted-by')) && acceptedMissingData?.errors?.some((item) => item.includes('--evidence-status accepted')), 'record-public-channel-publication accepted missing-fields dry-run'),
+  check('PCP09', 'accepted publication real write rejects placeholder or example evidence', registryPlaceholderWrite?.status !== 0 && registryPlaceholderWriteData?.status === 'failed' && registryPlaceholderWriteData?.errors?.some((item) => item.includes('not a placeholder')), 'record-public-channel-publication accepted placeholder write'),
+  check('PCP10', 'public release docs reference channel publication evidence', publicRelease.includes('Public channel publication') && publicRelease.includes('record-public-channel-publication.mjs'), 'references/public-release.md'),
+  check('PCP11', 'marketplace and packaging docs keep approval/publication external', marketplace.includes('Discovery metadata is not marketplace approval') && packaging.includes('It still does not publish GSE'), 'references/marketplace-discovery.md, references/packaging.md'),
+  check('PCP12', 'final readiness matrix includes public channel publication record', finalReadiness.includes('Public channel publication record') && finalReadiness.includes('Public registry publication') && finalReadiness.includes('Marketplace approval'), 'references/final-readiness.md'),
+  check('PCP13', 'consolidated validator includes public channel publication audit', validate.includes('audit-public-channel-publication.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  fixtureRoot: fixture,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicChannelPublication: failed === 0 ? 'verified' : 'failed',
+    acceptedRegistryPublication: registryOkData?.status === 'ready' ? 'fixture-verified' : 'not-verified',
+    acceptedMarketplaceApproval: marketplaceOkData?.status === 'ready' ? 'fixture-verified' : 'not-verified',
+  },
+  limits: [
+    'This audit verifies record mechanics and guardrails for public channel publication evidence.',
+    'It does not publish to a registry, approve a marketplace listing, or prove public installability.',
+    'Accepted publication still requires real external evidence from the chosen channel.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Channel Publication Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public channel publication: ' + data.workflows.publicChannelPublication)
+  lines.push('- Accepted registry publication path: ' + data.workflows.acceptedRegistryPublication)
+  lines.push('- Accepted marketplace approval path: ' + data.workflows.acceptedMarketplaceApproval)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-public-ci-run.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-public-ci-run-'))
+  fs.mkdirSync(path.join(fixture, '.gse', 'releases'), { recursive: true })
+  fs.mkdirSync(path.join(fixture, '.github', 'workflows'), { recursive: true })
+  fs.writeFileSync(path.join(fixture, '.github', 'workflows', 'validate-gse.yml'), 'name: Validate GSE\n', 'utf8')
+  return fixture
+}
+
+const recordScript = path.join(root, 'scripts', 'record-public-ci-run.mjs')
+const template = read('assets/templates/public-ci-run-record.md')
+const publicRelease = read('references/public-release.md')
+const finalReadiness = read('references/final-readiness.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const fixture = exists('scripts/record-public-ci-run.mjs') ? createFixture() : null
+const pending = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--run-status', 'pending', '--dry-run', '--json']) : null
+const acceptedOk = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--run-status', 'accepted',
+  '--run-conclusion', 'success',
+  '--repository-url', 'https://github.com/example/gse',
+  '--workflow-name', 'Validate GSE',
+  '--workflow-file', '.github/workflows/validate-gse.yml',
+  '--run-url', 'https://github.com/example/gse/actions/runs/123',
+  '--commit-sha', '0123456789abcdef0123456789abcdef01234567',
+  '--branch', 'main',
+  '--required-checks', 'Validate GSE',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/actions/runs/123',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--proves-public-ci-run', 'true',
+  '--proves-required-checks', 'true',
+  '--proves-release-commit', 'true',
+  '--dry-run',
+  '--json',
+]) : null
+const acceptedMissing = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--run-status', 'accepted', '--run-conclusion', 'failure', '--evidence-status', 'pending', '--dry-run', '--json']) : null
+const acceptedPlaceholderWrite = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--run-status', 'accepted',
+  '--run-conclusion', 'success',
+  '--repository-url', 'https://github.com/example/gse',
+  '--workflow-name', 'Validate GSE',
+  '--workflow-file', '.github/workflows/validate-gse.yml',
+  '--run-url', 'https://github.com/example/gse/actions/runs/123',
+  '--commit-sha', '0123456789abcdef0123456789abcdef01234567',
+  '--branch', 'main',
+  '--required-checks', 'Validate GSE',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/actions/runs/123',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--proves-public-ci-run', 'true',
+  '--proves-required-checks', 'true',
+  '--proves-release-commit', 'true',
+  '--json',
+]) : null
+
+const pendingData = pending ? parseJson(pending.stdout) : null
+const acceptedOkData = acceptedOk ? parseJson(acceptedOk.stdout) : null
+const acceptedMissingData = acceptedMissing ? parseJson(acceptedMissing.stdout) : null
+const acceptedPlaceholderWriteData = acceptedPlaceholderWrite ? parseJson(acceptedPlaceholderWrite.stdout) : null
+
+const checks = [
+  check('PCR01', 'public CI run record command exists', exists('scripts/record-public-ci-run.mjs'), 'scripts/record-public-ci-run.mjs'),
+  check('PCR02', 'public CI run template exists', exists('assets/templates/public-ci-run-record.md') && template.includes('Run URL') && template.includes('Does this prove a public CI run?'), 'assets/templates/public-ci-run-record.md'),
+  check('PCR03', 'pending CI run path remains writable without external proof', pending?.status === 0 && pendingData?.status === 'ready' && pendingData?.runStatus === 'pending' && pendingData?.evidenceStatus === 'pending', 'record-public-ci-run pending dry-run'),
+  check('PCR04', 'accepted CI run path accepts complete public run evidence', acceptedOk?.status === 0 && acceptedOkData?.status === 'ready' && acceptedOkData?.runStatus === 'accepted' && acceptedOkData?.runConclusion === 'success' && acceptedOkData?.evidenceStatus === 'accepted', 'record-public-ci-run accepted dry-run'),
+  check('PCR05', 'accepted CI run rejects missing external evidence or failed conclusion', acceptedMissing?.status !== 0 && acceptedMissingData?.status === 'failed' && acceptedMissingData?.errors?.some((item) => item.includes('--run-url')) && acceptedMissingData?.errors?.some((item) => item.includes('--run-conclusion success')) && acceptedMissingData?.errors?.some((item) => item.includes('--evidence-status accepted')), 'record-public-ci-run accepted missing-fields dry-run'),
+  check('PCR06', 'accepted CI run real write rejects placeholder or example evidence', acceptedPlaceholderWrite?.status !== 0 && acceptedPlaceholderWriteData?.status === 'failed' && acceptedPlaceholderWriteData?.errors?.some((item) => item.includes('not a placeholder')), 'record-public-ci-run accepted placeholder write'),
+  check('PCR07', 'public release docs reference public CI run evidence', publicRelease.includes('Public CI run') && publicRelease.includes('record-public-ci-run.mjs'), 'references/public-release.md'),
+  check('PCR08', 'final readiness matrix includes public CI run record and external CI run gate', finalReadiness.includes('Public CI run record') && finalReadiness.includes('Public CI run'), 'references/final-readiness.md'),
+  check('PCR09', 'consolidated validator includes public CI run audit', validate.includes('audit-public-ci-run.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  fixtureRoot: fixture,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicCiRunRecord: failed === 0 ? 'verified' : 'failed',
+    acceptedPublicCiRun: acceptedOkData?.status === 'ready' ? 'fixture-verified' : 'not-verified',
+  },
+  limits: [
+    'This audit verifies record mechanics and guardrails for public CI run evidence.',
+    'It does not run GitHub Actions, configure required checks, or prove a real public CI run.',
+    'Accepted public CI still requires real external evidence from the public repository.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public CI Run Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public CI run record: ' + data.workflows.publicCiRunRecord)
+  lines.push('- Accepted public CI run path: ' + data.workflows.acceptedPublicCiRun)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-public-collaboration-templates.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const pr = read('.github/PULL_REQUEST_TEMPLATE.md')
+const bug = read('.github/ISSUE_TEMPLATE/bug_report.yml')
+const change = read('.github/ISSUE_TEMPLATE/change_request.yml')
+const config = read('.github/ISSUE_TEMPLATE/config.yml')
+const openSourceAudit = read('scripts/audit-open-source-readiness.mjs')
+const validate = read('scripts/validate-gse.mjs')
+
+const prTerms = ['## Outcome', '## Scope', '## Acceptance', '## Evidence', '## Risk', '## Claim Boundary', 'validate-gse.mjs']
+const bugTerms = ['Outcome', 'Actual behavior', 'Reproduction', 'Evidence', 'Risk and claim boundary', 'needs-evidence']
+const changeTerms = ['Goal', 'Spec', 'Task level', 'Tool or host impact', 'Proposed evidence', 'needs-spec']
+
+const checks = [
+  check('PCT01', 'pull request template exists', exists('.github/PULL_REQUEST_TEMPLATE.md'), '.github/PULL_REQUEST_TEMPLATE.md'),
+  check('PCT02', 'pull request template requires GSE evidence fields', prTerms.every((term) => pr.includes(term)), prTerms.join(', ')),
+  check('PCT03', 'bug report template exists', exists('.github/ISSUE_TEMPLATE/bug_report.yml'), '.github/ISSUE_TEMPLATE/bug_report.yml'),
+  check('PCT04', 'bug report requires reproduction, evidence, and claim boundary', bugTerms.every((term) => bug.includes(term)), bugTerms.join(', ')),
+  check('PCT05', 'change request template exists', exists('.github/ISSUE_TEMPLATE/change_request.yml'), '.github/ISSUE_TEMPLATE/change_request.yml'),
+  check('PCT06', 'change request requires spec, level, tool impact, and proposed evidence', changeTerms.every((term) => change.includes(term)), changeTerms.join(', ')),
+  check('PCT07', 'blank issues are disabled until templates capture evidence', config.includes('blank_issues_enabled: false'), '.github/ISSUE_TEMPLATE/config.yml'),
+  check('PCT08', 'templates avoid fake public contact or repository URL claims', config.includes('placeholder URL') && !config.includes('mailto:'), 'config keeps public URL owner-approved'),
+  check('PCT09', 'open-source readiness audit includes collaboration templates', openSourceAudit.includes('audit-public-collaboration-templates.mjs') || openSourceAudit.includes('PULL_REQUEST_TEMPLATE.md'), 'scripts/audit-open-source-readiness.mjs'),
+  check('PCT10', 'consolidated validator includes collaboration template audit', validate.includes('audit-public-collaboration-templates.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicCollaborationTemplates: failed === 0 ? 'verified' : 'failed',
+  },
+  limits: [
+    'This audit verifies local GitHub collaboration templates.',
+    'It does not prove public repository issue settings, public URL ownership, maintainer response policy, or marketplace support.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Collaboration Template Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public collaboration templates: ' + data.workflows.publicCollaborationTemplates)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)