@t275005746/gse 0.1.0

package/scripts/audit-public-external-gate-probe.mjs

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import http from 'node:http'
+import os from 'node:os'
+import path from 'node:path'
+import { spawn, spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function runAsync(command, commandArgs) {
+  return new Promise((resolve) => {
+    const child = spawn(command, commandArgs, {
+      cwd: root,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    let stdout = ''
+    let stderr = ''
+    child.stdout.setEncoding('utf8')
+    child.stderr.setEncoding('utf8')
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk
+    })
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk
+    })
+    child.on('close', (status) => {
+      resolve({
+        status: status ?? 1,
+        stdout: stdout.trim(),
+        stderr: stderr.trim(),
+        command: [command, ...commandArgs].join(' '),
+      })
+    })
+  })
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function startServer() {
+  const server = http.createServer((request, response) => {
+    response.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' })
+    response.end('gse fixture evidence\n')
+  })
+  return new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address()
+      resolve({ server, url: `http://127.0.0.1:${address.port}` })
+    })
+  })
+}
+
+const probeScript = path.join(root, 'scripts', 'probe-public-external-gates.mjs')
+const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-public-external-probe-'))
+const hostEvidence = path.join(fixture, 'host-evidence.txt')
+fs.writeFileSync(hostEvidence, 'fixture host transcript\n', 'utf8')
+const { server, url } = await startServer()
+
+let positive
+let negativePlaceholder
+let negativeMissingFile
+let waiting
+try {
+  positive = await runAsync(process.execPath, [
+    probeScript,
+    '--root', root,
+    '--allow-local-fixture',
+    '--timeout-ms', '3000',
+    '--public-repo-url', `${url}/repo`,
+    '--security-contact-url', `${url}/security`,
+    '--public-ci-run-url', `${url}/ci`,
+    '--registry-package-url', `${url}/package`,
+    '--marketplace-url', `${url}/marketplace`,
+    '--native-host-evidence', hostEvidence,
+    '--other-host-evidence', `${url}/host`,
+    '--json',
+  ])
+  negativePlaceholder = run(process.execPath, [
+    probeScript,
+    '--root', root,
+    '--public-repo-url', 'https://github.com/example/gse',
+    '--registry-package-url', 'https://example.com/gse',
+    '--json',
+  ])
+  negativeMissingFile = run(process.execPath, [
+    probeScript,
+    '--root', root,
+    '--native-host-evidence', path.join(fixture, 'missing.txt'),
+    '--json',
+  ])
+  waiting = run(process.execPath, [probeScript, '--root', root, '--json'])
+} finally {
+  await new Promise((resolve) => server.close(resolve))
+  fs.rmSync(fixture, { recursive: true, force: true })
+}
+
+const positiveData = parseJson(positive.stdout)
+const negativePlaceholderData = parseJson(negativePlaceholder.stdout)
+const negativeMissingFileData = parseJson(negativeMissingFile.stdout)
+const waitingData = parseJson(waiting.stdout)
+const skill = read('SKILL.md')
+const validate = read('scripts/validate-gse.mjs')
+const completion = read('scripts/audit-completion-readiness.mjs')
+const ownerKitGenerator = read('scripts/generate-owner-external-gate-kit.mjs')
+const verificationCommands = read('.gse/acceptance/owner-external-gate-kit/verification-commands.md')
+
+const checks = [
+  check('PEG01', 'public external gate probe exists', exists('scripts/probe-public-external-gates.mjs'), 'scripts/probe-public-external-gates.mjs'),
+  check('PEG02', 'probe accepts reachable evidence locations in fixture mode', positive.status === 0 && positiveData?.status === 'ready' && positiveData?.summary?.checked === 7 && positiveData?.summary?.failed === 0, positive.command),
+  check('PEG03', 'probe rejects placeholder and example public evidence', negativePlaceholder.status !== 0 && negativePlaceholderData?.status === 'failed' && negativePlaceholderData?.probes?.some((item) => item.errors?.some((error) => error.includes('not a placeholder'))), negativePlaceholder.command),
+  check('PEG04', 'probe rejects missing host evidence files', negativeMissingFile.status !== 0 && negativeMissingFileData?.status === 'failed' && negativeMissingFileData?.probes?.some((item) => item.errors?.some((error) => error.includes('existing evidence file'))), negativeMissingFile.command),
+  check('PEG05', 'probe can run without evidence inputs as a waiting diagnostic', waiting.status === 0 && waitingData?.status === 'waiting-for-input' && waitingData?.summary?.checked === 0, waiting.command),
+  check('PEG06', 'probe keeps acceptance boundary explicit', positiveData?.limits?.some((item) => item.includes('does not publish GSE')) && positiveData?.limits?.some((item) => item.includes('record script')), 'probe report limits'),
+  check('PEG07', 'GSE routing and owner kit mention the portable probe command', skill.includes('probe-public-external-gates.mjs') && ownerKitGenerator.includes('run-gse-command.mjs') && ownerKitGenerator.includes('/gse probe') && verificationCommands.includes('run-gse-command.mjs') && verificationCommands.includes('/gse probe') && !verificationCommands.includes('node scripts/probe-public-external-gates.mjs'), 'SKILL.md, generate-owner-external-gate-kit.mjs, owner kit verification commands'),
+  check('PEG08', 'validator and completion readiness include the probe audit', validate.includes('audit-public-external-gate-probe.mjs') && completion.includes('audit-public-external-gate-probe.mjs'), 'scripts/validate-gse.mjs, scripts/audit-completion-readiness.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicExternalGateProbe: failed === 0 ? 'verified' : 'failed',
+  },
+  limits: [
+    'This audit verifies the probe mechanics with fixture evidence.',
+    'It does not create real public owner/external evidence or mark final readiness accepted.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public External Gate Probe Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public external gate probe: ' + data.workflows.publicExternalGateProbe)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-public-release-checklist.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const tmp = mkdtempSync(path.join(tmpdir(), 'gse-public-release-checklist-'))
+const tmpManifest = path.join(tmp, 'release-status-manifest.json')
+const tmpChecklist = path.join(tmp, 'public-release-checklist.md')
+const manifestRun = exists('scripts/generate-release-status-manifest.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'generate-release-status-manifest.mjs'), '--root', root, '--out', tmpManifest, '--force', '--json'])
+  : null
+const checklistRun = manifestRun?.status === 0 && exists('scripts/generate-public-release-checklist.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'generate-public-release-checklist.mjs'), '--root', root, '--manifest', tmpManifest, '--out', tmpChecklist, '--force', '--json'])
+  : null
+const manifest = fs.existsSync(tmpManifest) ? parseJson(fs.readFileSync(tmpManifest, 'utf8')) : null
+const checklist = fs.existsSync(tmpChecklist) ? fs.readFileSync(tmpChecklist, 'utf8') : ''
+const checklistData = checklistRun ? parseJson(checklistRun.stdout) : null
+const canonicalChecklist = read('.gse/acceptance/public-release-checklist.md')
+rmSync(tmp, { recursive: true, force: true })
+
+const pendingGates = manifest?.publicAcceptance?.pendingGates ?? []
+const expectedAreas = pendingGates.map((gate) => gate.area)
+const requiredPhases = [
+  '01. Prepare the release bundle',
+  '02. Publish and configure the public repository',
+  '03. Approve the public security contact',
+  '04. Run public CI on the release commit',
+  '05. Publish the registry package',
+  '06. Publish or submit marketplace listing',
+  '07. Record native slash-command evidence',
+  '08. Record other host runtime invocation evidence',
+]
+const expectedScripts = [...new Set(pendingGates
+  .map((gate) => String(gate.recordCommand ?? '').match(/scripts\/([\w-]+\.mjs)/)?.[1])
+  .filter(Boolean))]
+const noLocalPaths = !/[A-Z]:\\|C:\\Users\\|D:\\codex\\/i.test(checklist) && !/[A-Z]:\\|C:\\Users\\|D:\\codex\\/i.test(canonicalChecklist)
+const noFalseAcceptance = checklist.includes('Public accepted: not-accepted') &&
+  checklist.includes('does not publish, approve, or accept') &&
+  checklist.includes('A gate is complete only after real accepted evidence')
+const commandCoverage = expectedScripts.every((script) => checklist.includes(script)) &&
+  checklist.includes('/gse release') &&
+  checklist.includes('/gse release --execute --out <bundle>') &&
+  checklist.includes('/gse probe')
+const canonicalFresh = canonicalChecklist.includes('GSE Public Release Checklist') &&
+  requiredPhases.every((phase) => canonicalChecklist.includes(phase)) &&
+  expectedAreas.every((area) => canonicalChecklist.includes(`Gate: ${area}`)) &&
+  canonicalChecklist.includes(`Pending owner/external gates: ${pendingGates.length}`)
+
+const checks = [
+  check('PRC01', 'public release checklist generator exists', exists('scripts/generate-public-release-checklist.mjs'), 'scripts/generate-public-release-checklist.mjs'),
+  check('PRC02', 'generator writes checklist from release status manifest', checklistRun?.status === 0 && checklistData?.status === 'written' && checklist.includes('GSE Public Release Checklist'), 'generate-public-release-checklist.mjs'),
+  check('PRC03', 'checklist uses ordered public release runway phases', requiredPhases.every((phase) => checklist.includes(phase)), 'public-release-checklist.md'),
+  check('PRC04', 'checklist covers every pending owner/external gate', expectedAreas.length > 0 && expectedAreas.every((area) => checklist.includes(`Gate: ${area}`)), 'release-status-manifest pending gates'),
+  check('PRC05', 'checklist includes executable preflight and record command families', commandCoverage && checklist.includes('Preflight:') && checklist.includes('Record accepted evidence:'), 'public-release-checklist.md'),
+  check('PRC06', 'checklist preserves public acceptance boundary', noFalseAcceptance, 'public-release-checklist.md'),
+  check('PRC07', 'checklist avoids local machine paths', noLocalPaths, 'public-release-checklist.md'),
+  check('PRC08', 'canonical checklist is fresh against current manifest', canonicalFresh, '.gse/acceptance/public-release-checklist.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: {
+    status: failed === 0 ? 'passed' : 'failed',
+    passed,
+    failed,
+    total: checks.length,
+  },
+  workflows: {
+    publicReleaseChecklist: failed === 0 ? 'verified' : 'failed',
+    publicAccepted: manifest?.publicAcceptance?.publicAccepted ?? 'unknown',
+    pendingGates: pendingGates.length,
+  },
+  checks,
+}
+
+if (jsonOnly) {
+  console.log(JSON.stringify(report, null, 2))
+} else {
+  console.log(`${report.summary.status}: ${passed}/${checks.length}`)
+}
+
+process.exit(failed === 0 ? 0 : 1)

package/scripts/audit-public-release-decision.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function createReleaseFixture() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-public-release-decision-'))
+  fs.mkdirSync(path.join(fixture, '.gse', 'releases'), { recursive: true })
+  fs.writeFileSync(path.join(fixture, 'CHANGELOG.md'), '# Changelog\n\n## Unreleased\n\n- Fixture release decision.\n', 'utf8')
+  fs.writeFileSync(path.join(fixture, 'LICENSE'), 'Fixture license text for audit only.\n', 'utf8')
+  return fixture
+}
+
+const recordScript = path.join(root, 'scripts', 'record-public-release.mjs')
+const publicRelease = read('references/public-release.md')
+const validate = read('scripts/validate-gse.mjs')
+const completion = read('scripts/audit-completion-readiness.mjs')
+const roadmap = read('scripts/audit-roadmap-consistency.mjs')
+
+let fixture = null
+let ownerRequired = null
+let selectedOk = null
+let selectedMissing = null
+let notPublicOk = null
+let notPublicMissing = null
+
+if (fs.existsSync(recordScript)) {
+  fixture = createReleaseFixture()
+  ownerRequired = run(process.execPath, [
+    recordScript,
+    '--root',
+    fixture,
+    '--license-status',
+    'owner-required',
+    '--dry-run',
+    '--json',
+  ])
+  selectedOk = run(process.execPath, [
+    recordScript,
+    '--root',
+    fixture,
+    '--license-status',
+    'selected',
+    '--spdx',
+    'MIT',
+    '--license-file',
+    'LICENSE',
+    '--approved-by',
+    'fixture-owner',
+    '--decision-date',
+    '2026-07-06',
+    '--evidence-status',
+    'accepted',
+    '--dry-run',
+    '--json',
+  ])
+  selectedMissing = run(process.execPath, [
+    recordScript,
+    '--root',
+    fixture,
+    '--license-status',
+    'selected',
+    '--dry-run',
+    '--json',
+  ])
+  notPublicOk = run(process.execPath, [
+    recordScript,
+    '--root',
+    fixture,
+    '--license-status',
+    'not-public',
+    '--approved-by',
+    'fixture-owner',
+    '--decision-date',
+    '2026-07-06',
+    '--dry-run',
+    '--json',
+  ])
+  notPublicMissing = run(process.execPath, [
+    recordScript,
+    '--root',
+    fixture,
+    '--license-status',
+    'not-public',
+    '--dry-run',
+    '--json',
+  ])
+}
+
+const ownerRequiredData = ownerRequired ? parseJson(ownerRequired.stdout) : null
+const selectedOkData = selectedOk ? parseJson(selectedOk.stdout) : null
+const selectedMissingData = selectedMissing ? parseJson(selectedMissing.stdout) : null
+const notPublicOkData = notPublicOk ? parseJson(notPublicOk.stdout) : null
+const notPublicMissingData = notPublicMissing ? parseJson(notPublicMissing.stdout) : null
+
+const checks = [
+  check('PD01', 'public release decision command exists', exists('scripts/record-public-release.mjs'), 'scripts/record-public-release.mjs'),
+  check('PD02', 'owner-required decision path remains writable without approval fields', ownerRequired?.status === 0 && ownerRequiredData?.status === 'ready' && ownerRequiredData?.licenseStatus === 'owner-required' && ownerRequiredData?.evidenceStatus === 'result', 'record-public-release --license-status owner-required --dry-run'),
+  check('PD03', 'selected-license decision path accepts complete owner evidence', selectedOk?.status === 0 && selectedOkData?.status === 'ready' && selectedOkData?.licenseStatus === 'selected' && selectedOkData?.evidenceStatus === 'accepted', 'record-public-release --license-status selected fixture dry-run'),
+  check('PD04', 'selected-license decision path rejects missing owner evidence', selectedMissing?.status !== 0 && selectedMissingData?.status === 'failed' && selectedMissingData?.errors?.some((item) => item.includes('--spdx')) && selectedMissingData?.errors?.some((item) => item.includes('--approved-by')), 'record-public-release selected missing-fields dry-run'),
+  check('PD05', 'not-public decision path accepts explicit owner decision', notPublicOk?.status === 0 && notPublicOkData?.status === 'ready' && notPublicOkData?.licenseStatus === 'not-public', 'record-public-release --license-status not-public fixture dry-run'),
+  check('PD06', 'not-public decision path rejects missing owner decision', notPublicMissing?.status !== 0 && notPublicMissingData?.status === 'failed' && notPublicMissingData?.errors?.some((item) => item.includes('--approved-by')) && notPublicMissingData?.errors?.some((item) => item.includes('--decision-date')), 'record-public-release not-public missing-fields dry-run'),
+  check('PD07', 'public release docs describe all decision states', publicRelease.includes('owner-required | selected | not-public') && publicRelease.includes('For `--license-status selected`') && publicRelease.includes('not-public'), 'references/public-release.md'),
+  check('PD08', 'validator and completion audits include public decision lifecycle', validate.includes('audit-public-release-decision.mjs') && completion.includes('audit-public-release-decision.mjs') && roadmap.includes('audit-public-release-decision.mjs'), 'validate, completion, roadmap audits'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  fixtureRoot: fixture,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicReleaseDecisionLifecycle: failed === 0 ? 'verified' : 'failed',
+  },
+  limits: [
+    'This audit verifies decision-path mechanics for owner-required, selected-license, and not-public records.',
+    'The selected-license path is tested with a temporary fixture license; it does not select a license for GSE.',
+    'Accepted public release for GSE still requires an owner-approved real license file or explicit not-public decision record.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Release Decision Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public release decision lifecycle: ' + data.workflows.publicReleaseDecisionLifecycle)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)