@t275005746/gse 0.1.0

package/scripts/audit-public-release-metadata.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const skill = read('SKILL.md')
+const release = read('references/release.md')
+const publicRelease = read('references/public-release.md')
+const releaseTrust = read('references/release-trust.md')
+const marketplace = read('references/marketplace-discovery.md')
+const changelog = read('CHANGELOG.md')
+const template = read('assets/templates/public-release-record.md')
+const validate = read('scripts/validate-gse.mjs')
+const recordScript = read('scripts/record-public-release.mjs')
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+const ownerRequiredDryRun = exists('scripts/record-public-release.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'record-public-release.mjs'), '--root', root, '--license-status', 'owner-required', '--dry-run', '--json'])
+  : null
+const ownerRequiredData = ownerRequiredDryRun ? parseJson(ownerRequiredDryRun.stdout) : null
+const selectedFailureRun = exists('scripts/record-public-release.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'record-public-release.mjs'), '--root', root, '--license-status', 'selected', '--dry-run', '--json'])
+  : null
+const selectedFailureData = selectedFailureRun ? parseJson(selectedFailureRun.stdout) : null
+
+const ownerLicensePending =
+  publicRelease.includes('GSE must not choose a license by guessing') &&
+  publicRelease.includes('owner-required') &&
+  changelog.includes('Open-source license selection remains an owner decision')
+
+const releaseRecord = read('.gse/releases/public-release-owner-required.md')
+const ownerRequiredRecord =
+  releaseRecord.includes('License status: owner-required') &&
+  releaseRecord.includes('Evidence status: result')
+const selectedAcceptedRecord =
+  releaseRecord.includes('License status: selected') &&
+  releaseRecord.includes('SPDX identifier: MIT') &&
+  releaseRecord.includes('License file: LICENSE') &&
+  releaseRecord.includes('Evidence status: accepted')
+const releaseRecordStatus = selectedAcceptedRecord
+  ? 'accepted-license-decision'
+  : ownerRequiredRecord
+    ? 'owner-required'
+    : 'unknown'
+
+const releaseRecordFields = [
+  'Release name:',
+  'Release version or label:',
+  'Distribution channel:',
+  'License status:',
+  'SPDX identifier:',
+  'License file:',
+  'Approved by:',
+  'Changelog path:',
+  'Validation command:',
+  'Known unsupported claims:',
+  'Evidence status:',
+]
+
+const changelogTerms = [
+  '# Changelog',
+  '## Unreleased',
+  '### Added',
+  '### Verified',
+  '### Not Yet Accepted',
+  'Public registry publication and marketplace approval are not verified',
+]
+
+const checks = [
+  check('PR01', 'public release reference exists', exists('references/public-release.md'), 'references/public-release.md'),
+  check('PR02', 'public release record template exists', exists('assets/templates/public-release-record.md'), 'assets/templates/public-release-record.md'),
+  check('PR03', 'changelog exists with public-release boundaries', exists('CHANGELOG.md') && changelogTerms.every((term) => changelog.includes(term)), 'CHANGELOG.md'),
+  check('PR04', 'license decision is owner-gated and not guessed', ownerLicensePending, 'references/public-release.md, CHANGELOG.md'),
+  check('PR05', 'public release record captures owner/license/release evidence fields', releaseRecordFields.every((field) => template.includes(field)), releaseRecordFields.join(', ')),
+  check('PR06', 'release docs route to public metadata, trust, and marketplace gates', release.includes('references/public-release.md') && publicRelease.includes('references/release-trust.md') && publicRelease.includes('references/marketplace-discovery.md') && releaseTrust.includes('release-trust') && marketplace.includes('marketplace'), 'release, public-release, release-trust, marketplace references'),
+  check('PR07', 'SKILL routes public release metadata reference', skill.includes('references/public-release.md'), 'SKILL.md Reference Routing'),
+  check('PR08', 'validator includes public release metadata audit', validate.includes('audit-public-release-metadata.mjs'), 'scripts/validate-gse.mjs'),
+  check('PR09', 'public release record command exists and is documented', exists('scripts/record-public-release.mjs') && publicRelease.includes('scripts/record-public-release.mjs') && skill.includes('record-public-release.mjs'), 'scripts/record-public-release.mjs, references/public-release.md, SKILL.md'),
+  check('PR10', 'public release record command can dry-run owner-required state', ownerRequiredDryRun?.status === 0 && ownerRequiredData?.status === 'ready' && ownerRequiredData?.licenseStatus === 'owner-required', 'record-public-release owner-required dry-run'),
+  check('PR11', 'selected license mode requires owner decision fields', selectedFailureRun?.status !== 0 && selectedFailureData?.status === 'failed' && selectedFailureData?.errors?.some((item) => item.includes('--spdx')) && recordScript.includes('selected license requires --approved-by'), 'record-public-release selected dry-run failure'),
+  check('PR12', 'public release decision record is preserved', exists('.gse/releases/public-release-owner-required.md') && (ownerRequiredRecord || selectedAcceptedRecord), '.gse/releases/public-release-owner-required.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicReleaseMetadata: failed === 0 ? 'verified' : 'failed',
+    publicReleaseAcceptance: releaseRecordStatus,
+  },
+  limits: [
+    'This audit verifies public-release metadata structure, changelog policy, owner-gated license decision, and routing.',
+    'It does not choose a license, publish to GitHub, approve a marketplace listing, or certify legal suitability.',
+    'Accepted public release still requires public repository, CI, security contact, channel publication, and host-runtime evidence when those claims are made.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Release Metadata Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public release metadata: ' + data.workflows.publicReleaseMetadata)
+  lines.push('- Public release acceptance: ' + data.workflows.publicReleaseAcceptance)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-public-repository-settings.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-public-repo-settings-'))
+  fs.mkdirSync(path.join(fixture, '.gse', 'releases'), { recursive: true })
+  fs.mkdirSync(path.join(fixture, '.github', 'workflows'), { recursive: true })
+  fs.mkdirSync(path.join(fixture, '.github', 'ISSUE_TEMPLATE'), { recursive: true })
+  fs.writeFileSync(path.join(fixture, '.github', 'workflows', 'validate-gse.yml'), 'name: Validate GSE\n', 'utf8')
+  fs.writeFileSync(path.join(fixture, '.github', 'PULL_REQUEST_TEMPLATE.md'), '## Evidence\n', 'utf8')
+  fs.writeFileSync(path.join(fixture, '.github', 'ISSUE_TEMPLATE', 'bug_report.yml'), 'name: Bug report\n', 'utf8')
+  return fixture
+}
+
+const recordScript = path.join(root, 'scripts', 'record-public-repository-settings.mjs')
+const template = read('assets/templates/public-repository-settings-record.md')
+const publicRelease = read('references/public-release.md')
+const finalReadiness = read('references/final-readiness.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const fixture = exists('scripts/record-public-repository-settings.mjs') ? createFixture() : null
+const pending = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--settings-status', 'pending', '--dry-run', '--json']) : null
+const verifiedOk = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--repository-url', 'https://github.com/example/gse',
+  '--visibility', 'public',
+  '--settings-status', 'verified',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/settings/branches',
+  '--issues-enabled', 'true',
+  '--pull-requests-enabled', 'true',
+  '--security-policy-visible', 'true',
+  '--branch-protection-enabled', 'true',
+  '--required-status-checks-enabled', 'true',
+  '--required-checks', 'Validate GSE',
+  '--require-review-before-merge', 'true',
+  '--require-conversation-resolution', 'true',
+  '--restrict-force-pushes', 'true',
+  '--restrict-deletions', 'true',
+  '--evidence-status', 'verified',
+  '--dry-run',
+  '--json',
+]) : null
+const verifiedMissing = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--settings-status', 'verified', '--dry-run', '--json']) : null
+const acceptedMissing = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--repository-url', 'https://github.com/example/gse',
+  '--visibility', 'public',
+  '--settings-status', 'accepted',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/settings/branches',
+  '--issues-enabled', 'true',
+  '--pull-requests-enabled', 'true',
+  '--security-policy-visible', 'true',
+  '--branch-protection-enabled', 'true',
+  '--required-status-checks-enabled', 'true',
+  '--required-checks', 'Validate GSE',
+  '--require-review-before-merge', 'true',
+  '--require-conversation-resolution', 'true',
+  '--restrict-force-pushes', 'true',
+  '--restrict-deletions', 'true',
+  '--evidence-status', 'verified',
+  '--dry-run',
+  '--json',
+]) : null
+const acceptedOk = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--repository-url', 'https://github.com/example/gse',
+  '--visibility', 'public',
+  '--settings-status', 'accepted',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/settings/branches',
+  '--issues-enabled', 'true',
+  '--pull-requests-enabled', 'true',
+  '--security-policy-visible', 'true',
+  '--branch-protection-enabled', 'true',
+  '--required-status-checks-enabled', 'true',
+  '--required-checks', 'Validate GSE',
+  '--require-review-before-merge', 'true',
+  '--require-conversation-resolution', 'true',
+  '--restrict-force-pushes', 'true',
+  '--restrict-deletions', 'true',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--dry-run',
+  '--json',
+]) : null
+const verifiedPlaceholderWrite = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--repository-url', 'https://github.com/example/gse',
+  '--visibility', 'public',
+  '--settings-status', 'verified',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/settings/branches',
+  '--issues-enabled', 'true',
+  '--pull-requests-enabled', 'true',
+  '--security-policy-visible', 'true',
+  '--branch-protection-enabled', 'true',
+  '--required-status-checks-enabled', 'true',
+  '--required-checks', 'Validate GSE',
+  '--require-review-before-merge', 'true',
+  '--require-conversation-resolution', 'true',
+  '--restrict-force-pushes', 'true',
+  '--restrict-deletions', 'true',
+  '--evidence-status', 'verified',
+  '--json',
+]) : null
+
+const pendingData = pending ? parseJson(pending.stdout) : null
+const verifiedOkData = verifiedOk ? parseJson(verifiedOk.stdout) : null
+const verifiedMissingData = verifiedMissing ? parseJson(verifiedMissing.stdout) : null
+const acceptedMissingData = acceptedMissing ? parseJson(acceptedMissing.stdout) : null
+const acceptedOkData = acceptedOk ? parseJson(acceptedOk.stdout) : null
+const verifiedPlaceholderWriteData = verifiedPlaceholderWrite ? parseJson(verifiedPlaceholderWrite.stdout) : null
+
+const checks = [
+  check('PRS01', 'public repository settings record command exists', exists('scripts/record-public-repository-settings.mjs'), 'scripts/record-public-repository-settings.mjs'),
+  check('PRS02', 'public repository settings template exists', exists('assets/templates/public-repository-settings-record.md') && template.includes('Branch protection enabled') && template.includes('Required status checks enabled'), 'assets/templates/public-repository-settings-record.md'),
+  check('PRS03', 'pending settings path remains writable without external proof', pending?.status === 0 && pendingData?.status === 'ready' && pendingData?.settingsStatus === 'pending' && pendingData?.evidenceStatus === 'pending', 'record-public-repository-settings pending dry-run'),
+  check('PRS04', 'verified settings path accepts complete external evidence', verifiedOk?.status === 0 && verifiedOkData?.status === 'ready' && verifiedOkData?.settingsStatus === 'verified' && verifiedOkData?.evidenceStatus === 'verified', 'record-public-repository-settings verified dry-run'),
+  check('PRS05', 'verified settings path rejects missing evidence', verifiedMissing?.status !== 0 && verifiedMissingData?.status === 'failed' && verifiedMissingData?.errors?.some((item) => item.includes('--evidence-owner')) && verifiedMissingData?.errors?.some((item) => item.includes('--evidence-date')) && verifiedMissingData?.errors?.some((item) => item.includes('--required-checks')), 'record-public-repository-settings verified missing-fields dry-run'),
+  check('PRS06', 'accepted settings path rejects missing owner acceptance', acceptedMissing?.status !== 0 && acceptedMissingData?.status === 'failed' && acceptedMissingData?.errors?.some((item) => item.includes('--accepted-by')) && acceptedMissingData?.errors?.some((item) => item.includes('--evidence-status accepted')), 'record-public-repository-settings accepted missing acceptance dry-run'),
+  check('PRS07', 'accepted settings path accepts complete owner acceptance', acceptedOk?.status === 0 && acceptedOkData?.status === 'ready' && acceptedOkData?.settingsStatus === 'accepted' && acceptedOkData?.evidenceStatus === 'accepted', 'record-public-repository-settings accepted dry-run'),
+  check('PRS08', 'verified settings real write rejects placeholder or example evidence', verifiedPlaceholderWrite?.status !== 0 && verifiedPlaceholderWriteData?.status === 'failed' && verifiedPlaceholderWriteData?.errors?.some((item) => item.includes('not a placeholder')), 'record-public-repository-settings verified placeholder write'),
+  check('PRS09', 'public release docs reference repository settings evidence', publicRelease.includes('Public repository settings') || publicRelease.includes('repository settings'), 'references/public-release.md'),
+  check('PRS10', 'final readiness matrix includes public repository settings', finalReadiness.includes('Public repository settings'), 'references/final-readiness.md'),
+  check('PRS11', 'consolidated validator includes repository settings audit', validate.includes('audit-public-repository-settings.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  fixtureRoot: fixture,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicRepositorySettings: failed === 0 ? 'verified' : 'failed',
+    acceptedRepositorySettings: acceptedOkData?.status === 'ready' ? 'fixture-verified' : 'not-verified',
+  },
+  limits: [
+    'This audit verifies record mechanics and guardrails for public repository settings.',
+    'It does not configure a real GitHub repository, branch protection, issue settings, required checks, or maintainer policies.',
+    'Accepted public repository settings still require owner/external evidence from the real repository.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Repository Settings Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public repository settings: ' + data.workflows.publicRepositorySettings)
+  lines.push('- Accepted repository settings path: ' + data.workflows.acceptedRepositorySettings)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-public-security-contact.mjs

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-public-security-contact-'))
+  fs.mkdirSync(path.join(fixture, '.gse', 'releases'), { recursive: true })
+  fs.writeFileSync(path.join(fixture, 'SECURITY.md'), '# Security Policy\n\nNo public vulnerability disclosure address has been owner-approved yet.\n', 'utf8')
+  return fixture
+}
+
+const recordScript = path.join(root, 'scripts', 'record-public-security-contact.mjs')
+const template = read('assets/templates/public-security-contact-record.md')
+const security = read('SECURITY.md')
+const publicRelease = read('references/public-release.md')
+const finalReadiness = read('references/final-readiness.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const fixture = exists('scripts/record-public-security-contact.mjs') ? createFixture() : null
+const pending = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--contact-status', 'pending', '--dry-run', '--json']) : null
+const acceptedOk = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--contact-status', 'accepted',
+  '--contact-type', 'email',
+  '--contact-value', 'security@example.com',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/security/policy',
+  '--is-public', 'true',
+  '--security-policy-updated', 'true',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--dry-run',
+  '--json',
+]) : null
+const acceptedMissing = fixture ? run(process.execPath, [recordScript, '--root', fixture, '--contact-status', 'accepted', '--evidence-status', 'pending', '--dry-run', '--json']) : null
+const acceptedPlaceholderWrite = fixture ? run(process.execPath, [
+  recordScript,
+  '--root', fixture,
+  '--contact-status', 'accepted',
+  '--contact-type', 'email',
+  '--contact-value', 'security@example.com',
+  '--evidence-owner', 'fixture-owner',
+  '--evidence-date', '2026-07-06',
+  '--evidence-url', 'https://github.com/example/gse/security/policy',
+  '--is-public', 'true',
+  '--security-policy-updated', 'true',
+  '--evidence-status', 'accepted',
+  '--accepted-by', 'fixture-owner',
+  '--accepted-at', '2026-07-06',
+  '--json',
+]) : null
+
+const pendingData = pending ? parseJson(pending.stdout) : null
+const acceptedOkData = acceptedOk ? parseJson(acceptedOk.stdout) : null
+const acceptedMissingData = acceptedMissing ? parseJson(acceptedMissing.stdout) : null
+const acceptedPlaceholderWriteData = acceptedPlaceholderWrite ? parseJson(acceptedPlaceholderWrite.stdout) : null
+
+const checks = [
+  check('PSC01', 'public security contact record command exists', exists('scripts/record-public-security-contact.mjs'), 'scripts/record-public-security-contact.mjs'),
+  check('PSC02', 'public security contact template exists', exists('assets/templates/public-security-contact-record.md') && template.includes('Contact status') && template.includes('Security policy updated?'), 'assets/templates/public-security-contact-record.md'),
+  check('PSC03', 'pending contact path remains writable without owner proof', pending?.status === 0 && pendingData?.status === 'ready' && pendingData?.contactStatus === 'pending' && pendingData?.evidenceStatus === 'pending', 'record-public-security-contact pending dry-run'),
+  check('PSC04', 'accepted contact path accepts complete owner evidence', acceptedOk?.status === 0 && acceptedOkData?.status === 'ready' && acceptedOkData?.contactStatus === 'accepted' && acceptedOkData?.evidenceStatus === 'accepted', 'record-public-security-contact accepted dry-run'),
+  check('PSC05', 'accepted contact path rejects missing owner evidence', acceptedMissing?.status !== 0 && acceptedMissingData?.status === 'failed' && acceptedMissingData?.errors?.some((item) => item.includes('--contact-value')) && acceptedMissingData?.errors?.some((item) => item.includes('--accepted-by')) && acceptedMissingData?.errors?.some((item) => item.includes('--evidence-status accepted')), 'record-public-security-contact accepted missing-fields dry-run'),
+  check('PSC06', 'accepted contact real write rejects placeholder or example evidence', acceptedPlaceholderWrite?.status !== 0 && acceptedPlaceholderWriteData?.status === 'failed' && acceptedPlaceholderWriteData?.errors?.some((item) => item.includes('not a placeholder')), 'record-public-security-contact accepted placeholder write'),
+  check('PSC07', 'security policy keeps public contact owner-gated', security.includes('Until a public security contact is chosen') && security.includes('No public vulnerability disclosure address has been owner-approved yet'), 'SECURITY.md'),
+  check('PSC08', 'public release docs reference public security contact evidence', publicRelease.includes('Public security contact') && publicRelease.includes('record-public-security-contact.mjs'), 'references/public-release.md'),
+  check('PSC09', 'final readiness matrix includes public security contact record', finalReadiness.includes('Public security contact record') && finalReadiness.includes('Public security contact'), 'references/final-readiness.md'),
+  check('PSC10', 'consolidated validator includes public security contact audit', validate.includes('audit-public-security-contact.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  fixtureRoot: fixture,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    publicSecurityContact: failed === 0 ? 'verified' : 'failed',
+    acceptedSecurityContact: acceptedOkData?.status === 'ready' ? 'fixture-verified' : 'not-verified',
+  },
+  limits: [
+    'This audit verifies record mechanics and guardrails for public security contact acceptance.',
+    'It does not create a real public vulnerability disclosure address or approve a SECURITY.md policy.',
+    'Accepted public security contact still requires owner evidence from the real public release process.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public Security Contact Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public security contact: ' + data.workflows.publicSecurityContact)
+  lines.push('- Accepted security contact path: ' + data.workflows.acceptedSecurityContact)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)