@t275005746/gse 0.1.0

package/scripts/audit-readme-docs.mjs

@@ -0,0 +1,185 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function section(text, heading) {
+  const start = text.indexOf(heading)
+  if (start === -1) return ''
+  const next = text.indexOf('\n## ', start + heading.length)
+  return next === -1 ? text.slice(start) : text.slice(start, next)
+}
+
+function z(codes) {
+  return String.fromCodePoint(...codes)
+}
+
+function hasBom(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  if (!fs.existsSync(fullPath)) return false
+  const bytes = fs.readFileSync(fullPath)
+  return bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf
+}
+
+function hasEncodingDamage(text) {
+  const mojibakeSentinels = [
+    '\uFFFD',
+    String.fromCodePoint(0x951b),
+    String.fromCodePoint(0x9286),
+    String.fromCodePoint(0x9428),
+    String.fromCodePoint(0x95c8),
+    String.fromCodePoint(0x6d93),
+    String.fromCodePoint(0x7ecb),
+    String.fromCodePoint(0x6d60),
+  ]
+  return mojibakeSentinels.some((item) => text.includes(item))
+}
+
+const english = read('README.md')
+const chinese = read('README.zh-CN.md')
+const skill = read('SKILL.md')
+const validate = read('scripts/validate-gse.mjs')
+const packaging = read('references/packaging.md')
+const englishCommunity = section(english, '## Community')
+const zh = {
+  community: z([0x23, 0x23, 0x20, 0x793e, 0x533a]),
+  noPretend: z([0x4e0d, 0x8981, 0x5047, 0x88c5]),
+  noGroundlessClaim: z([0x4e0d, 0x80fd, 0x51ed, 0x7a7a, 0x5ba3, 0x79f0]),
+  noGateHubDependency: z([0x4e0d, 0x4f9d, 0x8d56, 0x20, 0x47, 0x61, 0x74, 0x65, 0x48, 0x75, 0x62]),
+  notRegistryCenter: z([0x4e0d, 0x662f, 0x20, 0x47, 0x53, 0x45, 0x20, 0x7684, 0x5305, 0x6ce8, 0x518c, 0x4e2d, 0x5fc3]),
+  securityDisclosureChannel: z([0x5b89, 0x5168, 0x6f0f, 0x6d1e, 0x62ab, 0x9732, 0x6e20, 0x9053]),
+  hostRuntimeCertification: 'host runtime ' + z([0x8ba4, 0x8bc1]),
+  highlights: z([0x23, 0x23, 0x20, 0x4eae, 0x70b9]),
+  quickStart: z([0x23, 0x23, 0x20, 0x5feb, 0x901f, 0x5f00, 0x59cb]),
+  longRunningAgentProjects: z([0x9762, 0x5411, 0x957f, 0x671f, 0x20, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x20, 0x8f85, 0x52a9, 0x8f6f, 0x4ef6, 0x9879, 0x76ee]),
+  whenToUse: z([0x23, 0x23, 0x20, 0x4ec0, 0x4e48, 0x65f6, 0x5019, 0x7528, 0x20, 0x47, 0x53, 0x45]),
+  manyAgentSessions: z([0x9879, 0x76ee, 0x4f1a, 0x8de8, 0x5f88, 0x591a, 0x20, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x20, 0x4f1a, 0x8bdd, 0x6301, 0x7eed, 0x63a8, 0x8fdb]),
+  whatItCreates: z([0x23, 0x23, 0x20, 0x4f1a, 0x521b, 0x5efa, 0x4ec0, 0x4e48]),
+  projectLayout: z([0x23, 0x23, 0x20, 0x9879, 0x76ee, 0x7ed3, 0x6784]),
+  commands: z([0x23, 0x23, 0x20, 0x547d, 0x4ee4]),
+  documentation: z([0x23, 0x23, 0x20, 0x6587, 0x6863]),
+  recommendedTopics: z([0x63a8, 0x8350, 0x20, 0x47, 0x69, 0x74, 0x48, 0x75, 0x62, 0x20, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x73]),
+  recommendedDescription: z([0x63a8, 0x8350, 0x4ed3, 0x5e93, 0x20, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e]),
+  largeProjectFirstAdoption: z([0x5927, 0x9879, 0x76ee, 0x7b2c, 0x4e00, 0x6b21, 0x63a5, 0x5165, 0x4e5f, 0x53ef, 0x4ee5, 0x76f4, 0x63a5, 0x4f7f, 0x7528]),
+  gsePosition: z([0x23, 0x23, 0x20, 0x47, 0x53, 0x45, 0x20, 0x7684, 0x4f4d, 0x7f6e]),
+  searchTerms: z([0x641c, 0x7d22, 0x8bcd]),
+  gatehubSupports: 'GateHub' + z([0xff08]) + '[gatehub.top](https://gatehub.top/)' + z([0xff09, 0x652f, 0x6301, 0x20, 0x47, 0x53, 0x45, 0x20, 0x7684, 0x5f00, 0x53d1]),
+  installation: z([0x23, 0x23, 0x20, 0x5b89, 0x88c5]),
+}
+const chineseCommunity = section(chinese, zh.community)
+
+const sharedTerms = [
+  'Goal -> Spec -> Execute -> Evidence -> Learn',
+  '/gse continue',
+  '/gse status',
+  'result -> verified -> accepted',
+  'validate-gse.mjs',
+  '.gse/',
+  'spec-driven development',
+]
+
+const defensivePhrases = [
+  'not the package registry',
+  'security disclosure channel',
+  'host-runtime certification',
+  'does not require GateHub',
+  'not required to use GSE',
+  'Do not claim',
+  'Do not fake',
+  zh.noPretend,
+  zh.noGroundlessClaim,
+  zh.noGateHubDependency,
+  zh.notRegistryCenter,
+  zh.securityDisclosureChannel,
+  zh.hostRuntimeCertification,
+]
+
+const checks = [
+  check('RD01', 'English README exists', exists('README.md'), 'README.md'),
+  check('RD02', 'Chinese README exists', exists('README.zh-CN.md'), 'README.zh-CN.md'),
+  check('RD02A', 'READMEs link to each other for language switching', english.includes('[简体中文](README.zh-CN.md)') && chinese.includes('[English](README.md)'), 'README.md, README.zh-CN.md'),
+  check('RD03', 'READMEs share core concepts and commands', sharedTerms.every((term) => english.includes(term) && chinese.includes(term)), sharedTerms.join(', ')),
+  check('RD04', 'READMEs open with value, quick start, and highlights', english.includes('## Highlights') && english.includes('## Quick Start') && english.includes('Goal-Spec-Evidence Engineering for long-running') && chinese.includes(zh.highlights) && chinese.includes(zh.quickStart) && chinese.includes(zh.longRunningAgentProjects), 'README.md, README.zh-CN.md'),
+  check('RD05', 'READMEs explain when to use GSE', english.includes('## When To Use GSE') && english.includes('the project will continue across many agent sessions') && chinese.includes(zh.whenToUse) && chinese.includes(zh.manyAgentSessions), 'README.md, README.zh-CN.md'),
+  check('RD06', 'SKILL links bilingual README docs', skill.includes('README.md') && skill.includes('README.zh-CN.md'), 'SKILL.md'),
+  check('RD07', 'validate-gse runs README docs audit', validate.includes('audit-readme-docs.mjs'), 'scripts/validate-gse.mjs'),
+  check('RD08', 'READMEs include open-source style usage sections', english.includes('## What It Creates') && english.includes('## Project Layout') && english.includes('## Commands') && english.includes('## Documentation') && chinese.includes(zh.whatItCreates) && chinese.includes(zh.projectLayout) && chinese.includes(zh.commands) && chinese.includes(zh.documentation), 'README.md, README.zh-CN.md'),
+  check('RD09', 'READMEs avoid machine-local absolute paths', !english.includes('C:\\Users\\Admin') && !chinese.includes('C:\\Users\\Admin') && english.includes('node scripts/validate-gse.mjs --root . --json') && chinese.includes('node scripts/validate-gse.mjs --root . --json'), 'README.md, README.zh-CN.md'),
+  check('RD10', 'READMEs avoid private project examples', !english.includes('AION') && !chinese.includes('AION') && !english.includes('aion-productization') && !chinese.includes('aion-productization'), 'README.md, README.zh-CN.md'),
+  check('RD11', 'READMEs avoid maintainer-only GitHub metadata blocks', !english.includes('Recommended GitHub topics') && !chinese.includes(zh.recommendedTopics) && !english.includes('Recommended repository description') && !chinese.includes(zh.recommendedDescription), 'README.md, README.zh-CN.md'),
+  check('RD12', 'READMEs avoid defensive caveat bloat', defensivePhrases.every((phrase) => !english.includes(phrase) && !chinese.includes(phrase)), 'README.md, README.zh-CN.md'),
+  check('RD13', 'READMEs explain scaffold modes and project workspace', english.includes('lite') && english.includes('standard') && english.includes('enterprise') && english.includes('Large projects can start directly') && chinese.includes('lite') && chinese.includes('standard') && chinese.includes('enterprise') && chinese.includes(zh.largeProjectFirstAdoption), 'README.md, README.zh-CN.md'),
+  check('RD14', 'READMEs explain goal hierarchy and ecosystem positioning naturally', english.includes('.gse/goals/') && english.includes('agentic engineering') && english.includes('spec-driven development') && english.includes('SDD') && !english.includes('## How GSE Fits') && chinese.includes('.gse/goals/') && chinese.includes('agentic engineering') && chinese.includes('spec-driven development') && chinese.includes('SDD') && !chinese.includes(zh.gsePosition) && !english.includes('Search Terms') && !chinese.includes(zh.searchTerms), 'README.md, README.zh-CN.md'),
+  check('RD15', 'README community sections are concise and non-defensive', englishCommunity.includes('GateHub ([gatehub.top](https://gatehub.top/)) supports GSE development') && !englishCommunity.includes('SUPPORT.md') && !englishCommunity.includes('CONTRIBUTING.md') && englishCommunity.length < 240 && chineseCommunity.includes(zh.gatehubSupports) && !chineseCommunity.includes('SUPPORT.md') && !chineseCommunity.includes('CONTRIBUTING.md') && chineseCommunity.length < 140, 'README.md, README.zh-CN.md'),
+  check('RD16', 'READMEs keep release and security caveats in deeper docs', english.includes('## License') && chinese.includes('## License') && read('references/community-channels.md').includes('vulnerability disclosure channel') && read('references/public-release.md').includes('references/community-channels.md'), 'README.md, README.zh-CN.md, references/community-channels.md, references/public-release.md'),
+  check('RD17', 'READMEs include package, install, and npm metadata commands', english.includes('## Installation') && chinese.includes(zh.installation) && english.includes('node scripts/package-gse.mjs --root . --out <package-dir> --label <release-label>') && chinese.includes('node scripts/package-gse.mjs --root . --out <package-dir> --label <release-label>') && english.includes('node scripts/install-gse.mjs --source <package-dir> --target <install-skill-dir>') && chinese.includes('node scripts/install-gse.mjs --source <package-dir> --target <install-skill-dir>') && english.includes('node scripts/install-gse.mjs --source-url <file-or-http-package-url> --target <install-skill-dir>') && chinese.includes('node scripts/install-gse.mjs --source-url <file-or-http-package-url> --target <install-skill-dir>') && english.includes('node scripts/audit-npm-package-metadata.mjs --root . --json') && chinese.includes('node scripts/audit-npm-package-metadata.mjs --root . --json') && english.includes('node scripts/audit-npm-tarball-install.mjs --root . --json') && chinese.includes('node scripts/audit-npm-tarball-install.mjs --root . --json') && english.includes('node scripts/audit-npm-publish-dry-run.mjs --root . --json') && chinese.includes('node scripts/audit-npm-publish-dry-run.mjs --root . --json') && packaging.includes('audit-npm-package-metadata.mjs') && packaging.includes('audit-npm-tarball-install.mjs') && packaging.includes('audit-npm-publish-dry-run.mjs') && packaging.includes('npm pack --dry-run --json') && english.includes('references/packaging.md') && chinese.includes('references/packaging.md'), 'README.md, README.zh-CN.md, references/packaging.md'),
+  check('RD18', 'READMEs have no BOM, replacement characters, or common mojibake sentinels', !hasBom('README.md') && !hasBom('README.zh-CN.md') && !hasEncodingDamage(english) && !hasEncodingDamage(chinese), 'README.md, README.zh-CN.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { readmeDocs: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit checks bilingual README coverage, public-facing clarity, and avoidance of defensive caveat bloat.',
+    'Release, marketplace, security, and host-runtime boundaries belong in deeper reference docs and dedicated audits.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE README Docs Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- README docs: ' + data.workflows.readmeDocs)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-recovery-readiness.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const recovery = read('references/recovery.md')
+const release = read('references/release.md')
+const incident = read('assets/templates/incident-review.md')
+const quality = read('references/quality-gates.md')
+
+const recoveryClasses = ['recoverable failure', 'blocked work', 'rollback required', 'handoff required', 'incident recovery']
+const failedVerificationSteps = ['Preserve the failed command', 'Decide whether the failure invalidates the result', 'Fix the smallest reusable artifact', 'Re-run the same focused verification', 'mark readiness `not ready` or `result`']
+const releaseRecoveryFields = ['Release scope:', 'Failed gate:', 'Release level:', 'Readiness after failure:', 'Rollback or resume decision:', 'Verification to rerun:', 'Next action:']
+const continuationFields = ['Goal or spec:', 'Active slice:', 'Current evidence status:', 'Changed files:', 'Failed or unavailable tools:', 'Next verification command:', 'Next action:']
+const incidentFields = ['Incident title:', 'Evidence status:', 'Affected users/systems:', 'Data/security/privacy impact:', 'Verification that stabilization worked:', 'Action Items', 'Follow-Up Evidence']
+
+const checks = [
+  check('RC01', 'recovery reference exists', exists('references/recovery.md'), 'references/recovery.md'),
+  check('RC02', 'failure classes cover core recovery cases', recoveryClasses.every((item) => recovery.includes(item)), recoveryClasses.join(', ')),
+  check('RC03', 'failed verification path prevents lowering acceptance', recovery.includes('do not reduce the acceptance bar') && failedVerificationSteps.every((item) => recovery.includes(item)), 'Failed Verification Path'),
+  check('RC04', 'release recovery record has required fields', releaseRecoveryFields.every((item) => recovery.includes(item)), releaseRecoveryFields.join(', ')),
+  check('RC05', 'release recovery routes through release gates', recovery.includes('references/release.md') && release.includes('Use references/recovery.md') && quality.includes('Use `references/recovery.md`'), 'release, recovery, and quality integration'),
+  check('RC06', 'rollback rules protect user and unrelated work', recovery.includes('Do not revert user work or unrelated dirty files') && recovery.includes('references/file-ownership.md'), 'rollback ownership rules'),
+  check('RC07', 'incident template includes commercial follow-up fields', incidentFields.every((item) => incident.includes(item)), incidentFields.join(', ')),
+  check('RC08', 'incident follow-up distinguishes signal, stabilization, prevention, and evidence', incident.includes('Detection gap') && incident.includes('Stabilization') && incident.includes('What Prevents Recurrence') && incident.includes('Remaining risk'), 'incident-review.md sections'),
+  check('RC09', 'future-agent continuation packet is defined', continuationFields.every((item) => recovery.includes(item)), continuationFields.join(', ')),
+  check('RC10', 'fresh-session acceptance is not faked during handoff', recovery.includes('accepted by: fresh-session') && recovery.includes('only after a separate session actually follows the packet'), 'future-agent continuation rule'),
+  check('RC11', 'recovery evidence status routes through taxonomy', recovery.includes('references/evidence-taxonomy.md') && recovery.includes('result, verified, accepted, blocked, rollback required, or not ready'), 'handoff evidence status'),
+  check('RC12', 'incident review is scoped, not mandatory for every failure', recovery.includes('Do not turn every failed command into an incident'), 'incident scope rule'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { recoveryReadiness: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'Recovery readiness audit verifies reusable recovery and incident workflow coverage; it does not exercise a live incident or release rollback.',
+    'Production readiness still depends on project-specific monitors, release tooling, ownership, and environment evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Recovery Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Recovery readiness: ' + data.workflows.recoveryReadiness)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-release-bundle.mjs

@@ -0,0 +1,251 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+import crypto from 'node:crypto'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function sha256File(filePath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
+}
+
+const tempRoot = mkdtempSync(path.join(tmpdir(), 'gse-release-bundle-audit-'))
+const bundlePath = path.join(tempRoot, 'bundle')
+const bundle = run(process.execPath, [
+  path.join(root, 'scripts', 'generate-release-bundle.mjs'),
+  '--root', root,
+  '--label', 'gse-release-bundle-audit',
+  '--out', bundlePath,
+  '--force',
+  '--json',
+])
+const bundleData = parseJson(bundle.stdout)
+function readBundle(fileName) {
+  const fullPath = path.join(bundlePath, fileName)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+const summary = readBundle('release-summary.md')
+const manifest = readBundle('bundle-manifest.json')
+const checklist = readBundle('validation-checklist.md')
+const record = readBundle('public-release-record.md')
+const handoff = readBundle('public-acceptance-handoff.md')
+const hostHandoff = readBundle('host-runtime-evidence-handoff.md')
+const releaseStatusManifest = readBundle('release-status-manifest.json')
+const releaseOwnerActionPlan = readBundle('release-owner-action-plan.md')
+const publicReleaseChecklist = readBundle('public-release-checklist.md')
+const ownerExternalGateKitReadme = readBundle('owner-external-gate-kit/README.md')
+const ownerExternalGateKitManifest = readBundle('owner-external-gate-kit/kit-manifest.json')
+const ownerExternalGateKitRecordCommands = readBundle('owner-external-gate-kit/record-commands.md')
+const ownerExternalGateKitVerificationCommands = readBundle('owner-external-gate-kit/verification-commands.md')
+const installablePackageManifest = readBundle('installable-package/gse-package-manifest.json')
+const provenance = readBundle('provenance.json')
+const checksums = readBundle('checksums.sha256')
+const releaseStatusData = parseJson(releaseStatusManifest)
+const pendingGates = releaseStatusData?.publicAcceptance?.pendingGates ?? []
+const pendingAreas = pendingGates.map((gate) => gate.area)
+const hasPendingRegistryPublication = pendingAreas.includes('Public registry publication')
+const bundleManifestData = parseJson(manifest)
+const ownerExternalGateKitData = parseJson(ownerExternalGateKitManifest)
+const installablePackageManifestData = parseJson(installablePackageManifest)
+const provenanceData = parseJson(provenance)
+const validate = read('scripts/validate-gse.mjs')
+const packaging = read('references/packaging.md')
+const canonicalReleaseStatusManifest = parseJson(read('.gse/acceptance/release-status-manifest.json'))
+const canonicalBundleReleaseOwnerActionPlan = read('.gse/release-bundles/gse-release-bundle-audit/release-owner-action-plan.md')
+const canonicalBundlePublicReleaseChecklist = read('.gse/release-bundles/gse-release-bundle-audit/public-release-checklist.md')
+const canonicalBundleKitReleaseOwnerActionPlan = read('.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/release-owner-action-plan.md')
+const canonicalBundleManifestData = parseJson(read('.gse/release-bundles/gse-release-bundle-audit/bundle-manifest.json'))
+const installedFromBundlePath = path.join(tempRoot, 'installed-from-bundle')
+const installFromBundle = fs.existsSync(path.join(bundlePath, 'installable-package', 'gse-package-manifest.json'))
+  ? run(process.execPath, [
+      path.join(root, 'scripts', 'install-gse.mjs'),
+      '--source',
+      path.join(bundlePath, 'installable-package'),
+      '--target',
+      installedFromBundlePath,
+      '--json',
+    ])
+  : { status: 1, stdout: '', stderr: 'installable package missing' }
+const installFromBundleData = parseJson(installFromBundle.stdout)
+const installedFromBundleCli = fs.existsSync(path.join(installedFromBundlePath, 'scripts', 'gse.mjs'))
+  ? run(process.execPath, [
+      path.join(installedFromBundlePath, 'scripts', 'gse.mjs'),
+      'status',
+      '--target',
+      installedFromBundlePath,
+      '--json',
+    ])
+  : { status: 1, stdout: '', stderr: 'installed gse cli missing' }
+const installedFromBundleCliData = parseJson(installedFromBundleCli.stdout)
+
+function planMatchesManifestCounts(plan, data) {
+  if (!plan || !data) return false
+  const verifiedRows = data.readiness?.verified?.length ?? 0
+  const ownerRequiredRows = data.readiness?.ownerRequired?.length ?? 0
+  const externalRequiredRows = data.readiness?.externalRequired?.length ?? 0
+  const publicAccepted = data.publicAcceptance?.publicAccepted ?? data.claimBoundary?.publicAccepted ?? 'unknown'
+  const pendingGates = data.publicAcceptance?.pendingGates ?? []
+  return plan.includes('- Public accepted: ' + publicAccepted) &&
+    plan.includes('- Verified rows: ' + verifiedRows) &&
+    plan.includes('- Owner-required rows: ' + ownerRequiredRows) &&
+    plan.includes('- External-required rows: ' + externalRequiredRows) &&
+    pendingGates.every((gate) => plan.includes('#### ' + gate.area)) &&
+    !plan.includes('#### License decision')
+}
+
+function hasLocalPathLeak(text) {
+  const escapedRoot = root.replace(/\\/g, '\\\\')
+  const forwardRoot = root.replace(/\\/g, '/')
+  const escapedForwardRoot = forwardRoot.replace(/\//g, '\\/')
+  return text.includes(root) ||
+    text.includes(escapedRoot) ||
+    text.includes(forwardRoot) ||
+    text.includes(escapedForwardRoot) ||
+    /C:\\\\Program Files\\\\nodejs\\\\node\.exe/i.test(text) ||
+    /C:\\Program Files\\nodejs\\node\.exe/i.test(text)
+}
+
+function verifyChecksumFile() {
+  if (!checksums.trim()) return false
+  const rows = checksums.trim().split(/\r?\n/)
+  return rows.every((row) => {
+    const match = row.match(/^([a-f0-9]{64})  (.+)$/)
+    if (!match) return false
+    const [, hash, relativePath] = match
+    const fullPath = path.join(bundlePath, relativePath)
+    if (!fs.existsSync(fullPath) || !fs.statSync(fullPath).isFile()) return false
+    return sha256File(fullPath) === hash
+  }) && rows.some((row) => row.endsWith('installable-package/gse-package-manifest.json'))
+}
+
+const checks = [
+  check('RB01', 'release bundle generator exists', exists('scripts/generate-release-bundle.mjs'), 'scripts/generate-release-bundle.mjs'),
+  check('RB02', 'release bundle generation succeeds', bundle.status === 0 && bundleData?.status === 'written', 'generate-release-bundle audit run'),
+  check('RB03', 'bundle includes required handoff files', ['release-summary.md', 'install-commands.md', 'validation-checklist.md', 'public-release-record.md', 'public-acceptance-handoff.md', 'host-runtime-evidence-handoff.md', 'release-status-manifest.json', 'release-owner-action-plan.md', 'public-release-checklist.md', 'owner-external-gate-kit/README.md', 'owner-external-gate-kit/kit-manifest.json', 'installable-package/gse-package-manifest.json', 'provenance.json', 'checksums.sha256', 'bundle-manifest.json'].every((item) => fs.existsSync(path.join(bundlePath, item))), bundlePath),
+  check('RB04', 'bundle preserves license decision and public release boundary', summary.includes('Accepted public release: not accepted') && record.includes('License status: selected') && record.includes('SPDX identifier: MIT') && record.includes('Evidence status: accepted'), 'release-summary.md, public-release-record.md'),
+  check('RB05', 'bundle includes install, validation, and installed CLI commands', summary.includes('installable-package/') && summary.includes('install-gse.mjs') && summary.includes('validate-gse.mjs') && summary.includes('scripts/gse.mjs status') && checklist.includes('audit-remote-distribution.mjs'), 'release-summary.md, validation-checklist.md'),
+  check('RB05b', 'bundle includes host runtime drill before cross-host handoff', summary.includes('audit-host-runtime-invocation-drill.mjs') && checklist.includes('audit-host-runtime-invocation-drill.mjs'), 'release-summary.md, validation-checklist.md'),
+  check('RB06', 'bundle manifest records validation and limits', manifest.includes('"validation"') && manifest.includes('Bundle does not choose a license') && bundleManifestData?.publicReleaseAcceptance === 'not-accepted' && bundleManifestData?.licenseDecision === 'accepted' && manifest.includes('"publicAcceptanceHandoff": "included"') && manifest.includes('"hostRuntimeEvidenceHandoff": "included"') && manifest.includes('"releaseStatusManifest": "included"') && manifest.includes('"releaseOwnerActionPlan": "included"'), 'bundle-manifest.json'),
+  check('RB06v', 'bundle manifest records compact validation check details', Array.isArray(bundleManifestData?.validationChecks) && bundleManifestData.validationChecks.some((item) => item.id === 'validate-09o' && item.label === 'public evidence placeholder helper audit' && item.command?.includes('audit-evidence-placeholders.mjs')) && summary.includes('Validation manifest detail'), 'bundle-manifest.json, release-summary.md'),
+  check('RB06v2', 'canonical bundle manifest records current validation check details', Array.isArray(canonicalBundleManifestData?.validationChecks) && canonicalBundleManifestData.validationChecks.some((item) => item.id === 'validate-09o' && item.label === 'public evidence placeholder helper audit' && item.command?.includes('audit-evidence-placeholders.mjs')), '.gse/release-bundles/gse-release-bundle-audit/bundle-manifest.json'),
+  check('RB06v3', 'bundle manifest records installable package snapshot', bundleManifestData?.installablePackage?.path === 'installable-package/' && bundleManifestData?.installablePackage?.manifest === 'installable-package/gse-package-manifest.json' && bundleManifestData?.installablePackage?.algorithm === 'sha256' && bundleManifestData?.installablePackage?.cli === 'scripts/gse.mjs', 'bundle-manifest.json installablePackage'),
+  check('RB06v4', 'bundle installable package manifest is valid', installablePackageManifestData?.integrity?.algorithm === 'sha256' && installablePackageManifestData?.entrypoints?.cli === 'scripts/gse.mjs' && installablePackageManifestData?.fileHashes?.['SKILL.md'], 'installable-package/gse-package-manifest.json'),
+  check('RB06v5', 'bundle installable package installs and installed CLI runs', installFromBundle.status === 0 && installFromBundleData?.status === 'passed' && installFromBundleData?.summary?.integrityFailed === 0 && installedFromBundleCli.status === 0 && installedFromBundleCliData?.command === '/gse status' && installedFromBundleCliData?.project?.stateValid === true, 'installable-package install and gse status'),
+  check('RB06v6', 'bundle provenance records local generation boundaries', provenanceData?.generator === 'scripts/generate-release-bundle.mjs' && provenanceData?.installablePackage?.packageDigest === installablePackageManifestData?.integrity?.packageDigest && provenanceData?.publicAcceptance?.status === 'not-accepted' && Array.isArray(provenanceData?.claimBoundaries) && provenanceData.claimBoundaries.some((item) => item.includes('not a registry attestation')), 'provenance.json'),
+  check('RB06v7', 'bundle checksums verify installable package files', verifyChecksumFile(), 'checksums.sha256'),
+  check('RB06v8', 'bundle provenance and checksums do not expose local paths', !hasLocalPathLeak(provenance) && !hasLocalPathLeak(checksums), 'provenance.json, checksums.sha256'),
+  check('RB06a', 'bundle manifest does not expose local source root or Node install path', bundleManifestData && !Object.hasOwn(bundleManifestData, 'sourceRoot') && !hasLocalPathLeak(manifest), 'bundle-manifest.json'),
+  check('RB06b', 'bundle includes public acceptance handoff boundaries', handoff.includes('GSE Public Acceptance Handoff') && handoff.includes('Public accepted: not-accepted') && handoff.includes('Do not claim public release acceptance'), 'public-acceptance-handoff.md'),
+  check('RB06b2', 'bundle public acceptance handoff uses current registry publication CLI flag when pending', !hasPendingRegistryPublication || (handoff.includes('--proves-registry-publication true') && !handoff.includes('--proves-public-registry-publication')), 'public-acceptance-handoff.md'),
+  check('RB06b3', 'bundle public acceptance handoff includes dry-run preflight commands', handoff.includes('Preflight command') && handoff.includes('--dry-run --json'), 'public-acceptance-handoff.md'),
+  check('RB06c', 'bundle includes host runtime evidence handoff boundaries', hostHandoff.includes('GSE Host Runtime Evidence Handoff') && hostHandoff.includes('Do not claim native slash-command support') && hostHandoff.includes('record-host-invocation.mjs'), 'host-runtime-evidence-handoff.md'),
+  check('RB06d', 'bundle includes machine-readable release status manifest', releaseStatusData?.claimBoundary?.publicAccepted === 'not-accepted' && releaseStatusManifest.includes('"releaseStatusManifest"') && releaseStatusManifest.includes('"localInstalledCli": "verified"') && releaseStatusManifest.includes('"remoteInstalledCli": "verified"') && releaseStatusManifest.includes('"nativeSlashCommandRecords": 0') && releaseStatusManifest.includes('"fixtureDrill": "verified"') && releaseStatusManifest.includes('"fixtureEvidenceIsPersistent": false'), 'release-status-manifest.json'),
+  check('RB06d2', 'bundle release status manifest includes dry-run preflight commands', (releaseStatusData?.publicAcceptance?.nextPreflightCommands?.length ?? 0) === (releaseStatusData?.publicAcceptance?.pendingGates?.length ?? -1) && releaseStatusData.publicAcceptance.nextPreflightCommands.every((command) => command.includes('--dry-run --json')), 'release-status-manifest.json'),
+  check('RB06d3', 'bundle release status manifest includes preflight command drill', releaseStatusData?.verificationCommands?.some((command) => command.includes('audit-public-acceptance-command-dry-run-drill.mjs')), 'release-status-manifest.json'),
+  check('RB06e', 'bundle includes owner-facing release action plan', releaseOwnerActionPlan.includes('GSE Release Owner Action Plan') && pendingGates.every((gate) => releaseOwnerActionPlan.includes('#### ' + gate.area)) && !releaseOwnerActionPlan.includes('record-public-release.mjs') && releaseOwnerActionPlan.includes('Local validation does not mean public acceptance'), 'release-owner-action-plan.md'),
+  check('RB06e2', 'bundle owner action plan includes dry-run preflight commands and drill', releaseOwnerActionPlan.includes('Preflight command') && releaseOwnerActionPlan.includes('--dry-run --json') && releaseOwnerActionPlan.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'release-owner-action-plan.md'),
+  check('RB06e3', 'canonical release bundle owner action plans match current manifest counts and pending gates', planMatchesManifestCounts(canonicalBundleReleaseOwnerActionPlan, canonicalReleaseStatusManifest) && planMatchesManifestCounts(canonicalBundleKitReleaseOwnerActionPlan, canonicalReleaseStatusManifest), '.gse/release-bundles/gse-release-bundle-audit/release-owner-action-plan.md'),
+  check('RB06e4', 'bundle includes linear public release checklist', publicReleaseChecklist.includes('GSE Public Release Checklist') && publicReleaseChecklist.includes('01. Prepare the release bundle') && publicReleaseChecklist.includes('08. Record other host runtime invocation evidence') && publicReleaseChecklist.includes('Public accepted: not-accepted') && publicReleaseChecklist.includes('/gse release --execute --out <bundle>'), 'public-release-checklist.md'),
+  check('RB06e5', 'canonical release bundle checklist matches pending gate count', canonicalBundlePublicReleaseChecklist.includes('GSE Public Release Checklist') && canonicalBundlePublicReleaseChecklist.includes('Pending owner/external gates: ' + (canonicalReleaseStatusManifest?.publicAcceptance?.pendingGates?.length ?? 0)), '.gse/release-bundles/gse-release-bundle-audit/public-release-checklist.md'),
+  check('RB06f', 'bundle includes owner/external gate execution kit', ownerExternalGateKitReadme.includes('GSE Owner / External Gate Kit') && ownerExternalGateKitData?.pendingGateCount === releaseStatusData?.publicAcceptance?.pendingGates?.length && ownerExternalGateKitData?.generatedFresh?.finalAcceptancePacket === true && !ownerExternalGateKitRecordCommands.includes('record-public-release.mjs'), 'owner-external-gate-kit/'),
+  check('RB06f2', 'bundle owner/external gate kit includes dry-run preflight commands', ownerExternalGateKitRecordCommands.includes('Preflight command') && ownerExternalGateKitRecordCommands.includes('--dry-run --json'), 'owner-external-gate-kit/record-commands.md'),
+  check('RB06f3', 'bundle owner/external gate kit includes preflight command drill', ownerExternalGateKitVerificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'owner-external-gate-kit/verification-commands.md'),
+  check('RB07', 'validator includes release bundle audit', validate.includes('audit-release-bundle.mjs'), 'scripts/validate-gse.mjs'),
+  check('RB08', 'packaging docs route release bundle command', packaging.includes('generate-release-bundle.mjs') && packaging.includes('audit-release-bundle.mjs'), 'references/packaging.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { releaseBundle: failed === 0 ? 'verified' : 'failed' },
+  bundle: bundleData,
+  tempRoot,
+  limits: [
+    'This audit verifies release bundle generation and contents.',
+    'This audit writes to an isolated temporary directory and does not mutate the canonical release bundle path.',
+    'It does not publish a package, approve a marketplace listing, choose a license, or prove host-native slash-command support.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Release Bundle Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Release bundle: ' + data.workflows.releaseBundle)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+rmSync(tempRoot, { recursive: true, force: true })
+
+if (failed > 0) process.exit(1)