@t275005746/gse 0.1.0

package/scripts/audit-release-owner-action-plan-drill.mjs

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function copySkillFixture() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-owner-action-plan-drill-'))
+  fs.cpSync(root, fixture, {
+    recursive: true,
+    filter(source) {
+      const normalized = source.replace(/\\/g, '/')
+      return !normalized.includes('/.git/') && !normalized.includes('/node_modules/')
+    },
+  })
+  fs.writeFileSync(path.join(fixture, 'LICENSE'), 'MIT License\n\nFixture only.\n', 'utf8')
+  return fixture
+}
+
+function runFixtureScript(fixture, scriptName, scriptArgs) {
+  return run(process.execPath, [path.join(fixture, 'scripts', scriptName), '--root', fixture, ...scriptArgs, '--force', '--json'], fixture)
+}
+
+function requiredCommandScriptsFor(gates) {
+  return [...new Set(gates.map((gate) => {
+    const match = String(gate.recordCommand ?? '').match(/scripts\/([\w-]+\.mjs)/)
+    return match ? match[1] : null
+  }).filter(Boolean))]
+}
+
+const fixture = copySkillFixture()
+const manifestPath = path.join(fixture, '.gse', 'acceptance', 'release-status-manifest.json')
+const planPath = path.join(fixture, '.gse', 'acceptance', 'release-owner-action-plan.md')
+
+const generateManifest = runFixtureScript(fixture, 'generate-release-status-manifest.mjs', [
+  '--out', manifestPath,
+])
+const generatePlan = runFixtureScript(fixture, 'generate-release-owner-action-plan.mjs', [
+  '--manifest', manifestPath,
+  '--out', planPath,
+])
+const manifest = fs.existsSync(manifestPath) ? parseJson(fs.readFileSync(manifestPath, 'utf8')) : null
+const plan = fs.existsSync(planPath) ? fs.readFileSync(planPath, 'utf8') : ''
+const pendingGates = manifest?.publicAcceptance?.pendingGates ?? []
+const commandScripts = requiredCommandScriptsFor(pendingGates)
+
+const recordRuns = [
+  runFixtureScript(fixture, 'record-public-security-contact.mjs', [
+    '--contact-status', 'accepted',
+    '--contact-type', 'url',
+    '--contact-value', 'https://gse.dev/security',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://gse.dev/security-policy',
+    '--is-public', 'true',
+    '--security-policy-updated', 'true',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-security-contact.md'),
+  ]),
+  runFixtureScript(fixture, 'record-public-repository-settings.mjs', [
+    '--repository-url', 'https://github.com/gse-org/gse',
+    '--visibility', 'public',
+    '--settings-status', 'accepted',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://github.com/gse-org/gse/settings/branches',
+    '--issues-enabled', 'true',
+    '--pull-requests-enabled', 'true',
+    '--security-policy-visible', 'true',
+    '--branch-protection-enabled', 'true',
+    '--required-status-checks-enabled', 'true',
+    '--required-checks', 'Validate GSE',
+    '--require-review-before-merge', 'true',
+    '--require-conversation-resolution', 'true',
+    '--restrict-force-pushes', 'true',
+    '--restrict-deletions', 'true',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-repository-settings.md'),
+  ]),
+  runFixtureScript(fixture, 'record-public-ci-run.mjs', [
+    '--run-status', 'accepted',
+    '--run-conclusion', 'success',
+    '--repository-url', 'https://github.com/gse-org/gse',
+    '--workflow-name', 'Validate GSE',
+    '--workflow-file', '.github/workflows/validate-gse.yml',
+    '--run-url', 'https://github.com/gse-org/gse/actions/runs/123',
+    '--commit-sha', '0123456789abcdef0123456789abcdef01234567',
+    '--branch', 'main',
+    '--required-checks', 'Validate GSE',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://github.com/gse-org/gse/actions/runs/123',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--proves-public-ci-run', 'true',
+    '--proves-required-checks', 'true',
+    '--proves-release-commit', 'true',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-ci-run.md'),
+  ]),
+  runFixtureScript(fixture, 'record-public-channel-publication.mjs', [
+    '--publication-status', 'accepted',
+    '--channel-type', 'package-registry',
+    '--channel-name', 'npm',
+    '--channel-url', 'https://registry.npmjs.org/gse',
+    '--version', '1.0.0',
+    '--artifact-digest', 'sha256:fixture',
+    '--review-status', 'published',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://registry.npmjs.org/gse/1.0.0',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--proves-registry-publication', 'true',
+    '--proves-channel-installability', 'true',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-public-registry-publication.md'),
+  ]),
+  runFixtureScript(fixture, 'record-public-channel-publication.mjs', [
+    '--publication-status', 'accepted',
+    '--channel-type', 'marketplace',
+    '--channel-name', 'Codex Marketplace',
+    '--channel-url', 'https://marketplace.openai.com/gse',
+    '--version', '1.0.0',
+    '--review-status', 'approved',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence-date', '2026-07-06',
+    '--evidence-url', 'https://marketplace.openai.com/gse/review',
+    '--evidence-status', 'accepted',
+    '--accepted-by', 'gse-maintainer',
+    '--accepted-at', '2026-07-06',
+    '--proves-marketplace-approval', 'true',
+    '--proves-channel-installability', 'true',
+    '--out', path.join(fixture, '.gse', 'releases', 'fixture-marketplace-approval.md'),
+  ]),
+  runFixtureScript(fixture, 'record-host-invocation.mjs', [
+    '--host', 'Fixture Native Host',
+    '--invocation-method', 'native-slash-command',
+    '--command', '/gse help',
+    '--status', 'accepted',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence', 'fixture native slash-command transcript',
+    '--verification-command', 'node scripts/audit-final-readiness.mjs --root __GSE__ --json',
+    '--native-slash-command', 'true',
+    '--portable-text-command', 'false',
+    '--generated-pointer', 'false',
+    '--owner-acceptance-required', 'false',
+    '--out', path.join(fixture, '.gse', 'evidence', 'host-invocations', 'fixture-native-host.md'),
+  ]),
+  runFixtureScript(fixture, 'record-host-invocation.mjs', [
+    '--host', 'Fixture Other Host',
+    '--invocation-method', 'portable-command-runner',
+    '--command', '/gse continue',
+    '--status', 'accepted',
+    '--evidence-owner', 'gse-maintainer',
+    '--evidence', 'fixture other host runtime transcript',
+    '--verification-command', 'node scripts/audit-final-readiness.mjs --root __GSE__ --json',
+    '--native-slash-command', 'false',
+    '--portable-text-command', 'false',
+    '--generated-pointer', 'false',
+    '--owner-acceptance-required', 'false',
+    '--out', path.join(fixture, '.gse', 'evidence', 'host-invocations', 'fixture-other-host.md'),
+  ]),
+]
+
+const finalReadiness = run(process.execPath, [path.join(fixture, 'scripts', 'audit-final-readiness.mjs'), '--root', fixture, '--json'], fixture)
+const finalReadinessData = parseJson(finalReadiness.stdout)
+const publicDoctor = run(process.execPath, [path.join(fixture, 'scripts', 'audit-public-acceptance-readiness.mjs'), '--root', fixture, '--json'], fixture)
+const publicDoctorData = parseJson(publicDoctor.stdout)
+
+const expectedScripts = commandScripts
+const recordFailures = recordRuns.filter((item) => item.status !== 0)
+const promotedRows = finalReadinessData?.matrix?.filter((row) => row.status === 'verified') ?? []
+
+const checks = [
+  check('ROAD01', 'release status manifest and owner action plan generate in fixture', generateManifest.status === 0 && generatePlan.status === 0 && manifest?.publicAcceptance?.publicAccepted === 'not-accepted' && plan.includes('GSE Release Owner Action Plan'), 'generate manifest and action plan'),
+  check('ROAD02', 'owner action plan covers all pending gates from manifest', pendingGates.length > 0 && pendingGates.every((gate) => plan.includes(gate.area) && plan.includes(gate.recordCommand)) && !pendingGates.some((gate) => gate.area === 'License decision'), `${pendingGates.length} pending gate(s); License decision resolved`),
+  check('ROAD03', 'owner action plan commands map to real record scripts', expectedScripts.every((script) => commandScripts.includes(script)) && !plan.includes('proves-public-registry-publication'), commandScripts.join(', ')),
+  check('ROAD04', 'accepted fixture records can be created for every owner/external gate family', recordFailures.length === 0, recordFailures.map((item) => item.stderr || item.stdout || item.command).join('; ') || 'all fixture records written'),
+  check('ROAD05', 'final readiness promotes to publicAccepted verified after fixture records', finalReadiness.status === 0 && finalReadinessData?.workflows?.publicAccepted === 'verified' && promotedRows.length >= 22, finalReadinessData?.workflows?.publicAccepted ?? 'unknown'),
+  check('ROAD06', 'public acceptance doctor reports no pending gates after accepted fixture records', publicDoctor.status === 0 && publicDoctorData?.summary?.pendingGates === 0 && publicDoctorData?.summary?.publicAccepted === 'verified', `pending=${publicDoctorData?.summary?.pendingGates ?? 'unknown'}, publicAccepted=${publicDoctorData?.summary?.publicAccepted ?? 'unknown'}`),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  fixtureRoot: fixture,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    releaseOwnerActionPlanDrill: failed === 0 ? 'verified' : 'failed',
+    publicAcceptedFixture: finalReadinessData?.workflows?.publicAccepted ?? 'unknown',
+    pendingGatesAfterRecords: publicDoctorData?.summary?.pendingGates ?? 'unknown',
+  },
+  limits: [
+    'This drill verifies the owner action plan path with fixture accepted records.',
+    'It does not create real owner decisions, public CI runs, public repository settings, registry publications, marketplace approvals, or native host invocations.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Release Owner Action Plan Drill')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Fixture root: ' + data.fixtureRoot)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Public accepted fixture: ' + data.workflows.publicAcceptedFixture)
+  lines.push('- Pending gates after records: ' + data.workflows.pendingGatesAfterRecords)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+fs.rmSync(fixture, { recursive: true, force: true })
+
+if (failed > 0) process.exit(1)

package/scripts/audit-release-owner-action-plan.mjs

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const generator = read('scripts/generate-release-owner-action-plan.mjs')
+const validate = read('scripts/validate-gse.mjs')
+const skill = read('SKILL.md')
+const packaging = read('references/packaging.md')
+const releaseGenerator = read('scripts/generate-release-bundle.mjs')
+const releaseAudit = read('scripts/audit-release-bundle.mjs')
+const tmp = mkdtempSync(path.join(tmpdir(), 'gse-release-owner-action-plan-'))
+const tmpManifest = path.join(tmp, 'release-status-manifest.json')
+const tmpPlan = path.join(tmp, 'release-owner-action-plan.md')
+const generatedManifest = exists('scripts/generate-release-status-manifest.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'generate-release-status-manifest.mjs'), '--root', root, '--out', tmpManifest, '--force', '--json'])
+  : null
+const generatedPlan = generatedManifest?.status === 0 && exists('scripts/generate-release-owner-action-plan.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'generate-release-owner-action-plan.mjs'), '--root', root, '--manifest', tmpManifest, '--out', tmpPlan, '--force', '--json'])
+  : null
+const manifest = fs.existsSync(tmpManifest) ? parseJson(fs.readFileSync(tmpManifest, 'utf8')) : null
+const plan = fs.existsSync(tmpPlan) ? fs.readFileSync(tmpPlan, 'utf8') : ''
+const generatedData = generatedPlan ? parseJson(generatedPlan.stdout) : null
+const canonicalPlan = read('.gse/acceptance/release-owner-action-plan.md')
+rmSync(tmp, { recursive: true, force: true })
+
+const pendingGates = manifest?.publicAcceptance?.pendingGates ?? []
+const verifiedRows = manifest?.readiness?.verified?.length ?? 0
+const ownerRequiredRows = manifest?.readiness?.ownerRequired?.length ?? 0
+const externalRequiredRows = manifest?.readiness?.externalRequired?.length ?? 0
+const publicAccepted = manifest?.publicAcceptance?.publicAccepted ?? manifest?.claimBoundary?.publicAccepted ?? 'unknown'
+const requiredOwners = ['project owner', 'repository owner', 'external CI', 'external registry', 'external marketplace', 'host runtime']
+const recordCommands = [...new Set(pendingGates
+  .map((gate) => String(gate.recordCommand ?? '').match(/node scripts\/([^ ]+)/)?.[1] ?? '')
+  .filter(Boolean))]
+const planUsesCompleteRecordCommandTemplates = !plan.includes('--invocation-status') &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(plan) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(plan) &&
+  plan.includes('--status accepted')
+const planVerificationCommandsAreShellSafe = !/(audit-[a-z-]+|validate-gse|generate-release-status-manifest)\.mjs[^\n`]*[<>]/.test(plan) &&
+  plan.includes('__GSE__')
+const canonicalPlanMatchesCurrentManifest = canonicalPlan.includes('- Public accepted: ' + publicAccepted) &&
+  canonicalPlan.includes('- Verified rows: ' + verifiedRows) &&
+  canonicalPlan.includes('- Owner-required rows: ' + ownerRequiredRows) &&
+  canonicalPlan.includes('- External-required rows: ' + externalRequiredRows) &&
+  pendingGates.every((gate) => canonicalPlan.includes('#### ' + gate.area)) &&
+  !canonicalPlan.includes('#### License decision')
+
+const checks = [
+  check('ROAP01', 'release owner action plan generator exists', exists('scripts/generate-release-owner-action-plan.mjs'), 'scripts/generate-release-owner-action-plan.mjs'),
+  check('ROAP02', 'generator reads release status manifest', generator.includes('release-status-manifest.json') && generator.includes('pendingGates') && generator.includes('recordCommand'), 'generator source'),
+  check('ROAP03', 'generator writes parseable action plan report', generatedPlan?.status === 0 && generatedData?.status === 'written' && plan.includes('GSE Release Owner Action Plan'), generatedPlan?.stderr || tmpPlan),
+  check('ROAP04', 'plan preserves public acceptance boundary', plan.includes('Public accepted: not-accepted') && plan.includes('Local validation does not mean public acceptance') && plan.includes('Native slash-command support requires a real host invocation record'), 'claim boundary'),
+  check('ROAP05', 'plan groups actions by responsible owner', requiredOwners.every((owner) => plan.includes(owner.replace(/\b\w/g, (char) => char.toUpperCase())) || pendingGates.every((gate) => gate.owner !== owner)), 'owner groups'),
+  check('ROAP06', 'plan includes every pending gate area', pendingGates.length > 0 && pendingGates.every((gate) => plan.includes(gate.area)) && !plan.includes('#### License decision'), 'pending gate areas; License decision resolved'),
+  check('ROAP07', 'plan includes concrete record commands', recordCommands.length > 0 && recordCommands.every((command) => plan.includes(command)), recordCommands.join(', ')),
+  check('ROAP08', 'plan includes dry-run preflight commands and post-action verification commands', plan.includes('Preflight command') && plan.includes('--dry-run --json') && plan.includes('validate-gse.mjs') && plan.includes('audit-public-acceptance-command-dry-run-drill.mjs') && plan.includes('audit-release-owner-action-plan.mjs') && plan.includes('generate-release-status-manifest.mjs'), 'dry-run preflight and verification commands'),
+  check('ROAP08b', 'plan uses complete record command templates', planUsesCompleteRecordCommandTemplates, 'no ellipsis, no stale host invocation flag, host records use --status accepted'),
+  check('ROAP09', 'skill routes users to release owner action plan', skill.includes('generate-release-owner-action-plan.mjs'), 'SKILL.md'),
+  check('ROAP10', 'packaging docs route release owner action plan', packaging.includes('generate-release-owner-action-plan.mjs') && packaging.includes('audit-release-owner-action-plan.mjs'), 'references/packaging.md'),
+  check('ROAP11', 'validator includes release owner action plan audit', validate.includes('audit-release-owner-action-plan.mjs'), 'scripts/validate-gse.mjs'),
+  check('ROAP12', 'release bundle includes owner action plan', releaseGenerator.includes('release-owner-action-plan.md') && releaseAudit.includes('release-owner-action-plan.md'), 'release bundle generator and audit'),
+  check('ROAP13', 'plan verification commands use shell-safe placeholders', planVerificationCommandsAreShellSafe, 'verification commands use __GSE__ instead of <gse>'),
+  check('ROAP14', 'canonical release owner action plan matches current manifest counts and pending gates', canonicalPlanMatchesCurrentManifest, '.gse/acceptance/release-owner-action-plan.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    releaseOwnerActionPlan: failed === 0 ? 'verified' : 'failed',
+    publicAccepted: manifest?.publicAcceptance?.publicAccepted ?? 'unknown',
+    pendingGates: pendingGates.length,
+  },
+  limits: [
+    'This audit verifies generation of an owner-facing action plan from the release status manifest.',
+    'It does not create owner decisions, public CI, public repository settings, marketplace approval, registry publication, or native slash-command evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Release Owner Action Plan Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Release owner action plan: ' + data.workflows.releaseOwnerActionPlan)
+  lines.push('- Public accepted: ' + data.workflows.publicAccepted)
+  lines.push('- Pending gates: ' + data.workflows.pendingGates)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-release-readiness.mjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const skill = read('SKILL.md')
+const packaging = read('references/packaging.md')
+const release = read('references/release.md')
+const publicRelease = read('references/public-release.md')
+const quality = read('references/quality-gates.md')
+const openai = read('agents/openai.yaml')
+const validate = read('scripts/validate-gse.mjs')
+
+const packageBoundary = ['SKILL.md', 'CHANGELOG.md', 'CONTRIBUTING.md', 'SECURITY.md', 'SUPPORT.md', 'references/', 'scripts/', 'assets/templates/', 'assets/marketplace/', 'examples/', 'agents/openai.yaml', '.gse/', '.learnings/']
+const releaseNoteFields = ['Release label:', 'Date:', 'Readiness:', 'Changed:', 'Validation:', 'Compatibility impact:', 'Migration or rollback:', 'Known risks:', 'Follow-up slices:']
+const handoffFields = ['Skill path:', 'Release label or date.', 'Validation command and latest result.', 'Evidence log path.', 'Known residual risks.', 'Next slice from `.gse/current-slice.md`.']
+
+const checks = [
+  check('R01', 'packaging reference exists', exists('references/packaging.md'), 'references/packaging.md'),
+  check('R02', 'SKILL routes packaging reference', skill.includes('references/packaging.md'), 'SKILL.md Reference Routing'),
+  check('R03', 'package boundary lists core skill artifacts', packageBoundary.every((item) => packaging.includes(item)), packageBoundary.join(', ')),
+  check('R04', 'validation command is the release gate', packaging.includes('node <skill>/scripts/validate-gse.mjs --root <skill>') && quality.includes('Use `references/release.md`') && release.includes('references/quality-gates.md'), 'packaging, quality, and release references'),
+  check('R05', 'release label policy is explicit without fake semver', packaging.includes('gse-internal-YYYY-MM-DD-N') && packaging.includes('Use semver only after there is a maintained distribution channel'), 'internal release label policy'),
+  check('R06', 'release notes fields are complete', releaseNoteFields.every((item) => packaging.includes(item)), releaseNoteFields.join(', ')),
+  check('R07', 'install/update handoff fields are complete', handoffFields.every((item) => packaging.includes(item)), 'handoff checklist'),
+  check('R08', 'rollback guidance distinguishes low-risk and generated artifacts', packaging.includes('file-level revert') && packaging.includes('generated files or adapters') && packaging.includes('re-running `validate-gse.mjs`'), 'rollback section'),
+  check('R09', 'readiness status avoids overstating acceptance', packaging.includes('Do not call a release accepted only because local validation passed') && packaging.includes('true fresh-session acceptance separate from fresh-session readiness'), 'readiness status and release notes rules'),
+  check('R10', 'host UI metadata is present and minimal', openai.includes('display_name: "GSE"') && openai.includes('short_description') && openai.includes('default_prompt'), 'agents/openai.yaml'),
+  check('R11', 'consolidated validator includes packaging-adjacent gates', validate.includes('audit-fresh-session-readiness.mjs') && validate.includes('audit-compatibility.mjs') && validate.includes('audit-marketplace-discovery.mjs') && validate.includes('audit-host-ui-invocation.mjs') && validate.includes('quick_validate.py'), 'scripts/validate-gse.mjs'),
+  check('R12', 'no external distribution is claimed', packaging.includes('not a registry publication process') && packaging.includes('Do not claim marketplace distribution') && packaging.includes('Do not call a release accepted'), 'distribution boundary'),
+  check('R13', 'public release metadata gate is linked', release.includes('references/public-release.md') && packaging.includes('references/public-release.md') && publicRelease.includes('owner-required') && publicRelease.includes('assets/templates/public-release-record.md'), 'release, packaging, public-release references'),
+  check('R14', 'release docs include npm publish dry-run preflight', packaging.includes('audit-npm-publish-dry-run.mjs') && packaging.includes('harmful metadata auto-correction warnings') && validate.includes('audit-npm-publish-dry-run.mjs'), 'references/packaging.md, scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { releasePackagingReadiness: failed === 0 ? 'verified' : 'failed' },
+  releaseReadiness: failed === 0 ? 'verified' : 'result',
+  acceptedBy: 'not accepted; this audit verifies release packaging readiness but does not publish or owner-accept a release',
+  limits: [
+    'Release readiness audit verifies packaging policy, validation gate, handoff fields, rollback guidance, and metadata presence.',
+    'It does not publish GSE, install it in another host, run marketplace checks, or mark v1.0 complete.',
+    'A real release still needs the project or owner policy required for accepted status.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Release Readiness Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Release packaging readiness: ' + data.workflows.releasePackagingReadiness)
+  lines.push('- Release readiness: ' + data.releaseReadiness)
+  lines.push('- Accepted by: ' + data.acceptedBy)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)