@t275005746/gse 0.1.0

package/scripts/audit-release-status-manifest.mjs

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const generator = read('scripts/generate-release-status-manifest.mjs')
+const validate = read('scripts/validate-gse.mjs')
+const skill = read('SKILL.md')
+const releaseGenerator = read('scripts/generate-release-bundle.mjs')
+const releaseAudit = read('scripts/audit-release-bundle.mjs')
+const tmp = mkdtempSync(path.join(tmpdir(), 'gse-release-status-manifest-'))
+const out = path.join(tmp, 'release-status-manifest.json')
+const generated = exists('scripts/generate-release-status-manifest.mjs')
+  ? run(process.execPath, [path.join(root, 'scripts', 'generate-release-status-manifest.mjs'), '--root', root, '--out', out, '--force', '--json'])
+  : null
+const generatedData = generated ? parseJson(generated.stdout) : null
+const manifest = fs.existsSync(out) ? parseJson(fs.readFileSync(out, 'utf8')) : null
+rmSync(tmp, { recursive: true, force: true })
+
+const requiredArtifacts = [
+  'finalAcceptancePacket',
+  'publicAcceptanceHandoff',
+  'hostRuntimeEvidenceHandoff',
+  'releaseStatusManifest',
+]
+const requiredDistribution = [
+  'localPackage',
+  'localInstall',
+  'localInstalledCli',
+  'remoteInstall',
+  'remoteInstalledCli',
+  'integrityGate',
+  'packageSigning',
+  'signatureVerification',
+  'releaseBundle',
+]
+const requiredCommands = [
+  'validate-gse.mjs',
+  'audit-final-readiness.mjs',
+  'audit-public-acceptance-readiness.mjs',
+  'audit-public-acceptance-command-dry-run-drill.mjs',
+  'audit-host-runtime-invocations.mjs',
+  'audit-host-runtime-invocation-drill.mjs',
+  'audit-release-bundle.mjs',
+]
+const verificationCommandsAreShellSafe = (manifest?.verificationCommands?.length ?? 0) > 0 &&
+  manifest.verificationCommands.every((command) => !/[<>]/.test(command) && command.includes('__GSE__'))
+
+const checks = [
+  check('RSM01', 'release status manifest generator exists', exists('scripts/generate-release-status-manifest.mjs'), 'scripts/generate-release-status-manifest.mjs'),
+  check('RSM02', 'generator composes authoritative non-circular audits', ['audit-final-readiness.mjs', 'audit-public-acceptance-readiness.mjs', 'audit-host-runtime-invocations.mjs', 'audit-host-runtime-invocation-drill.mjs'].every((term) => generator.includes(term)) && !generator.includes("audit('audit-release-bundle.mjs')") && !generator.includes("audit('audit-distribution.mjs')"), 'generator source audits'),
+  check('RSM03', 'generator writes parseable manifest', generated?.status === 0 && generatedData?.status === 'written' && manifest?.schemaVersion === 1, generated?.stderr || out),
+  check('RSM04', 'manifest preserves public acceptance boundary', manifest?.claimBoundary?.publicAccepted === 'not-accepted' && manifest?.claimBoundary?.localValidationDoesNotMeanPublicAcceptance === true, 'publicAccepted not-accepted'),
+  check('RSM05', 'manifest covers verified rows and current owner/external rows', (manifest?.readiness?.verified?.length ?? 0) > 0 && ((manifest?.readiness?.ownerRequired?.length ?? 0) + (manifest?.readiness?.externalRequired?.length ?? 0)) > 0, 'readiness row groups'),
+  check('RSM06', 'manifest covers install and distribution status', requiredDistribution.every((key) => manifest?.distribution?.[key]), requiredDistribution.join(', ')),
+  check('RSM07', 'manifest covers public acceptance next commands', (manifest?.publicAcceptance?.pendingGates?.length ?? 0) > 0 && (manifest?.publicAcceptance?.nextCommands?.length ?? 0) === (manifest?.publicAcceptance?.pendingGates?.length ?? -1), 'pending gates and next commands'),
+  check('RSM07b', 'manifest covers public acceptance dry-run preflight commands', (manifest?.publicAcceptance?.pendingGates?.length ?? 0) > 0 && (manifest?.publicAcceptance?.nextPreflightCommands?.length ?? 0) === (manifest?.publicAcceptance?.pendingGates?.length ?? -1) && manifest.publicAcceptance.nextPreflightCommands.every((command) => command.includes('--dry-run --json')), 'pending gates and preflight commands'),
+  check('RSM08', 'manifest covers host runtime evidence counts', Number.isInteger(manifest?.hostRuntime?.nativeSlashCommandRecords) && Number.isInteger(manifest?.hostRuntime?.portableTextCommandRecords) && manifest.hostRuntime.nativeSlashCommandRecords >= 0 && manifest.hostRuntime.portableTextCommandRecords >= 0, `native ${manifest?.hostRuntime?.nativeSlashCommandRecords ?? 'unknown'}, portable ${manifest?.hostRuntime?.portableTextCommandRecords ?? 'unknown'}`),
+  check('RSM08b', 'manifest covers host runtime fixture drill status', manifest?.hostRuntime?.fixtureDrill === 'verified' && manifest?.hostRuntime?.fixtureNativeSlashCommandRecords === 1 && manifest?.hostRuntime?.fixturePortableTextCommandRecords === 4 && manifest?.hostRuntime?.fixtureEvidenceIsPersistent === false, `drill ${manifest?.hostRuntime?.fixtureDrill ?? 'unknown'}, fixture native ${manifest?.hostRuntime?.fixtureNativeSlashCommandRecords ?? 'unknown'}, fixture portable ${manifest?.hostRuntime?.fixturePortableTextCommandRecords ?? 'unknown'}`),
+  check('RSM09', 'manifest points to handoff artifacts', requiredArtifacts.every((key) => manifest?.artifacts?.[key]), requiredArtifacts.join(', ')),
+  check('RSM10', 'manifest includes verification commands', requiredCommands.every((term) => manifest?.verificationCommands?.some((command) => command.includes(term))), requiredCommands.join(', ')),
+  check('RSM11', 'skill routes users to release status manifest', skill.includes('generate-release-status-manifest.mjs'), 'SKILL.md'),
+  check('RSM12', 'validator includes release status manifest audit', validate.includes('audit-release-status-manifest.mjs'), 'scripts/validate-gse.mjs'),
+  check('RSM13', 'release bundle includes release status manifest', releaseGenerator.includes('release-status-manifest.json') && releaseAudit.includes('release-status-manifest.json'), 'release bundle generator and audit'),
+  check('RSM14', 'manifest verification commands use shell-safe placeholders', verificationCommandsAreShellSafe, 'verification commands use __GSE__ instead of <gse>'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    releaseStatusManifest: failed === 0 ? 'verified' : 'failed',
+    publicAccepted: manifest?.claimBoundary?.publicAccepted ?? 'unknown',
+    pendingGates: manifest?.publicAcceptance?.pendingGates?.length ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies manifest generation from local audits.',
+    'It does not create owner decisions, public CI, public repository settings, marketplace approval, registry publication, or native slash-command evidence.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Release Status Manifest Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Release status manifest: ' + data.workflows.releaseStatusManifest)
+  lines.push('- Public accepted: ' + data.workflows.publicAccepted)
+  lines.push('- Pending gates: ' + data.workflows.pendingGates)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-release-trust.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const trust = read('references/release-trust.md')
+const template = read('assets/templates/release-trust-record.md')
+const packaging = read('references/packaging.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const checks = [
+  check('TRUST01', 'release trust reference exists', exists('references/release-trust.md'), 'references/release-trust.md'),
+  check('TRUST02', 'release trust template exists', exists('assets/templates/release-trust-record.md'), 'assets/templates/release-trust-record.md'),
+  check('TRUST03', 'trust reference separates signed verified trusted', ['signed', 'verified', 'trusted', 'Do not claim `trusted` from signing alone.'].every((term) => trust.includes(term)), 'references/release-trust.md'),
+  check('TRUST04', 'trust reference defines key custody and revocation', ['Key custody', 'Rotation policy', 'Revocation path', 'Do not commit private keys'].every((term) => trust.includes(term)), 'references/release-trust.md'),
+  check('TRUST05', 'template captures owner acceptance and public key fingerprint', ['Public key fingerprint', 'Accepted by', 'Private key location', 'Verification command'].every((term) => template.includes(term)), 'release-trust-record.md'),
+  check('TRUST06', 'packaging routes readers to signing and trust rules', packaging.includes('Signing And Verification') && packaging.includes('Release Trust'), 'references/packaging.md'),
+  check('TRUST07', 'validator includes release trust audit', validate.includes('audit-release-trust.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { releaseTrustPolicy: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies release trust policy and template coverage.',
+    'It does not prove a real maintainer identity, key custody event, marketplace approval, or production release acceptance.',
+  ],
+  checks,
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)
+

package/scripts/audit-remote-distribution.mjs

@@ -0,0 +1,266 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import http from 'node:http'
+import os from 'node:os'
+import path from 'node:path'
+import { spawn, spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const profile = readArg('--profile', 'full')
+if (!['smoke', 'full'].includes(profile)) {
+  console.error('Unsupported --profile. Expected smoke or full.')
+  process.exit(1)
+}
+const smokeProfile = profile === 'smoke'
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function runAsync(command, commandArgs, cwd = root) {
+  return new Promise((resolve) => {
+    const child = spawn(command, commandArgs, { cwd, windowsHide: true })
+    let stdout = ''
+    let stderr = ''
+    child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8') })
+    child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8') })
+    child.on('close', (status) => {
+      resolve({
+        command: [command, ...commandArgs].join(' '),
+        status: status ?? 1,
+        stdout: stdout.trim(),
+        stderr: stderr.trim(),
+      })
+    })
+  })
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function skipped(id, label, evidence, risk = '') {
+  return { id, label, status: 'skipped', evidence, risk }
+}
+
+function runInstalledPackageValidation(target) {
+  const validationCommands = [
+    ['audit-gse.mjs', ['--root', target, '--json']],
+    ['audit-project.mjs', ['--root', target, '--json']],
+    ['audit-fixtures.mjs', ['--root', target, '--json']],
+    ['audit-commands.mjs', ['--root', target, '--json']],
+    ['audit-command-execution.mjs', ['--root', target, '--profile', 'lite', '--json']],
+    ['audit-readme-docs.mjs', ['--root', target, '--json']],
+    ['audit-open-source-readiness.mjs', ['--root', target, '--json']],
+    ['audit-marketplace-discovery.mjs', ['--root', target, '--json']],
+    ['generate-session-prompt.mjs', ['--root', target, '--json']],
+  ]
+  const results = validationCommands.map(([script, commandArgs]) => {
+    const result = run(process.execPath, [path.join(target, 'scripts', script), ...commandArgs], target)
+    const parsed = parseJson(result.stdout)
+    const failed = parsed?.summary?.failed
+    const ok = result.status === 0 || failed === 0
+    return {
+      script,
+      command: result.command,
+      status: result.status,
+      ok,
+      summary: parsed?.summary ?? null,
+      stderr: result.stderr,
+    }
+  })
+  const passed = results.filter((item) => item.ok).length
+  const failed = results.length - passed
+  return {
+    command: 'remote installed package validation: ' + validationCommands.map(([script]) => script).join(', '),
+    status: failed === 0 ? 0 : 1,
+    stdout: JSON.stringify({
+      summary: {
+        status: failed === 0 ? 'passed' : 'failed',
+        passed,
+        failed,
+        total: results.length,
+      },
+      results,
+      limits: [
+        'Installed-package validation checks portable skill structure, bootstrap fixtures, command semantics, lite command execution, README docs, open-source readiness, marketplace metadata, and session prompt generation.',
+        'It intentionally excludes source-workspace-only roadmap, long evidence logs, release-bundle cache, and owner/external acceptance artifacts.',
+      ],
+    }),
+    stderr: results.filter((item) => !item.ok).map((item) => item.script + ': ' + item.stderr).filter(Boolean).join('\n'),
+  }
+}
+
+function contentType(filePath) {
+  if (filePath.endsWith('.json')) return 'application/json'
+  if (filePath.endsWith('.md')) return 'text/markdown; charset=utf-8'
+  if (filePath.endsWith('.mjs')) return 'text/javascript; charset=utf-8'
+  return 'application/octet-stream'
+}
+
+function createStaticServer(baseDir) {
+  const server = http.createServer((request, response) => {
+    try {
+      const url = new URL(request.url ?? '/', 'http://127.0.0.1')
+      const relativePath = decodeURIComponent(url.pathname.replace(/^\/+/, '')) || 'gse-package-manifest.json'
+      const fullPath = path.resolve(baseDir, relativePath)
+      if (!fullPath.startsWith(path.resolve(baseDir))) {
+        response.writeHead(403)
+        response.end('Forbidden')
+        return
+      }
+      if (!fs.existsSync(fullPath) || !fs.statSync(fullPath).isFile()) {
+        response.writeHead(404)
+        response.end('Not found')
+        return
+      }
+      response.writeHead(200, { 'content-type': contentType(fullPath) })
+      fs.createReadStream(fullPath).pipe(response)
+    } catch (error) {
+      response.writeHead(500)
+      response.end(error instanceof Error ? error.message : String(error))
+    }
+  })
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address()
+      resolve({ server, baseUrl: `http://127.0.0.1:${address.port}/` })
+    })
+  })
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-remote-distribution-'))
+const packageOut = path.join(tempRoot, 'package')
+const installTarget = path.join(tempRoot, 'installed-gse')
+const tamperedTarget = path.join(tempRoot, 'tampered-install')
+
+const packageRun = run(process.execPath, [
+  path.join(root, 'scripts', 'package-gse.mjs'),
+  '--root',
+  root,
+  '--out',
+  packageOut,
+  '--label',
+  'gse-remote-audit',
+  '--json',
+])
+const packageData = parseJson(packageRun.stdout)
+
+const manifestPath = path.join(packageOut, 'gse-package-manifest.json')
+const manifest = fs.existsSync(manifestPath) ? JSON.parse(fs.readFileSync(manifestPath, 'utf8')) : null
+
+let server
+let baseUrl = ''
+let remoteInstall = { status: 1, command: 'not-run', stdout: '', stderr: '' }
+let installedValidate = { status: 1, command: 'not-run', stdout: '', stderr: '' }
+let installedCli = { status: 1, command: 'not-run', stdout: '', stderr: '' }
+let tamperedInstall = { status: 1, command: 'not-run', stdout: '', stderr: '' }
+
+try {
+  const started = await createStaticServer(packageOut)
+  server = started.server
+  baseUrl = started.baseUrl
+  remoteInstall = await runAsync(process.execPath, [
+    path.join(root, 'scripts', 'install-gse.mjs'),
+    '--source-url',
+    baseUrl,
+    '--target',
+    installTarget,
+    '--json',
+  ])
+  installedValidate = smokeProfile
+    ? { status: 0, command: 'skipped by --profile smoke', stdout: '', stderr: '' }
+    : runInstalledPackageValidation(installTarget)
+  installedCli = await runAsync(process.execPath, [
+    path.join(installTarget, 'scripts', 'gse.mjs'),
+    'status',
+    '--target',
+    installTarget,
+    '--json',
+  ], installTarget)
+
+  fs.appendFileSync(path.join(packageOut, 'README.md'), '\nTampered for integrity audit.\n', 'utf8')
+  tamperedInstall = await runAsync(process.execPath, [
+    path.join(root, 'scripts', 'install-gse.mjs'),
+    '--source-url',
+    baseUrl,
+    '--target',
+    tamperedTarget,
+    '--json',
+  ])
+} finally {
+  if (server) await new Promise((resolve) => server.close(resolve))
+}
+
+const remoteInstallData = parseJson(remoteInstall.stdout)
+const installedValidateData = parseJson(installedValidate.stdout)
+const installedCliData = parseJson(installedCli.stdout)
+const tamperedInstallData = parseJson(tamperedInstall.stdout)
+
+const checks = [
+  check('RD01', 'package manifest includes sha256 file hashes', packageRun.status === 0 && manifest?.integrity?.algorithm === 'sha256' && manifest?.fileHashes?.['SKILL.md'], 'gse-package-manifest.json'),
+  check('RD02', 'HTTP package source served manifest and files', Boolean(baseUrl) && remoteInstall.status === 0, baseUrl),
+  check('RD03', 'install-gse supports --source-url', remoteInstall.status === 0 && remoteInstallData?.sourceMode === 'http-url', remoteInstall.command),
+  check('RD04', 'remote install validates file integrity', remoteInstall.status === 0 && remoteInstallData?.summary?.integrityFailed === 0 && remoteInstallData?.integrity?.algorithm === 'sha256', 'install summary integrity'),
+  smokeProfile
+    ? skipped('RD05', 'remote installed copy validates', installedValidate.command, 'Run --profile full for remote installed-copy validation.')
+    : check('RD05', 'remote installed copy validates', installedValidate.status === 0 && installedValidateData?.summary?.failed === 0, installedValidate.command),
+  check('RD06', 'remote installed short CLI wrapper runs status command', installedCli.status === 0 && installedCliData?.command === '/gse status' && installedCliData?.project?.stateValid === true, installedCli.command),
+  check('RD07', 'tampered remote package fails integrity gate', tamperedInstall.status === 1 && tamperedInstallData?.summary?.integrityFailed > 0, 'tampered README.md install'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const skippedCount = checks.filter((item) => item.status === 'skipped').length
+const failed = checks.filter((item) => item.status === 'failed').length
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  baseUrl,
+  profile,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, skipped: skippedCount, total: checks.length },
+  workflows: {
+    remoteInstall: remoteInstall.status === 0 ? 'verified' : 'failed',
+    integrityGate: tamperedInstall.status === 1 ? 'verified' : 'failed',
+    installedValidation: smokeProfile ? 'skipped' : installedValidate.status === 0 ? 'verified' : 'failed',
+    installedCli: installedCli.status === 0 ? 'verified' : 'failed',
+  },
+  commands: [packageRun.command, remoteInstall.command, installedValidate.command, installedCli.command, tamperedInstall.command],
+  limits: [
+    'This audit verifies HTTP URL install through a local ephemeral server and manifest integrity checks.',
+    'Use --profile smoke for routine remote install, CLI, and integrity checks; use --profile full before release or when installed-copy validation matters.',
+    'Installed-package validation intentionally excludes source-workspace-only roadmap, long evidence logs, release-bundle cache, and owner/external acceptance artifacts.',
+    'It does not publish to a public registry, verify marketplace discovery, or sign artifacts with a trusted key.',
+  ],
+  checks,
+}
+
+fs.rmSync(tempRoot, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)