@t275005746/gse 0.1.0

package/scripts/audit-roadmap-consistency.mjs

@@ -0,0 +1,235 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const masterPlan = read('.gse/gse-design-master-plan.md')
+const goalMap = read('.gse/goal-map.md')
+const validate = read('scripts/validate-gse.mjs')
+
+const requiredVerifiedAssets = [
+  'references/router.md',
+  'references/evidence-taxonomy.md',
+  'references/domain-model.md',
+  'references/file-ownership.md',
+  'references/forward-test.md',
+  'references/review.md',
+  'references/architecture-health.md',
+  'references/release.md',
+  'references/public-release.md',
+  'references/recovery.md',
+  'references/drift-audit.md',
+  'references/compatibility.md',
+  'references/packaging.md',
+  'references/release-trust.md',
+  'references/domain-quality-gates.md',
+  'assets/templates/release-trust-record.md',
+  'assets/templates/public-release-record.md',
+  'assets/templates/acceptance-execution-packet.md',
+  'assets/templates/target-adoption-evidence.md',
+  'assets/templates/update-release-acceptance-record.md',
+  'references/commands.md',
+  'README.md',
+  'README.zh-CN.md',
+  'CONTRIBUTING.md',
+  'SECURITY.md',
+  'SUPPORT.md',
+  '.github/workflows/validate-gse.yml',
+  '.github/PULL_REQUEST_TEMPLATE.md',
+  '.github/ISSUE_TEMPLATE/bug_report.yml',
+  '.github/ISSUE_TEMPLATE/change_request.yml',
+  'assets/templates/public-channel-publication-record.md',
+  'assets/templates/public-ci-run-record.md',
+  'assets/templates/public-security-contact-record.md',
+  'assets/templates/public-repository-settings-record.md',
+  'scripts/audit-gse.mjs',
+  'scripts/validate-gse.mjs',
+  'scripts/audit-target-project.mjs',
+  'scripts/generate-session-prompt.mjs',
+  'scripts/run-gse-command.mjs',
+  'scripts/audit-command-execution.mjs',
+  'scripts/audit-close-gate.mjs',
+  'scripts/update-project-state.mjs',
+  'scripts/init-change.mjs',
+  'scripts/audit-change-system.mjs',
+  'scripts/audit-roadmap-consistency.mjs',
+  'scripts/audit-commands.mjs',
+  'scripts/audit-readme-docs.mjs',
+  'scripts/package-gse.mjs',
+  'scripts/install-gse.mjs',
+  'scripts/audit-distribution.mjs',
+  'scripts/audit-remote-distribution.mjs',
+  'scripts/sign-gse-package.mjs',
+  'scripts/verify-gse-package.mjs',
+  'scripts/audit-signing.mjs',
+  'scripts/generate-command-adapter.mjs',
+  'scripts/audit-command-adapters.mjs',
+  'scripts/close-change.mjs',
+  'scripts/audit-change-lifecycle.mjs',
+  'scripts/audit-public-release-metadata.mjs',
+  'scripts/record-public-release.mjs',
+  'scripts/audit-public-release-decision.mjs',
+  'scripts/record-public-ci-run.mjs',
+  'scripts/audit-public-ci-run.mjs',
+  'scripts/record-public-security-contact.mjs',
+  'scripts/audit-public-security-contact.mjs',
+  'scripts/record-public-channel-publication.mjs',
+  'scripts/audit-public-channel-publication.mjs',
+  'scripts/generate-release-bundle.mjs',
+  'scripts/audit-release-bundle.mjs',
+  'scripts/audit-open-source-readiness.mjs',
+  'scripts/audit-ci-readiness.mjs',
+  'scripts/audit-public-collaboration-templates.mjs',
+  'scripts/record-public-repository-settings.mjs',
+  'scripts/audit-public-repository-settings.mjs',
+  'scripts/record-host-invocation.mjs',
+  'scripts/audit-host-runtime-invocations.mjs',
+  'references/final-readiness.md',
+  'scripts/audit-final-readiness.mjs',
+  'scripts/audit-final-readiness-promotion.mjs',
+  'scripts/audit-final-form-stale-copy.mjs',
+  'scripts/generate-final-acceptance-packet.mjs',
+  'scripts/audit-final-acceptance-packet.mjs',
+  '.gse/releases/public-release-owner-required.md',
+  '.gse/releases/public-security-contact-owner-required.md',
+]
+
+const stalePhrases = [
+  'dedicated router missing',
+  'taxonomy and archive lifecycle missing',
+  'domain model reference should be expanded',
+  'lock rules and forward-test examples missing',
+  'vertical slice discipline is partially covered',
+  'gate taxonomy and audit script missing',
+  'review/architecture scan references need stronger integration',
+  'Status: next.',
+  'Status: planned.',
+]
+
+const currentStatusTerms = [
+  'router, command semantics, task levels, and tool routing are verified',
+  'bilingual README docs',
+  'native `.gse/changes/<change-id>/` change pack generation',
+  'execution-quality pack templates',
+  'domain model reference and ADR template are verified',
+  'role docs, dispatch packet, file ownership, and forward-test fallback are verified',
+  'review protocol and architecture health references are verified',
+  'v0.2 - Self-Auditing GSE',
+  'Status: verified.',
+  'v0.3 - Project-Aware GSE',
+  'Status: verified pending external acceptance.',
+  'v0.4 - Quality And Release GSE',
+  'v1.0 - Productized GSE',
+  'Status: verified.',
+  'owner-approved AION project-write acceptance is executed',
+  'AION/MuseFlow v1 target validation',
+  'target-project doctor',
+  '.gse/state.json',
+  '.gse/evidence/index.jsonl',
+  'session prompt generator',
+  'Close gate verifies',
+  'safe project-local state/index update path',
+  'local package/install distribution audit',
+  'remote URL distribution and integrity audit',
+  'package signing and verification audit',
+  'portable command execution audit',
+  'release trust and key custody policy audit',
+  'public release metadata audit',
+  'public release decision lifecycle audit',
+  'public CI run record audit',
+  'MIT license decision',
+  'public channel publication record audit',
+  'release bundle generation audit',
+  'open-source repository readiness audit',
+  'CI workflow readiness audit',
+  'public collaboration template audit',
+  'public security contact record audit',
+  'public repository settings record audit',
+  'host runtime invocation record mechanics',
+  'final readiness matrix',
+  'final-form progress report',
+  'final readiness promotion audit',
+  'final acceptance packet',
+  'host command adapter audit',
+  'change close/archive lifecycle',
+  'OpenSpec-style requirements',
+  'Superpowers-style execution skills',
+  'AION and MuseFlow',
+]
+
+const checks = [
+  check('RC01', 'roadmap consistency audit is wired into validator', validate.includes('audit-roadmap-consistency.mjs'), 'scripts/validate-gse.mjs'),
+  check('RC02', 'required verified roadmap assets exist', requiredVerifiedAssets.every(exists), requiredVerifiedAssets.join(', ')),
+  check('RC03', 'master plan no longer contains stale missing/planned status phrases', stalePhrases.every((phrase) => !masterPlan.includes(phrase)), stalePhrases.join(', ')),
+  check('RC04', 'master plan contains current verified status terms', currentStatusTerms.every((term) => masterPlan.includes(term)), currentStatusTerms.join(', ')),
+  check('RC05', 'goal map tracks v1 execution-state work as verified', goalMap.includes('GSE-008') && goalMap.includes('Productize v1.0 execution-state workflow') && goalMap.includes('verified') && goalMap.includes('audit-v1-target-validation.mjs'), '.gse/goal-map.md'),
+  check('RC06', 'master plan preserves target validation while keeping current final-form limits explicit', masterPlan.includes('AION/MuseFlow v1 target validation are verified') && masterPlan.includes('MIT license decision') && masterPlan.includes('Remaining final-form work is real public security contact approval, real public repository settings, public CI run, real public registry publication, real public marketplace approval, host-native slash-command support, and other host runtime invocation records.') && masterPlan.includes('P1: harden GSE beyond the verified v1.0 execution-state workflow') && !masterPlan.includes('This does not yet prove the full v1.0 execution-state layer') && !masterPlan.includes('owner license selection remains required before an accepted public release'), '.gse/gse-design-master-plan.md'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { roadmapConsistency: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit checks GSE roadmap/status consistency against local verified artifacts.',
+    'It does not certify arbitrary repositories or execute fresh-session acceptance.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Roadmap Consistency Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Roadmap consistency: ' + data.workflows.roadmapConsistency)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-signing.mjs

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, { cwd, encoding: 'utf8', windowsHide: true })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-signing-'))
+const packageOut = path.join(tempRoot, 'package')
+const installTarget = path.join(tempRoot, 'installed-gse')
+const tamperedPackage = path.join(tempRoot, 'tampered-package')
+const tamperedTarget = path.join(tempRoot, 'tampered-installed')
+const privateKey = path.join(tempRoot, 'gse-private.pem')
+const publicKey = path.join(tempRoot, 'gse-public.pem')
+
+const packageRun = run(process.execPath, [
+  path.join(root, 'scripts', 'package-gse.mjs'),
+  '--root',
+  root,
+  '--out',
+  packageOut,
+  '--label',
+  'gse-signing-audit',
+  '--json',
+])
+const signRun = run(process.execPath, [
+  path.join(root, 'scripts', 'sign-gse-package.mjs'),
+  '--package',
+  packageOut,
+  '--private-key',
+  privateKey,
+  '--public-key',
+  publicKey,
+  '--generate-key',
+  '--json',
+])
+const verifyRun = run(process.execPath, [
+  path.join(root, 'scripts', 'verify-gse-package.mjs'),
+  '--package',
+  packageOut,
+  '--public-key',
+  publicKey,
+  '--json',
+])
+const installRun = run(process.execPath, [
+  path.join(root, 'scripts', 'install-gse.mjs'),
+  '--source',
+  packageOut,
+  '--target',
+  installTarget,
+  '--public-key',
+  publicKey,
+  '--json',
+])
+
+fs.cpSync(packageOut, tamperedPackage, { recursive: true })
+fs.appendFileSync(path.join(tamperedPackage, 'SKILL.md'), '\nTampered for signature audit.\n', 'utf8')
+const tamperedVerify = run(process.execPath, [
+  path.join(root, 'scripts', 'verify-gse-package.mjs'),
+  '--package',
+  tamperedPackage,
+  '--public-key',
+  publicKey,
+  '--json',
+])
+const tamperedInstall = run(process.execPath, [
+  path.join(root, 'scripts', 'install-gse.mjs'),
+  '--source',
+  tamperedPackage,
+  '--target',
+  tamperedTarget,
+  '--public-key',
+  publicKey,
+  '--json',
+])
+
+const signData = parseJson(signRun.stdout)
+const verifyData = parseJson(verifyRun.stdout)
+const installData = parseJson(installRun.stdout)
+const tamperedVerifyData = parseJson(tamperedVerify.stdout)
+const tamperedInstallData = parseJson(tamperedInstall.stdout)
+
+const checks = [
+  check('SIGN01', 'package command succeeds', packageRun.status === 0, packageRun.command),
+  check('SIGN02', 'sign command creates signature and keys', signRun.status === 0 && fs.existsSync(path.join(packageOut, 'gse-package-signature.json')) && fs.existsSync(publicKey), signRun.command),
+  check('SIGN03', 'verify command accepts signed package', verifyRun.status === 0 && verifyData?.summary?.failed === 0, verifyRun.command),
+  check('SIGN04', 'install command accepts signed package with public key', installRun.status === 0 && installData?.signature?.status === 'verified', installRun.command),
+  check('SIGN05', 'tampered package fails signature/hash verification', tamperedVerify.status === 1 && tamperedVerifyData?.summary?.failed > 0, tamperedVerify.command),
+  check('SIGN06', 'install command rejects tampered signed package', tamperedInstall.status === 1 && (tamperedInstallData?.signature?.status === 'failed' || tamperedInstallData?.summary?.integrityFailed > 0), tamperedInstall.command),
+  check('SIGN07', 'signature uses Ed25519', signData?.algorithm === 'ed25519', 'sign-gse-package output'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    packageSigning: signRun.status === 0 ? 'verified' : 'failed',
+    signatureVerification: verifyRun.status === 0 ? 'verified' : 'failed',
+    signedInstall: installRun.status === 0 ? 'verified' : 'failed',
+    tamperRejection: tamperedVerify.status === 1 && tamperedInstall.status === 1 ? 'verified' : 'failed',
+  },
+  commands: [packageRun.command, signRun.command, verifyRun.command, installRun.command, tamperedVerify.command, tamperedInstall.command],
+  limits: [
+    'This audit verifies local Ed25519 signing and verification mechanics.',
+    'It does not prove public key custody, maintainer identity, transparency logs, or marketplace trust.',
+  ],
+  checks,
+}
+
+fs.rmSync(tempRoot, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-state-freshness.mjs

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function parseJson(text) {
+  try { return JSON.parse(text) } catch { return null }
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const stateText = read('.gse/state.json')
+const state = parseJson(stateText)
+const doctorRun = run('audit-public-acceptance-readiness.mjs', ['--root', root, '--json'])
+const doctor = parseJson(doctorRun.stdout)
+const pendingAreas = (doctor?.pendingGates ?? []).map((gate) => gate.area).sort()
+const stateSearch = [
+  state?.currentSlice?.id,
+  state?.currentSlice?.outcome,
+  state?.currentSlice?.status,
+  state?.currentSlice?.nextAction,
+  ...(state?.residualRisks ?? []),
+].join('\n')
+
+const staleResolvedGatePhrases = [
+  'authorize GitHub workflow scope',
+  'run public CI',
+  'public CI remains pending',
+  'public CI run remains pending',
+  'public security contact remains pending',
+  'public repository settings remain pending',
+  'marketplace approval remains pending',
+  'marketplace approval, and native slash-command proof are not verified',
+  '7 pending owner/external gates',
+  'public CI, marketplace approval',
+]
+
+const staleMatches = staleResolvedGatePhrases.filter((phrase) => stateSearch.includes(phrase))
+const mentionsAllPending = pendingAreas.every((area) => stateSearch.includes(area) || (
+  area === 'Public registry publication' && stateSearch.includes('registry publication')
+) || (
+  area === 'Native slash command' && stateSearch.includes('Native slash-command')
+))
+
+const checks = [
+  check('STF01', 'state JSON exists and parses', Boolean(state), '.gse/state.json'),
+  check('STF02', 'public acceptance doctor runs before state freshness check', doctorRun.status === 0 && doctor?.summary?.status === 'passed', doctorRun.command),
+  check('STF03', 'state next action mentions every current pending final-form gate', mentionsAllPending && pendingAreas.length === 2, pendingAreas.join(', ')),
+  check('STF04', 'state no longer routes users to resolved public CI/security/repository/marketplace gates', staleMatches.length === 0, staleMatches.length ? staleMatches.join('; ') : '.gse/state.json'),
+  check(
+    'STF05',
+    'state marks current registry work as externally blocked by npm auth/publication',
+    state?.currentSlice?.id === 'GSE-108-public-registry-publication' &&
+      state?.currentSlice?.status === 'blocked-external-auth' &&
+      (stateSearch.includes('npm is not logged in') || stateSearch.includes('not yet published on npm')),
+    '.gse/state.json',
+  ),
+  check('STF06', 'state points users to current doctor as source of truth', stateSearch.includes('/gse doctor') || stateSearch.includes('audit-public-acceptance-readiness.mjs'), '.gse/state.json'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    stateFreshness: failed === 0 ? 'verified' : 'failed',
+    pendingGates: pendingAreas,
+  },
+  limits: [
+    'This audit checks the machine-readable GSE state summary against the current public acceptance doctor.',
+    'It does not publish to npm or prove native slash-command support.',
+  ],
+  checks,
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-target-adoption-evidence.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const template = read('assets/templates/target-adoption-evidence.md')
+const recipes = read('references/adoption-recipes.md')
+const discovery = read('scripts/discover-project-profile.mjs')
+const validate = read('scripts/validate-gse.mjs')
+
+const fields = [
+  'Target project:',
+  'Adoption path:',
+  'Project rules read:',
+  'Files inspected:',
+  'Files changed:',
+  'Commands run:',
+  'Detected project type:',
+  'Detected package manager:',
+  'Detected scripts:',
+  'Host/tool statuses:',
+  'Evidence status:',
+  'Accepted by:',
+  'Residual risks:',
+  'Next action:',
+]
+
+const noOverclaim = [
+  'documented` until executed',
+  'unknown` unless the tool was actually checked',
+  'Do not claim arbitrary real-repo certification',
+  'host runtime support',
+  'subagent support',
+  'browser support',
+  'MCP support',
+  'CI support',
+  'release publication',
+  'owner acceptance',
+  'Accepted by: not accepted',
+]
+
+const checks = [
+  check('TAE01', 'target adoption evidence template exists', exists('assets/templates/target-adoption-evidence.md'), 'assets/templates/target-adoption-evidence.md'),
+  check('TAE02', 'template captures target-project evidence fields', fields.every((item) => template.includes(item)), fields.join(', ')),
+  check('TAE03', 'template prevents real-repo and host capability overclaims', noOverclaim.every((item) => template.includes(item)), 'anti-overclaim rules'),
+  check('TAE04', 'adoption recipes route real target evidence to template', recipes.includes('assets/templates/target-adoption-evidence.md') && recipes.includes('Accepted by: not accepted'), 'references/adoption-recipes.md'),
+  check('TAE05', 'discovery captures namespaced project scripts', discovery.includes('/^(smoke|evidence|replay|eval|release|deploy|publish|electron):/') && discovery.includes('package.json smoke script'), 'scripts/discover-project-profile.mjs'),
+  check('TAE06', 'consolidated validator includes this audit', validate.includes('audit-target-adoption-evidence.mjs'), 'scripts/validate-gse.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { targetAdoptionEvidence: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies the target-project evidence template and discovery support only.',
+    'It does not certify any arbitrary repository or accept a host/runtime capability.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Target Adoption Evidence Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Target adoption evidence: ' + data.workflows.targetAdoptionEvidence)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)