@t275005746/gse 0.1.0

package/scripts/audit-v1-target-validation.mjs

@@ -0,0 +1,269 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function readConfiguredTarget(argName, envName) {
+  return readArg(argName, process.env[envName] || null)
+}
+
+const configuredTargets = [
+  {
+    id: 'primary',
+    root: readConfiguredTarget('--primary-target', 'GSE_PRIMARY_TARGET'),
+    canonicalPlan: readArg('--primary-plan', process.env.GSE_PRIMARY_PLAN || ''),
+    minCloseableRecords: Number(readArg('--primary-min-closeable-records', process.env.GSE_PRIMARY_MIN_CLOSEABLE_RECORDS || '1')),
+    allowedDoctorWarnings: (readArg('--primary-allowed-doctor-warnings', process.env.GSE_PRIMARY_ALLOWED_DOCTOR_WARNINGS || 'TPD09,TPD10') || '').split(',').filter(Boolean),
+    allowedCloseWarnings: (readArg('--primary-allowed-close-warnings', process.env.GSE_PRIMARY_ALLOWED_CLOSE_WARNINGS || 'CG08') || '').split(',').filter(Boolean),
+  },
+  {
+    id: 'secondary',
+    root: readConfiguredTarget('--secondary-target', 'GSE_SECONDARY_TARGET'),
+    canonicalPlan: readArg('--secondary-plan', process.env.GSE_SECONDARY_PLAN || ''),
+    minCloseableRecords: Number(readArg('--secondary-min-closeable-records', process.env.GSE_SECONDARY_MIN_CLOSEABLE_RECORDS || '1')),
+    allowedDoctorWarnings: (readArg('--secondary-allowed-doctor-warnings', process.env.GSE_SECONDARY_ALLOWED_DOCTOR_WARNINGS || 'TPD09') || '').split(',').filter(Boolean),
+    allowedCloseWarnings: (readArg('--secondary-allowed-close-warnings', process.env.GSE_SECONDARY_ALLOWED_CLOSE_WARNINGS || 'CG08') || '').split(',').filter(Boolean),
+  },
+]
+const targets = configuredTargets
+  .filter((target) => target.root)
+  .map((target) => ({ ...target, root: path.resolve(target.root) }))
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function readJson(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    return null
+  }
+}
+
+function evidenceRecordCount(filePath) {
+  if (!fs.existsSync(filePath)) return 0
+  return fs
+    .readFileSync(filePath, 'utf8')
+    .split(/\r?\n/)
+    .filter((line) => line.trim().length > 0)
+    .length
+}
+
+const checks = []
+const targetReports = []
+
+if (targets.length === 0) {
+  const report = {
+    root,
+    generatedAt: new Date().toISOString(),
+    summary: { status: 'skipped', passed: 0, failed: 0, skipped: 1, total: 1 },
+    workflows: { v1TargetValidation: 'skipped' },
+    targets: [],
+    limits: [
+      'No v1 target validation targets were configured.',
+      'Set --primary-target/--secondary-target or GSE_PRIMARY_TARGET/GSE_SECONDARY_TARGET to validate real projects.',
+      'This keeps the distributable GSE package free of local pilot-project paths.',
+    ],
+    checks: [
+      {
+        id: 'configured-targets',
+        label: 'configured target projects are present',
+        status: 'skipped',
+        evidence: 'no configured target paths',
+        risk: 'target-project validation was not run',
+      },
+    ],
+  }
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log('# GSE v1 Target Validation Audit\n\nStatus: skipped\n\nNo target projects were configured.\n')
+  process.exit(0)
+}
+
+for (const target of targets) {
+  const doctorRun = run(process.execPath, [path.join(root, 'scripts', 'audit-target-project.mjs'), '--target', target.root, '--json'])
+  const doctor = parseJson(doctorRun.stdout)
+  const closeRun = run(process.execPath, [path.join(root, 'scripts', 'audit-close-gate.mjs'), '--target', target.root, '--json'])
+  const close = parseJson(closeRun.stdout)
+  const state = readJson(path.join(target.root, '.gse', 'state.json'))
+  const evidenceIndex = path.join(target.root, '.gse', 'evidence', 'index.jsonl')
+  const recordCount = evidenceRecordCount(evidenceIndex)
+
+  const doctorFailures = doctor?.summary?.failed ?? 1
+  const doctorWarnings = doctor?.checks?.filter((item) => item.status === 'warning').map((item) => item.id) ?? []
+  const unexpectedWarnings = doctorWarnings.filter((item) => !target.allowedDoctorWarnings.includes(item))
+  const closeStatus = close?.summary?.status
+  const closeFailures = close?.summary?.failed ?? 1
+  const closeWarnings = close?.checks?.filter((item) => item.status === 'warning').map((item) => item.id) ?? []
+  const unexpectedCloseWarnings = closeWarnings.filter((item) => !target.allowedCloseWarnings.includes(item))
+  const closeableRecords = close?.evidenceIndex?.closeableRecords ?? 0
+  const canonicalPlanExists = fs.existsSync(path.join(target.root, target.canonicalPlan))
+  const currentSliceVerified = state?.currentSlice?.status === 'verified' || state?.currentSlice?.status === 'accepted'
+
+  checks.push(
+    check(
+      `${target.id}-01`,
+      `${target.id} target doctor has no failed checks`,
+      doctorRun.status === 0 && doctorFailures === 0,
+      `status:${doctor?.summary?.status ?? 'unknown'}, passed:${doctor?.summary?.passed ?? 0}, warnings:${doctor?.summary?.warnings ?? 0}, failed:${doctorFailures}`,
+    ),
+    check(
+      `${target.id}-02`,
+      `${target.id} target doctor warnings are expected`,
+      unexpectedWarnings.length === 0,
+      doctorWarnings.length ? `warnings:${doctorWarnings.join(',')}` : 'warnings:none',
+      unexpectedWarnings.length ? `unexpected warnings:${unexpectedWarnings.join(',')}` : '',
+    ),
+    check(
+      `${target.id}-03`,
+      `${target.id} close gate has no failed checks`,
+      closeRun.status === 0 && closeFailures === 0,
+      `closeGate:${closeStatus ?? 'unknown'}, passed:${close?.summary?.passed ?? 0}/${close?.summary?.total ?? 0}, warnings:${close?.summary?.warnings ?? 0}, failed:${closeFailures}`,
+    ),
+    check(
+      `${target.id}-04`,
+      `${target.id} close gate warnings are expected`,
+      unexpectedCloseWarnings.length === 0,
+      closeWarnings.length ? `warnings:${closeWarnings.join(',')}` : 'warnings:none',
+      unexpectedCloseWarnings.length ? `unexpected warnings:${unexpectedCloseWarnings.join(',')}` : '',
+    ),
+    check(
+      `${target.id}-05`,
+      `${target.id} state points to a verified or accepted current slice`,
+      currentSliceVerified,
+      `slice:${state?.currentSlice?.id ?? 'missing'}, status:${state?.currentSlice?.status ?? 'missing'}`,
+    ),
+    check(
+      `${target.id}-06`,
+      `${target.id} evidence index has closeable records`,
+      recordCount >= target.minCloseableRecords && closeableRecords >= target.minCloseableRecords,
+      `records:${recordCount}, closeable:${closeableRecords}`,
+    ),
+    check(
+      `${target.id}-07`,
+      `${target.id} canonical plan exists`,
+      canonicalPlanExists,
+      target.canonicalPlan,
+    ),
+  )
+
+  targetReports.push({
+    id: target.id,
+    root: target.root,
+    doctor: doctor
+      ? {
+          status: doctor.summary?.status,
+          passed: doctor.summary?.passed,
+          warnings: doctor.summary?.warnings,
+          failed: doctor.summary?.failed,
+          workflow: doctor.workflows?.targetProjectDoctor,
+        }
+      : null,
+    closeGate: close
+      ? {
+          status: close.summary?.status,
+          passed: close.summary?.passed,
+          warnings: close.summary?.warnings,
+          failed: close.summary?.failed,
+          workflow: close.workflows?.closeGate,
+        }
+      : null,
+    state: state
+      ? {
+          phase: state.phase,
+          currentSliceId: state.currentSlice?.id,
+          currentSliceStatus: state.currentSlice?.status,
+          lastEvidence: state.lastEvidence,
+        }
+      : null,
+    evidenceRecords: recordCount,
+    commands: [doctorRun.command, closeRun.command],
+  })
+}
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { v1TargetValidation: failed === 0 ? 'verified' : 'failed' },
+  targets: targetReports,
+  limits: [
+    'This audit validates configured local project states through GSE target doctor and close gate.',
+    'It does not run those projects full test suites, browser smokes, CI, release publication, or marketplace installation.',
+    'Allowed warning IDs are target-specific and must be supplied by arguments or environment for real project validation.',
+    'Active-session .gse warnings are allowed only when they have no failed checks and reflect in-progress project-local GSE change-pack work.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE v1 Target Validation Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Target validation: ' + data.workflows.v1TargetValidation)
+  lines.push('')
+  lines.push('## Targets')
+  lines.push('')
+  for (const target of data.targets) {
+    lines.push('- ' + target.id + ': doctor=' + target.doctor?.status + ', close=' + target.closeGate?.status + ', slice=' + target.state?.currentSliceStatus)
+  }
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-validation-profiles.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function run(commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', 'run-validation-profile.mjs'), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  let parsed = null
+  try {
+    parsed = JSON.parse((result.stdout ?? '').trim())
+  } catch {
+    parsed = null
+  }
+  return {
+    command: [process.execPath, path.join(root, 'scripts', 'run-validation-profile.mjs'), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    parsed,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const runnerSource = read('scripts/run-validation-profile.mjs')
+const skill = read('SKILL.md')
+const commands = read('references/commands.md')
+const qualityGates = read('references/quality-gates.md')
+const lite = run(['--root', root, '--target', root, '--profile', 'lite', '--json'])
+const standard = run(['--root', root, '--target', root, '--profile', 'standard', '--json'])
+const releaseProfileScripts = [
+  'audit-command-execution.mjs',
+  'audit-npm-package-metadata.mjs',
+  'audit-npm-tarball-install.mjs',
+  'audit-signing.mjs',
+  'audit-release-bundle.mjs',
+  'audit-distribution.mjs',
+  'audit-remote-distribution.mjs',
+  'audit-public-acceptance-readiness.mjs',
+  'audit-final-readiness.mjs',
+  'audit-final-acceptance-packet.mjs',
+  'audit-owner-external-gate-kit.mjs',
+]
+
+const checks = [
+  check('VP01', 'validation profile runner exists', fs.existsSync(path.join(root, 'scripts', 'run-validation-profile.mjs')), 'scripts/run-validation-profile.mjs'),
+  check('VP02', 'runner defines lite, standard, enterprise, and release profiles', ['lite', 'standard', 'enterprise', 'release'].every((item) => runnerSource.includes(`'${item}'`)), 'profile names'),
+  check('VP03', 'lite profile avoids release/distribution heavy gates', lite.status === 0 && lite.parsed?.summary?.status === 'passed' && !lite.stdout.includes('audit-distribution.mjs') && !lite.stdout.includes('audit-release-bundle.mjs'), 'lite profile output'),
+  check('VP04', 'standard profile passes without forcing close gate during in-progress work', standard.status === 0 && standard.parsed?.summary?.status === 'passed' && !standard.stdout.includes('audit-close-gate.mjs') && !standard.stdout.includes('audit-distribution.mjs'), 'standard profile output'),
+  check('VP05', 'quality gates document full validation as enterprise/release-grade work', qualityGates.includes('Full validation belongs here, not on every small product slice') && qualityGates.includes('Use the lightest gate profile'), 'references/quality-gates.md'),
+  check('VP06', 'skill exposes validation profile runner', skill.includes('run-validation-profile.mjs'), 'SKILL.md'),
+  check('VP07', 'command docs expose profile-based verify', commands.includes('/gse verify --profile lite') && commands.includes('run-validation-profile.mjs'), 'references/commands.md'),
+  check('VP08', 'release profile includes install, signing, bundle, final readiness, and owner handoff gates', releaseProfileScripts.every((item) => runnerSource.includes(item)) && runnerSource.includes("--profile', 'full'"), releaseProfileScripts.join(', ')),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    validationProfiles: failed === 0 ? 'verified' : 'failed',
+    liteChecks: lite.parsed?.summary ?? null,
+    standardChecks: standard.parsed?.summary ?? null,
+  },
+  limits: [
+    'This audit verifies validation profile routing and fast profile behavior.',
+    'It does not run the release profile because that profile is intentionally heavy and should be selected only for release/install claims.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Validation Profiles Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Validation profiles: ' + data.workflows.validationProfiles)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/close-change.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const target = path.resolve(readArg('--target', process.cwd()))
+const changeId = String(readArg('--change-id', '')).trim().toLowerCase()
+const status = readArg('--status', 'verified')
+const date = readArg('--date', new Date().toISOString().slice(0, 10))
+const dryRun = args.includes('--dry-run')
+const force = args.includes('--force')
+const jsonOnly = args.includes('--json')
+
+const validStatus = new Set(['result', 'verified', 'accepted'])
+if (!changeId) {
+  console.error('Missing --change-id.')
+  process.exit(1)
+}
+if (!validStatus.has(status)) {
+  console.error('Invalid --status value. Expected result, verified, or accepted.')
+  process.exit(1)
+}
+
+const changeDir = path.join(target, '.gse', 'changes', changeId)
+const archiveDir = path.join(target, '.gse', 'archive', `${date}-${changeId}`)
+const evidenceIndex = path.join(target, '.gse', 'evidence', 'index.jsonl')
+const requiredFiles = [
+  'brief.md',
+  'spec.md',
+  'tasks.md',
+  'evidence.md',
+  'review.md',
+]
+
+function read(relativePath) {
+  const fullPath = path.join(changeDir, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : ''
+}
+
+function fail(message, extra = {}) {
+  const report = { target, changeId, status: 'failed', message, ...extra }
+  console.error(JSON.stringify(report, null, 2))
+  process.exit(1)
+}
+
+if (!fs.existsSync(changeDir)) fail('Change directory does not exist.', { changeDir })
+if (fs.existsSync(archiveDir) && !force) fail('Archive directory already exists. Use --force to overwrite.', { archiveDir })
+
+const missing = requiredFiles.filter((file) => !fs.existsSync(path.join(changeDir, file)))
+if (missing.length) fail('Required change files are missing.', { missing })
+
+const evidence = read('evidence.md')
+const review = read('review.md')
+const hasEvidenceStatus = ['result', 'verified', 'accepted'].some((term) => evidence.toLowerCase().includes(term))
+const hasReviewClosure = review.includes('## Closure')
+if (!hasEvidenceStatus) fail('Evidence file does not include result/verified/accepted status vocabulary.', { file: 'evidence.md' })
+if (!hasReviewClosure) fail('Review file does not include closure section.', { file: 'review.md' })
+
+const archiveRecord = `# Change Archive Record
+
+Change ID: ${changeId}
+Closed At: ${new Date().toISOString()}
+Status: ${status}
+Source: .gse/changes/${changeId}
+Archive: .gse/archive/${date}-${changeId}
+
+## Closure Rules
+
+- Required change files were present.
+- Evidence status vocabulary was present.
+- Review closure section was present.
+- Source change folder was moved to archive.
+`
+
+const indexRecord = {
+  date,
+  recordType: 'change-archive',
+  changeId,
+  status,
+  summary: `Archived GSE change ${changeId}.`,
+  evidenceFile: `.gse/archive/${date}-${changeId}/evidence.md`,
+  archivePath: `.gse/archive/${date}-${changeId}`,
+  commands: [
+    `node scripts/close-change.mjs --target ${target} --change-id ${changeId} --status ${status} --date ${date} --json`,
+  ],
+  nextAction: 'Continue from .gse/state.json and the current goal map.',
+}
+
+if (!dryRun) {
+  fs.mkdirSync(path.dirname(archiveDir), { recursive: true })
+  fs.rmSync(archiveDir, { recursive: true, force: true })
+  fs.renameSync(changeDir, archiveDir)
+  fs.writeFileSync(path.join(archiveDir, 'archive-record.md'), archiveRecord.replace(/\n/g, '\r\n'), 'utf8')
+  fs.mkdirSync(path.dirname(evidenceIndex), { recursive: true })
+  fs.appendFileSync(evidenceIndex, JSON.stringify(indexRecord) + '\n', 'utf8')
+}
+
+const report = {
+  target,
+  changeId,
+  status: 'passed',
+  evidenceStatus: status,
+  dryRun,
+  source: changeDir,
+  archive: archiveDir,
+  indexRecord,
+}
+
+console.log(JSON.stringify(report, null, 2))