@t275005746/gse 0.1.0

package/scripts/generate-owner-external-gate-kit.mjs

@@ -0,0 +1,295 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function hasArg(name) {
+  return args.includes(name)
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const out = path.resolve(readArg('--out', path.join(root, '.gse', 'acceptance', 'owner-external-gate-kit')))
+const displayRoot = readArg('--display-root', '<gse-root>')
+const jsonOnly = hasArg('--json')
+const dryRun = hasArg('--dry-run')
+const force = hasArg('--force')
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(stdout) {
+  try {
+    return JSON.parse(stdout)
+  } catch {
+    return null
+  }
+}
+
+function stageFor(gate) {
+  if (gate.area === 'License decision') return '01-owner-license'
+  if (gate.area === 'Public security contact') return '02-owner-security-contact'
+  if (gate.area === 'Public repository settings') return '03-public-repository-settings'
+  if (gate.area === 'Public CI run') return '04-public-ci-run'
+  if (gate.area === 'Public registry publication') return '05-public-registry-publication'
+  if (gate.area === 'Marketplace approval') return '06-marketplace-approval'
+  if (gate.area === 'Native slash command') return '07-native-slash-command'
+  if (gate.area === 'Other host runtime invocation') return '08-other-host-runtime-invocation'
+  return '99-other'
+}
+
+function runJsonScript(scriptName, scriptArgs = []) {
+  const result = run(process.execPath, [path.join(root, 'scripts', scriptName), '--root', root, '--display-root', displayRoot, ...scriptArgs, '--json'])
+  return { result, data: parseJson(result.stdout) }
+}
+
+const tempRoot = mkdtempSync(path.join(tmpdir(), 'gse-owner-external-gate-kit-src-'))
+const generatedPaths = {
+  finalAcceptancePacket: path.join(tempRoot, 'final-acceptance-packet.md'),
+  publicAcceptanceHandoff: path.join(tempRoot, 'public-acceptance-handoff.md'),
+  hostRuntimeEvidenceHandoff: path.join(tempRoot, 'host-runtime-evidence-handoff.md'),
+  releaseStatusManifest: path.join(tempRoot, 'release-status-manifest.json'),
+  releaseOwnerActionPlan: path.join(tempRoot, 'release-owner-action-plan.md'),
+}
+
+const errors = []
+const doctor = runJsonScript('audit-public-acceptance-readiness.mjs')
+if (doctor.result.status !== 0 || !doctor.data) errors.push('public acceptance doctor failed')
+
+const finalPacket = runJsonScript('generate-final-acceptance-packet.mjs', ['--out', generatedPaths.finalAcceptancePacket, '--force'])
+if (finalPacket.result.status !== 0) errors.push('final acceptance packet generation failed')
+
+const publicHandoff = runJsonScript('generate-public-acceptance-handoff.mjs', ['--out', generatedPaths.publicAcceptanceHandoff, '--force'])
+if (publicHandoff.result.status !== 0) errors.push('public acceptance handoff generation failed')
+
+const hostHandoff = runJsonScript('generate-host-runtime-evidence-handoff.mjs', ['--out', generatedPaths.hostRuntimeEvidenceHandoff, '--force'])
+if (hostHandoff.result.status !== 0) errors.push('host runtime evidence handoff generation failed')
+
+const manifest = runJsonScript('generate-release-status-manifest.mjs', ['--out', generatedPaths.releaseStatusManifest, '--force'])
+if (manifest.result.status !== 0) errors.push('release status manifest generation failed')
+
+const actionPlan = runJsonScript('generate-release-owner-action-plan.mjs', ['--manifest', generatedPaths.releaseStatusManifest, '--out', generatedPaths.releaseOwnerActionPlan, '--force'])
+if (actionPlan.result.status !== 0) errors.push('release owner action plan generation failed')
+
+const gates = [...(doctor.data?.pendingGates ?? [])].sort((a, b) => stageFor(a).localeCompare(stageFor(b)))
+
+function renderReadme() {
+  const lines = []
+  lines.push('# GSE Owner / External Gate Kit')
+  lines.push('')
+  lines.push('Generated: ' + new Date().toISOString())
+  lines.push('Root: ' + displayRoot)
+  lines.push('')
+  lines.push('## Purpose')
+  lines.push('')
+  lines.push('This kit is the one-directory execution packet for the remaining owner-required and external-required final-form gates. It does not choose a license, publish a package, configure a public repository, run public CI, approve a marketplace listing, or prove host-native slash-command support.')
+  lines.push('')
+  lines.push('## Current Boundary')
+  lines.push('')
+  lines.push('- Public accepted: ' + (doctor.data?.summary?.publicAccepted ?? doctor.data?.workflows?.publicAccepted ?? 'unknown'))
+  lines.push('- Pending gates: ' + gates.length)
+  lines.push('- Source of truth: `scripts/audit-public-acceptance-readiness.mjs` and `references/final-readiness.md`')
+  lines.push('')
+  lines.push('## Execution Order')
+  lines.push('')
+  for (const gate of gates) {
+    lines.push('- `' + stageFor(gate) + '`: ' + gate.area + ' (' + gate.owner + ')')
+  }
+  lines.push('')
+  lines.push('## Files')
+  lines.push('')
+  lines.push('- `action-packet.md`: concise human-facing execution packet.')
+  lines.push('- `final-acceptance-packet.md`: final readiness acceptance checklist generated fresh.')
+  lines.push('- `public-acceptance-handoff.md`: public acceptance handoff generated fresh.')
+  lines.push('- `host-runtime-evidence-handoff.md`: host runtime evidence handoff generated fresh.')
+  lines.push('- `release-status-manifest.json`: machine-readable release status generated fresh.')
+  lines.push('- `release-owner-action-plan.md`: owner-facing action plan generated fresh from the manifest.')
+  lines.push('- `record-commands.md`: copy-ready record commands grouped by execution order.')
+  lines.push('- `verification-commands.md`: audits to run after attaching real evidence.')
+  lines.push('- `kit-manifest.json`: machine-readable inventory for the kit itself.')
+  lines.push('')
+  lines.push('## Anti-Overclaim')
+  lines.push('')
+  lines.push('- Do not claim public release acceptance until `publicAccepted` is verified by final readiness audits.')
+  lines.push('- Do not claim registry publication, marketplace approval, public CI, or repository settings without real external records.')
+  lines.push('- Do not claim native slash-command support from fixture drills, generated pointers, or portable text-command records.')
+  lines.push('- Keep owner-required and external-required gates visible until accepted evidence promotes them.')
+  return lines.join('\n') + '\n'
+}
+
+function renderRecordCommands() {
+  const lines = []
+  lines.push('# GSE Owner / External Gate Record Commands')
+  lines.push('')
+  for (const gate of gates) {
+    lines.push('## ' + stageFor(gate) + ' - ' + gate.area)
+    lines.push('')
+    lines.push('- Responsible party: ' + gate.owner)
+    lines.push('- Current status: ' + gate.status)
+    lines.push('- Required evidence: ' + gate.requiredEvidence)
+    lines.push('')
+    lines.push('```bash')
+    lines.push(gate.recordCommand)
+    lines.push('```')
+    lines.push('')
+    lines.push('Preflight command:')
+    lines.push('')
+    lines.push('```bash')
+    lines.push(gate.preflightCommand ?? `${gate.recordCommand} --dry-run --json`)
+    lines.push('```')
+    lines.push('')
+  }
+  return lines.join('\n') + '\n'
+}
+
+function renderVerificationCommands() {
+  return [
+    '# GSE Owner / External Gate Verification Commands',
+    '',
+    'Run these commands after attaching real owner/external records:',
+    '',
+    '```bash',
+    'node scripts/run-gse-command.mjs --root __GSE__ --target __GSE__ --command "/gse probe --public-repo-url __PUBLIC_REPO_URL__ --security-contact-url __SECURITY_CONTACT_URL__ --public-ci-run-url __PUBLIC_CI_RUN_URL__ --registry-package-url __REGISTRY_PACKAGE_URL__ --marketplace-url __MARKETPLACE_LISTING_URL__ --native-host-evidence __NATIVE_HOST_EVIDENCE__ --other-host-evidence __OTHER_HOST_EVIDENCE__" --json',
+    'node scripts/audit-public-acceptance-readiness.mjs --root __GSE__ --json',
+    'node scripts/audit-public-acceptance-command-dry-run-drill.mjs --root __GSE__ --json',
+    'node scripts/audit-final-readiness.mjs --root __GSE__ --json',
+    'node scripts/audit-final-acceptance-packet.mjs --root __GSE__ --json',
+    'node scripts/audit-release-owner-action-plan.mjs --root __GSE__ --json',
+    'node scripts/audit-host-runtime-invocations.mjs --root __GSE__ --json',
+    'node scripts/audit-owner-external-gate-kit.mjs --root __GSE__ --json',
+    'node scripts/validate-gse.mjs --root __GSE__ --json',
+    'node scripts/audit-close-gate.mjs --target __GSE__ --json',
+    '```',
+    '',
+    'Acceptance rule: every pending gate must have accepted real evidence and final readiness must report `publicAccepted: verified`. Local fixture drills, pointer adapters, and generated handoff files do not count as external acceptance.',
+    '',
+  ].join('\n')
+}
+
+function renderActionPacket() {
+  const lines = []
+  const pendingAreas = new Set(gates.map((gate) => gate.area))
+  const firstAction = pendingAreas.has('License decision')
+    ? 'Start with owner-required decisions: license decision and public security contact. Then attach public repository, CI, publication, marketplace, and host runtime evidence as those external systems become available.'
+    : pendingAreas.has('Public security contact')
+      ? 'Start with the public security contact. Then attach public repository, CI, publication, marketplace, and host runtime evidence as those external systems become available.'
+      : 'Start with the first available public repository, CI, publication, marketplace, or host runtime evidence record.'
+  lines.push('# GSE Owner / External Action Packet')
+  lines.push('')
+  lines.push('Public accepted: ' + (doctor.data?.summary?.publicAccepted ?? 'unknown'))
+  lines.push('')
+  lines.push('## Pending Gates')
+  lines.push('')
+  for (const gate of gates) {
+    lines.push('- ' + stageFor(gate) + ': ' + gate.area + ' -> ' + gate.owner)
+  }
+  lines.push('')
+  lines.push('## First Action')
+  lines.push('')
+  lines.push(firstAction)
+  lines.push('')
+  lines.push('## Boundary')
+  lines.push('')
+  lines.push('This packet is not public acceptance. It is the execution kit for collecting the evidence that can later promote final readiness.')
+  return lines.join('\n') + '\n'
+}
+
+function readGenerated(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8') : ''
+}
+
+const kitManifest = JSON.stringify({
+  schemaVersion: 1,
+  generatedAt: new Date().toISOString(),
+  root: displayRoot,
+  publicAccepted: doctor.data?.summary?.publicAccepted ?? doctor.data?.workflows?.publicAccepted ?? 'unknown',
+  pendingGateCount: gates.length,
+  generatedFresh: {
+    finalAcceptancePacket: true,
+    publicAcceptanceHandoff: true,
+    hostRuntimeEvidenceHandoff: true,
+    releaseStatusManifest: true,
+    releaseOwnerActionPlan: true,
+  },
+  gates: gates.map((gate) => ({
+    stage: stageFor(gate),
+    area: gate.area,
+    status: gate.status,
+    owner: gate.owner,
+    currentEvidence: gate.currentEvidence,
+    requiredEvidence: gate.requiredEvidence,
+    recordCommand: gate.recordCommand,
+    preflightCommand: gate.preflightCommand,
+    willPromoteWhenAccepted: gate.willPromoteWhenAccepted,
+  })),
+  limits: [
+    'Kit generation does not choose a license.',
+    'Kit generation does not publish a package or approve a marketplace listing.',
+    'Kit generation does not prove host-native slash-command support.',
+  ],
+}, null, 2) + '\n'
+
+const files = {
+  'README.md': renderReadme(),
+  'action-packet.md': renderActionPacket(),
+  'final-acceptance-packet.md': readGenerated(generatedPaths.finalAcceptancePacket),
+  'public-acceptance-handoff.md': readGenerated(generatedPaths.publicAcceptanceHandoff),
+  'host-runtime-evidence-handoff.md': readGenerated(generatedPaths.hostRuntimeEvidenceHandoff),
+  'release-status-manifest.json': readGenerated(generatedPaths.releaseStatusManifest),
+  'release-owner-action-plan.md': readGenerated(generatedPaths.releaseOwnerActionPlan),
+  'record-commands.md': renderRecordCommands(),
+  'verification-commands.md': renderVerificationCommands(),
+  'kit-manifest.json': kitManifest,
+}
+
+if (errors.length === 0 && !dryRun) {
+  if (fs.existsSync(out) && !force) {
+    errors.push('output exists; pass --force to overwrite')
+  } else {
+    if (fs.existsSync(out)) fs.rmSync(out, { recursive: true, force: true })
+    fs.mkdirSync(out, { recursive: true })
+    for (const [fileName, content] of Object.entries(files)) {
+      fs.writeFileSync(path.join(out, fileName), content, 'utf8')
+    }
+  }
+}
+
+const report = {
+  status: errors.length ? 'failed' : dryRun ? 'ready' : 'written',
+  root,
+  out,
+  dryRun,
+  errors,
+  summary: {
+    publicAccepted: doctor.data?.summary?.publicAccepted ?? doctor.data?.workflows?.publicAccepted ?? 'unknown',
+    pendingGates: gates.length,
+    files: Object.keys(files),
+  },
+}
+
+rmSync(tempRoot, { recursive: true, force: true })
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(files['README.md'])
+
+if (report.status === 'failed') process.exit(1)

package/scripts/generate-public-acceptance-handoff.mjs

@@ -0,0 +1,168 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function hasArg(name) {
+  return args.includes(name)
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const out = path.resolve(readArg('--out', path.join(root, '.gse', 'acceptance', 'public-acceptance-handoff.md')))
+const displayRoot = readArg('--display-root', '<gse-root>')
+const releaseLabel = readArg('--release-label', 'unreleased')
+const jsonOnly = hasArg('--json')
+const dryRun = hasArg('--dry-run')
+const force = hasArg('--force')
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function runDoctor() {
+  const result = run(process.execPath, [path.join(root, 'scripts', 'audit-public-acceptance-readiness.mjs'), '--root', root, '--json'])
+  if (result.status !== 0) {
+    return { ok: false, error: 'public acceptance doctor failed', result }
+  }
+  try {
+    return { ok: true, data: JSON.parse(result.stdout), command: result.command }
+  } catch (error) {
+    return { ok: false, error: 'public acceptance doctor returned invalid JSON', detail: error.message, result }
+  }
+}
+
+function stageFor(gate) {
+  if (gate.area === 'License decision') return '1. Owner decision'
+  if (gate.area === 'Public security contact') return '2. Owner policy'
+  if (gate.area === 'Public repository settings') return '3. Repository setup'
+  if (gate.area === 'Public CI run') return '4. Public CI'
+  if (gate.area === 'Public registry publication') return '5. Public channel'
+  if (gate.area === 'Marketplace approval') return '6. Marketplace or catalog'
+  if (gate.area === 'Native slash command') return '7. Host runtime'
+  if (gate.area === 'Other host runtime invocation') return '8. Cross-host evidence'
+  return 'Other'
+}
+
+function renderHandoff(doctor) {
+  const gates = doctor.pendingGates ?? []
+  const gateNames = new Set(gates.map((gate) => gate.area))
+  const lines = []
+  lines.push('# GSE Public Acceptance Handoff')
+  lines.push('')
+  lines.push('Generated: ' + new Date().toISOString())
+  lines.push('Root: ' + displayRoot)
+  lines.push('Release label: ' + releaseLabel)
+  lines.push('')
+  lines.push('## Purpose')
+  lines.push('')
+  lines.push('Give the owner and future agents one executable checklist for public acceptance. This handoff does not choose a license, publish a package, configure a repository, approve a marketplace listing, or prove host-native slash-command support.')
+  lines.push('')
+  lines.push('## Current Boundary')
+  lines.push('')
+  lines.push('- Public accepted: ' + (doctor.summary?.publicAccepted ?? doctor.workflows?.publicAccepted ?? 'unknown'))
+  lines.push('- Pending owner/external gates: ' + gates.length)
+  lines.push('- Source of truth: `scripts/audit-public-acceptance-readiness.mjs` and `references/final-readiness.md`')
+  lines.push('')
+  lines.push('## Execution Order')
+  lines.push('')
+  for (const gate of gates) {
+    lines.push('### ' + stageFor(gate) + ' - ' + gate.area)
+    lines.push('')
+    lines.push('- Current status: ' + gate.status)
+    lines.push('- Responsible party: ' + gate.owner)
+    lines.push('- Current evidence: ' + gate.currentEvidence)
+    lines.push('- Required evidence: ' + gate.requiredEvidence)
+    lines.push('- Record command:')
+    lines.push('')
+    lines.push('```bash')
+    lines.push(gate.recordCommand)
+    lines.push('```')
+    lines.push('')
+    lines.push('- Preflight command:')
+    lines.push('')
+    lines.push('```bash')
+    lines.push(gate.preflightCommand ?? `${gate.recordCommand} --dry-run --json`)
+    lines.push('```')
+    lines.push('')
+    lines.push('- Promotion rule: create a real accepted record, then re-run `node scripts/audit-final-readiness.mjs --root __GSE__ --json` and `node scripts/audit-public-acceptance-readiness.mjs --root __GSE__ --json`.')
+    lines.push('')
+  }
+  lines.push('## Final Verification')
+  lines.push('')
+  lines.push('Run these commands after owner/external records are attached:')
+  lines.push('')
+  lines.push('```bash')
+  lines.push('node scripts/audit-public-acceptance-readiness.mjs --root __GSE__ --json')
+  lines.push('node scripts/audit-final-readiness.mjs --root __GSE__ --json')
+  lines.push('node scripts/audit-final-acceptance-packet.mjs --root __GSE__ --json')
+  lines.push('node scripts/validate-gse.mjs --root __GSE__ --json')
+  lines.push('node scripts/audit-close-gate.mjs --target __GSE__ --json')
+  lines.push('```')
+  lines.push('')
+  lines.push('## Anti-Overclaim')
+  lines.push('')
+  lines.push('- Do not claim public release acceptance until the final readiness matrix returns `publicAccepted: verified`.')
+  lines.push('- Do not claim marketplace availability without a real marketplace or catalog record.')
+  lines.push('- Do not claim native slash-command support from portable text-command routing.')
+  lines.push('- Do not claim support for a host without a host runtime invocation record for that host.')
+  lines.push('- Keep this handoff updated when final-readiness gates change.')
+  lines.push('')
+  lines.push('## Next Action')
+  lines.push('')
+  if (gateNames.has('License decision')) {
+    lines.push('Start with the owner-required license decision and public security contact, then attach public repository, CI, publication, and host runtime evidence as those systems become available.')
+  } else {
+    lines.push('Start with the public security contact, then attach public repository, CI, publication, and host runtime evidence as those systems become available.')
+  }
+  return lines.join('\n') + '\n'
+}
+
+const doctor = runDoctor()
+if (!doctor.ok) {
+  console.error(JSON.stringify({ status: 'failed', root, out, error: doctor.error, detail: doctor.detail, doctorResult: doctor.result }, null, 2))
+  process.exit(1)
+}
+
+const handoff = renderHandoff(doctor.data)
+if (!dryRun) {
+  if (fs.existsSync(out) && !force) {
+    console.error(JSON.stringify({ status: 'exists', root, out, error: 'output exists; pass --force to overwrite' }, null, 2))
+    process.exit(1)
+  }
+  fs.mkdirSync(path.dirname(out), { recursive: true })
+  fs.writeFileSync(out, handoff, 'utf8')
+}
+
+const report = {
+  status: dryRun ? 'ready' : 'written',
+  root,
+  out,
+  dryRun,
+  doctorCommand: doctor.command,
+  summary: {
+    publicAccepted: doctor.data.summary?.publicAccepted ?? doctor.data.workflows?.publicAccepted ?? 'unknown',
+    pendingGates: doctor.data.pendingGates?.length ?? 0,
+    stages: [...new Set((doctor.data.pendingGates ?? []).map(stageFor))],
+  },
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(handoff)

package/scripts/generate-public-release-checklist.mjs

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function hasArg(name) {
+  return args.includes(name)
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const out = path.resolve(readArg('--out', path.join(root, '.gse', 'acceptance', 'public-release-checklist.md')))
+const manifestPath = path.resolve(readArg('--manifest', path.join(root, '.gse', 'acceptance', 'release-status-manifest.json')))
+const displayRoot = readArg('--display-root', '<gse-root>')
+const jsonOnly = hasArg('--json')
+const dryRun = hasArg('--dry-run')
+const force = hasArg('--force')
+
+function run(command, commandArgs) {
+  const result = spawnSync(command, commandArgs, {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+    command: [command, ...commandArgs].join(' '),
+  }
+}
+
+function parseJson(text, label) {
+  try {
+    return JSON.parse(text)
+  } catch (error) {
+    throw new Error(`${label} is not valid JSON: ${error.message}`)
+  }
+}
+
+function readManifest() {
+  if (!fs.existsSync(manifestPath)) {
+    const generated = run(process.execPath, [
+      path.join(root, 'scripts', 'generate-release-status-manifest.mjs'),
+      '--root', root,
+      '--out', manifestPath,
+      '--force',
+      '--json',
+    ])
+    if (generated.status !== 0) {
+      throw new Error(`release status manifest generation failed: ${generated.stderr || generated.stdout}`)
+    }
+  }
+  return parseJson(fs.readFileSync(manifestPath, 'utf8').replace(/^\uFEFF/, ''), 'release status manifest')
+}
+
+function gateByArea(gates, area) {
+  return gates.find((gate) => gate.area === area)
+}
+
+function safeCommand(command) {
+  return (command ?? '').replaceAll('__GSE__', displayRoot)
+}
+
+function renderCommandBlock(command) {
+  return ['```text', safeCommand(command), '```']
+}
+
+function renderPhase(lines, number, title, gate, actions) {
+  lines.push(`### ${number}. ${title}`)
+  lines.push('')
+  if (gate) {
+    lines.push(`- Gate: ${gate.area}`)
+    lines.push(`- Status: ${gate.status}`)
+    lines.push(`- Required evidence: ${gate.requiredEvidence}`)
+  } else {
+    lines.push('- Gate: local preparation')
+    lines.push('- Status: verified locally before public handoff')
+  }
+  for (const action of actions) lines.push(`- ${action}`)
+  if (gate?.preflightCommand) {
+    lines.push('')
+    lines.push('Preflight:')
+    lines.push('')
+    lines.push(...renderCommandBlock(gate.preflightCommand))
+  }
+  if (gate?.recordCommand) {
+    lines.push('')
+    lines.push('Record accepted evidence:')
+    lines.push('')
+    lines.push(...renderCommandBlock(gate.recordCommand))
+  }
+  lines.push('')
+}
+
+function render(manifest) {
+  const gates = manifest.publicAcceptance?.pendingGates ?? []
+  const lines = []
+  lines.push('# GSE Public Release Checklist')
+  lines.push('')
+  lines.push(`Generated: ${new Date().toISOString()}`)
+  lines.push('Source manifest: `.gse/acceptance/release-status-manifest.json`')
+  lines.push('')
+  lines.push('## Boundary')
+  lines.push('')
+  lines.push(`- Public accepted: ${manifest.publicAcceptance?.publicAccepted ?? manifest.claimBoundary?.publicAccepted ?? 'unknown'}`)
+  lines.push(`- Pending owner/external gates: ${gates.length}`)
+  lines.push('- This checklist is an execution runway. It does not publish, approve, or accept a release by itself.')
+  lines.push('- A gate is complete only after real accepted evidence is recorded and final readiness is re-audited.')
+  lines.push('')
+  lines.push('## Runway')
+  lines.push('')
+  renderPhase(lines, '01', 'Prepare the release bundle', null, [
+    'Run `/gse release` as a dry-run before writing a bundle.',
+    'Run `/gse release --execute --out <bundle>` only for the bundle that will be handed off.',
+    'Keep `npm publish --dry-run`, tarball install, checksum, provenance, and signing evidence attached to the bundle.',
+  ])
+  renderPhase(lines, '02', 'Publish and configure the public repository', gateByArea(gates, 'Public repository settings'), [
+    'Create or update the public repository.',
+    'Enable issues, pull requests, visible security policy, branch protection, required checks, review before merge, conversation resolution, force-push restriction, and deletion restriction.',
+  ])
+  renderPhase(lines, '03', 'Approve the public security contact', gateByArea(gates, 'Public security contact'), [
+    'Choose the owner-approved vulnerability disclosure path.',
+    'Make the contact public and ensure the security policy points to it.',
+  ])
+  renderPhase(lines, '04', 'Run public CI on the release commit', gateByArea(gates, 'Public CI run'), [
+    'Run the public workflow on the release commit.',
+    'Record the public run URL, commit SHA, branch, required checks, and successful conclusion.',
+  ])
+  renderPhase(lines, '05', 'Publish the registry package', gateByArea(gates, 'Public registry publication'), [
+    'Publish only after the public repository and CI evidence are available.',
+    'Record package URL, version, artifact digest, publication date, and installability proof.',
+  ])
+  renderPhase(lines, '06', 'Publish or submit marketplace listing', gateByArea(gates, 'Marketplace approval'), [
+    'Submit the marketplace/catalog listing after registry or package installability is proven.',
+    'Record listing URL, approval/publication status, review date, version, and installability proof.',
+  ])
+  renderPhase(lines, '07', 'Record native slash-command evidence', gateByArea(gates, 'Native slash command'), [
+    'Use a real host runtime that supports native slash commands.',
+    'Record transcript, screenshot, host log, or equivalent proof that does not rely on portable text routing.',
+  ])
+  renderPhase(lines, '08', 'Record other host runtime invocation evidence', gateByArea(gates, 'Other host runtime invocation'), [
+    'Use each claimed non-native host runtime directly.',
+    'Record accepted evidence without generated-pointer-only proof.',
+  ])
+  lines.push('## Final Verification')
+  lines.push('')
+  lines.push('- `node scripts/run-gse-command.mjs --root ' + displayRoot + ' --target ' + displayRoot + ' --command "/gse probe --public-repo-url __PUBLIC_REPO_URL__ --security-contact-url __SECURITY_CONTACT_URL__ --public-ci-run-url __PUBLIC_CI_RUN_URL__ --registry-package-url __REGISTRY_PACKAGE_URL__ --marketplace-url __MARKETPLACE_LISTING_URL__ --native-host-evidence __NATIVE_HOST_EVIDENCE__ --other-host-evidence __OTHER_HOST_EVIDENCE__" --json`')
+  for (const command of manifest.verificationCommands ?? []) {
+    lines.push('- `' + safeCommand(command) + '`')
+  }
+  lines.push('- `node scripts/audit-public-acceptance-readiness.mjs --root ' + displayRoot + ' --json`')
+  lines.push('- `node scripts/audit-final-readiness.mjs --root ' + displayRoot + ' --json`')
+  lines.push('- `node scripts/audit-release-bundle.mjs --root ' + displayRoot + ' --json`')
+  lines.push('')
+  lines.push('## Stop Conditions')
+  lines.push('')
+  lines.push('- Stop if any evidence value is a placeholder, local path, example URL, or private-only URL.')
+  lines.push('- Stop if public CI did not run against the release commit.')
+  lines.push('- Stop if a host invocation only proves generated pointer files or portable text routing while claiming native slash-command support.')
+  lines.push('- Stop if public acceptance is still `not-accepted` after recording evidence; rerun the readiness doctor and fix the named gate.')
+  lines.push('')
+  return lines.join('\n')
+}
+
+let status = 'written'
+let errors = []
+let checklist = ''
+try {
+  const manifest = readManifest()
+  checklist = render(manifest)
+  if (!dryRun) {
+    if (fs.existsSync(out) && !force) throw new Error(`output already exists, use --force: ${out}`)
+    fs.mkdirSync(path.dirname(out), { recursive: true })
+    fs.writeFileSync(out, checklist, 'utf8')
+  } else {
+    status = 'ready'
+  }
+} catch (error) {
+  status = 'failed'
+  errors = [error.message]
+}
+
+const report = {
+  root,
+  out,
+  manifest: manifestPath,
+  dryRun,
+  status,
+  errors,
+  publicReleaseChecklist: status === 'failed' ? 'failed' : dryRun ? 'ready' : 'written',
+}
+
+if (jsonOnly) {
+  console.log(JSON.stringify(report, null, 2))
+} else if (status === 'failed') {
+  console.error(errors.join('\n'))
+}
+
+process.exit(status === 'failed' ? 1 : 0)