@t275005746/gse 0.1.0

package/scripts/install-gse.mjs

@@ -0,0 +1,234 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { fileURLToPath } from 'node:url'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const sourceArg = readArg('--source', null)
+const sourceUrlArg = readArg('--source-url', null)
+const manifestUrlArg = readArg('--manifest-url', null)
+const publicKeyArg = readArg('--public-key', null)
+const skipIntegrity = args.includes('--skip-integrity')
+const skipSignature = args.includes('--skip-signature')
+let materializedRemote = null
+let source = path.resolve(sourceArg ?? path.join(import.meta.dirname, '..'))
+const target = path.resolve(readArg('--target', ''))
+const force = args.includes('--force')
+const dryRun = args.includes('--dry-run')
+const jsonOnly = args.includes('--json')
+
+const defaultInclude = [
+  'package.json',
+  'SKILL.md',
+  'README.md',
+  'README.zh-CN.md',
+  'agents',
+  'assets',
+  'examples',
+  'references',
+  'scripts',
+  '.gse',
+]
+
+function joinUrl(base, relativePath) {
+  const cleanBase = base.endsWith('/') ? base : base + '/'
+  return new URL(relativePath.split('/').map(encodeURIComponent).join('/'), cleanBase).toString()
+}
+
+async function fetchText(url) {
+  const response = await fetch(url)
+  if (!response.ok) throw new Error(`Failed to fetch ${url}: ${response.status} ${response.statusText}`)
+  return await response.text()
+}
+
+async function fetchBytes(url) {
+  const response = await fetch(url)
+  if (!response.ok) throw new Error(`Failed to fetch ${url}: ${response.status} ${response.statusText}`)
+  return Buffer.from(await response.arrayBuffer())
+}
+
+function sha256(filePath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
+}
+
+function fingerprint(pem) {
+  return crypto.createHash('sha256').update(pem).digest('hex')
+}
+
+function verifyPackageSignature(packageDir, publicKeyPath) {
+  const signaturePath = path.join(packageDir, 'gse-package-signature.json')
+  if (!publicKeyPath) return { status: 'not-requested' }
+  if (!fs.existsSync(publicKeyPath)) return { status: 'failed', error: 'public key does not exist', publicKey: publicKeyPath }
+  if (!fs.existsSync(signaturePath)) return { status: 'failed', error: 'signature file does not exist', signaturePath }
+  try {
+    const signatureRecord = JSON.parse(fs.readFileSync(signaturePath, 'utf8').replace(/^\uFEFF/, ''))
+    const publicKeyPem = fs.readFileSync(publicKeyPath, 'utf8')
+    const manifestPath = path.join(packageDir, 'gse-package-manifest.json')
+    const localManifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8').replace(/^\uFEFF/, ''))
+    const payloadText = JSON.stringify(signatureRecord.payload)
+    const signatureOk = crypto.verify(null, Buffer.from(payloadText), publicKeyPem, Buffer.from(signatureRecord.signature, 'base64'))
+    const digestOk = signatureRecord.payload?.packageDigest === localManifest.integrity?.packageDigest
+    const fingerprintOk = signatureRecord.publicKeyFingerprint === fingerprint(publicKeyPem)
+    return signatureOk && digestOk && fingerprintOk
+      ? { status: 'verified', algorithm: signatureRecord.algorithm, publicKeyFingerprint: signatureRecord.publicKeyFingerprint }
+      : { status: 'failed', error: 'signature, digest, or public key fingerprint mismatch' }
+  } catch (error) {
+    return { status: 'failed', error: error instanceof Error ? error.message : String(error) }
+  }
+}
+
+async function resolveSource() {
+  if (!sourceUrlArg && !manifestUrlArg) return { source, sourceMode: 'path', remoteBaseUrl: null }
+  const urlText = sourceUrlArg ?? manifestUrlArg
+  const parsed = new URL(urlText)
+  if (parsed.protocol === 'file:') {
+    const resolved = fileURLToPath(parsed)
+    const stat = fs.existsSync(resolved) ? fs.statSync(resolved) : null
+    if (stat?.isFile()) return { source: path.dirname(resolved), sourceMode: 'file-url', remoteBaseUrl: null }
+    return { source: resolved, sourceMode: 'file-url', remoteBaseUrl: null }
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error('Unsupported --source-url protocol. Expected file:, http:, or https:.')
+  }
+
+  const manifestUrl = manifestUrlArg ?? joinUrl(sourceUrlArg, 'gse-package-manifest.json')
+  const manifestText = await fetchText(manifestUrl)
+  const manifest = JSON.parse(manifestText.replace(/^\uFEFF/, ''))
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-remote-install-'))
+  materializedRemote = tempRoot
+  fs.writeFileSync(path.join(tempRoot, 'gse-package-manifest.json'), JSON.stringify(manifest, null, 2) + '\n', 'utf8')
+  const baseUrl = manifestUrl.slice(0, manifestUrl.lastIndexOf('/') + 1)
+  try {
+    const signatureText = await fetchText(joinUrl(baseUrl, 'gse-package-signature.json'))
+    fs.writeFileSync(path.join(tempRoot, 'gse-package-signature.json'), signatureText, 'utf8')
+  } catch {
+    // Signature is optional unless --public-key is supplied.
+  }
+  for (const relativePath of manifest.files ?? []) {
+    const fileUrl = joinUrl(baseUrl, relativePath)
+    const bytes = await fetchBytes(fileUrl)
+    const targetPath = path.join(tempRoot, relativePath)
+    fs.mkdirSync(path.dirname(targetPath), { recursive: true })
+    fs.writeFileSync(targetPath, bytes)
+  }
+  return { source: tempRoot, sourceMode: 'http-url', remoteBaseUrl: baseUrl }
+}
+
+let sourceInfo
+try {
+  sourceInfo = await resolveSource()
+  source = sourceInfo.source
+} catch (error) {
+  const report = {
+    source: sourceArg,
+    sourceUrl: sourceUrlArg,
+    manifestUrl: manifestUrlArg,
+    target,
+    status: 'failed',
+    error: error instanceof Error ? error.message : String(error),
+  }
+  console.log(JSON.stringify(report, null, 2))
+  process.exit(1)
+}
+
+const manifestPath = path.join(source, 'gse-package-manifest.json')
+const manifest = fs.existsSync(manifestPath)
+  ? JSON.parse(fs.readFileSync(manifestPath, 'utf8').replace(/^\uFEFF/, ''))
+  : null
+
+function walk(itemPath, rootPath = source) {
+  const entries = []
+  if (!fs.existsSync(itemPath)) return entries
+  const stat = fs.statSync(itemPath)
+  if (stat.isFile()) {
+    entries.push(path.relative(rootPath, itemPath).replace(/\\/g, '/'))
+    return entries
+  }
+  for (const child of fs.readdirSync(itemPath, { withFileTypes: true })) {
+    const fullPath = path.join(itemPath, child.name)
+    if (child.name === 'node_modules' || child.name === '.git') continue
+    if (child.isDirectory()) entries.push(...walk(fullPath, rootPath))
+    else if (child.isFile()) entries.push(path.relative(rootPath, fullPath).replace(/\\/g, '/'))
+  }
+  return entries
+}
+
+function sourceFiles() {
+  if (manifest?.files?.length) return manifest.files
+  return defaultInclude.flatMap((item) => walk(path.join(source, item)))
+}
+
+function copy(relativePath) {
+  const from = path.join(source, relativePath)
+  const to = path.join(target, relativePath)
+  if (!fs.existsSync(from)) return { relativePath, status: 'missing-source' }
+  if (!skipIntegrity && manifest?.fileHashes?.[relativePath]) {
+    const actualHash = sha256(from)
+    if (actualHash !== manifest.fileHashes[relativePath]) {
+      return { relativePath, status: 'integrity-failed', expected: manifest.fileHashes[relativePath], actual: actualHash }
+    }
+  }
+  if (!force && fs.existsSync(to)) return { relativePath, status: 'skipped' }
+  if (!dryRun) {
+    fs.mkdirSync(path.dirname(to), { recursive: true })
+    fs.copyFileSync(from, to)
+  }
+  return { relativePath, status: dryRun ? 'would-write' : 'written' }
+}
+
+const files = sourceFiles()
+const signatureStatus = skipSignature ? { status: 'skipped' } : verifyPackageSignature(source, publicKeyArg ? path.resolve(publicKeyArg) : null)
+const report = {
+  source,
+  sourceUrl: sourceUrlArg,
+  manifestUrl: manifestUrlArg,
+  sourceMode: sourceInfo.sourceMode,
+  target,
+  dryRun,
+  force,
+  integrity: manifest?.integrity ? { algorithm: manifest.integrity.algorithm, packageDigest: manifest.integrity.packageDigest, skipped: skipIntegrity } : null,
+  signature: signatureStatus,
+  manifest: manifest ? { label: manifest.label, fileCount: manifest.fileCount } : null,
+  status: 'passed',
+  results: [],
+  summary: { written: 0, skipped: 0, missingSource: 0, integrityFailed: 0, total: files.length },
+}
+
+if (!target) {
+  report.status = 'failed'
+  report.error = 'Missing --target <install-skill-dir>.'
+} else if (!fs.existsSync(source)) {
+  report.status = 'failed'
+  report.error = 'Source does not exist.'
+} else if (signatureStatus.status === 'failed') {
+  report.status = 'failed'
+  report.error = 'Package signature verification failed.'
+} else {
+  for (const file of files) report.results.push(copy(file))
+  report.summary.written = report.results.filter((item) => item.status === 'written' || item.status === 'would-write').length
+  report.summary.skipped = report.results.filter((item) => item.status === 'skipped').length
+  report.summary.missingSource = report.results.filter((item) => item.status === 'missing-source').length
+  report.summary.integrityFailed = report.results.filter((item) => item.status === 'integrity-failed').length
+  if (report.summary.missingSource > 0 || report.summary.integrityFailed > 0) report.status = 'failed'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log('GSE install status: ' + report.status)
+  console.log('Source: ' + report.source)
+  if (report.sourceUrl) console.log('Source URL: ' + report.sourceUrl)
+  console.log('Target: ' + report.target)
+  if (report.error) console.log('Error: ' + report.error)
+  console.log('Written: ' + report.summary.written + ', skipped: ' + report.summary.skipped + ', missing source: ' + report.summary.missingSource + ', integrity failed: ' + report.summary.integrityFailed)
+}
+
+if (report.status !== 'passed') process.exit(1)

package/scripts/lib/evidence-placeholders.mjs

@@ -0,0 +1,28 @@
+export function isPlaceholderEvidence(value) {
+  const text = String(value ?? '').trim()
+  const lower = text.toLowerCase()
+  if (!text) return false
+  if (lower.includes('__placeholder__') || lower.includes('__') || /<[^>]+>/.test(lower)) return true
+  if (['owner', 'fixture', 'fixture-owner', 'todo', 'tbd', 'pending', 'example'].includes(lower)) return true
+  if (lower.endsWith('@example.com') || lower.endsWith('@localhost')) return true
+  try {
+    const url = new URL(text)
+    const host = url.hostname.toLowerCase()
+    if (host === 'localhost' || host === '127.0.0.1' || host === '0.0.0.0') return true
+    if (host === 'example.com' || host.endsWith('.example') || host.endsWith('.example.com')) return true
+    if (host.endsWith('.local')) return true
+    const firstPathSegment = url.pathname.split('/').filter(Boolean)[0]?.toLowerCase()
+    if ((host === 'github.com' || host === 'gitlab.com') && firstPathSegment === 'example') return true
+  } catch {
+    // Non-URL fields are checked by literal placeholder and email rules above.
+  }
+  return false
+}
+
+export function placeholderEvidenceError(label) {
+  return `${label} must be real public evidence, not a placeholder, fixture, local, or example value`
+}
+
+export function rejectPlaceholderEvidence(errors, value, label) {
+  if (isPlaceholderEvidence(value)) errors.push(placeholderEvidenceError(label))
+}

package/scripts/package-gse.mjs

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const label = readArg('--label', 'gse-local-' + new Date().toISOString().slice(0, 10))
+const out = path.resolve(readArg('--out', path.join(process.env.TEMP || process.env.TMP || root, label)))
+const force = args.includes('--force')
+const dryRun = args.includes('--dry-run')
+const jsonOnly = args.includes('--json')
+
+const include = [
+  'package.json',
+  'SKILL.md',
+  'README.md',
+  'README.zh-CN.md',
+  'CHANGELOG.md',
+  'CONTRIBUTING.md',
+  'LICENSE',
+  'SECURITY.md',
+  'SUPPORT.md',
+  '.github',
+  'agents',
+  'assets',
+  'examples',
+  'references',
+  'scripts',
+  '.gse',
+]
+
+const excludeNames = new Set(['.git', 'node_modules', 'dist', '.DS_Store'])
+const packageGseAllowlist = new Set([
+  '.gse/README.md',
+  '.gse/project-profile.md',
+  '.gse/quality-gates.md',
+  '.gse/gse-development-protocol.md',
+  '.gse/state.json',
+  '.gse/releases',
+  '.gse/releases/public-release-owner-required.md',
+  '.gse/releases/public-security-contact-owner-required.md',
+])
+const excludeRelativePrefixes = [
+  '.gse/evidence/',
+  '.gse/benchmark-audits/',
+  '.gse/acceptance/',
+  '.gse/archive/',
+  '.gse/changes/',
+  '.gse/release-bundles/',
+]
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function shouldExclude(relativePath) {
+  const normalized = relativePath.replace(/\\/g, '/')
+  if (normalized.startsWith('.gse/') && !packageGseAllowlist.has(normalized)) return true
+  if (excludeRelativePrefixes.some((prefix) => normalized.startsWith(prefix))) return true
+  return normalized.split('/').some((part) => excludeNames.has(part))
+}
+
+function walk(sourcePath, basePath = sourcePath) {
+  const entries = []
+  if (!fs.existsSync(sourcePath)) return entries
+  const stat = fs.statSync(sourcePath)
+  if (stat.isFile()) {
+    const relativePath = path.relative(root, sourcePath).replace(/\\/g, '/')
+    if (!shouldExclude(relativePath)) entries.push({ sourcePath, relativePath, bytes: stat.size })
+    return entries
+  }
+  for (const child of fs.readdirSync(sourcePath, { withFileTypes: true })) {
+    const fullPath = path.join(sourcePath, child.name)
+    const relativePath = path.relative(root, fullPath).replace(/\\/g, '/')
+    if (shouldExclude(relativePath)) continue
+    if (child.isDirectory()) entries.push(...walk(fullPath, basePath))
+    else if (child.isFile()) entries.push({ sourcePath: fullPath, relativePath, bytes: fs.statSync(fullPath).size })
+  }
+  return entries
+}
+
+function copyFile(entry) {
+  const targetPath = path.join(out, entry.relativePath)
+  fs.mkdirSync(path.dirname(targetPath), { recursive: true })
+  fs.copyFileSync(entry.sourcePath, targetPath)
+}
+
+function sha256(filePath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
+}
+
+const missing = include.filter((item) => !exists(item))
+const files = include.flatMap((item) => walk(path.join(root, item)))
+const sortedFiles = files.map((item) => item.relativePath).sort()
+const fileHashes = Object.fromEntries(
+  sortedFiles.map((relativePath) => [relativePath, sha256(path.join(root, relativePath))]),
+)
+const manifest = {
+  schemaVersion: 1,
+  packageName: 'gse',
+  label,
+  generatedAt: new Date().toISOString(),
+  fileCount: files.length,
+  totalBytes: files.reduce((sum, item) => sum + item.bytes, 0),
+  includes: include,
+  excludes: [...excludeNames, ...excludeRelativePrefixes, '.gse/* except portable package allowlist'],
+  packageGseAllowlist: [...packageGseAllowlist].sort(),
+  entrypoints: {
+    nodePackage: 'package.json',
+    skill: 'SKILL.md',
+    cli: 'scripts/gse.mjs',
+    validate: 'scripts/validate-gse.mjs',
+    npmPackageAudit: 'scripts/audit-npm-package-metadata.mjs',
+    validationProfile: 'scripts/run-validation-profile.mjs',
+    install: 'scripts/install-gse.mjs',
+    commands: 'references/commands.md',
+  },
+  integrity: {
+    algorithm: 'sha256',
+  },
+  files: sortedFiles,
+  fileHashes,
+}
+manifest.integrity.packageDigest = crypto
+  .createHash('sha256')
+  .update(JSON.stringify({ files: manifest.files, fileHashes: manifest.fileHashes }))
+  .digest('hex')
+
+const report = {
+  root,
+  out,
+  label,
+  dryRun,
+  status: missing.length === 0 ? 'ready' : 'failed',
+  missing,
+  fileCount: files.length,
+  totalBytes: manifest.totalBytes,
+  manifestPath: path.join(out, 'gse-package-manifest.json'),
+}
+
+if (missing.length === 0 && !dryRun) {
+  if (fs.existsSync(out)) {
+    if (!force) {
+      report.status = 'exists'
+      report.recommendation = 'Use --force or choose another --out directory.'
+    } else {
+      fs.rmSync(out, { recursive: true, force: true })
+    }
+  }
+  if (report.status === 'ready') {
+    fs.mkdirSync(out, { recursive: true })
+    for (const file of files) copyFile(file)
+    fs.writeFileSync(path.join(out, 'gse-package-manifest.json'), JSON.stringify(manifest, null, 2) + '\n', 'utf8')
+    report.status = 'written'
+  }
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log('GSE package status: ' + report.status)
+  console.log('Output: ' + report.out)
+  console.log('Files: ' + report.fileCount)
+  if (report.missing.length) console.log('Missing: ' + report.missing.join(', '))
+}
+
+if (report.status === 'failed' || report.status === 'exists') process.exit(1)

package/scripts/probe-public-external-gates.mjs

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { isPlaceholderEvidence } from './lib/evidence-placeholders.mjs'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = '') {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function hasArg(name) {
+  return args.includes(name)
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = hasArg('--json')
+const allowLocalFixture = hasArg('--allow-local-fixture')
+const timeoutMs = Number(readArg('--timeout-ms', '5000'))
+
+const inputs = [
+  { area: 'Public repository settings', kind: 'url', flag: '--public-repo-url', value: readArg('--public-repo-url') },
+  { area: 'Public security contact', kind: 'url', flag: '--security-contact-url', value: readArg('--security-contact-url') },
+  { area: 'Public CI run', kind: 'url', flag: '--public-ci-run-url', value: readArg('--public-ci-run-url') },
+  { area: 'Public registry publication', kind: 'url', flag: '--registry-package-url', value: readArg('--registry-package-url') },
+  { area: 'Marketplace approval', kind: 'url', flag: '--marketplace-url', value: readArg('--marketplace-url') },
+  { area: 'Native slash command', kind: 'evidence', flag: '--native-host-evidence', value: readArg('--native-host-evidence') },
+  { area: 'Other host runtime invocation', kind: 'evidence', flag: '--other-host-evidence', value: readArg('--other-host-evidence') },
+].filter((item) => String(item.value ?? '').trim())
+
+function isLocalUrl(value) {
+  try {
+    const url = new URL(value)
+    const host = url.hostname.toLowerCase()
+    return host === 'localhost' || host === '127.0.0.1' || host === '0.0.0.0' || host.endsWith('.local')
+  } catch {
+    return false
+  }
+}
+
+function isHttpUrl(value) {
+  try {
+    const url = new URL(value)
+    return url.protocol === 'http:' || url.protocol === 'https:'
+  } catch {
+    return false
+  }
+}
+
+async function probeUrl(value) {
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 5000)
+  try {
+    let response = await fetch(value, { method: 'HEAD', redirect: 'follow', signal: controller.signal })
+    if (response.status === 405 || response.status === 403) {
+      response = await fetch(value, { method: 'GET', redirect: 'follow', signal: controller.signal })
+    }
+    return {
+      reachable: response.status >= 200 && response.status < 500,
+      statusCode: response.status,
+      finalUrl: response.url,
+    }
+  } catch (error) {
+    return {
+      reachable: false,
+      error: error?.name === 'AbortError' ? 'timeout' : String(error?.message ?? error),
+    }
+  } finally {
+    clearTimeout(timeout)
+  }
+}
+
+function probeEvidence(value) {
+  if (isHttpUrl(value)) return null
+  const fullPath = path.isAbsolute(value) ? value : path.resolve(root, value)
+  return {
+    reachable: fs.existsSync(fullPath),
+    path: fullPath,
+    type: fs.existsSync(fullPath) ? 'file' : 'missing',
+  }
+}
+
+const probes = []
+for (const item of inputs) {
+  const placeholder = isPlaceholderEvidence(item.value)
+  const local = isLocalUrl(item.value)
+  const errors = []
+  if (placeholder && !(allowLocalFixture && local)) errors.push(`${item.flag} must be real public evidence, not a placeholder, fixture, local, or example value`)
+  if (item.kind === 'url' && !isHttpUrl(item.value)) errors.push(`${item.flag} must be an http or https URL`)
+  if (item.kind === 'url' && local && !allowLocalFixture) errors.push(`${item.flag} must not be local evidence`)
+  if (item.kind === 'evidence' && !isHttpUrl(item.value) && !fs.existsSync(path.isAbsolute(item.value) ? item.value : path.resolve(root, item.value))) {
+    errors.push(`${item.flag} must be an http/https URL or an existing evidence file`)
+  }
+  probes.push({ ...item, placeholder, local, errors })
+}
+
+for (const probe of probes) {
+  if (probe.errors.length) continue
+  if (probe.kind === 'url' || isHttpUrl(probe.value)) {
+    probe.network = await probeUrl(probe.value)
+    if (!probe.network.reachable) probe.errors.push(`${probe.flag} is not reachable`)
+  } else {
+    probe.file = probeEvidence(probe.value)
+    if (!probe.file.reachable) probe.errors.push(`${probe.flag} evidence file is not reachable`)
+  }
+}
+
+const failed = probes.filter((item) => item.errors.length > 0).length
+const ready = probes.length > 0 && failed === 0
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  status: probes.length === 0 ? 'waiting-for-input' : ready ? 'ready' : 'failed',
+  summary: {
+    checked: probes.length,
+    ready: probes.length - failed,
+    failed,
+    allowLocalFixture,
+  },
+  probes: probes.map((item) => ({
+    area: item.area,
+    flag: item.flag,
+    kind: item.kind,
+    value: item.value,
+    placeholder: item.placeholder,
+    local: item.local,
+    status: item.errors.length === 0 ? 'ready' : 'failed',
+    network: item.network,
+    file: item.file,
+    errors: item.errors,
+  })),
+  limits: [
+    'This probe checks supplied owner/external evidence locations before record creation.',
+    'It does not publish GSE, configure repository settings, approve marketplace listings, or mark final readiness accepted.',
+    'Accepted gates still require the matching record script and final readiness promotion.',
+  ],
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Public External Gate Probe')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Status: ' + data.status)
+  lines.push('')
+  lines.push('## Probes')
+  lines.push('')
+  if (data.probes.length === 0) lines.push('- No evidence inputs supplied.')
+  for (const probe of data.probes) {
+    lines.push('- ' + probe.area + ': ' + probe.status + ' (' + probe.flag + ')')
+    if (probe.network) lines.push('  - HTTP status: ' + probe.network.statusCode)
+    if (probe.file) lines.push('  - File: ' + probe.file.path)
+    for (const error of probe.errors) lines.push('  - Error: ' + error)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (report.status === 'failed') process.exit(1)