@t275005746/gse 0.1.0

package/scripts/record-public-release.mjs

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function hasArg(name) {
+  return args.includes(name)
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const releaseName = readArg('--release-name', 'GSE')
+const releaseLabel = readArg('--release-label', 'unreleased')
+const releaseDate = readArg('--release-date', new Date().toISOString().slice(0, 10))
+const channel = readArg('--channel', 'owner-required')
+const licenseStatus = readArg('--license-status', 'owner-required')
+const spdx = readArg('--spdx', '')
+const licenseFile = readArg('--license-file', '')
+const approvedBy = readArg('--approved-by', '')
+const decisionDate = readArg('--decision-date', '')
+const changelogPath = readArg('--changelog-path', 'CHANGELOG.md')
+const packagePath = readArg('--package-path', '<install-skill-dir>')
+const validationCommand = readArg('--validation-command', 'node scripts/validate-gse.mjs --root <skill> --json')
+const evidenceStatus = readArg('--evidence-status', licenseStatus === 'selected' ? 'accepted' : 'result')
+const out = path.resolve(readArg('--out', path.join(root, '.gse', 'releases', 'public-release-owner-required.md')))
+const dryRun = hasArg('--dry-run')
+const force = hasArg('--force')
+const jsonOnly = hasArg('--json')
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function pushError(errors, condition, message) {
+  if (!condition) errors.push(message)
+}
+
+const validLicenseStatuses = new Set(['owner-required', 'selected', 'not-public'])
+const errors = []
+
+pushError(errors, validLicenseStatuses.has(licenseStatus), 'license-status must be owner-required, selected, or not-public')
+pushError(errors, releaseName.trim().length > 0, 'release-name is required')
+pushError(errors, releaseLabel.trim().length > 0, 'release-label is required')
+pushError(errors, channel.trim().length > 0, 'channel is required')
+pushError(errors, exists(changelogPath), 'changelog-path must exist: ' + changelogPath)
+
+if (licenseStatus === 'selected') {
+  pushError(errors, spdx.trim().length > 0, 'selected license requires --spdx')
+  pushError(errors, licenseFile.trim().length > 0, 'selected license requires --license-file')
+  pushError(errors, licenseFile.trim().length > 0 && exists(licenseFile), 'selected license file must exist: ' + licenseFile)
+  pushError(errors, approvedBy.trim().length > 0, 'selected license requires --approved-by')
+  pushError(errors, decisionDate.trim().length > 0, 'selected license requires --decision-date')
+  pushError(errors, evidenceStatus === 'accepted', 'selected license record must use --evidence-status accepted')
+}
+
+if (licenseStatus === 'not-public') {
+  pushError(errors, approvedBy.trim().length > 0, 'not-public decision requires --approved-by')
+  pushError(errors, decisionDate.trim().length > 0, 'not-public decision requires --decision-date')
+}
+
+const lines = [
+  '# Public Release Record',
+  '',
+  'Release name: ' + releaseName,
+  '',
+  'Release version or label: ' + releaseLabel,
+  '',
+  'Release date: ' + releaseDate,
+  '',
+  'Distribution channel: ' + channel,
+  '',
+  'Release scope: GSE public release metadata and distribution readiness',
+  '',
+  '## License',
+  '',
+  'License status: ' + licenseStatus,
+  '',
+  'SPDX identifier: ' + spdx,
+  '',
+  'License file: ' + licenseFile,
+  '',
+  'Approved by: ' + approvedBy,
+  '',
+  'Decision date: ' + decisionDate,
+  '',
+  'Notes: ' + (licenseStatus === 'owner-required'
+    ? 'Owner license decision is required before accepted public release.'
+    : licenseStatus === 'not-public'
+      ? 'Package is not approved for public open-source release.'
+      : 'Owner-selected license decision recorded.'),
+  '',
+  '## Artifacts',
+  '',
+  'Package or source path: ' + packagePath,
+  '',
+  'Changelog path: ' + changelogPath,
+  '',
+  'Install/update instructions: references/packaging.md',
+  '',
+  'Integrity or signing record: references/release-trust.md',
+  '',
+  'Marketplace/catalog record: references/marketplace-discovery.md',
+  '',
+  '## Verification',
+  '',
+  'Validation command: ' + validationCommand,
+  '',
+  'Validation result: pending current run',
+  '',
+  'Focused smoke: scripts/audit-public-release-metadata.mjs',
+  '',
+  'Acceptance evidence: ' + (licenseStatus === 'selected' ? 'Owner license decision accepted; public release still requires remaining public and host evidence.' : 'Owner decision pending.'),
+  '',
+  '## Risks',
+  '',
+  'Known unsupported claims: public marketplace approval, public registry publication, legal suitability, and host-native slash-command runtime support are not implied by this record.',
+  '',
+  'Known compatibility limits: host behavior must be verified per host runtime.',
+  '',
+  'Rollback or unpublish path: remove public listing/package and publish corrected release record.',
+  '',
+  '## Acceptance',
+  '',
+  'Evidence status: ' + evidenceStatus,
+  '',
+  'Accepted by: ' + approvedBy,
+  '',
+  'Accepted at: ' + (evidenceStatus === 'accepted' ? decisionDate : ''),
+  '',
+  'Next action: ' + (licenseStatus === 'owner-required'
+    ? 'Owner selects license or records not-public decision.'
+    : 'Run release validation and preserve acceptance evidence.'),
+  '',
+]
+
+const report = {
+  root,
+  out,
+  dryRun,
+  releaseName,
+  releaseLabel,
+  channel,
+  licenseStatus,
+  evidenceStatus,
+  status: errors.length > 0 ? 'failed' : dryRun ? 'ready' : 'written',
+  errors,
+}
+
+if (errors.length === 0 && !dryRun) {
+  if (fs.existsSync(out) && !force) {
+    report.status = 'exists'
+    report.errors.push('output exists; use --force or choose another --out path')
+  } else {
+    fs.mkdirSync(path.dirname(out), { recursive: true })
+    fs.writeFileSync(out, lines.join('\n'), 'utf8')
+  }
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log('Public release record status: ' + report.status)
+  console.log('Output: ' + report.out)
+  if (report.errors.length) {
+    console.log('Errors:')
+    for (const error of report.errors) console.log('- ' + error)
+  }
+}
+
+if (report.status === 'failed' || report.status === 'exists') process.exit(1)

package/scripts/record-public-repository-settings.mjs

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { rejectPlaceholderEvidence } from './lib/evidence-placeholders.mjs'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = '') {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function hasArg(name) {
+  return args.includes(name)
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const repositoryUrl = readArg('--repository-url', 'owner-required')
+const defaultBranch = readArg('--default-branch', 'main')
+const visibility = readArg('--visibility', 'unknown')
+const settingsStatus = readArg('--settings-status', 'pending')
+const evidenceOwner = readArg('--evidence-owner', '')
+const evidenceDate = readArg('--evidence-date', '')
+const evidenceUrl = readArg('--evidence-url', '')
+const issuesEnabled = readArg('--issues-enabled', 'unknown')
+const pullRequestsEnabled = readArg('--pull-requests-enabled', 'unknown')
+const discussionsEnabled = readArg('--discussions-enabled', 'unknown')
+const securityPolicyVisible = readArg('--security-policy-visible', 'unknown')
+const branchProtectionEnabled = readArg('--branch-protection-enabled', 'unknown')
+const requiredStatusChecksEnabled = readArg('--required-status-checks-enabled', 'unknown')
+const requiredChecks = readArg('--required-checks', '')
+const requireReview = readArg('--require-review-before-merge', 'unknown')
+const requireConversationResolution = readArg('--require-conversation-resolution', 'unknown')
+const restrictForcePushes = readArg('--restrict-force-pushes', 'unknown')
+const restrictDeletions = readArg('--restrict-deletions', 'unknown')
+const verificationCommand = readArg('--verification-command', 'node scripts/validate-gse.mjs --root . --json')
+const verificationResult = readArg('--verification-result', 'pending')
+const evidenceStatus = readArg('--evidence-status', settingsStatus === 'accepted' ? 'accepted' : settingsStatus === 'verified' ? 'verified' : 'pending')
+const acceptedBy = readArg('--accepted-by', '')
+const acceptedAt = readArg('--accepted-at', '')
+const residualRisk = readArg('--residual-risk', 'Public repository settings are not verified until owner/external evidence is attached.')
+const nextAction = readArg('--next-action', 'Attach public repository settings evidence and re-run repository settings audit.')
+const out = path.resolve(readArg('--out', path.join(root, '.gse', 'releases', 'public-repository-settings-owner-required.md')))
+const dryRun = hasArg('--dry-run')
+const force = hasArg('--force')
+const jsonOnly = hasArg('--json')
+
+const validStatuses = new Set(['pending', 'verified', 'accepted'])
+const validVisibility = new Set(['public', 'private', 'internal', 'unknown'])
+const validTriState = new Set(['true', 'false', 'unknown'])
+const errors = []
+
+function requireField(value, message) {
+  if (!String(value).trim()) errors.push(message)
+}
+
+function requireTriState(value, name) {
+  if (!validTriState.has(value)) errors.push(`${name} must be true, false, or unknown`)
+}
+
+if (!validStatuses.has(settingsStatus)) errors.push('--settings-status must be pending, verified, or accepted')
+if (!validStatuses.has(evidenceStatus)) errors.push('--evidence-status must be pending, verified, or accepted')
+if (!validVisibility.has(visibility)) errors.push('--visibility must be public, private, internal, or unknown')
+for (const [value, name] of [
+  [issuesEnabled, '--issues-enabled'],
+  [pullRequestsEnabled, '--pull-requests-enabled'],
+  [discussionsEnabled, '--discussions-enabled'],
+  [securityPolicyVisible, '--security-policy-visible'],
+  [branchProtectionEnabled, '--branch-protection-enabled'],
+  [requiredStatusChecksEnabled, '--required-status-checks-enabled'],
+  [requireReview, '--require-review-before-merge'],
+  [requireConversationResolution, '--require-conversation-resolution'],
+  [restrictForcePushes, '--restrict-force-pushes'],
+  [restrictDeletions, '--restrict-deletions'],
+]) {
+  requireTriState(value, name)
+}
+
+if (settingsStatus === 'verified' || settingsStatus === 'accepted') {
+  requireField(repositoryUrl, 'verified or accepted settings require --repository-url')
+  requireField(evidenceOwner, 'verified or accepted settings require --evidence-owner')
+  requireField(evidenceDate, 'verified or accepted settings require --evidence-date')
+  requireField(evidenceUrl, 'verified or accepted settings require --evidence-url')
+  if (visibility !== 'public') errors.push('verified or accepted public repository settings require --visibility public')
+  for (const [value, name] of [
+    [issuesEnabled, '--issues-enabled'],
+    [pullRequestsEnabled, '--pull-requests-enabled'],
+    [securityPolicyVisible, '--security-policy-visible'],
+    [branchProtectionEnabled, '--branch-protection-enabled'],
+    [requiredStatusChecksEnabled, '--required-status-checks-enabled'],
+    [requireReview, '--require-review-before-merge'],
+    [requireConversationResolution, '--require-conversation-resolution'],
+    [restrictForcePushes, '--restrict-force-pushes'],
+    [restrictDeletions, '--restrict-deletions'],
+  ]) {
+    if (value !== 'true') errors.push(`verified or accepted settings require ${name} true`)
+  }
+  requireField(requiredChecks, 'verified or accepted settings require --required-checks')
+  if (evidenceStatus === 'pending') errors.push('verified or accepted settings require --evidence-status verified or accepted')
+  if (!dryRun) {
+    rejectPlaceholderEvidence(errors, repositoryUrl, '--repository-url')
+    rejectPlaceholderEvidence(errors, evidenceOwner, '--evidence-owner')
+    rejectPlaceholderEvidence(errors, evidenceUrl, '--evidence-url')
+  }
+}
+
+if (settingsStatus === 'accepted') {
+  requireField(acceptedBy, 'accepted settings require --accepted-by')
+  requireField(acceptedAt, 'accepted settings require --accepted-at')
+  if (evidenceStatus !== 'accepted') errors.push('accepted settings require --evidence-status accepted')
+  if (!dryRun) rejectPlaceholderEvidence(errors, acceptedBy, '--accepted-by')
+}
+
+const lines = [
+  '# Public Repository Settings Record',
+  '',
+  'Repository URL: ' + repositoryUrl,
+  '',
+  'Default branch: ' + defaultBranch,
+  '',
+  'Visibility: ' + visibility,
+  '',
+  'Settings status: ' + settingsStatus,
+  '',
+  'Evidence owner: ' + evidenceOwner,
+  '',
+  'Evidence date: ' + evidenceDate,
+  '',
+  'Evidence URL or run id: ' + evidenceUrl,
+  '',
+  '## Required Public Settings',
+  '',
+  '- Issues enabled: ' + issuesEnabled,
+  '- Pull requests enabled: ' + pullRequestsEnabled,
+  '- Discussions enabled: ' + discussionsEnabled,
+  '- Security policy visible: ' + securityPolicyVisible,
+  '- Branch protection enabled: ' + branchProtectionEnabled,
+  '- Required status checks enabled: ' + requiredStatusChecksEnabled,
+  '- Required checks: ' + requiredChecks,
+  '- Require review before merge: ' + requireReview,
+  '- Require conversation resolution: ' + requireConversationResolution,
+  '- Restrict force pushes: ' + restrictForcePushes,
+  '- Restrict deletions: ' + restrictDeletions,
+  '',
+  '## GSE-Specific Checks',
+  '',
+  '- CI workflow path: `.github/workflows/validate-gse.yml`',
+  '- PR template path: `.github/PULL_REQUEST_TEMPLATE.md`',
+  '- Issue templates path: `.github/ISSUE_TEMPLATE/`',
+  '- Public release record path: `.gse/releases/public-release-owner-required.md`',
+  '- Final acceptance packet path: `.gse/acceptance/final-acceptance-packet.md`',
+  '',
+  '## Verification',
+  '',
+  'Verification command: ' + verificationCommand,
+  '',
+  'Verification result: ' + verificationResult,
+  '',
+  '## Acceptance',
+  '',
+  'Evidence status: ' + evidenceStatus,
+  '',
+  'Accepted by: ' + acceptedBy,
+  '',
+  'Accepted at: ' + acceptedAt,
+  '',
+  '## Residual Risk',
+  '',
+  '- ' + residualRisk,
+  '',
+  '## Next Action',
+  '',
+  '- ' + nextAction,
+  '',
+]
+
+const report = {
+  root,
+  out,
+  dryRun,
+  repositoryUrl,
+  settingsStatus,
+  evidenceStatus,
+  status: errors.length ? 'failed' : dryRun ? 'ready' : 'written',
+  errors,
+}
+
+if (!errors.length && !dryRun) {
+  if (fs.existsSync(out) && !force) {
+    report.status = 'exists'
+    report.errors.push('output exists; use --force or choose another --out path')
+  } else {
+    fs.mkdirSync(path.dirname(out), { recursive: true })
+    fs.writeFileSync(out, lines.join('\n'), 'utf8')
+  }
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log('Public repository settings record status: ' + report.status)
+  console.log('Output: ' + report.out)
+  if (report.errors.length) {
+    console.log('Errors:')
+    for (const error of report.errors) console.log('- ' + error)
+  }
+}
+
+if (report.status === 'failed' || report.status === 'exists') process.exit(1)

package/scripts/record-public-security-contact.mjs

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { rejectPlaceholderEvidence } from './lib/evidence-placeholders.mjs'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = '') {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function hasArg(name) {
+  return args.includes(name)
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const contactStatus = readArg('--contact-status', 'pending')
+const contactType = readArg('--contact-type', 'unknown')
+const contactValue = readArg('--contact-value', '')
+const policyPath = readArg('--policy-path', 'SECURITY.md')
+const evidenceOwner = readArg('--evidence-owner', '')
+const evidenceDate = readArg('--evidence-date', '')
+const evidenceUrl = readArg('--evidence-url', '')
+const isPublic = readArg('--is-public', 'unknown')
+const policyUpdated = readArg('--security-policy-updated', 'unknown')
+const privateFallback = readArg('--private-fallback-channel', 'owner private coordination channel')
+const responseExpectation = readArg('--response-expectation', 'pending owner policy')
+const disclosureNotes = readArg('--disclosure-notes', 'Do not publish exploit details until the public contact is owner-accepted.')
+const verificationCommand = readArg('--verification-command', 'node scripts/audit-open-source-readiness.mjs --root . --json')
+const verificationResult = readArg('--verification-result', 'pending')
+const evidenceStatus = readArg('--evidence-status', contactStatus === 'accepted' ? 'accepted' : 'pending')
+const acceptedBy = readArg('--accepted-by', '')
+const acceptedAt = readArg('--accepted-at', '')
+const residualRisk = readArg('--residual-risk', 'Public security contact is not accepted until owner evidence is attached.')
+const nextAction = readArg('--next-action', 'Attach owner-approved public security contact evidence and re-run final readiness.')
+const out = path.resolve(readArg('--out', path.join(root, '.gse', 'releases', 'public-security-contact-owner-required.md')))
+const dryRun = hasArg('--dry-run')
+const force = hasArg('--force')
+const jsonOnly = hasArg('--json')
+
+const validStatuses = new Set(['pending', 'accepted'])
+const validContactTypes = new Set(['email', 'url', 'github-security-advisory', 'other', 'unknown'])
+const validTriState = new Set(['true', 'false', 'unknown'])
+const validEvidenceStatuses = new Set(['pending', 'accepted'])
+const errors = []
+
+function requireField(value, message) {
+  if (!String(value).trim()) errors.push(message)
+}
+
+if (!validStatuses.has(contactStatus)) errors.push('--contact-status must be pending or accepted')
+if (!validContactTypes.has(contactType)) errors.push('--contact-type must be email, url, github-security-advisory, other, or unknown')
+if (!validTriState.has(isPublic)) errors.push('--is-public must be true, false, or unknown')
+if (!validTriState.has(policyUpdated)) errors.push('--security-policy-updated must be true, false, or unknown')
+if (!validEvidenceStatuses.has(evidenceStatus)) errors.push('--evidence-status must be pending or accepted')
+
+if (contactStatus === 'accepted') {
+  if (contactType === 'unknown') errors.push('accepted security contact requires --contact-type')
+  requireField(contactValue, 'accepted security contact requires --contact-value')
+  requireField(evidenceOwner, 'accepted security contact requires --evidence-owner')
+  requireField(evidenceDate, 'accepted security contact requires --evidence-date')
+  requireField(evidenceUrl, 'accepted security contact requires --evidence-url')
+  requireField(acceptedBy, 'accepted security contact requires --accepted-by')
+  requireField(acceptedAt, 'accepted security contact requires --accepted-at')
+  if (isPublic !== 'true') errors.push('accepted security contact requires --is-public true')
+  if (policyUpdated !== 'true') errors.push('accepted security contact requires --security-policy-updated true')
+  if (evidenceStatus !== 'accepted') errors.push('accepted security contact requires --evidence-status accepted')
+  if (!dryRun) {
+    rejectPlaceholderEvidence(errors, contactValue, '--contact-value')
+    rejectPlaceholderEvidence(errors, evidenceOwner, '--evidence-owner')
+    rejectPlaceholderEvidence(errors, evidenceUrl, '--evidence-url')
+    rejectPlaceholderEvidence(errors, acceptedBy, '--accepted-by')
+  }
+}
+
+const lines = [
+  '# Public Security Contact Record',
+  '',
+  'Contact status: ' + contactStatus,
+  '',
+  'Contact type: ' + contactType,
+  '',
+  'Contact value: ' + contactValue,
+  '',
+  'Policy path: `' + policyPath + '`',
+  '',
+  'Evidence owner: ' + evidenceOwner,
+  '',
+  'Evidence date: ' + evidenceDate,
+  '',
+  'Evidence URL or run id: ' + evidenceUrl,
+  '',
+  '## Public Disclosure Policy',
+  '',
+  '- Is this contact public? ' + isPublic,
+  '- Security policy updated? ' + policyUpdated,
+  '- Private fallback channel: ' + privateFallback,
+  '- Response expectation: ' + responseExpectation,
+  '- Embargo or disclosure notes: ' + disclosureNotes,
+  '',
+  '## Verification',
+  '',
+  'Verification command: ' + verificationCommand,
+  '',
+  'Verification result: ' + verificationResult,
+  '',
+  '## Acceptance',
+  '',
+  'Evidence status: ' + evidenceStatus,
+  '',
+  'Accepted by: ' + acceptedBy,
+  '',
+  'Accepted at: ' + acceptedAt,
+  '',
+  '## Residual Risk',
+  '',
+  '- ' + residualRisk,
+  '',
+  '## Next Action',
+  '',
+  '- ' + nextAction,
+  '',
+]
+
+const report = {
+  root,
+  out,
+  dryRun,
+  contactStatus,
+  evidenceStatus,
+  status: errors.length ? 'failed' : dryRun ? 'ready' : 'written',
+  errors,
+}
+
+if (!errors.length && !dryRun) {
+  if (fs.existsSync(out) && !force) {
+    report.status = 'exists'
+    report.errors.push('output exists; use --force or choose another --out path')
+  } else {
+    fs.mkdirSync(path.dirname(out), { recursive: true })
+    fs.writeFileSync(out, lines.join('\n'), 'utf8')
+  }
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log('Public security contact record status: ' + report.status)
+  console.log('Output: ' + report.out)
+  if (report.errors.length) {
+    console.log('Errors:')
+    for (const error of report.errors) console.log('- ' + error)
+  }
+}
+
+if (report.status === 'failed' || report.status === 'exists') process.exit(1)