@t275005746/gse 0.1.0

package/scripts/run-gse-command.mjs

@@ -0,0 +1,538 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const target = path.resolve(readArg('--target', process.cwd()))
+const commandText = readArg('--command', args.find((item) => item.startsWith('/gse') || item.startsWith('gse ')) ?? '/gse help')
+const jsonOnly = args.includes('--json')
+const execute = args.includes('--execute')
+const compactOutput = args.includes('--compact')
+
+function readJson(relativePath) {
+  const fullPath = path.join(target, relativePath)
+  if (!fs.existsSync(fullPath)) return null
+  try {
+    return JSON.parse(fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    return null
+  }
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(target, relativePath))
+}
+
+function runNode(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  const stdout = (result.stdout ?? '').trim()
+  let diagnosticSummary = null
+  try {
+    const parsed = JSON.parse(stdout)
+    if (parsed?.summary && typeof parsed.summary.failed === 'number') {
+      diagnosticSummary = parsed.summary
+    }
+  } catch {
+    diagnosticSummary = null
+  }
+  const status = result.status ?? 1
+  const ok = status === 0 || (diagnosticSummary && diagnosticSummary.failed === 0)
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status,
+    ok,
+    diagnosticSummary,
+    stdout,
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function normalizeCommand(value) {
+  return String(value || '')
+    .trim()
+    .replace(/^gse\b/i, '/gse')
+    .replace(/\s+/g, ' ')
+}
+
+function readRestValue(items, name, fallback = '') {
+  const index = items.indexOf(name)
+  if (index === -1) return fallback
+  const values = []
+  for (let cursor = index + 1; cursor < items.length; cursor += 1) {
+    const item = items[cursor]
+    if (item.startsWith('--')) break
+    values.push(item)
+  }
+  return values.join(' ').replace(/^["']|["']$/g, '').trim() || fallback
+}
+
+const normalized = normalizeCommand(commandText)
+const parts = normalized.split(' ')
+const verb = parts[0] === '/gse' ? (parts[1] || 'help') : 'help'
+const rest = parts.slice(2)
+const state = readJson('.gse/state.json')
+const projectProfile = exists('.gse/project-profile.md')
+const goalMap = exists('.gse/goal-map.md')
+const qualityGates = exists('.gse/quality-gates.md')
+const canonicalPlan = state?.canonicalPlan ?? null
+
+const commandMap = {
+  help: {
+    route: 'references/commands.md',
+    effect: 'read-only',
+    summary: 'Show GSE commands and project entry files.',
+  },
+  continue: {
+    route: 'scripts/generate-session-prompt.mjs',
+    effect: 'read-only',
+    summary: 'Generate a continuation packet from project state.',
+  },
+  next: {
+    route: 'scripts/generate-session-prompt.mjs',
+    effect: 'read-only',
+    summary: 'Alias for /gse continue.',
+  },
+  status: {
+    route: 'scripts/generate-final-form-progress-report.mjs or .gse/state.json',
+    effect: 'read-only',
+    summary: 'Show project state, or GSE final-form progress when the target is the GSE skill.',
+  },
+  doctor: {
+    route: 'scripts/audit-public-acceptance-readiness.mjs or scripts/audit-target-project.mjs',
+    effect: 'read-only',
+    summary: 'Diagnose final-form public/host acceptance blockers for GSE, or target-project GSE readiness for normal projects.',
+  },
+  acceptance: {
+    route: 'scripts/audit-public-acceptance-readiness.mjs or scripts/audit-target-project.mjs',
+    effect: 'read-only',
+    summary: 'Alias for /gse doctor focused on final acceptance boundaries.',
+  },
+  'owner-actions': {
+    route: 'scripts/audit-public-acceptance-readiness.mjs',
+    effect: 'read-only',
+    summary: 'Show the remaining owner/external actions required before public acceptance.',
+  },
+  probe: {
+    route: 'scripts/probe-public-external-gates.mjs',
+    effect: 'read-only',
+    summary: 'Probe supplied owner/external evidence locations before accepted records are written.',
+  },
+  release: {
+    route: 'scripts/generate-release-bundle.mjs or scripts/audit-release-bundle.mjs',
+    effect: 'read-only by default; write-with-execute for canonical bundle generation',
+    summary: 'Dry-run or generate a release bundle for open-source/package handoff.',
+  },
+  package: {
+    route: 'scripts/package-gse.mjs',
+    effect: 'read-only by default; write-with-execute for local package generation',
+    summary: 'Dry-run or generate a local installable GSE package.',
+  },
+  install: {
+    route: 'scripts/install-gse.mjs',
+    effect: 'read-only by default; write-with-execute for install target writes',
+    summary: 'Dry-run or install GSE from a local package path or URL-shaped package source.',
+  },
+  'public-release': {
+    route: 'scripts/generate-public-release-checklist.mjs or scripts/audit-public-release-checklist.mjs',
+    effect: 'read-only by default; write-with-execute for canonical checklist generation',
+    summary: 'Dry-run or generate the ordered owner/public release checklist.',
+  },
+  owner: {
+    route: 'scripts/audit-public-acceptance-readiness.mjs',
+    effect: 'read-only',
+    summary: 'Alias for /gse owner-actions.',
+  },
+  audit: {
+    route: 'scripts/audit-target-project.mjs',
+    effect: 'read-only',
+    summary: 'Audit target project GSE readiness.',
+  },
+  close: {
+    route: 'scripts/audit-close-gate.mjs',
+    effect: 'read-only',
+    summary: 'Check whether current slice can close.',
+  },
+  verify: {
+    route: 'references/quality-gates.md',
+    effect: 'read-only',
+    summary: 'Select and run focused verification according to project quality gates.',
+  },
+  learn: {
+    route: 'scripts/record-learning.mjs',
+    effect: 'read-only by default; write-with-execute for .gse/learnings.md',
+    summary: 'Record a reusable project lesson and skip duplicate summaries.',
+  },
+  slice: {
+    route: 'references/spec-workflow.md',
+    effect: 'read-only',
+    summary: 'Normalize outcome, scope, acceptance, evidence, risk, and next action.',
+  },
+  init: {
+    route: 'scripts/init-project.mjs',
+    effect: 'write-with-execute',
+    summary: 'Initialize .gse scaffold when --execute is supplied.',
+  },
+  adopt: {
+    route: 'references/adoption-recipes.md',
+    effect: 'write-with-execute',
+    summary: 'Adopt GSE without overwriting local rules.',
+  },
+  change: {
+    route: 'scripts/init-change.mjs',
+    effect: 'write-with-execute',
+    summary: 'Create a change pack when --execute is supplied.',
+  },
+}
+
+const route = commandMap[verb] ?? commandMap.help
+let execution = null
+
+if (execute && verb === 'init') {
+  const mode = rest.includes('--mode') ? rest[rest.indexOf('--mode') + 1] : 'auto'
+  execution = runNode('init-project.mjs', ['--target', target, '--mode', mode, '--json'])
+} else if (execute && verb === 'change') {
+  const changeId = rest.find((item) => !item.startsWith('--')) ?? 'gse-change'
+  const level = rest.includes('--level') ? rest[rest.indexOf('--level') + 1] : 'standard'
+  execution = runNode('init-change.mjs', ['--target', target, '--change-id', changeId, '--level', level, '--json'])
+} else if (verb === 'continue' || verb === 'next') {
+  execution = runNode('generate-session-prompt.mjs', ['--target', target, '--json'])
+} else if (verb === 'status') {
+  const targetHasFinalFormReport = fs.existsSync(path.join(target, 'scripts', 'generate-final-form-progress-report.mjs'))
+    && fs.existsSync(path.join(target, 'references', 'final-readiness.md'))
+  execution = targetHasFinalFormReport
+    ? runNode('generate-final-form-progress-report.mjs', ['--root', target, '--dry-run', '--json'])
+    : {
+        command: 'read .gse/state.json',
+        status: state ? 0 : 1,
+        ok: Boolean(state),
+        diagnosticSummary: state ? { status: 'passed', failed: 0, total: 1 } : { status: 'failed', failed: 1, total: 1 },
+        stdout: JSON.stringify({
+          status: state ? 'ready' : 'missing-state',
+          target,
+          state: state ?? null,
+          project: {
+            hasGse: exists('.gse'),
+            projectProfile,
+            goalMap,
+            qualityGates,
+            canonicalPlan,
+            canonicalPlanExists: canonicalPlan ? exists(canonicalPlan) : null,
+          },
+          limits: [
+            'Generic project status reports .gse/state.json only.',
+            'Final-form progress report is available when the target is the GSE skill package.',
+          ],
+        }),
+        stderr: state ? '' : '.gse/state.json is missing or invalid',
+      }
+} else if (verb === 'doctor' || verb === 'acceptance') {
+  const targetHasPublicAcceptanceDoctor = fs.existsSync(path.join(target, 'scripts', 'audit-public-acceptance-readiness.mjs'))
+    && fs.existsSync(path.join(target, 'references', 'final-readiness.md'))
+  execution = targetHasPublicAcceptanceDoctor
+    ? runNode('audit-public-acceptance-readiness.mjs', ['--root', target, '--json'])
+    : runNode('audit-target-project.mjs', ['--target', target, '--json'])
+} else if (verb === 'owner-actions' || verb === 'owner') {
+  const targetHasPublicAcceptanceDoctor = fs.existsSync(path.join(target, 'scripts', 'audit-public-acceptance-readiness.mjs'))
+    && fs.existsSync(path.join(target, 'references', 'final-readiness.md'))
+  if (targetHasPublicAcceptanceDoctor) {
+    const doctor = runNode('audit-public-acceptance-readiness.mjs', ['--root', target, '--json'])
+    let compact = null
+    try {
+      const parsed = JSON.parse(doctor.stdout)
+      compact = {
+        status: parsed.summary?.status ?? 'unknown',
+        publicAccepted: parsed.summary?.publicAccepted ?? 'unknown',
+        pendingGateCount: parsed.summary?.pendingGates ?? 0,
+        actions: (parsed.pendingGates ?? []).map((gate, index) => ({
+          order: String(index + 1).padStart(2, '0'),
+          area: gate.area,
+          owner: gate.owner,
+          status: gate.status,
+          requiredEvidence: gate.requiredEvidence,
+          recordCommand: gate.recordCommand,
+          preflightCommand: gate.preflightCommand,
+        })),
+        verificationCommands: [
+          'node scripts/run-gse-command.mjs --root __GSE__ --target __GSE__ --command "/gse probe --public-repo-url __PUBLIC_REPO_URL__ --security-contact-url __SECURITY_CONTACT_URL__ --public-ci-run-url __PUBLIC_CI_RUN_URL__ --registry-package-url __REGISTRY_PACKAGE_URL__ --marketplace-url __MARKETPLACE_LISTING_URL__ --native-host-evidence __NATIVE_HOST_EVIDENCE__ --other-host-evidence __OTHER_HOST_EVIDENCE__" --json',
+          'node scripts/audit-public-acceptance-readiness.mjs --root __GSE__ --json',
+          'node scripts/audit-final-readiness.mjs --root __GSE__ --json',
+          'node scripts/audit-owner-external-gate-kit.mjs --root __GSE__ --json',
+        ],
+        limits: [
+          'These are owner/external collection actions, not public acceptance.',
+          'Run preflight commands first, then record real accepted evidence when available.',
+        ],
+      }
+    } catch {
+      compact = null
+    }
+    execution = {
+      ...doctor,
+      command: doctor.command + ' -> compact owner actions',
+      stdout: compact ? JSON.stringify(compact, null, 2) : doctor.stdout,
+    }
+  } else {
+    execution = {
+      command: 'read target final-readiness/public-acceptance support',
+      status: 1,
+      ok: false,
+      diagnosticSummary: { status: 'failed', failed: 1, total: 1 },
+      stdout: JSON.stringify({
+        status: 'unsupported-target',
+        target,
+        error: '/gse owner-actions is only available for GSE skill packages with public acceptance audits.',
+      }),
+      stderr: 'target does not expose scripts/audit-public-acceptance-readiness.mjs and references/final-readiness.md',
+    }
+  }
+} else if (verb === 'probe') {
+  const targetHasProbe = fs.existsSync(path.join(target, 'scripts', 'probe-public-external-gates.mjs'))
+  if (targetHasProbe) {
+    const passthrough = []
+    const allowedValueFlags = new Set([
+      '--public-repo-url',
+      '--security-contact-url',
+      '--public-ci-run-url',
+      '--registry-package-url',
+      '--marketplace-url',
+      '--native-host-evidence',
+      '--other-host-evidence',
+      '--timeout-ms',
+    ])
+    const allowedBooleanFlags = new Set(['--allow-local-fixture'])
+    for (let index = 0; index < rest.length; index += 1) {
+      const item = rest[index]
+      if (allowedBooleanFlags.has(item)) {
+        passthrough.push(item)
+      } else if (allowedValueFlags.has(item)) {
+        passthrough.push(item, rest[index + 1] ?? '')
+        index += 1
+      }
+    }
+    execution = runNode('probe-public-external-gates.mjs', ['--root', target, ...passthrough, '--json'])
+  } else {
+    execution = {
+      command: 'read target public external gate probe support',
+      status: 1,
+      ok: false,
+      diagnosticSummary: { status: 'failed', failed: 1, total: 1 },
+      stdout: JSON.stringify({
+        status: 'unsupported-target',
+        target,
+        error: '/gse probe is only available for GSE skill packages that include scripts/probe-public-external-gates.mjs.',
+      }),
+      stderr: 'target does not expose scripts/probe-public-external-gates.mjs',
+    }
+  }
+} else if (verb === 'release') {
+  const targetHasReleaseBundle = fs.existsSync(path.join(target, 'scripts', 'generate-release-bundle.mjs'))
+    && fs.existsSync(path.join(target, 'scripts', 'audit-release-bundle.mjs'))
+  if (targetHasReleaseBundle) {
+    const labelIndex = rest.indexOf('--label')
+    const outIndex = rest.indexOf('--out')
+    const label = labelIndex === -1 ? 'gse-release-bundle-audit' : (rest[labelIndex + 1] || 'gse-release-bundle-audit')
+    const out = outIndex === -1 ? path.join(target, '.gse', 'release-bundles', label) : path.resolve(rest[outIndex + 1] || path.join(target, '.gse', 'release-bundles', label))
+    execution = execute
+      ? runNode('generate-release-bundle.mjs', ['--root', target, '--label', label, '--out', out, '--force', '--json'])
+      : runNode('generate-release-bundle.mjs', ['--root', target, '--label', label, '--out', out, '--dry-run', '--json'])
+  } else {
+    execution = {
+      command: 'read target release bundle support',
+      status: 1,
+      ok: false,
+      diagnosticSummary: { status: 'failed', failed: 1, total: 1 },
+      stdout: JSON.stringify({
+        status: 'unsupported-target',
+        target,
+        error: '/gse release is only available for GSE skill packages that include release bundle scripts.',
+      }),
+      stderr: 'target does not expose scripts/generate-release-bundle.mjs and scripts/audit-release-bundle.mjs',
+    }
+  }
+} else if (verb === 'package') {
+  const targetHasPackageScript = fs.existsSync(path.join(target, 'scripts', 'package-gse.mjs'))
+  if (targetHasPackageScript) {
+    const labelIndex = rest.indexOf('--label')
+    const outIndex = rest.indexOf('--out')
+    const label = labelIndex === -1 ? 'gse-command-package' : (rest[labelIndex + 1] || 'gse-command-package')
+    const out = outIndex === -1 ? path.join(target, '.gse', 'packages', label) : path.resolve(rest[outIndex + 1] || path.join(target, '.gse', 'packages', label))
+    execution = execute
+      ? runNode('package-gse.mjs', ['--root', target, '--label', label, '--out', out, '--force', '--json'])
+      : runNode('package-gse.mjs', ['--root', target, '--label', label, '--out', out, '--dry-run', '--json'])
+  } else {
+    execution = {
+      command: 'read target package support',
+      status: 1,
+      ok: false,
+      diagnosticSummary: { status: 'failed', failed: 1, total: 1 },
+      stdout: JSON.stringify({
+        status: 'unsupported-target',
+        target,
+        error: '/gse package is only available for GSE skill packages that include scripts/package-gse.mjs.',
+      }),
+      stderr: 'target does not expose scripts/package-gse.mjs',
+    }
+  }
+} else if (verb === 'install') {
+  const targetHasInstallScript = fs.existsSync(path.join(target, 'scripts', 'install-gse.mjs'))
+  if (targetHasInstallScript) {
+    const sourceIndex = rest.indexOf('--source')
+    const sourceUrlIndex = rest.indexOf('--source-url')
+    const manifestUrlIndex = rest.indexOf('--manifest-url')
+    const installTargetIndex = rest.indexOf('--install-target')
+    const legacyTargetIndex = rest.indexOf('--target')
+    const publicKeyIndex = rest.indexOf('--public-key')
+    const packageSource = sourceIndex === -1 ? null : path.resolve(rest[sourceIndex + 1] || '')
+    const packageSourceUrl = sourceUrlIndex === -1 ? null : (rest[sourceUrlIndex + 1] || '')
+    const manifestUrl = manifestUrlIndex === -1 ? null : (rest[manifestUrlIndex + 1] || '')
+    const installTarget = installTargetIndex !== -1
+      ? path.resolve(rest[installTargetIndex + 1] || '')
+      : legacyTargetIndex !== -1
+        ? path.resolve(rest[legacyTargetIndex + 1] || '')
+        : null
+    const publicKey = publicKeyIndex === -1 ? null : path.resolve(rest[publicKeyIndex + 1] || '')
+    if (!installTarget || (!packageSource && !packageSourceUrl && !manifestUrl)) {
+      execution = {
+        command: 'parse /gse install arguments',
+        status: 0,
+        ok: true,
+        diagnosticSummary: { status: 'waiting-for-input', failed: 0, total: 1 },
+        stdout: JSON.stringify({
+          status: 'waiting-for-input',
+          target,
+          required: ['--source <package-dir> or --source-url <package-url>', '--install-target <install-skill-dir>'],
+          example: '/gse install --source __PACKAGE_DIR__ --install-target __INSTALL_SKILL_DIR__',
+          effect: 'read-only by default; add --execute to write the install target',
+        }),
+        stderr: '',
+      }
+    } else {
+      const installArgs = ['--target', installTarget, '--json']
+      if (packageSource) installArgs.push('--source', packageSource)
+      if (packageSourceUrl) installArgs.push('--source-url', packageSourceUrl)
+      if (manifestUrl) installArgs.push('--manifest-url', manifestUrl)
+      if (publicKey) installArgs.push('--public-key', publicKey)
+      if (rest.includes('--skip-integrity')) installArgs.push('--skip-integrity')
+      if (rest.includes('--skip-signature')) installArgs.push('--skip-signature')
+      execution = execute
+        ? runNode('install-gse.mjs', [...installArgs, '--force'])
+        : runNode('install-gse.mjs', [...installArgs, '--dry-run'])
+    }
+  } else {
+    execution = {
+      command: 'read target install support',
+      status: 1,
+      ok: false,
+      diagnosticSummary: { status: 'failed', failed: 1, total: 1 },
+      stdout: JSON.stringify({
+        status: 'unsupported-target',
+        target,
+        error: '/gse install is only available for GSE skill packages that include scripts/install-gse.mjs.',
+      }),
+      stderr: 'target does not expose scripts/install-gse.mjs',
+    }
+  }
+} else if (verb === 'public-release') {
+  const targetHasPublicReleaseChecklist = fs.existsSync(path.join(target, 'scripts', 'generate-public-release-checklist.mjs'))
+    && fs.existsSync(path.join(target, 'scripts', 'audit-public-release-checklist.mjs'))
+  if (targetHasPublicReleaseChecklist) {
+    const outIndex = rest.indexOf('--out')
+    const manifestIndex = rest.indexOf('--manifest')
+    const out = outIndex === -1
+      ? path.join(target, '.gse', 'acceptance', 'public-release-checklist.md')
+      : path.resolve(rest[outIndex + 1] || path.join(target, '.gse', 'acceptance', 'public-release-checklist.md'))
+    const checklistArgs = ['--root', target, '--out', out, '--json']
+    if (manifestIndex !== -1) checklistArgs.push('--manifest', path.resolve(rest[manifestIndex + 1] || path.join(target, '.gse', 'acceptance', 'release-status-manifest.json')))
+    execution = execute
+      ? runNode('generate-public-release-checklist.mjs', [...checklistArgs, '--force'])
+      : runNode('generate-public-release-checklist.mjs', [...checklistArgs, '--dry-run'])
+  } else {
+    execution = {
+      command: 'read target public release checklist support',
+      status: 1,
+      ok: false,
+      diagnosticSummary: { status: 'failed', failed: 1, total: 1 },
+      stdout: JSON.stringify({
+        status: 'unsupported-target',
+        target,
+        error: '/gse public-release is only available for GSE skill packages that include public release checklist scripts.',
+      }),
+      stderr: 'target does not expose scripts/generate-public-release-checklist.mjs and scripts/audit-public-release-checklist.mjs',
+    }
+  }
+} else if (verb === 'audit') {
+  execution = runNode('audit-target-project.mjs', ['--target', target, '--json'])
+} else if (verb === 'close') {
+  execution = runNode('audit-close-gate.mjs', ['--target', target, '--json'])
+} else if (verb === 'verify') {
+  const profileIndex = rest.indexOf('--profile')
+  const profile = profileIndex === -1 ? 'lite' : (rest[profileIndex + 1] || 'lite')
+  execution = runNode('run-validation-profile.mjs', ['--target', target, '--profile', profile, '--json'])
+} else if (verb === 'learn') {
+  const learningArgs = [
+    '--target', target,
+    '--summary', readRestValue(rest, '--summary'),
+    '--trigger', readRestValue(rest, '--trigger', 'reusable lesson'),
+    '--source', readRestValue(rest, '--source', 'run-gse-command'),
+    '--promotion', readRestValue(rest, '--promotion', 'first occurrence: learning note'),
+    '--json',
+  ]
+  const impact = readRestValue(rest, '--impact')
+  if (impact) learningArgs.push('--impact', impact)
+  if (execute) learningArgs.push('--execute')
+  execution = runNode('record-learning.mjs', learningArgs)
+}
+
+const report = {
+  root,
+  target,
+  command: normalized,
+  verb,
+  route,
+  project: {
+    hasGse: exists('.gse'),
+    projectProfile,
+    goalMap,
+    qualityGates,
+    stateValid: Boolean(state),
+    phase: state?.phase ?? null,
+    currentSlice: state?.currentSlice ?? null,
+    canonicalPlan,
+    canonicalPlanExists: canonicalPlan ? exists(canonicalPlan) : null,
+  },
+  execution,
+  limits: [
+    'This runner executes portable GSE command semantics.',
+    'It does not prove a host UI accepted a native slash command unless the host invokes this runner or a host smoke records that behavior.',
+    'Write-capable commands require --execute.',
+  ],
+}
+
+if (jsonOnly && compactOutput && execution?.stdout) {
+  try {
+    console.log(JSON.stringify(JSON.parse(execution.stdout), null, 2))
+  } catch {
+    console.log(execution.stdout)
+  }
+} else if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else {
+  console.log('GSE command: ' + report.command)
+  console.log('Route: ' + report.route.route)
+  console.log('Effect: ' + report.route.effect)
+  console.log('Target: ' + report.target)
+}
+
+if (execution && !execution.ok) process.exit(1)

package/scripts/run-validation-profile.mjs

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const target = path.resolve(readArg('--target', root))
+const profile = readArg('--profile', 'lite')
+const jsonOnly = args.includes('--json')
+
+function scriptExists(name) {
+  return fs.existsSync(path.join(root, 'scripts', name))
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  const stdout = (result.stdout ?? '').trim()
+  let parsed = null
+  try {
+    parsed = JSON.parse(stdout)
+  } catch {
+    parsed = null
+  }
+  const failed = parsed?.summary?.failed
+  const ok = (result.status ?? 1) === 0 || failed === 0
+  return {
+    script,
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    ok,
+    summary: parsed?.summary ?? null,
+    workflows: parsed?.workflows ?? null,
+    stdout,
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function commandList(selectedProfile) {
+  const common = [
+    ['audit-commands.mjs', ['--root', root, '--json']],
+    ['audit-command-execution.mjs', ['--root', root, '--profile', 'lite', '--json']],
+    ['audit-learning-system.mjs', ['--root', root, '--json']],
+  ]
+
+  const targetChecks = target === root
+    ? []
+    : [['audit-target-project.mjs', ['--root', root, '--target', target, '--json']]]
+  const closeChecks = [
+    ['audit-close-gate.mjs', ['--target', target, '--json']],
+  ]
+
+  const gseFinalChecks = []
+  if (target === root && scriptExists('audit-final-form-progress-report.mjs')) {
+    gseFinalChecks.push(['audit-final-form-progress-report.mjs', ['--root', root, '--json']])
+  }
+
+  const releaseChecks = [
+    ['audit-command-execution.mjs', ['--root', root, '--profile', 'full', '--json']],
+    ['audit-npm-package-metadata.mjs', ['--root', root, '--json']],
+    ['audit-npm-tarball-install.mjs', ['--root', root, '--json']],
+    ['audit-signing.mjs', ['--root', root, '--json']],
+    ['audit-release-bundle.mjs', ['--root', root, '--json']],
+    ['audit-distribution.mjs', ['--root', root, '--json']],
+    ['audit-remote-distribution.mjs', ['--root', root, '--json']],
+    ['audit-public-acceptance-readiness.mjs', ['--root', root, '--json']],
+    ['audit-final-readiness.mjs', ['--root', root, '--json']],
+    ['audit-final-acceptance-packet.mjs', ['--root', root, '--json']],
+    ['audit-owner-external-gate-kit.mjs', ['--root', root, '--json']],
+  ]
+
+  if (selectedProfile === 'lite') return [...common, ...gseFinalChecks]
+  if (selectedProfile === 'standard') return [...common, ...targetChecks, ...gseFinalChecks]
+  if (selectedProfile === 'enterprise') return [...common, ...targetChecks, ...gseFinalChecks, ...closeChecks, ['audit-owner-external-gate-kit.mjs', ['--root', root, '--json']]]
+  if (selectedProfile === 'release') return [...common, ...targetChecks, ...gseFinalChecks, ...closeChecks, ...releaseChecks]
+  throw new Error(`Unknown validation profile: ${selectedProfile}`)
+}
+
+const selectedCommands = commandList(profile)
+const results = selectedCommands.map(([script, commandArgs]) => run(script, commandArgs))
+const passed = results.filter((item) => item.ok).length
+const failed = results.length - passed
+const report = {
+  root,
+  target,
+  profile,
+  generatedAt: new Date().toISOString(),
+  summary: {
+    status: failed === 0 ? 'passed' : 'failed',
+    passed,
+    failed,
+    total: results.length,
+  },
+  workflows: {
+    validationProfile: failed === 0 ? 'verified' : 'failed',
+    profile,
+  },
+  results,
+  limits: [
+    'Validation profiles select the lightest command set that proves the requested claim.',
+    'Lite and standard profiles do not replace release, distribution, security, public acceptance, or host-native runtime evidence.',
+    'Release profile may be slow and should be reserved for release/install/distribution claims.',
+  ],
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Validation Profile')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Target: ' + data.target)
+  lines.push('Profile: ' + data.profile)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('')
+  lines.push('## Commands')
+  lines.push('')
+  for (const item of data.results) {
+    lines.push('- ' + (item.ok ? '[x]' : '[ ]') + ' `' + item.command + '`')
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)