@t275005746/gse 0.1.1 → 0.1.2

package/scripts/audit-maintenance-snapshot.mjs

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  const stdout = (result.stdout ?? '').trim()
+  let data = null
+  try {
+    data = JSON.parse(stdout)
+  } catch {
+    data = null
+  }
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    ok: (result.status ?? 1) === 0 || data?.summary?.failed === 0,
+    data,
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const skill = read('SKILL.md')
+const maintenanceRef = read('references/maintenance-cadence.md')
+const commandRunner = read('scripts/run-gse-command.mjs')
+const validationProfile = read('scripts/run-validation-profile.mjs')
+const validator = read('scripts/validate-gse.mjs')
+const snapshotScript = read('scripts/generate-maintenance-snapshot.mjs')
+const canonicalSnapshotPath = path.join(root, '.gse', 'maintenance', 'latest-maintenance-snapshot.json')
+let canonicalSnapshot = null
+try {
+  canonicalSnapshot = fs.existsSync(canonicalSnapshotPath)
+    ? JSON.parse(fs.readFileSync(canonicalSnapshotPath, 'utf8').replace(/^\uFEFF/, ''))
+    : null
+} catch {
+  canonicalSnapshot = null
+}
+
+const dryRun = run('generate-maintenance-snapshot.mjs', ['--root', root, '--target', root, '--skip-release-bundle', '--json'])
+const packageSmokeRun = run('generate-maintenance-snapshot.mjs', ['--root', root, '--target', root, '--package-smoke', '--skip-release-bundle', '--json'])
+const tempOut = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'gse-maintenance-snapshot-')), 'snapshot.json')
+const writeRun = run('generate-maintenance-snapshot.mjs', ['--root', root, '--target', root, '--skip-release-bundle', '--out', tempOut, '--execute', '--json'])
+const writtenSnapshot = fs.existsSync(tempOut)
+  ? JSON.parse(fs.readFileSync(tempOut, 'utf8').replace(/^\uFEFF/, ''))
+  : null
+
+function runCanonicalFailureFixture() {
+  const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-maintenance-canonical-failure-'))
+  const fixtureScripts = path.join(fixtureRoot, 'scripts')
+  const fixtureMaintenance = path.join(fixtureRoot, '.gse', 'maintenance')
+  fs.mkdirSync(fixtureScripts, { recursive: true })
+  fs.mkdirSync(fixtureMaintenance, { recursive: true })
+  fs.copyFileSync(path.join(root, 'scripts', 'generate-maintenance-snapshot.mjs'), path.join(fixtureScripts, 'generate-maintenance-snapshot.mjs'))
+  fs.writeFileSync(path.join(fixtureScripts, 'audit-maintenance-cadence.mjs'), [
+    '#!/usr/bin/env node',
+    'console.log(JSON.stringify({ summary: { status: "failed", passed: 0, failed: 1, total: 1 } }))',
+    'process.exit(1)',
+    '',
+  ].join('\n'), 'utf8')
+  const canonicalPath = path.join(fixtureMaintenance, 'latest-maintenance-snapshot.json')
+  const failedPath = path.join(fixtureMaintenance, 'latest-maintenance-snapshot.failed.json')
+  const previousCanonical = {
+    schemaVersion: 1,
+    summary: { status: 'passed' },
+    fixtureMarker: 'previous-passing-snapshot',
+  }
+  fs.writeFileSync(canonicalPath, JSON.stringify(previousCanonical, null, 2) + '\n', 'utf8')
+  const result = spawnSync(process.execPath, [
+    path.join(fixtureScripts, 'generate-maintenance-snapshot.mjs'),
+    '--root',
+    fixtureRoot,
+    '--target',
+    fixtureRoot,
+    '--execute',
+    '--json',
+  ], {
+    cwd: fixtureRoot,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  let canonicalAfter = null
+  let failedSnapshot = null
+  let stdout = null
+  try {
+    canonicalAfter = JSON.parse(fs.readFileSync(canonicalPath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    canonicalAfter = null
+  }
+  try {
+    failedSnapshot = JSON.parse(fs.readFileSync(failedPath, 'utf8').replace(/^\uFEFF/, ''))
+  } catch {
+    failedSnapshot = null
+  }
+  try {
+    stdout = JSON.parse((result.stdout ?? '').trim())
+  } catch {
+    stdout = null
+  }
+  return {
+    command: [process.execPath, path.join(fixtureScripts, 'generate-maintenance-snapshot.mjs'), '--root', fixtureRoot, '--target', fixtureRoot, '--execute', '--json'].join(' '),
+    status: result.status ?? 1,
+    canonicalPreserved: canonicalAfter?.fixtureMarker === previousCanonical.fixtureMarker && canonicalAfter?.summary?.status === 'passed',
+    failedWritten: failedSnapshot?.summary?.status === 'failed' && failedSnapshot?.canonicalWritePolicy === 'failed-canonical-write-isolated',
+    stdoutPolicy: stdout?.canonicalWritePolicy === 'failed-canonical-write-isolated',
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+const canonicalFailureFixture = runCanonicalFailureFixture()
+
+const requiredIds = ['MS01', 'MS02', 'MS03', 'MS04', 'MS05', 'MS06', 'MS07', 'MS08', 'MS09']
+const checks = [
+  check('MSS01', 'maintenance snapshot generator exists', exists('scripts/generate-maintenance-snapshot.mjs'), 'scripts/generate-maintenance-snapshot.mjs'),
+  check('MSS02', 'snapshot generator runs read-only dry-run', dryRun.ok && dryRun.data?.summary?.status === 'passed', dryRun.command, dryRun.stderr),
+  check('MSS03', 'snapshot covers recurring final-form check set', requiredIds.every((id) => dryRun.data?.results?.some((item) => item.id === id)), requiredIds.join(', ')),
+  check('MSS04', 'snapshot write is execute-gated and writes JSON/Markdown', writeRun.ok && fs.existsSync(tempOut) && fs.existsSync(tempOut.replace(/\.json$/i, '.md')), tempOut),
+  check('MSS05', 'written snapshot has machine-readable result summaries', writtenSnapshot?.results?.every((item) => item.id && item.area && item.status && item.command), 'snapshot results'),
+  check('MSS06', 'SKILL routes maintenance snapshot helper', skill.includes('generate-maintenance-snapshot.mjs') && skill.includes('audit-maintenance-snapshot.mjs'), 'SKILL.md'),
+  check('MSS07', 'maintenance reference documents snapshot command', maintenanceRef.includes('generate-maintenance-snapshot.mjs') && maintenanceRef.includes('latest-maintenance-snapshot.json'), 'references/maintenance-cadence.md'),
+  check('MSS08', 'portable /gse maintenance route uses snapshot generator', commandRunner.includes('generate-maintenance-snapshot.mjs') && commandRunner.includes('snapshot'), 'scripts/run-gse-command.mjs'),
+  check('MSS09', 'validation profile includes maintenance snapshot audit', validationProfile.includes('audit-maintenance-snapshot.mjs'), 'scripts/run-validation-profile.mjs'),
+  check('MSS10', 'consolidated validator includes maintenance snapshot audit', validator.includes('audit-maintenance-snapshot.mjs'), 'scripts/validate-gse.mjs'),
+  check('MSS11', 'canonical snapshot is present when recorded', canonicalSnapshot ? canonicalSnapshot.summary?.status === 'passed' : true, canonicalSnapshotPath),
+  check('MSS12', 'snapshot preserves host-native slash-command boundary', snapshotScript.includes('does not prove native host slash-command support'), 'scripts/generate-maintenance-snapshot.mjs'),
+  check('MSS13', 'snapshot supports installed package smoke mode', packageSmokeRun.ok && packageSmokeRun.data?.summary?.packageSmoke === true && !packageSmokeRun.data?.results?.some((item) => item.id === 'MS02'), packageSmokeRun.command, packageSmokeRun.stderr),
+  check('MSS14', 'failed canonical maintenance snapshot writes are isolated from the last passing latest snapshot', canonicalFailureFixture.status !== 0 && canonicalFailureFixture.canonicalPreserved && canonicalFailureFixture.failedWritten && canonicalFailureFixture.stdoutPolicy, canonicalFailureFixture.command, canonicalFailureFixture.stderr),
+  check('MSS15', 'snapshot documents canonical failure isolation policy', snapshotScript.includes('failed checks are written to latest-maintenance-snapshot.failed.json'), 'scripts/generate-maintenance-snapshot.mjs'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    maintenanceSnapshot: failed === 0 ? 'verified' : 'failed',
+    dryRunStatus: dryRun.data?.summary?.status ?? 'unknown',
+    writeStatus: writeRun.data?.summary?.status ?? 'unknown',
+  },
+  limits: [
+    'This audit verifies snapshot mechanics and routing.',
+    'It does not prove a native host slash command or replace installed-root sync evidence.',
+  ],
+  checks,
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-npm-package-metadata.mjs

@@ -60,7 +60,13 @@ const packRun = process.platform === 'win32'
   : run('npm', ['pack', '--dry-run', '--json'])
 const packData = parseJson(packRun.stdout)
 const packFiles = new Set((Array.isArray(packData) ? packData[0]?.files : []).map((item) => item.path))
-const packageFiles = new Set(pkg?.files ?? [])
+const packageFiles = new Set(pkg?.files ?? [])
+const repositoryUrl = typeof pkg?.repository === 'string' ? pkg.repository : pkg?.repository?.url
+const expectedRepositoryUrls = new Set([
+  'git+https://github.com/275005746/gse.git',
+  'https://github.com/275005746/gse.git',
+  'https://github.com/275005746/gse',
+])
 const requiredPackageFiles = [
   'SKILL.md',
   'README.md',
@@ -92,7 +98,7 @@ const checks = [
   check('NPM06', 'files whitelist includes core skill content', requiredFilesWhitelist.every((item) => packageFiles.has(item)), requiredFilesWhitelist.join(', ')),
   check('NPM07', 'npm pack dry-run succeeds', packRun.status === 0 && Array.isArray(packData) && packData.length === 1, packRun.command, packRun.stderr),
   check('NPM08', 'npm pack dry-run includes required runtime files', requiredPackageFiles.every((item) => packFiles.has(item)), requiredPackageFiles.filter((item) => !packFiles.has(item)).join(', ') || 'all required files present'),
-  check('NPM09', 'npm package metadata does not claim registry publication', !pkg?.publishConfig && !pkg?.repository, 'no publishConfig or repository claim until public repo/channel evidence exists'),
+  check('NPM09', 'npm package metadata points at the public GSE repository without publishConfig overrides', !pkg?.publishConfig && expectedRepositoryUrls.has(repositoryUrl), 'repository=' + (repositoryUrl ?? 'missing') + ', publishConfig=' + (pkg?.publishConfig ? 'present' : 'absent')),
 ]
 
 const passed = checks.filter((item) => item.status === 'passed').length

package/scripts/audit-npm-publish-dry-run.mjs

@@ -56,8 +56,14 @@ function check(id, label, ok, evidence, risk = '') {
   return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
 }
 
-const pkg = readJson('package.json')
-const publishRun = npm(['publish', '--dry-run', '--json'])
+const pkg = readJson('package.json')
+const repositoryUrl = typeof pkg?.repository === 'string' ? pkg.repository : pkg?.repository?.url
+const expectedRepositoryUrls = new Set([
+  'git+https://github.com/275005746/gse.git',
+  'https://github.com/275005746/gse.git',
+  'https://github.com/275005746/gse',
+])
+const publishRun = npm(['publish', '--dry-run', '--json'])
 const publishData = parseJson(publishRun.stdout)
 const usablePublishData = publishData?.name && publishData?.version ? publishData : null
 const alreadyPublished = publishRun.status !== 0 && /previously published versions/i.test(publishRun.stderr)
@@ -123,8 +129,8 @@ const checks = [
   check('NPD04', 'publish package includes required runtime files', packRun.status === 0 && requiredPublishFiles.every((item) => publishFiles.has(item)), requiredPublishFiles.filter((item) => !publishFiles.has(item)).join(', ') || 'all required publish files present'),
   check('NPD05', 'publish or registry metadata reports tarball integrity fields', typeof effectiveData?.shasum === 'string' && typeof effectiveData?.integrity === 'string' && effectiveData.integrity.startsWith('sha512-'), 'shasum and integrity'),
   check('NPD06', 'publish dry-run does not auto-correct or remove package metadata', unexpectedWarningLines.length === 0, unexpectedWarningLines.join(' | ') || 'no harmful npm warnings'),
-  check('NPD07', 'package still does not claim actual registry publication', !pkg?.publishConfig && !pkg?.repository, 'no publishConfig or repository claim until public repo/channel evidence exists'),
-]
+  check('NPD07', 'package metadata points at the public GSE repository without publishConfig overrides', !pkg?.publishConfig && expectedRepositoryUrls.has(repositoryUrl), 'repository=' + (repositoryUrl ?? 'missing') + ', publishConfig=' + (pkg?.publishConfig ? 'present' : 'absent')),
+]
 
 const passed = checks.filter((item) => item.status === 'passed').length
 const failed = checks.length - passed

package/scripts/audit-npm-tarball-install.mjs

@@ -78,8 +78,14 @@ const tarballPath = packItem?.filename ? path.join(tempRoot, packItem.filename)
 const installRun = tarballPath
   ? npm(['install', tarballPath, '--ignore-scripts', '--no-audit', '--no-fund'], consumerRoot)
   : { command: 'npm install skipped; tarball not created', cwd: consumerRoot, status: 1, stdout: '', stderr: 'tarball not created' }
-const installedRoot = path.join(consumerRoot, 'node_modules', '@t275005746', 'gse')
-const installedPkg = safeReadJson(path.join(installedRoot, 'package.json'))
+const installedRoot = path.join(consumerRoot, 'node_modules', '@t275005746', 'gse')
+const installedPkg = safeReadJson(path.join(installedRoot, 'package.json'))
+const repositoryUrl = typeof installedPkg?.repository === 'string' ? installedPkg.repository : installedPkg?.repository?.url
+const expectedRepositoryUrls = new Set([
+  'git+https://github.com/275005746/gse.git',
+  'https://github.com/275005746/gse.git',
+  'https://github.com/275005746/gse',
+])
 const binPath = process.platform === 'win32'
   ? path.join(consumerRoot, 'node_modules', '.bin', 'gse.cmd')
   : path.join(consumerRoot, 'node_modules', '.bin', 'gse')
@@ -115,7 +121,7 @@ const checks = [
   check('NTI05', 'installed package exposes gse bin shim', exists(binPath), binPath),
   check('NTI06', 'installed gse bin runs status command', binRun.status === 0 && binData?.command === '/gse status' && binData?.project?.stateValid === true, binRun.command, binRun.stderr),
   check('NTI07', 'installed README audit passes', readmeAudit.status === 0 && readmeData?.summary?.failed === 0, readmeAudit.command, readmeAudit.stderr),
-  check('NTI08', 'package metadata does not claim public registry publication', !installedPkg?.publishConfig && !installedPkg?.repository, 'no publishConfig or repository claim'),
+  check('NTI08', 'installed package metadata points at the public GSE repository without publishConfig overrides', !installedPkg?.publishConfig && expectedRepositoryUrls.has(repositoryUrl), 'repository=' + (repositoryUrl ?? 'missing') + ', publishConfig=' + (installedPkg?.publishConfig ? 'present' : 'absent')),
 ]
 
 const passed = checks.filter((item) => item.status === 'passed').length

package/scripts/audit-owner-external-gate-kit.mjs

@@ -120,10 +120,11 @@ const skill = read('SKILL.md')
 const validate = read('scripts/validate-gse.mjs')
 const bundleGenerator = read('scripts/generate-release-bundle.mjs')
 const bundleAudit = read('scripts/audit-release-bundle.mjs')
-const expectedAreas = (manifest?.gates ?? []).map((gate) => gate.area)
-const expectedScripts = [...new Set((manifest?.gates ?? [])
-  .map((gate) => String(gate.recordCommand ?? '').match(/node scripts\/([^ ]+)/)?.[1] ?? '')
-  .filter(Boolean))]
+const expectedAreas = (manifest?.gates ?? []).map((gate) => gate.area)
+const hasPendingGates = expectedAreas.length > 0
+const expectedScripts = [...new Set((manifest?.gates ?? [])
+  .map((gate) => String(gate.recordCommand ?? '').match(/node scripts\/([^ ]+)/)?.[1] ?? '')
+  .filter(Boolean))]
 const kitRecordTemplatesAreComplete = !commands.includes('--invocation-status') &&
   !finalPacket.includes('--invocation-status') &&
   !publicHandoff.includes('--invocation-status') &&
@@ -138,7 +139,7 @@ const kitRecordTemplatesAreComplete = !commands.includes('--invocation-status')
   !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(publicHandoff) &&
   !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(releaseOwnerActionPlan) &&
   !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(hostHandoff) &&
-  commands.includes('--status accepted')
+  (hasPendingGates ? commands.includes('--status accepted') : manifest?.publicAccepted === 'verified')
 const kitVerificationCommandsAreShellSafe = !/(audit-[a-z-]+|validate-gse|generate-release-status-manifest)\.mjs[^\n`]*[<>]/.test(verificationCommands) &&
   !/(audit-[a-z-]+|validate-gse)\.mjs[^\n`]*[<>]/.test(releaseStatusManifest) &&
   !/(audit-[a-z-]+|validate-gse|generate-release-status-manifest)\.mjs[^\n`]*[<>]/.test(releaseOwnerActionPlan) &&
@@ -148,22 +149,22 @@ const checks = [
   check('OEG01', 'owner/external gate kit generator exists', exists('scripts/generate-owner-external-gate-kit.mjs'), 'scripts/generate-owner-external-gate-kit.mjs'),
   check('OEG02', 'generator produces the kit directory', generated?.status === 0 && generatedData?.status === 'written', generated?.stderr || out),
   check('OEG03', 'kit includes required files', requiredKitFilesPresent, requiredKitFiles.join(', ')),
-  check('OEG04', 'machine-readable pending gates cover current final owner/external gates', expectedAreas.length > 0 && expectedAreas.every((area) => manifest?.gates?.some((gate) => gate.area === area)) && !manifest?.gates?.some((gate) => gate.area === 'License decision'), expectedAreas.join(', ') + '; License decision resolved'),
-  check('OEG05', 'record commands map to real scripts', expectedScripts.length > 0 && expectedScripts.every((script) => commands.includes(script)) && !commands.includes('proves-public-registry-publication') && (!commands.includes('record-public-channel-publication.mjs') || commands.includes('--proves-registry-publication true') || commands.includes('--proves-marketplace-approval true')), expectedScripts.join(', ')),
-  check('OEG05b', 'record commands include dry-run preflight commands for accepted evidence', commands.includes('Preflight command') && commands.includes('--dry-run --json'), 'record-commands.md'),
+  check('OEG04', 'machine-readable pending gates cover current final owner/external gates', (hasPendingGates ? expectedAreas.every((area) => manifest?.gates?.some((gate) => gate.area === area)) : manifest?.pendingGateCount === 0 && manifest?.publicAccepted === 'verified') && !manifest?.gates?.some((gate) => gate.area === 'License decision'), hasPendingGates ? expectedAreas.join(', ') + '; License decision resolved' : '0 pending gates; publicAccepted verified; License decision resolved'),
+  check('OEG05', 'record commands map to real scripts', hasPendingGates ? (expectedScripts.length > 0 && expectedScripts.every((script) => commands.includes(script)) && !commands.includes('proves-public-registry-publication') && (!commands.includes('record-public-channel-publication.mjs') || commands.includes('--proves-registry-publication true') || commands.includes('--proves-marketplace-approval true'))) : commands.includes('GSE Owner / External Gate Record Commands'), expectedScripts.join(', ')),
+  check('OEG05b', 'record commands include dry-run preflight commands for accepted evidence', hasPendingGates ? (commands.includes('Preflight command') && commands.includes('--dry-run --json')) : !commands.includes('Preflight command'), 'record-commands.md'),
   check('OEG05c', 'kit uses complete record command templates', kitRecordTemplatesAreComplete, 'no ellipsis, no stale host invocation flag, host records use --status accepted'),
   check('OEG06', 'kit preserves anti-overclaim boundaries', readme.includes('does not choose a license') && readme.includes('Do not claim native slash-command support') && verificationCommands.includes('Local fixture drills, pointer adapters, and generated handoff files do not count as external acceptance'), 'README.md, verification-commands.md'),
   check('OEG07', 'kit verification commands include portable probe, final readiness, preflight drill, and close gate', verificationCommands.includes('run-gse-command.mjs') && verificationCommands.includes('/gse probe') && !verificationCommands.includes('node scripts/probe-public-external-gates.mjs') && verificationCommands.includes('audit-final-readiness.mjs') && verificationCommands.includes('audit-public-acceptance-readiness.mjs') && verificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs') && verificationCommands.includes('audit-close-gate.mjs'), 'verification-commands.md'),
-  check('OEG08', 'kit contains fresh final acceptance, public handoff, host handoff, manifest, and owner action plan', finalPacket.includes('GSE Final Acceptance Packet') && publicHandoff.includes('GSE Public Acceptance Handoff') && hostHandoff.includes('GSE Host Runtime Evidence Handoff') && releaseStatusManifest.includes('"publicAccepted": "not-accepted"') && releaseOwnerActionPlan.includes('GSE Release Owner Action Plan'), 'generated kit artifacts'),
+  check('OEG08', 'kit contains fresh final acceptance, public handoff, host handoff, manifest, and owner action plan', finalPacket.includes('GSE Final Acceptance Packet') && publicHandoff.includes('GSE Public Acceptance Handoff') && hostHandoff.includes('GSE Host Runtime Evidence Handoff') && releaseStatusManifest.includes('"publicAccepted": "' + (manifest?.publicAccepted ?? 'unknown') + '"') && releaseOwnerActionPlan.includes('GSE Release Owner Action Plan'), 'generated kit artifacts'),
   check('OEG09', 'kit manifest marks generated handoff artifacts as fresh', manifest?.generatedFresh?.finalAcceptancePacket === true && manifest?.generatedFresh?.publicAcceptanceHandoff === true && manifest?.generatedFresh?.hostRuntimeEvidenceHandoff === true && manifest?.generatedFresh?.releaseStatusManifest === true && manifest?.generatedFresh?.releaseOwnerActionPlan === true, 'kit-manifest.json'),
-  check('OEG09b', 'kit manifest carries preflight commands for every pending gate', (manifest?.gates?.length ?? 0) > 0 && manifest.gates.every((gate) => gate.preflightCommand?.includes('--dry-run --json')), 'kit-manifest.json'),
+  check('OEG09b', 'kit manifest carries preflight commands for every pending gate', hasPendingGates ? manifest.gates.every((gate) => gate.preflightCommand?.includes('--dry-run --json')) : manifest?.pendingGateCount === 0, 'kit-manifest.json'),
   check('OEG10', 'skill routes users to the owner/external gate kit', skill.includes('generate-owner-external-gate-kit.mjs') && skill.includes('audit-owner-external-gate-kit.mjs'), 'SKILL.md'),
   check('OEG11', 'validator includes owner/external gate kit audit', validate.includes('audit-owner-external-gate-kit.mjs'), 'scripts/validate-gse.mjs'),
   check('OEG12', 'release bundle includes owner/external gate kit', bundleGenerator.includes('generate-owner-external-gate-kit.mjs') && bundleAudit.includes('owner-external-gate-kit'), 'release bundle generator/audit'),
   check('OEG13', 'kit verification commands use shell-safe placeholders', kitVerificationCommandsAreShellSafe, 'verification commands use __GSE__ instead of <gse>'),
   check('OEG14', 'canonical owner/external gate kit exists', canonicalRequiredKitFilesPresent, '.gse/acceptance/owner-external-gate-kit/'),
   check('OEG15', 'canonical owner/external gate kit matches current generated gate snapshot', canonicalManifest?.publicAccepted === manifest?.publicAccepted && canonicalManifest?.pendingGateCount === manifest?.pendingGateCount && sameJson(stableGateSnapshot(canonicalManifest), stableGateSnapshot(manifest)), '.gse/acceptance/owner-external-gate-kit/kit-manifest.json'),
-  check('OEG16', 'canonical owner/external gate kit preserves current handoff commands and boundaries', canonicalReadme.includes('GSE Owner / External Gate Kit') && canonicalActionPacket.includes('Public accepted: ' + (manifest?.publicAccepted ?? 'unknown')) && canonicalCommands.includes('--dry-run --json') && canonicalCommands.includes('--status accepted') && canonicalVerificationCommands.includes('run-gse-command.mjs') && canonicalVerificationCommands.includes('/gse probe') && !canonicalVerificationCommands.includes('node scripts/probe-public-external-gates.mjs') && canonicalVerificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs') && canonicalVerificationCommands.includes('__GSE__'), '.gse/acceptance/owner-external-gate-kit/'),
+  check('OEG16', 'canonical owner/external gate kit preserves current handoff commands and boundaries', canonicalReadme.includes('GSE Owner / External Gate Kit') && canonicalActionPacket.includes('Public accepted: ' + (manifest?.publicAccepted ?? 'unknown')) && (hasPendingGates ? (canonicalCommands.includes('--dry-run --json') && canonicalCommands.includes('--status accepted')) : !canonicalCommands.includes('Preflight command')) && canonicalVerificationCommands.includes('run-gse-command.mjs') && canonicalVerificationCommands.includes('/gse probe') && !canonicalVerificationCommands.includes('node scripts/probe-public-external-gates.mjs') && canonicalVerificationCommands.includes('audit-public-acceptance-command-dry-run-drill.mjs') && canonicalVerificationCommands.includes('__GSE__'), '.gse/acceptance/owner-external-gate-kit/'),
 ]
 
 const passed = checks.filter((item) => item.status === 'passed').length

package/scripts/audit-project-guards.mjs

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function parseGuardTable(text) {
+  const rows = []
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('|')) continue
+    if (/^\|\s*-+/.test(trimmed)) continue
+    if (/^\|\s*ID\s*\|/i.test(trimmed)) continue
+    const cells = trimmed
+      .slice(1, trimmed.endsWith('|') ? -1 : undefined)
+      .split('|')
+      .map((cell) => cell.trim())
+    if (cells.length < 6) continue
+    rows.push({
+      id: cells[0],
+      guard: cells[1],
+      severity: cells[2],
+      trigger: cells[3],
+      check: cells[4],
+      status: cells[5],
+    })
+  }
+  return rows
+}
+
+export function readProjectGuards(target) {
+  const filePath = path.join(target, '.gse', 'project-guards.md')
+  const exists = fs.existsSync(filePath)
+  const text = exists ? readText(filePath) : ''
+  const guards = parseGuardTable(text)
+  const active = guards.filter((guard) => guard.status.toLowerCase() === 'active')
+  const requiredIds = ['WIN-SHELL', 'SPARSE-GIT', 'UTF8-DOC', 'EVIDENCE-STALE', 'UI-EVIDENCE', 'SUBAGENT-HONEST', 'SYNC-NO-INTERRUPT']
+  const ids = new Set(guards.map((guard) => guard.id))
+  const missingDefaultIds = requiredIds.filter((id) => !ids.has(id))
+  const incomplete = guards.filter((guard) =>
+    !guard.id ||
+    !guard.guard ||
+    !guard.severity ||
+    !guard.trigger ||
+    !guard.check ||
+    !guard.status,
+  )
+  const invalidSeverity = guards.filter((guard) => !['low', 'medium', 'high', 'critical'].includes(guard.severity.toLowerCase()))
+  const invalidStatus = guards.filter((guard) => !['active', 'inactive', 'candidate'].includes(guard.status.toLowerCase()))
+  const status = !exists
+    ? 'warning'
+    : guards.length === 0 || incomplete.length > 0 || invalidSeverity.length > 0 || invalidStatus.length > 0
+      ? 'failed'
+      : missingDefaultIds.length > 0
+        ? 'warning'
+        : 'passed'
+  return {
+    path: '.gse/project-guards.md',
+    exists,
+    status,
+    guards,
+    active,
+    summary: {
+      total: guards.length,
+      active: active.length,
+      missingDefaultIds,
+      incomplete: incomplete.map((guard) => guard.id || '(blank)'),
+      invalidSeverity: invalidSeverity.map((guard) => guard.id),
+      invalidStatus: invalidStatus.map((guard) => guard.id),
+    },
+  }
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-project-guards-'))
+  const init = run('init-project.mjs', ['--target', dir, '--mode', 'lite', '--json'])
+  return { dir, init }
+}
+
+function audit(target) {
+  const resolvedTarget = path.resolve(target)
+  const guardResult = readProjectGuards(resolvedTarget)
+  const checks = [
+    check('PG01', 'project guard file is present or reported as warning', guardResult.exists || guardResult.status === 'warning', guardResult.exists ? guardResult.path : 'missing guard file warning'),
+    check('PG02', 'guard table parses at least one active guard when file exists', !guardResult.exists || guardResult.active.length > 0, `${guardResult.active.length} active guard(s)`),
+    check('PG03', 'guard rows have valid severity and status values', guardResult.summary.invalidSeverity.length === 0 && guardResult.summary.invalidStatus.length === 0, 'severity/status vocabulary'),
+    check('PG04', 'default guard IDs are present when scaffolded', !guardResult.exists || guardResult.summary.missingDefaultIds.length === 0, guardResult.summary.missingDefaultIds.join(', ') || 'default guards present'),
+    check('PG05', 'guard audit keeps missing file as warning instead of hard failure', true, 'missing file policy is warning'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? guardResult.status : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      projectGuards: guardResult.status === 'failed' ? 'failed' : 'verified',
+      continuePreflightGuardSection: 'available',
+    },
+    projectGuards: guardResult,
+    checks,
+    limits: [
+      'Project guards are soft continuation preflight rules in this slice.',
+      'Broken state or evidence index remains the hard /gse continue failure.',
+      'AION and MuseFlow lessons are examples; this audit does not hardcode product-specific behavior.',
+    ],
+  }
+}
+
+function selfTestReport() {
+  const fixture = createFixture()
+  const fixtureReport = audit(fixture.dir)
+  const missingDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-project-guards-missing-'))
+  fs.mkdirSync(path.join(missingDir, '.gse'), { recursive: true })
+  const missingReport = audit(missingDir)
+  fs.rmSync(fixture.dir, { recursive: true, force: true })
+  fs.rmSync(missingDir, { recursive: true, force: true })
+  const checks = [
+    check('PGA01', 'init-project creates project guards', fixture.init.status === 0 && fixtureReport.projectGuards.exists, 'scripts/init-project.mjs'),
+    check('PGA02', 'default scaffold contains seven active guards', fixtureReport.projectGuards.summary.active === 7, `${fixtureReport.projectGuards.summary.active} active guard(s)`),
+    check('PGA03', 'missing guard file is warning, not hard failure', missingReport.projectGuards.status === 'warning', 'missing fixture'),
+    check('PGA04', 'default guard set includes real-project lesson categories', ['WIN-SHELL', 'SPARSE-GIT', 'UTF8-DOC', 'EVIDENCE-STALE', 'UI-EVIDENCE', 'SUBAGENT-HONEST', 'SYNC-NO-INTERRUPT'].every((id) => fixtureReport.projectGuards.guards.some((guard) => guard.id === id)), 'default guard IDs'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    root,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      projectGuards: failed === 0 ? 'verified' : 'failed',
+      initProjectGuardScaffold: failed === 0 ? 'verified' : 'failed',
+    },
+    fixture: {
+      scaffoldStatus: fixtureReport.projectGuards.status,
+      missingStatus: missingReport.projectGuards.status,
+      activeGuards: fixtureReport.projectGuards.active.map((guard) => guard.id),
+    },
+    checks,
+    limits: [
+      'This audit verifies guard scaffold and parsing mechanics.',
+      'It does not prove every project-specific guard has been promoted yet.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const report = targetArg ? audit(targetArg) : selfTestReport()
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}

package/scripts/audit-project.mjs

@@ -23,10 +23,12 @@ const commonFiles = [
   '.gse/README.md',
   '.gse/state.json',
   '.gse/project-profile.md',
-  '.gse/goal-map.md',
-  '.gse/quality-gates.md',
-  '.gse/tooling.md',
-  '.gse/learnings.md',
+  '.gse/goal-map.md',
+  '.gse/quality-gates.md',
+  '.gse/project-guards.md',
+  '.gse/tooling.md',
+  '.gse/host-capabilities.md',
+  '.gse/learnings.md',
   '.gse/evidence/index.jsonl',
   '.gse/goals/README.md',
   '.gse/templates/change-brief.md',
@@ -39,12 +41,13 @@ const commonFiles = [
 ]
 
 const standardFiles = [
-  '.gse/agent-workspace.md',
-  '.gse/agents/roles.md',
-  '.gse/agents/dispatch.md',
-  '.gse/skills/README.md',
-  '.gse/lsp/README.md',
-]
+  '.gse/agent-workspace.md',
+  '.gse/agents/roles.md',
+  '.gse/agents/dispatch.md',
+  '.gse/agents/role-fallback-packets.md',
+  '.gse/skills/README.md',
+  '.gse/lsp/README.md',
+]
 
 const enterpriseFiles = [
   '.gse/hooks/README.md',
@@ -184,7 +187,7 @@ function auditMode(mode, tempRoot) {
   const changedOnRerun = compareSignatures(before, after)
   const writtenCount = firstJson?.results?.filter((item) => item.status === 'written').length ?? 0
   const skippedCount = secondJson?.results?.filter((item) => item.status === 'skipped').length ?? 0
-  const expectedWrites = expectation.files.length
+  const expectedWrites = expectation.files.length + 1
   const ok =
     firstRun.status === 0 &&
     secondRun.status === 0 &&

package/scripts/audit-public-acceptance-handoff.mjs

@@ -71,23 +71,23 @@ const hasRegistryGate = requiredGates.includes('Public registry publication')
 const requiredCommands = [...new Set(currentPendingGates
   .map((gate) => String(gate.recordCommand ?? '').match(/scripts\/([\w-]+\.mjs)/)?.[1])
   .filter(Boolean))]
-const antiOverclaim = [
-  'does not choose a license',
-  'does not choose a license, publish a package, configure a repository, approve a marketplace listing, or prove host-native slash-command support',
-  'Do not claim public release acceptance',
-  'Do not claim native slash-command support',
-]
+const antiOverclaim = [
+  'does not choose a license',
+  'does not choose a license, publish a package, configure a repository, approve a marketplace listing, or prove optional host-native slash-command support',
+  'Do not claim public release acceptance',
+  'Do not claim native slash-command support',
+]
 
 const checks = [
   check('PAH01', 'public acceptance handoff generator exists', exists('scripts/generate-public-acceptance-handoff.mjs'), 'scripts/generate-public-acceptance-handoff.mjs'),
   check('PAH02', 'generator is based on the public acceptance doctor', generator.includes('audit-public-acceptance-readiness.mjs') && generator.includes('pendingGates'), 'generator calls doctor and renders pending gates'),
   check('PAH03', 'generator produces a handoff file', generated?.status === 0 && generatedData?.status === 'written' && handoff.length > 0, generated?.stderr || out),
-  check('PAH04', 'handoff covers all current final-form gates', requiredGates.length > 0 && requiredGates.every((term) => handoff.includes(term)) && !handoff.includes('### 1. Owner decision - License decision'), requiredGates.join(', ') + '; License decision resolved'),
+  check('PAH04', 'handoff covers all current required final-form gates or states none are pending', (requiredGates.length === 0 && handoff.includes('No owner/external gates are pending')) || (requiredGates.length > 0 && requiredGates.every((term) => handoff.includes(term)) && !handoff.includes('### 1. Owner decision - License decision')), requiredGates.join(', ') || 'none'),
   check('PAH05', 'handoff reuses existing record commands', requiredCommands.every((term) => handoff.includes(term)), requiredCommands.join(', ')),
   check('PAH05b', 'handoff registry publication command matches real record CLI when pending', !hasRegistryGate || (handoff.includes('--proves-registry-publication true') && !handoff.includes('--proves-public-registry-publication')), hasRegistryGate ? 'record-public-channel-publication.mjs uses --proves-registry-publication' : 'registry publication already verified'),
-  check('PAH05c', 'handoff includes dry-run preflight commands for accepted records', handoff.includes('Preflight command') && handoff.includes('--dry-run --json'), 'dry-run preflight commands'),
+  check('PAH05c', 'handoff includes dry-run preflight commands when accepted records are pending', requiredGates.length === 0 || (handoff.includes('Preflight command') && handoff.includes('--dry-run --json')), 'dry-run preflight commands'),
   check('PAH06', 'handoff preserves anti-overclaim boundaries', antiOverclaim.every((term) => handoff.includes(term)), antiOverclaim.join(', ')),
-  check('PAH07', 'handoff preserves current public acceptance boundary', handoff.includes('Public accepted: not-accepted') && generatedData?.summary?.publicAccepted === 'not-accepted', 'publicAccepted not-accepted'),
+  check('PAH07', 'handoff preserves current public acceptance boundary', handoff.includes('Public accepted: verified') && generatedData?.summary?.publicAccepted === 'verified', 'publicAccepted verified'),
   check('PAH08', 'skill routes users to public acceptance handoff', skill.includes('generate-public-acceptance-handoff.mjs'), 'SKILL.md'),
   check('PAH09', 'consolidated validator includes handoff audit', validate.includes('audit-public-acceptance-handoff.mjs'), 'scripts/validate-gse.mjs'),
 ]
@@ -104,7 +104,7 @@ const report = {
   },
   limits: [
     'This audit verifies handoff generation and claim boundaries only.',
-    'It does not choose a license, publish a package, configure a repository, run public CI, approve a marketplace listing, or prove host-native slash commands.',
+    'It does not choose a license, publish a package, configure a repository, run public CI, approve a marketplace listing, or prove optional host-native slash commands.',
   ],
   checks,
 }