@t275005746/gse 0.1.1 → 0.1.2

package/scripts/audit-target-hardening-drills.mjs

@@ -0,0 +1,267 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+function readAllArgs(name) {
+  const values = []
+  for (let index = 0; index < args.length; index += 1) {
+    if (args[index] === name && args[index + 1]) values.push(args[index + 1])
+  }
+  return values
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+const strictWarnings = args.includes('--strict-warnings')
+
+function run(script, commandArgs, options = {}) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+    ...options,
+  })
+  const stdout = (result.stdout ?? '').trim()
+  let parsed = null
+  try {
+    parsed = JSON.parse(stdout)
+  } catch {
+    parsed = null
+  }
+  return {
+    script,
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout,
+    stderr: (result.stderr ?? '').trim(),
+    parsed,
+  }
+}
+
+function check(id, label, status, evidence, recommendation = '') {
+  return { id, label, status, evidence, recommendation }
+}
+
+function parseTargets() {
+  const explicitTargets = readAllArgs('--target')
+  const namedTargets = [
+    { id: 'aion', root: readArg('--aion-target', process.env.GSE_AION_TARGET || null) },
+    { id: 'museflow', root: readArg('--museflow-target', process.env.GSE_MUSEFLOW_TARGET || null) },
+  ].filter((item) => item.root)
+  const explicit = explicitTargets.map((target, index) => ({
+    id: `target-${index + 1}`,
+    root: target,
+  }))
+  return [...namedTargets, ...explicit].map((item) => ({
+    ...item,
+    root: path.resolve(item.root),
+  }))
+}
+
+function statusFromRun(runResult) {
+  if (!runResult.parsed) return runResult.status === 0 ? 'passed' : 'failed'
+  const summaryStatus = runResult.parsed.summary?.status
+  if (summaryStatus === 'failed' || summaryStatus === 'not-ready') return 'failed'
+  if (summaryStatus === 'warning' || summaryStatus === 'ready-with-warnings') return 'warning'
+  if ((runResult.parsed.summary?.failed ?? 0) > 0) return 'failed'
+  if ((runResult.parsed.summary?.warnings ?? 0) > 0) return 'warning'
+  return runResult.status === 0 ? 'passed' : 'failed'
+}
+
+function evidenceFromRun(runResult) {
+  const summary = runResult.parsed?.summary
+  if (!summary) return runResult.stderr || runResult.stdout.slice(0, 160) || `exit:${runResult.status}`
+  const parts = []
+  if (summary.status) parts.push(`status:${summary.status}`)
+  if (Number.isFinite(summary.passed) && Number.isFinite(summary.total)) parts.push(`checks:${summary.passed}/${summary.total}`)
+  if (Number.isFinite(summary.warnings)) parts.push(`warnings:${summary.warnings}`)
+  if (Number.isFinite(summary.failed)) parts.push(`failed:${summary.failed}`)
+  if (Number.isFinite(summary.blockedGates)) parts.push(`blockedGates:${summary.blockedGates}`)
+  if (Number.isFinite(summary.highUnenforced)) parts.push(`highUnenforced:${summary.highUnenforced}`)
+  return parts.join(', ') || `exit:${runResult.status}`
+}
+
+function createFixture(label) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), `gse-hardening-${label}-`))
+  const init = run('init-project.mjs', ['--target', dir, '--mode', 'enterprise', '--json'])
+  fs.mkdirSync(path.join(dir, 'docs'), { recursive: true })
+  fs.writeFileSync(path.join(dir, 'docs', 'productization-architecture.md'), `# ${label} Productization\n`, 'utf8')
+
+  const statePath = path.join(dir, '.gse', 'state.json')
+  const state = JSON.parse(fs.readFileSync(statePath, 'utf8'))
+  state.canonicalPlan = 'docs/productization-architecture.md'
+  state.phase = 'verify'
+  state.currentSlice = {
+    id: `${label}-hardening-fixture`,
+    outcome: `${label} hardening fixture.`,
+    status: 'verified',
+    nextAction: 'Continue target hardening drill.',
+  }
+  state.lastEvidence = '.gse/evidence/2026-07-09.md'
+  state.residualRisks = []
+  fs.writeFileSync(statePath, JSON.stringify(state, null, 2) + '\n', 'utf8')
+  fs.appendFileSync(path.join(dir, '.gse', 'README.md'), '\nCanonical plan: `docs/productization-architecture.md`.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-09.md'), '# Evidence\n\nFixture hardening evidence.\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', 'index.jsonl'), JSON.stringify({
+    date: '2026-07-09',
+    recordType: 'slice',
+    status: 'verified',
+    evidenceLevel: 'verified-unit',
+    requiredEvidenceLevel: 'verified-unit',
+    summary: `${label} hardening fixture evidence.`,
+    evidenceFile: '.gse/evidence/2026-07-09.md',
+    commands: ['node scripts/audit-target-hardening-drills.mjs --self-test'],
+    nextAction: 'Continue target hardening drill.',
+  }) + '\n', 'utf8')
+  spawnSync('git', ['init'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  spawnSync('git', ['config', 'user.email', 'gse-fixture@example.local'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  spawnSync('git', ['config', 'user.name', 'GSE Fixture'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  spawnSync('git', ['add', '.'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  spawnSync('git', ['commit', '-m', 'fixture'], { cwd: dir, encoding: 'utf8', windowsHide: true })
+  return { dir, init }
+}
+
+function auditTarget(target) {
+  const commandRuns = {
+    doctor: run('audit-target-project.mjs', ['--root', root, '--target', target.root, '--json']),
+    continue: run('run-gse-command.mjs', ['--root', root, '--target', target.root, '--command', '/gse continue', '--json', '--compact']),
+    close: run('audit-close-gate.mjs', ['--target', target.root, '--json']),
+    hostCapabilities: run('audit-host-capabilities.mjs', ['--root', root, '--target', target.root, '--json']),
+    learningDrift: run('audit-learning-drift.mjs', ['--root', root, '--target', target.root, '--json']),
+  }
+  const checks = [
+    check(`${target.id}-doctor`, 'target project doctor has no hard failures', statusFromRun(commandRuns.doctor), evidenceFromRun(commandRuns.doctor), 'Repair target .gse adoption drift before claiming GSE-ready status.'),
+    check(`${target.id}-continue`, '/gse continue hard preflight returns a usable packet', statusFromRun(commandRuns.continue), evidenceFromRun(commandRuns.continue), 'Repair hard preflight failures before implementation starts.'),
+    check(`${target.id}-close`, 'close gate exposes close readiness and ownership state', statusFromRun(commandRuns.close), evidenceFromRun(commandRuns.close), 'Resolve close-gate failures before claiming the slice complete.'),
+    check(`${target.id}-host`, 'host capability records are audited with claim boundaries', statusFromRun(commandRuns.hostCapabilities), evidenceFromRun(commandRuns.hostCapabilities), 'Record missing host capability facts or keep unknown/external-required boundaries explicit.'),
+    check(`${target.id}-learning`, 'learning drift is audited for promoted guard candidates', statusFromRun(commandRuns.learningDrift), evidenceFromRun(commandRuns.learningDrift), 'Promote high-severity learning drift into guards, gates, or scripts before close.'),
+  ]
+  const failed = checks.filter((item) => item.status === 'failed')
+  const warnings = checks.filter((item) => item.status === 'warning')
+  return {
+    id: target.id,
+    root: target.root,
+    status: failed.length > 0 ? 'failed' : warnings.length > 0 ? 'warning' : 'passed',
+    checks,
+    commands: Object.values(commandRuns).map((item) => item.command),
+    summaries: Object.fromEntries(Object.entries(commandRuns).map(([key, value]) => [key, value.parsed?.summary ?? { exit: value.status }])),
+  }
+}
+
+function runConfiguredTargets() {
+  const targets = parseTargets()
+  if (targets.length === 0) return null
+  return {
+    targets,
+    cleanup: () => {},
+  }
+}
+
+function runSelfTestTargets() {
+  const primary = createFixture('primary')
+  const secondary = createFixture('secondary')
+  return {
+    targets: [
+      { id: 'fixture-primary', root: primary.dir },
+      { id: 'fixture-secondary', root: secondary.dir },
+    ],
+    cleanup: () => {
+      fs.rmSync(primary.dir, { recursive: true, force: true })
+      fs.rmSync(secondary.dir, { recursive: true, force: true })
+    },
+  }
+}
+
+function buildReport() {
+  const configured = runConfiguredTargets()
+  const targetSet = configured ?? runSelfTestTargets()
+  try {
+    const reports = targetSet.targets.map(auditTarget)
+    const checks = reports.flatMap((report) => report.checks)
+    const hardFailures = checks.filter((item) => item.status === 'failed')
+    const warnings = checks.filter((item) => item.status === 'warning')
+    const passed = checks.filter((item) => item.status === 'passed').length
+    const failed = hardFailures.length
+    const warningCount = warnings.length
+    const status = failed > 0 || (strictWarnings && warningCount > 0) ? 'failed' : warningCount > 0 ? 'warning' : 'passed'
+    return {
+      root,
+      generatedAt: new Date().toISOString(),
+      summary: {
+        status,
+        mode: configured ? 'configured-targets' : 'self-test',
+        passed,
+        warnings: warningCount,
+        failed,
+        hardFailures: failed,
+        total: checks.length,
+        targets: reports.length,
+      },
+      workflows: {
+        targetHardeningDrills: status === 'failed' ? 'failed' : 'verified',
+        closeGateHardening: hardFailures.length === 0 ? 'verified' : 'failed',
+        hostCapabilityBoundaries: hardFailures.length === 0 ? 'verified' : 'failed',
+        learningDriftCoverage: hardFailures.length === 0 ? 'verified' : 'failed',
+      },
+      targets: reports,
+      checks,
+      limits: [
+        'Target hardening drills are read-only for target projects.',
+        'They run GSE doctor, /gse continue, close gate, host capability audit, and learning drift audit.',
+        'Warnings mean the project can continue only if the current slice accepts that residual risk; hard failures must be fixed before close.',
+        'This drill does not run product tests, browser smokes, CI, or native host slash-command invocation.',
+      ],
+    }
+  } finally {
+    targetSet.cleanup()
+  }
+}
+
+function renderMarkdown(report) {
+  const lines = []
+  lines.push('# GSE Target Hardening Drills')
+  lines.push('')
+  lines.push('Generated: ' + report.generatedAt)
+  lines.push('Root: ' + report.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + report.summary.status)
+  lines.push('- Mode: ' + report.summary.mode)
+  lines.push('- Targets: ' + report.summary.targets)
+  lines.push('- Checks: ' + report.summary.passed + ' passed, ' + report.summary.warnings + ' warnings, ' + report.summary.hardFailures + ' hard failures, ' + report.summary.total + ' total')
+  lines.push('')
+  lines.push('## Targets')
+  lines.push('')
+  for (const target of report.targets) {
+    lines.push('- ' + target.id + ': ' + target.status + ' at ' + target.root)
+  }
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of report.checks) {
+    const marker = item.status === 'passed' ? '[x]' : item.status === 'warning' ? '[!]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of report.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+const report = buildReport()
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (report.summary.status === 'failed') process.exit(1)

package/scripts/audit-tool-fallback-policy.mjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(target, relativePath) {
+  return fs.existsSync(path.join(target, relativePath))
+}
+
+function check(id, label, ok, evidence, severity = 'hard', recommendation = '') {
+  return {
+    id,
+    label,
+    status: ok ? 'passed' : severity === 'soft' ? 'warning' : 'failed',
+    severity,
+    evidence,
+    recommendation,
+  }
+}
+
+function includesAll(text, phrases) {
+  const normalized = text.toLowerCase()
+  return phrases.every((phrase) => normalized.includes(phrase.toLowerCase()))
+}
+
+export function auditToolFallbackPolicy(target) {
+  const resolvedTarget = path.resolve(target)
+  const toolAdapters = readText(path.join(root, 'references', 'tool-adapters.md'))
+  const router = readText(path.join(root, 'references', 'router.md'))
+  const modelRouting = readText(path.join(root, 'references', 'model-routing.md'))
+  const hostAdapters = readText(path.join(root, 'references', 'host-adapters.md'))
+  const compatibility = readText(path.join(root, 'references', 'compatibility.md'))
+  const designBasis = readText(path.join(root, 'references', 'design-basis.md'))
+  const projectProfile = readText(path.join(root, 'references', 'project-profile.md'))
+  const initProject = readText(path.join(root, 'scripts', 'init-project.mjs'))
+  const updateProjectState = readText(path.join(root, 'scripts', 'update-project-state.mjs'))
+  const generateCommandAdapter = readText(path.join(root, 'scripts', 'generate-command-adapter.mjs'))
+  const generateContinuePacket = readText(path.join(root, 'scripts', 'generate-continue-packet.mjs'))
+
+  const checks = [
+    check(
+      'TFP01',
+      'tool adapters keep optional tools non-blocking and portable',
+      includesAll(toolAdapters, [
+        'few hard requirements',
+        'tools enhance the workflow when available',
+        'use markdown fallback when optional tools are unavailable',
+      ]),
+      'references/tool-adapters.md',
+      'hard',
+      'Keep markdown fallback available when a tool is missing.',
+    ),
+    check(
+      'TFP02',
+      'router keeps optional tools on the markdown fallback path',
+      includesAll(router, [
+        'use markdown fallback when optional tools are unavailable',
+        'do not treat optional tools as hard prerequisites',
+      ]),
+      'references/router.md',
+      'hard',
+      'Route around missing tools instead of blocking the slice.',
+    ),
+    check(
+      'TFP03',
+      'model routing preserves a portable fallback path',
+      includesAll(modelRouting, [
+        'preserve a portable fallback path',
+        'fallback policy',
+      ]),
+      'references/model-routing.md',
+      'hard',
+      'Keep provider and tool fallback policy in project profile docs.',
+    ),
+    check(
+      'TFP04',
+      'host adapters keep .gse as the source of truth and unknown capability claims explicit',
+      includesAll(hostAdapters, [
+        '.gse/` is the portable source of truth',
+        'host-specific folders are adapters',
+        'document it as `unknown`',
+      ]),
+      'references/host-adapters.md',
+      'hard',
+      'Keep host/tool capability claims evidence-gated in the portable layer.',
+    ),
+    check(
+      'TFP05',
+      'project profile records fallback policy and model/tool ids',
+      includesAll(projectProfile, [
+        'model routing',
+        'fallback policy',
+        'model/tool ids',
+      ]),
+      'references/project-profile.md',
+      'hard',
+      'Keep the project-approved fallback path visible in profile docs.',
+    ),
+    check(
+      'TFP06',
+      'generated command adapters keep unsupported host claims unknown until evidence exists',
+      includesAll(generateCommandAdapter, [
+        'unknown until',
+        'current host records evidence',
+        'skill/text-command pointer',
+      ]),
+      'scripts/generate-command-adapter.mjs',
+      'hard',
+      'Do not let generated adapters become runtime proof.',
+    ),
+    check(
+      'TFP07',
+      'project bootstrap and state update keep commands and host tools unknown until verified',
+      includesAll(initProject, ['project commands and host tools are unknown until verified in this repository']) &&
+        includesAll(updateProjectState, ['project-specific tool statuses remain unknown until verified']),
+      'scripts/init-project.mjs and scripts/update-project-state.mjs',
+      'hard',
+      'Leave capability status unknown until the project records it.',
+    ),
+    check(
+      'TFP08',
+      'continue packet surfaces fallback policy as a compact preflight concern',
+      includesAll(generateContinuePacket, [
+        'toolfallbackpolicy',
+        'host capabilities',
+        'optional tools',
+      ]),
+      'scripts/generate-continue-packet.mjs',
+      'soft',
+      'Expose the fallback policy in /gse continue so future sessions can see the boundary.',
+    ),
+  ]
+
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: {
+      status: failed === 0 ? 'passed' : 'failed',
+      passed,
+      failed,
+      total: checks.length,
+    },
+    workflows: {
+      optionalToolFallbackPolicy: failed === 0 ? 'verified' : 'failed',
+    },
+    checks,
+    limits: [
+      'This audit verifies portable fallback policy and claim boundaries.',
+      'It does not prove actual browser, MCP, LSP, subagent, or CI availability.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const report = auditToolFallbackPolicy(targetArg ?? root)
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}

package/scripts/audit-ui-browser-evidence-policy.mjs

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { analyzeEvidenceLevels } from './audit-evidence-levels.mjs'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const target = path.resolve(targetArg || root)
+const jsonOnly = args.includes('--json')
+
+function read(relativePath, base = root) {
+  const fullPath = path.join(base, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function readJsonl(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, records: [], error: 'missing' }
+  const lines = fs.readFileSync(filePath, 'utf8')
+    .replace(/^\uFEFF/, '')
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+  const records = []
+  for (const [index, line] of lines.entries()) {
+    try {
+      records.push(JSON.parse(line))
+    } catch (error) {
+      return { exists: true, ok: false, records, error: `line ${index + 1}: ${error.message}` }
+    }
+  }
+  return { exists: true, ok: true, records, error: '' }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-ui-evidence-policy-'))
+  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+  const records = [
+    {
+      date: '2026-07-09',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'verified-component',
+      requiredEvidenceLevel: 'verified-browser',
+      summary: 'Component-only proof for visible UI behavior.',
+      evidenceFile: '.gse/evidence/2026-07-09.md',
+      commands: ['pnpm test component'],
+      nextAction: 'Run browser smoke before release.',
+    },
+    {
+      date: '2026-07-09',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'verified-browser',
+      requiredEvidenceLevel: 'verified-browser',
+      summary: 'Browser-backed proof for visible UI behavior.',
+      evidenceFile: '.gse/evidence/2026-07-09.md',
+      commands: ['pnpm smoke browser', 'playwright screenshot'],
+      nextAction: 'Close slice.',
+    },
+  ]
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', 'index.jsonl'), records.map((record) => JSON.stringify(record)).join('\n') + '\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-09.md'), '# Evidence\n', 'utf8')
+  return dir
+}
+
+const qualityGates = read('references/quality-gates.md')
+const taxonomy = read('references/evidence-taxonomy.md')
+const template = read('assets/templates/evidence.md')
+const continuePacket = read('scripts/generate-continue-packet.mjs')
+const closeGate = read('scripts/audit-close-gate.mjs')
+const validationProfile = read('scripts/run-validation-profile.mjs')
+const validator = read('scripts/validate-gse.mjs')
+const roadmap = read('references/final-form-roadmap.md')
+const fixture = createFixture()
+const fixtureAnalysis = analyzeEvidenceLevels(readJsonl(path.join(fixture, '.gse', 'evidence', 'index.jsonl')).records)
+const targetEvidence = readJsonl(path.join(target, '.gse', 'evidence', 'index.jsonl'))
+const targetAnalysis = analyzeEvidenceLevels(targetEvidence.records)
+
+const checks = [
+  check(
+    'UIE01',
+    'quality gates distinguish component proof from browser proof',
+    qualityGates.includes('verified-component') &&
+      qualityGates.includes('verified-browser') &&
+      qualityGates.includes('Do not describe `verified-component` or `verified-api` as `verified-browser`') &&
+      qualityGates.includes('Screenshot or visual inspection for layout-sensitive work'),
+    'references/quality-gates.md',
+  ),
+  check(
+    'UIE02',
+    'evidence taxonomy defines browser proof and downgrade examples',
+    taxonomy.includes('A UI component test can be `status: verified` with `evidenceLevel: verified-component`') &&
+      taxonomy.includes('A Playwright smoke can be `status: verified` with `evidenceLevel: verified-browser`') &&
+      taxonomy.includes('requiredEvidenceLevel'),
+    'references/evidence-taxonomy.md',
+  ),
+  check(
+    'UIE03',
+    'evidence template requires status, level, and required level',
+    template.includes('Evidence status') &&
+      template.includes('Evidence level') &&
+      template.includes('Required evidence level'),
+    'assets/templates/evidence.md',
+  ),
+  check(
+    'UIE04',
+    'continue preflight exposes evidence level downgrades before implementation',
+    continuePacket.includes('evidenceLevels') &&
+      continuePacket.includes('downgraded') &&
+      continuePacket.includes('verified-component') &&
+      continuePacket.includes('verified-browser'),
+    'scripts/generate-continue-packet.mjs',
+  ),
+  check(
+    'UIE05',
+    'close gate surfaces evidence downgrade before close',
+    closeGate.includes('CG09') &&
+      closeGate.includes('evidence level') &&
+      closeGate.includes('downgrade'),
+    'scripts/audit-close-gate.mjs',
+  ),
+  check(
+    'UIE06',
+    'fixture labels component proof downgrade from required browser proof',
+    fixtureAnalysis.downgraded.length === 1 &&
+      fixtureAnalysis.downgraded[0]?.evidenceLevel === 'verified-component' &&
+      fixtureAnalysis.downgraded[0]?.requiredEvidenceLevel === 'verified-browser',
+    `${fixtureAnalysis.downgraded.length} downgrade(s)`,
+  ),
+  check(
+    'UIE07',
+    'target evidence has no invalid evidence levels',
+    targetEvidence.ok && targetAnalysis.invalidLevel.length === 0,
+    targetEvidence.ok ? `${targetAnalysis.invalidLevel.length} invalid level(s), ${targetAnalysis.downgraded.length} downgrade(s)` : targetEvidence.error,
+  ),
+  check(
+    'UIE08',
+    'validation profiles include UI/browser evidence policy audit',
+    validationProfile.includes('audit-ui-browser-evidence-policy.mjs') &&
+      validator.includes('audit-ui-browser-evidence-policy.mjs'),
+    'scripts/run-validation-profile.mjs + scripts/validate-gse.mjs',
+  ),
+  check(
+    'UIE09',
+    'final-form roadmap tracks browser UI evidence policy as Wave 4 capability',
+    roadmap.includes('Done: Browser/UI evidence policy') &&
+      roadmap.includes('verified-component') &&
+      roadmap.includes('verified-browser'),
+    'references/final-form-roadmap.md',
+  ),
+]
+
+fs.rmSync(fixture, { recursive: true, force: true })
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  target,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    uiBrowserEvidencePolicy: failed === 0 ? 'verified' : 'failed',
+    targetDowngrades: targetAnalysis.downgraded.length,
+    targetInvalidLevels: targetAnalysis.invalidLevel.length,
+  },
+  checks,
+  limits: [
+    'This audit verifies UI/browser evidence policy and gate wiring.',
+    'It does not run a real browser, Playwright, screenshot, or visual inspection.',
+    'Only a project-specific browser/screenshot smoke can justify evidenceLevel verified-browser for visible UI behavior.',
+  ],
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(JSON.stringify(report, null, 2))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-validation-profiles.mjs

@@ -48,8 +48,10 @@ const runnerSource = read('scripts/run-validation-profile.mjs')
 const skill = read('SKILL.md')
 const commands = read('references/commands.md')
 const qualityGates = read('references/quality-gates.md')
-const lite = run(['--root', root, '--target', root, '--profile', 'lite', '--json'])
-const standard = run(['--root', root, '--target', root, '--profile', 'standard', '--json'])
+const lite = run(['--root', root, '--target', root, '--profile', 'lite', '--json'])
+const standard = run(['--root', root, '--target', root, '--profile', 'standard', '--json'])
+const liteScripts = new Set((lite.parsed?.results ?? []).map((item) => item.script))
+const standardScripts = new Set((standard.parsed?.results ?? []).map((item) => item.script))
 const releaseProfileScripts = [
   'audit-command-execution.mjs',
   'audit-npm-package-metadata.mjs',
@@ -67,8 +69,8 @@ const releaseProfileScripts = [
 const checks = [
   check('VP01', 'validation profile runner exists', fs.existsSync(path.join(root, 'scripts', 'run-validation-profile.mjs')), 'scripts/run-validation-profile.mjs'),
   check('VP02', 'runner defines lite, standard, enterprise, and release profiles', ['lite', 'standard', 'enterprise', 'release'].every((item) => runnerSource.includes(`'${item}'`)), 'profile names'),
-  check('VP03', 'lite profile avoids release/distribution heavy gates', lite.status === 0 && lite.parsed?.summary?.status === 'passed' && !lite.stdout.includes('audit-distribution.mjs') && !lite.stdout.includes('audit-release-bundle.mjs'), 'lite profile output'),
-  check('VP04', 'standard profile passes without forcing close gate during in-progress work', standard.status === 0 && standard.parsed?.summary?.status === 'passed' && !standard.stdout.includes('audit-close-gate.mjs') && !standard.stdout.includes('audit-distribution.mjs'), 'standard profile output'),
+  check('VP03', 'lite profile avoids release/distribution heavy gates', lite.status === 0 && lite.parsed?.summary?.status === 'passed' && !liteScripts.has('audit-distribution.mjs') && !liteScripts.has('audit-release-bundle.mjs'), 'lite profile output'),
+  check('VP04', 'standard profile passes without forcing close gate during in-progress work', standard.status === 0 && standard.parsed?.summary?.status === 'passed' && !standardScripts.has('audit-close-gate.mjs') && !standardScripts.has('audit-distribution.mjs'), 'standard profile output'),
   check('VP05', 'quality gates document full validation as enterprise/release-grade work', qualityGates.includes('Full validation belongs here, not on every small product slice') && qualityGates.includes('Use the lightest gate profile'), 'references/quality-gates.md'),
   check('VP06', 'skill exposes validation profile runner', skill.includes('run-validation-profile.mjs'), 'SKILL.md'),
   check('VP07', 'command docs expose profile-based verify', commands.includes('/gse verify --profile lite') && commands.includes('run-validation-profile.mjs'), 'references/commands.md'),