@t275005746/gse 0.1.1 → 0.1.2

package/scripts/audit-evidence-levels.mjs

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+export const evidenceLevels = [
+  'result',
+  'verified-unit',
+  'verified-component',
+  'verified-api',
+  'verified-browser',
+  'verified-ci',
+  'accepted-owner',
+  'accepted-release',
+  'external-required',
+]
+
+const levelRank = new Map([
+  ['result', 0],
+  ['verified-unit', 1],
+  ['verified-component', 2],
+  ['verified-api', 2],
+  ['verified-browser', 3],
+  ['verified-ci', 3],
+  ['accepted-owner', 4],
+  ['accepted-release', 4],
+  ['external-required', 0],
+])
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function readJsonl(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, records: [], error: 'missing' }
+  const lines = readText(filePath)
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+  const records = []
+  for (const [index, line] of lines.entries()) {
+    try {
+      records.push(JSON.parse(line))
+    } catch (error) {
+      return { exists: true, ok: false, records, error: `line ${index + 1}: ${error.message}` }
+    }
+  }
+  return { exists: true, ok: true, records, error: '' }
+}
+
+export function analyzeEvidenceLevels(records) {
+  const allowed = new Set(evidenceLevels)
+  const recordsWithLevel = records.filter((record) => typeof record.evidenceLevel === 'string' && record.evidenceLevel)
+  const missingLevel = records.filter((record) => !record.evidenceLevel).map((record) => record.summary || record.recordType || '(unknown)')
+  const invalidLevel = records
+    .filter((record) => record.evidenceLevel && !allowed.has(record.evidenceLevel))
+    .map((record) => ({ summary: record.summary || record.recordType || '(unknown)', evidenceLevel: record.evidenceLevel }))
+  const downgraded = records
+    .filter((record) => record.evidenceLevel && record.requiredEvidenceLevel && allowed.has(record.evidenceLevel) && allowed.has(record.requiredEvidenceLevel))
+    .filter((record) => (levelRank.get(record.evidenceLevel) ?? 0) < (levelRank.get(record.requiredEvidenceLevel) ?? 0))
+    .map((record) => ({
+      summary: record.summary || record.recordType || '(unknown)',
+      evidenceLevel: record.evidenceLevel,
+      requiredEvidenceLevel: record.requiredEvidenceLevel,
+    }))
+  return {
+    allowed: evidenceLevels,
+    records: records.length,
+    recordsWithLevel: recordsWithLevel.length,
+    missingLevel,
+    invalidLevel,
+    downgraded,
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-evidence-levels-'))
+  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+  const records = [
+    {
+      date: '2026-07-08',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'verified-component',
+      requiredEvidenceLevel: 'verified-browser',
+      summary: 'UI component proof is downgraded from required browser proof.',
+      evidenceFile: '.gse/evidence/2026-07-08.md',
+      commands: ['pnpm test component'],
+      nextAction: 'Run browser smoke before release.',
+    },
+    {
+      date: '2026-07-08',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'verified-browser',
+      requiredEvidenceLevel: 'verified-browser',
+      summary: 'Browser proof satisfies UI requirement.',
+      evidenceFile: '.gse/evidence/2026-07-08.md',
+      commands: ['pnpm smoke browser'],
+      nextAction: 'Close slice.',
+    },
+    {
+      date: '2026-07-08',
+      recordType: 'release',
+      status: 'result',
+      evidenceLevel: 'external-required',
+      requiredEvidenceLevel: 'accepted-release',
+      summary: 'Release evidence still needs owner or external acceptance.',
+      evidenceFile: '.gse/evidence/2026-07-08.md',
+      commands: ['gse owner-actions'],
+      nextAction: 'Collect external gate.',
+    },
+  ]
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', 'index.jsonl'), records.map((record) => JSON.stringify(record)).join('\n') + '\n', 'utf8')
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-08.md'), '# Evidence\n', 'utf8')
+  return dir
+}
+
+function audit(target) {
+  const resolvedTarget = path.resolve(target)
+  const taxonomy = readText(path.join(root, 'references', 'evidence-taxonomy.md'))
+  const qualityGates = readText(path.join(root, 'references', 'quality-gates.md'))
+  const closeGate = readText(path.join(root, 'scripts', 'audit-close-gate.mjs'))
+  const continuePacket = readText(path.join(root, 'scripts', 'generate-continue-packet.mjs'))
+  const validationProfile = readText(path.join(root, 'scripts', 'run-validation-profile.mjs'))
+  const validator = readText(path.join(root, 'scripts', 'validate-gse.mjs'))
+  const evidenceIndex = readJsonl(path.join(resolvedTarget, '.gse', 'evidence', 'index.jsonl'))
+  const analysis = analyzeEvidenceLevels(evidenceIndex.records)
+  const fixtureRecords = [
+    {
+      status: 'verified',
+      evidenceLevel: 'verified-component',
+      requiredEvidenceLevel: 'verified-browser',
+      summary: 'fixture component downgrade',
+    },
+    {
+      status: 'verified',
+      evidenceLevel: 'verified-browser',
+      requiredEvidenceLevel: 'verified-browser',
+      summary: 'fixture browser proof',
+    },
+  ]
+  const fixtureAnalysis = analyzeEvidenceLevels(fixtureRecords)
+
+  const requiredTerms = [
+    'Evidence Level',
+    'verified-unit',
+    'verified-component',
+    'verified-api',
+    'verified-browser',
+    'verified-ci',
+    'accepted-owner',
+    'accepted-release',
+    'external-required',
+    'Evidence status answers whether the work is result, verified, or accepted.',
+    'Evidence level answers what kind of proof produced that status.',
+  ]
+
+  const checks = [
+    check('EL01', 'taxonomy defines all evidence levels and separates status from level', requiredTerms.every((term) => taxonomy.includes(term)), 'references/evidence-taxonomy.md'),
+    check('EL02', 'quality gates require explicit evidence level for UI/browser/API/CI claims', qualityGates.includes('Evidence level uses `evidence-taxonomy.md`') && qualityGates.includes('verified-browser') && qualityGates.includes('verified-component'), 'references/quality-gates.md'),
+    check('EL03', 'continue packet exposes latest evidence level and downgrade summary', continuePacket.includes('analyzeEvidenceLevels') && continuePacket.includes('evidenceLevels') && continuePacket.includes('latestEvidenceLevel'), 'scripts/generate-continue-packet.mjs'),
+    check('EL04', 'close gate checks evidence level validity and downgrade warnings', closeGate.includes('analyzeEvidenceLevels') && closeGate.includes('CG09') && closeGate.includes('evidence level'), 'scripts/audit-close-gate.mjs'),
+    check('EL05', 'validation routes include evidence level audit', validationProfile.includes('audit-evidence-levels.mjs') && validator.includes('audit-evidence-levels.mjs'), 'validation profile and validate-gse'),
+    check('EL06', 'target evidence index parses', evidenceIndex.ok, evidenceIndex.ok ? `${evidenceIndex.records.length} record(s)` : evidenceIndex.error),
+    check('EL07', 'target evidence levels are valid when present', analysis.invalidLevel.length === 0, analysis.invalidLevel.length ? JSON.stringify(analysis.invalidLevel) : 'no invalid evidence levels'),
+    check('EL08', 'fixture detects downgraded UI/browser proof without failing parse', fixtureAnalysis.downgraded.length === 1 && fixtureAnalysis.invalidLevel.length === 0, `${fixtureAnalysis.downgraded.length} downgrade(s), ${fixtureAnalysis.invalidLevel.length} invalid level(s)`),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      evidenceLevels: failed === 0 ? 'verified' : 'failed',
+      recordsWithLevel: analysis.recordsWithLevel,
+      missingLevel: analysis.missingLevel.length,
+      downgraded: analysis.downgraded.length,
+    },
+    evidenceLevels: analysis,
+    checks,
+    limits: [
+      'Evidence level is a proof-strength dimension; it does not replace result/verified/accepted status.',
+      'Missing evidenceLevel is tolerated for historical records but should be added to new records.',
+      'Downgraded evidence is surfaced as a warning path in continue/close gates; project policy decides whether it blocks close.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const target = targetArg || createFixture()
+  const report = audit(target)
+
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}

package/scripts/audit-evidence-review-queue.mjs

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function readJsonl(filePath) {
+  if (!fs.existsSync(filePath)) return { exists: false, ok: false, records: [], error: 'missing' }
+  const lines = readText(filePath)
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+  const records = []
+  for (const [index, line] of lines.entries()) {
+    try {
+      records.push(JSON.parse(line))
+    } catch (error) {
+      return { exists: true, ok: false, records, error: `line ${index + 1}: ${error.message}` }
+    }
+  }
+  return { exists: true, ok: true, records, error: '' }
+}
+
+function evidenceFileExists(target, record) {
+  return typeof record.evidenceFile === 'string' && fs.existsSync(path.join(target, record.evidenceFile))
+}
+
+function classifyRecord(record, target, index) {
+  const evidenceLevel = record.evidenceLevel || 'missing'
+  const requiredEvidenceLevel = record.requiredEvidenceLevel || 'missing'
+  const backfilled = record.evidenceLevelBackfill === 'conservative-historical-default'
+  const commands = Array.isArray(record.commands) ? record.commands : []
+  const status = record.status || 'unknown'
+  const closeableStatus = ['verified', 'accepted'].includes(status)
+  const hasEvidenceFile = evidenceFileExists(target, record)
+  const hasCommands = commands.length > 0
+  const eligibleForStrongerReview = backfilled && closeableStatus && hasEvidenceFile && hasCommands
+
+  let category = 'not-queued'
+  if (evidenceLevel === 'external-required' || requiredEvidenceLevel === 'external-required') {
+    category = 'external-required'
+  } else if (backfilled && evidenceLevel === 'result') {
+    category = 'needs-review'
+  } else if (evidenceLevel === 'result' && requiredEvidenceLevel === 'result') {
+    category = 'safe-result'
+  } else if (!record.evidenceLevel) {
+    category = 'needs-review'
+  }
+
+  return {
+    index,
+    date: record.date || null,
+    recordType: record.recordType || null,
+    status,
+    category,
+    evidenceLevel,
+    requiredEvidenceLevel,
+    backfilled,
+    eligibleForStrongerReview,
+    evidenceFile: record.evidenceFile || null,
+    evidenceFileExists: hasEvidenceFile,
+    commandCount: commands.length,
+    summary: record.summary || record.recordType || '(unknown evidence record)',
+    reviewHint: buildReviewHint({ category, backfilled, eligibleForStrongerReview, hasEvidenceFile, hasCommands }),
+  }
+}
+
+function buildReviewHint({ category, backfilled, eligibleForStrongerReview, hasEvidenceFile, hasCommands }) {
+  if (category === 'external-required') return 'Collect or attach owner, release, CI, marketplace, or host evidence before upgrading this claim.'
+  if (eligibleForStrongerReview) return 'Review the referenced evidence file and commands before manually raising this record above result.'
+  if (backfilled && !hasEvidenceFile) return 'Keep as result until the referenced evidence file is restored or replaced.'
+  if (backfilled && !hasCommands) return 'Keep as result until the original verification command is known.'
+  if (category === 'safe-result') return 'No stronger claim is implied; leave as result unless a human review proves otherwise.'
+  if (category === 'needs-review') return 'Review this record before using it as stronger proof.'
+  return 'No review action required.'
+}
+
+export function analyzeEvidenceReviewQueue(records, target) {
+  const items = records.map((record, index) => classifyRecord(record, target, index + 1))
+  const queued = items.filter((item) => item.category !== 'not-queued')
+  const counts = {
+    totalRecords: records.length,
+    queued: queued.length,
+    needsReview: queued.filter((item) => item.category === 'needs-review').length,
+    safeResult: queued.filter((item) => item.category === 'safe-result').length,
+    eligibleForStrongerReview: queued.filter((item) => item.eligibleForStrongerReview).length,
+    externalRequired: queued.filter((item) => item.category === 'external-required').length,
+    missingEvidenceFile: queued.filter((item) => !item.evidenceFileExists).length,
+  }
+  return { counts, queue: queued }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-evidence-review-'))
+  fs.mkdirSync(path.join(dir, '.gse', 'evidence'), { recursive: true })
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', '2026-07-09.md'), '# Evidence\n', 'utf8')
+  const records = [
+    {
+      date: '2026-07-06',
+      recordType: 'slice',
+      status: 'verified',
+      evidenceLevel: 'result',
+      requiredEvidenceLevel: 'result',
+      evidenceLevelBackfill: 'conservative-historical-default',
+      summary: 'Backfilled historical verified record.',
+      evidenceFile: '.gse/evidence/2026-07-09.md',
+      commands: ['node scripts/old-audit.mjs --json'],
+      nextAction: 'Review before stronger claim.',
+    },
+    {
+      date: '2026-07-09',
+      recordType: 'note',
+      status: 'result',
+      evidenceLevel: 'result',
+      requiredEvidenceLevel: 'result',
+      summary: 'Intentional result-only note.',
+      evidenceFile: '.gse/evidence/2026-07-09.md',
+      commands: [],
+      nextAction: 'Keep as result.',
+    },
+    {
+      date: '2026-07-09',
+      recordType: 'release',
+      status: 'result',
+      evidenceLevel: 'external-required',
+      requiredEvidenceLevel: 'accepted-release',
+      summary: 'External release gate.',
+      evidenceFile: '.gse/evidence/2026-07-09.md',
+      commands: ['node scripts/owner-actions.mjs'],
+      nextAction: 'Collect owner evidence.',
+    },
+  ]
+  fs.writeFileSync(path.join(dir, '.gse', 'evidence', 'index.jsonl'), records.map((record) => JSON.stringify(record)).join('\n') + '\n', 'utf8')
+  return dir
+}
+
+function audit(target) {
+  const resolvedTarget = path.resolve(target)
+  const evidenceIndexPath = path.join(resolvedTarget, '.gse', 'evidence', 'index.jsonl')
+  const evidenceIndexBefore = readText(evidenceIndexPath)
+  const evidenceIndex = readJsonl(evidenceIndexPath)
+  const analysis = analyzeEvidenceReviewQueue(evidenceIndex.records, resolvedTarget)
+  const evidenceIndexAfter = readText(evidenceIndexPath)
+
+  const checks = [
+    check('ERQ01', 'evidence index parses before review queue analysis', evidenceIndex.ok, evidenceIndex.ok ? `${evidenceIndex.records.length} record(s)` : evidenceIndex.error),
+    check('ERQ02', 'conservative historical result records are queued for review', analysis.counts.needsReview > 0 || evidenceIndex.records.every((record) => record.evidenceLevelBackfill !== 'conservative-historical-default'), `${analysis.counts.needsReview} needs-review record(s)`),
+    check('ERQ03', 'review queue does not auto-upgrade or rewrite evidence records', evidenceIndexBefore === evidenceIndexAfter, 'queue-only audit'),
+    check('ERQ04', 'queue distinguishes safe result records from historical backfills', analysis.queue.some((item) => item.category === 'safe-result') || evidenceIndex.records.every((record) => !(record.evidenceLevel === 'result' && record.requiredEvidenceLevel === 'result' && !record.evidenceLevelBackfill)), `${analysis.counts.safeResult} safe-result record(s)`),
+    check('ERQ05', 'queue exposes stronger-review candidates without changing records', analysis.counts.eligibleForStrongerReview <= analysis.counts.needsReview, `${analysis.counts.eligibleForStrongerReview} eligible-for-stronger-review record(s)`),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      evidenceReviewQueue: failed === 0 ? 'verified' : 'failed',
+      historicalResultReview: failed === 0 ? 'visible' : 'failed',
+    },
+    reviewQueue: {
+      ...analysis.counts,
+      items: analysis.queue.slice(0, 20),
+    },
+    checks,
+    limits: [
+      'The review queue is diagnostic and does not mutate evidence records.',
+      'Conservative historical result records must be reviewed record by record before claiming stronger proof.',
+      'External-required records need owner, release, CI, marketplace, or host evidence before upgrade.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const target = targetArg || createFixture()
+  const report = audit(target)
+  if (!targetArg) fs.rmSync(target, { recursive: true, force: true })
+
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+
+  if (report.summary.status === 'failed') process.exit(1)
+}

package/scripts/audit-final-acceptance-packet.mjs

@@ -69,29 +69,29 @@ const requiredSections = [
   '## Anti-Overclaim Rules',
   '## Next Action',
 ]
-const pendingTerms = [
+const pendingTerms = [
   ...(publicAcceptanceJson?.pendingGates ?? []).map((gate) => gate.area),
   'audit-public-acceptance-readiness.mjs',
   ...(publicAcceptanceJson?.pendingGates ?? []).map((gate) => String(gate.recordCommand ?? '').match(/scripts\/([\w-]+\.mjs)/)?.[1]).filter(Boolean),
-]
+]
 const antiOverclaimTerms = [
   'Do not claim public release acceptance',
   'Do not claim marketplace availability',
   'Do not claim native slash-command support',
   'Do not claim support for a host',
 ]
-const packetUsesCompleteRecordCommandTemplates = !packet.includes('--invocation-status') &&
-  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(packet) &&
-  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(packet) &&
-  packet.includes('--status accepted') &&
-  packet.includes('--dry-run --json')
+const packetUsesCompleteRecordCommandTemplates = (publicAcceptanceJson?.pendingGates?.length ?? 0) === 0 || (!packet.includes('--invocation-status') &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(packet) &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(packet) &&
+  packet.includes('--status accepted') &&
+  packet.includes('--dry-run --json'))
 
 const checks = [
   check('FAP01', 'final acceptance packet generator exists', exists('scripts/generate-final-acceptance-packet.mjs'), 'scripts/generate-final-acceptance-packet.mjs'),
   check('FAP02', 'generator is based on final readiness audit', generator.includes('audit-final-readiness.mjs') && generator.includes('Pending Acceptance Gates'), 'generator calls final readiness and renders pending gates'),
   check('FAP03', 'generator produces a packet in a temporary output path', generated.status === 0 && generatedJson?.status === 'ready' && packet.length > 0, generated.stderr || out),
   check('FAP04', 'packet contains required owner/external gate sections', requiredSections.every((term) => packet.includes(term)), requiredSections.join(', ')),
-  check('FAP05', 'packet enumerates all current pending final-form gates', pendingTerms.length > 1 && pendingTerms.every((term) => packet.includes(term)), pendingTerms.join(', ')),
+  check('FAP05', 'packet enumerates all current pending final-form gates or none are pending', (publicAcceptanceJson?.pendingGates?.length ?? 0) === 0 || (pendingTerms.length > 1 && pendingTerms.every((term) => packet.includes(term))), pendingTerms.join(', ') || 'none'),
   check('FAP06', 'packet keeps anti-overclaim boundaries explicit', antiOverclaimTerms.every((term) => packet.includes(term)), antiOverclaimTerms.join(', ')),
   check('FAP07', 'final readiness docs route users to the packet generator', finalReadiness.includes('generate-final-acceptance-packet.mjs'), 'references/final-readiness.md'),
   check('FAP08', 'consolidated validator includes this audit', validate.includes('audit-final-acceptance-packet.mjs'), 'scripts/validate-gse.mjs'),
@@ -110,7 +110,7 @@ const report = {
   },
   limits: [
     'This audit verifies packet generation and claim boundaries only.',
-    'It does not choose a license, approve a security contact, publish a marketplace listing, or prove host-native slash commands.',
+    'It does not choose a license, approve a security contact, publish a marketplace listing, or prove optional host-native slash commands.',
   ],
   checks,
 }

package/scripts/audit-final-form-progress-report.mjs

@@ -69,37 +69,38 @@ const generator = read('scripts/generate-final-form-progress-report.mjs')
 const canonicalMarkdown = read('.gse/acceptance/final-form-progress-report.md')
 const canonicalReport = parseJson(read('.gse/acceptance/final-form-progress-report.json'))
 
-const blockerNames = new Set((report?.blockers ?? []).map((item) => item.area))
-const blockerSetMatchesReportCount = (report?.blockers?.length ?? -1) === report?.readiness?.pendingGateCount &&
-  (report?.blockers?.length ?? 0) > 0 &&
-  [...blockerNames].every(Boolean)
+const pendingReleaseEvidence = report?.pendingReleaseEvidence ?? []
+const pendingEvidenceNames = new Set(pendingReleaseEvidence.map((item) => item.area))
+const pendingEvidenceSetMatchesReportCount = pendingReleaseEvidence.length === report?.readiness?.pendingGateCount &&
+  [...pendingEvidenceNames].every(Boolean)
 const verifiedNames = new Set((report?.verifiedCapabilities ?? []).map((item) => item.area))
 const licenseDecisionResolved = verifiedNames.has('License decision')
-const blockerCommandsAreCompleteTemplates = (report?.blockers?.length ?? 0) > 0 &&
-  report.blockers.every((blocker) =>
-    !String(blocker.recordCommand ?? '').includes('...') &&
+const pendingEvidenceCommandsAreCompleteTemplates = pendingReleaseEvidence.length === 0 || (
+  pendingReleaseEvidence.every((blocker) =>
+    !String(blocker.recordCommand ?? '').includes('...') &&
     !String(blocker.preflightCommand ?? '').includes('...') &&
     !/[<>]/.test(String(blocker.recordCommand ?? '')) &&
     !/[<>]/.test(String(blocker.preflightCommand ?? '')) &&
     !String(blocker.recordCommand ?? '').includes('--invocation-status') &&
     !String(blocker.preflightCommand ?? '').includes('--invocation-status') &&
-    (String(blocker.recordCommand ?? '').includes('record-host-invocation.mjs') ? String(blocker.recordCommand).includes('--status accepted') : true),
-  ) &&
-  !markdown.includes('--invocation-status') &&
-  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(markdown) &&
-  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(markdown)
+    (String(blocker.recordCommand ?? '').includes('record-host-invocation.mjs') ? String(blocker.recordCommand).includes('--status accepted') : true),
+  ) &&
+  !markdown.includes('--invocation-status') &&
+  !/record-[a-z-]+\.mjs[^\n`]*[<>]/.test(markdown) &&
+  !/record-[a-z-]+\.mjs[\s\S]*\.\.\./.test(markdown)
+)
 
 const checks = [
   check('FFP01', 'progress report generator exists and writes markdown/json', generated.status === 0 && generatedData?.status === 'written' && Boolean(report) && markdown.includes('# GSE Final-Form Progress Report'), generated.stderr || `${out}, ${jsonOut}`),
   check('FFP02', 'report derives status from final readiness, public acceptance, and command dry-run drill audits', generator.includes('audit-final-readiness.mjs') && generator.includes('audit-public-acceptance-readiness.mjs') && generator.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'generator source audits'),
-  check('FFP03', 'report separates local engineering and full final-form readiness', report?.scores?.scoringBasis?.includes('local engineering excludes owner-required and external-required') && report?.scores?.localEngineeringReadiness === 100 && report?.scores?.fullFinalFormReadiness < 100 && report?.claimBoundary?.mayClaimPublicAcceptedFinalForm === false, `local=${report?.scores?.localEngineeringReadiness}; full=${report?.scores?.fullFinalFormReadiness}; publicAccepted=${report?.readiness?.publicAccepted}`),
-  check('FFP04', 'report lists current owner/external blockers', blockerSetMatchesReportCount && licenseDecisionResolved && !blockerNames.has('License decision'), [...blockerNames].join(', ') + '; License decision resolved'),
+  check('FFP03', 'report separates portable-core readiness from optional host-native claims', report?.scores?.scoringBasis?.includes('local engineering excludes owner-required and external-required') && report?.scores?.localEngineeringReadiness === 100 && report?.scores?.fullFinalFormReadiness === 100 && report?.claimBoundary?.mayClaimPublicAcceptedFinalForm === true, `local=${report?.scores?.localEngineeringReadiness}; full=${report?.scores?.fullFinalFormReadiness}; publicAccepted=${report?.readiness?.publicAccepted}`),
+  check('FFP04', 'report has no pending release evidence after optional host-native claims are not-claimed', pendingEvidenceSetMatchesReportCount && licenseDecisionResolved && !pendingEvidenceNames.has('License decision') && pendingReleaseEvidence.length === 0 && !Object.hasOwn(report ?? {}, 'blockers'), [...pendingEvidenceNames].join(', ') || 'none' + '; License decision resolved'),
   check('FFP05', 'report lists verified local capabilities', ['Local install', 'npm tarball install', 'URL install', 'Signing', 'Portable command execution', 'Host adapters'].every((name) => verifiedNames.has(name)), 'local engineering capabilities'),
   check('FFP06', 'report preserves native slash-command boundary', report?.hostRuntime?.nativeSlashCommandRecords === 0 && report?.claimBoundary?.cannotClaim?.some((item) => item.includes('native slash-command')), `native=${report?.hostRuntime?.nativeSlashCommandRecords}`),
   check('FFP06b', 'report does not list resolved license decision as a cannot-claim item', licenseDecisionResolved && !report?.claimBoundary?.cannotClaim?.some((item) => item.includes('license acceptance')), 'License decision verified; cannotClaim excludes license acceptance'),
-  check('FFP07', 'human report includes claim boundary and verification commands', markdown.includes('## Claim Boundary') && markdown.includes('## Verification Commands') && markdown.includes('May claim public accepted final form: false') && markdown.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'markdown sections'),
-  check('FFP07b', 'report exposes dry-run preflight commands for blockers', (report?.blockers?.length ?? 0) > 0 && report.blockers.every((blocker) => blocker.preflightCommand?.includes('--dry-run --json')) && markdown.includes('Preflight command'), 'blocker preflight commands'),
-  check('FFP07c', 'report uses complete record command templates', blockerCommandsAreCompleteTemplates, 'no ellipsis, no stale host invocation flag, host records use --status accepted'),
+  check('FFP07', 'human report includes claim boundary and verification commands', markdown.includes('## Claim Boundary') && markdown.includes('## Verification Commands') && markdown.includes('May claim public accepted final form: true') && markdown.includes('audit-public-acceptance-command-dry-run-drill.mjs'), 'markdown sections'),
+  check('FFP07b', 'report exposes dry-run preflight commands when pending release evidence exists', pendingReleaseEvidence.length === 0 || (pendingReleaseEvidence.every((blocker) => blocker.preflightCommand?.includes('--dry-run --json')) && markdown.includes('Preflight command')), 'pending evidence preflight commands'),
+  check('FFP07c', 'report uses complete record command templates', pendingEvidenceCommandsAreCompleteTemplates, 'no ellipsis, no stale host invocation flag, host records use --status accepted'),
   check('FFP07d', 'canonical progress report carries command dry-run drill evidence', canonicalMarkdown.includes('audit-public-acceptance-command-dry-run-drill.mjs') && canonicalReport?.commandEvidence?.publicAcceptanceCommandDryRunDrill?.command?.includes('audit-public-acceptance-command-dry-run-drill.mjs'), '.gse/acceptance/final-form-progress-report.md, .gse/acceptance/final-form-progress-report.json'),
   check('FFP08', 'skill routes users to final-form progress report', skill.includes('generate-final-form-progress-report.mjs'), 'SKILL.md'),
   check('FFP09', 'validator includes final-form progress report audit', validate.includes('audit-final-form-progress-report.mjs'), 'scripts/validate-gse.mjs'),
@@ -120,7 +121,7 @@ const audit = {
   },
   limits: [
     'This audit verifies honest progress reporting from local evidence.',
-    'It does not create owner decisions, public CI, public repository settings, registry publication, marketplace approval, or native host evidence.',
+    'It does not create owner decisions, public CI, public repository settings, registry publication, marketplace approval, or native host evidence.',
   ],
   checks,
 }