@t275005746/gse 0.1.1 → 0.1.2

package/scripts/audit-final-form-roadmap.mjs

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const jsonOnly = args.includes('--json')
+
+function read(relativePath) {
+  const fullPath = path.join(root, relativePath)
+  return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function exists(relativePath) {
+  return fs.existsSync(path.join(root, relativePath))
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+const roadmap = read('references/final-form-roadmap.md')
+const masterPlan = read('.gse/gse-design-master-plan.md')
+const goalMap = read('.gse/goal-map.md')
+const currentSlice = read('.gse/current-slice.md')
+const stateRaw = read('.gse/state.json')
+const evidenceIndexRaw = read('.gse/evidence/index.jsonl')
+const skill = read('SKILL.md')
+
+let state = null
+try {
+  state = JSON.parse(stateRaw)
+} catch {
+  state = null
+}
+
+let evidenceRecords = []
+try {
+  evidenceRecords = evidenceIndexRaw
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => JSON.parse(line))
+} catch {
+  evidenceRecords = []
+}
+
+const latestEvidence = evidenceRecords.at(-1)
+const stateHasCurrentEvidence =
+  state?.phase === 'final-form' &&
+  typeof state?.currentSlice?.id === 'string' &&
+  state.currentSlice.id.startsWith('GSE-') &&
+  typeof state?.currentSlice?.nextAction === 'string' &&
+  typeof state?.lastEvidence === 'string' &&
+  state.lastEvidence.startsWith('.gse/evidence/') &&
+  exists(state.lastEvidence) &&
+  latestEvidence?.evidenceFile === state.lastEvidence &&
+  latestEvidence?.nextAction === state.currentSlice.nextAction
+
+const priorities = Array.from({ length: 11 }, (_, index) => `P${index}`)
+const roadmapHasPriorities = priorities.every((item) => roadmap.includes(`| ${item} |`))
+const requiredTerms = [
+  '/gse continue',
+  'Completion Definition',
+  'Short entry takeover',
+  'State system',
+  'Evidence gate',
+  'Spec and change lifecycle',
+  'Roles and subagents',
+  'Learning automation',
+  'Final Form Execution Plan',
+  'Current Final-Form Gap List',
+  'Goal Mode Operating Contract',
+  'Claim Boundary',
+]
+
+const executionWaveTerms = [
+  'Wave 1 - Short Entry And State Control',
+  'Wave 2 - Spec, Role, And Execution Discipline',
+  'Wave 3 - Learning To Guard Promotion',
+  'Wave 4 - Tool And Host Runtime Adapters',
+  'Wave 5 - Distribution, Public Trust, And Maintenance',
+]
+
+const checks = [
+  check('FFR01', 'final form roadmap exists', exists('references/final-form-roadmap.md'), 'references/final-form-roadmap.md'),
+  check('FFR02', 'roadmap covers P0 through P10', roadmapHasPriorities, priorities.join(', ')),
+  check('FFR03', 'roadmap contains required final-form concepts', requiredTerms.every((term) => roadmap.includes(term)), requiredTerms.join(', ')),
+  check('FFR04', 'master plan points to the final-form roadmap', masterPlan.includes('references/final-form-roadmap.md') && masterPlan.includes('Final Form Roadmap'), '.gse/gse-design-master-plan.md'),
+  check('FFR05', 'goal map has an active final-form roadmap contract node', goalMap.includes('GSE-109') && goalMap.includes('final-form roadmap contract') && goalMap.includes('references/final-form-roadmap.md'), '.gse/goal-map.md'),
+  check('FFR06', 'current slice continues from the final-form roadmap', currentSlice.includes('references/final-form-roadmap.md') && currentSlice.includes('final-form') && currentSlice.includes('Next Action'), '.gse/current-slice.md'),
+  check('FFR07', 'state points to a current final-form execution slice and current evidence', stateHasCurrentEvidence, '.gse/state.json + .gse/evidence/index.jsonl'),
+  check('FFR08', 'skill reference routing includes final-form roadmap', skill.includes('references/final-form-roadmap.md'), 'SKILL.md'),
+  check('FFR09', 'roadmap contains ordered final-form execution waves', executionWaveTerms.every((term) => roadmap.includes(term)), executionWaveTerms.join(', ')),
+  check('FFR10', 'roadmap separates current gaps from optional adapter claims', roadmap.includes('Current Final-Form Gap List') && roadmap.includes('host-native slash-command evidence is optional per host adapter') && roadmap.includes('no AION/MuseFlow-specific behavior is hardcoded'), 'references/final-form-roadmap.md'),
+  check(
+    'FFR11',
+    'roadmap preserves process-skill versus host-capability boundary',
+    roadmap.includes('OpenSpec-style and Superpowers-style workflows define requirements') &&
+      roadmap.includes('They do not provide native slash commands') &&
+      roadmap.includes('Process skills such as OpenSpec, Superpowers, Comet, and GSE provide workflow discipline') &&
+      roadmap.includes('they do not satisfy host-native slash-command, subagent, browser, MCP, LSP, CI, or host UI evidence rows'),
+    'references/final-form-roadmap.md',
+  ),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  generatedAt: new Date().toISOString(),
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: { finalFormRoadmap: failed === 0 ? 'verified' : 'failed' },
+  limits: [
+    'This audit verifies the final-form roadmap contract and routing.',
+    'It does not prove every final-form capability is complete.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Final Form Roadmap Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Final form roadmap: ' + data.workflows.finalFormRoadmap)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+if (failed > 0) process.exit(1)

package/scripts/audit-final-form-stale-copy.mjs

@@ -145,7 +145,7 @@ const bundleReleaseStatus = jsonFile('.gse/release-bundles/gse-release-bundle-au
 const bundleOwnerKit = jsonFile('.gse/release-bundles/gse-release-bundle-audit/owner-external-gate-kit/kit-manifest.json')
 
 const artifactPendingSets = [
-  ['final progress', (finalProgress?.blockers ?? []).map((gate) => gate.area).sort()],
+  ['final progress', (finalProgress?.pendingReleaseEvidence ?? []).map((gate) => gate.area).sort()],
   ['release status', (releaseStatus?.publicAcceptance?.pendingGates ?? []).map((gate) => gate.area).sort()],
   ['owner kit', (ownerKit?.gates ?? []).map((gate) => gate.area).sort()],
   ['bundle release status', (bundleReleaseStatus?.publicAcceptance?.pendingGates ?? []).map((gate) => gate.area).sort()],
@@ -159,7 +159,7 @@ const pathMatches = localPathMatches()
 
 const checks = [
   check('FFSC01', 'live final readiness resolves the MIT license decision', finalReadiness.status === 0 && licenseVerified && publicReleaseRecord.includes('License status: selected') && publicReleaseRecord.includes('SPDX identifier: MIT') && publicReleaseRecord.includes('Evidence status: accepted'), 'audit-final-readiness.mjs, .gse/releases/public-release-owner-required.md'),
-  check('FFSC02', 'live public acceptance pending gates are current non-license gates', publicAcceptance.status === 0 && pendingAreas.length > 0 && sameList(pendingAreas, expectedPendingAreas) && !pendingAreas.includes('License decision'), pendingAreas.join(', ')),
+  check('FFSC02', 'live public acceptance pending gates are current non-license gates', publicAcceptance.status === 0 && sameList(pendingAreas, expectedPendingAreas) && !pendingAreas.includes('License decision') && (pendingAreas.length > 0 || publicAcceptanceData?.summary?.publicAccepted === 'verified'), pendingAreas.join(', ')),
   check('FFSC03', 'current control and handoff docs do not describe resolved license decision as pending', matches.length === 0, matches.length ? matches.join('; ') : currentFiles.join(', ')),
   check('FFSC04', 'canonical and bundled artifacts expose the same current pending gates', artifactPendingSets.every(([, areas]) => sameList(areas, expectedPendingAreas)), artifactPendingSets.map(([name, areas]) => `${name}: ${areas.join(', ')}`).join(' | ')),
   check('FFSC05', 'public release record accepted license wording is not contradictory', publicReleaseRecord.includes('Owner license decision accepted') && !publicReleaseRecord.includes('Owner license decision and validation evidence required'), '.gse/releases/public-release-owner-required.md'),

package/scripts/audit-final-readiness.mjs

@@ -144,14 +144,14 @@ const matrix = [
   { area: 'Marketplace approval', status: acceptedMarketplaceApprovalRecord ? 'verified' : 'external-required', evidence: acceptedMarketplaceApprovalRecord ? relative(acceptedMarketplaceApprovalRecord.filePath) : 'references/marketplace-discovery.md' },
   { area: 'Portable command execution', status: exists('scripts/audit-command-execution.mjs') && exists('scripts/run-gse-command.mjs') ? 'verified' : 'missing', evidence: 'run-gse-command and audit-command-execution' },
   { area: 'Host adapters', status: exists('scripts/generate-command-adapter.mjs') && exists('scripts/audit-command-adapters.mjs') ? 'verified' : 'missing', evidence: 'command adapter generator and audit' },
-  { area: 'Native slash command', status: nativeHostRecords.length > 0 ? 'verified' : 'external-required', evidence: nativeHostRecords.length > 0 ? nativeHostRecords.map(relative).join(', ') : `${nativeHostRecords.length} native host record(s)` },
+  { area: 'Native slash command', status: nativeHostRecords.length > 0 ? 'verified' : 'not-claimed', evidence: nativeHostRecords.length > 0 ? nativeHostRecords.map(relative).join(', ') : 'optional host-native adapter claim; GSE core uses portable command execution' },
   { area: 'Other host runtime invocation', status: otherHostRuntimeRecords.length > 0 ? 'verified' : 'external-required', evidence: otherHostRuntimeRecords.length > 0 ? otherHostRuntimeRecords.map(relative).join(', ') : `${closeableHostRecords.length} verified/accepted host record(s), ${portableHostRecords.length} portable text record(s)` },
 ]
 
 const allowedStatuses = new Set(['verified', 'owner-required', 'external-required', 'not-claimed'])
 const matrixStatusesHonest = matrix.every((item) => allowedStatuses.has(item.status))
 const verifiedRowsHaveEvidence = matrix.filter((item) => item.status === 'verified').every((item) => item.evidence && item.evidence !== '0')
-const publicAccepted = matrix.every((item) => item.status === 'verified')
+const publicAccepted = matrix.every((item) => item.status === 'verified' || item.status === 'not-claimed')
 const ownerAndExternalRowsRemainExplicit = publicAccepted || matrix.some((item) => item.status === 'owner-required' || item.status === 'external-required')
 const finalReadinessUsesStatusSourceBoundary = finalReadiness.includes('Status source / baseline') &&
   finalReadiness.includes('current truth is computed by `scripts/audit-final-readiness.mjs`') &&
@@ -184,7 +184,7 @@ const report = {
   limits: [
     'This audit verifies that GSE has an honest final-readiness matrix.',
     'It may pass while owner-required or external-required rows remain incomplete.',
-    'It does not publish to a registry, approve a marketplace listing, choose a license, or prove native slash-command support.',
+    'It does not prove native slash-command support; that remains a per-host optional adapter claim.',
   ],
   checks,
 }

package/scripts/audit-fresh-session-readiness.mjs

@@ -97,7 +97,7 @@ const probePacket = probePacketLines.join('\n') + '\n'
 const checks = [
   check('FS01', 'required startup inputs exist', requiredInputs.every(exists), requiredInputs.join(', ')),
   check('FS02', 'SKILL routes GSE changes through control and validation', skill.includes('references/router.md') && skill.includes('scripts/validate-gse.mjs') && skill.includes('references/forward-test.md'), 'SKILL.md'),
-  check('FS03', 'master plan preserves fresh-session boundary after owner acceptance', masterPlan.includes('owner-approved AION project-write acceptance is executed') && (masterPlan.includes('fresh-session acceptance remains optional future confidence evidence') || masterPlan.includes('Marketplace discovery, public key custody, and cross-host native command execution remain final-form work') || masterPlan.includes('Marketplace discovery and real host UI invocation remain final-form work') || masterPlan.includes('Public marketplace approval, public registry publication, other host runtime invocation records, and host-native slash-command execution remain final-form work') || masterPlan.includes('Remaining final-form work is host-native slash-command support with real host runtime evidence.')), '.gse/gse-design-master-plan.md'),
+  check('FS03', 'master plan preserves fresh-session boundary after owner acceptance', masterPlan.includes('owner-approved AION project-write acceptance is executed') && (masterPlan.includes('fresh-session acceptance remains optional future confidence evidence') || masterPlan.includes('Marketplace discovery, public key custody, and cross-host native command execution remain final-form work') || masterPlan.includes('Marketplace discovery and real host UI invocation remain final-form work') || masterPlan.includes('Public marketplace approval, public registry publication, other host runtime invocation records, and host-native slash-command execution remain final-form work') || masterPlan.includes('Remaining final-form work is host-native slash-command support with real host runtime evidence.') || masterPlan.includes('The Final Form Roadmap now lives in `references/final-form-roadmap.md`')), '.gse/gse-design-master-plan.md'),
   check('FS04', 'goal map exposes active slice and next action without hidden history', goalMap.includes('- Active slice:') && goalMap.includes('- Next action:') && goalMap.includes('scripts/audit-fresh-session-readiness.mjs'), '.gse/goal-map.md'),
   check('FS05', 'current slice has required GSE fields', Boolean(outcome && scope && acceptance && evidence && nextAction), 'Outcome, Scope, Acceptance, Evidence or Evidence Plan, Next Action'),
   check('FS06', 'probe packet explicitly avoids false acceptance', probePacket.includes('Do not claim accepted unless a separate session actually ran the path or an explicit policy accepts it.'), 'generated probe packet'),

package/scripts/audit-host-capabilities.mjs

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+const requiredCapabilities = ['native-slash-command', 'browser', 'mcp', 'lsp', 'subagent', 'ci']
+const allowedStatuses = new Set(['verified', 'documented', 'unknown', 'unavailable', 'external-required'])
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function parseCapabilityTable(text) {
+  const rows = []
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('|')) continue
+    if (/^\|\s*-+/.test(trimmed)) continue
+    if (/^\|\s*Capability\s*\|/i.test(trimmed)) continue
+    const cells = trimmed
+      .slice(1, trimmed.endsWith('|') ? -1 : undefined)
+      .split('|')
+      .map((cell) => cell.trim())
+    if (cells.length < 6) continue
+    rows.push({
+      capability: cells[0].toLowerCase(),
+      hostOrTool: cells[1],
+      status: cells[2],
+      evidence: cells[3],
+      claimBoundary: cells[4],
+      lastChecked: cells[5],
+    })
+  }
+  return rows
+}
+
+function hasConcreteEvidence(value) {
+  const normalized = String(value || '').trim().toLowerCase()
+  return Boolean(normalized && !['-', 'n/a', 'none', 'unknown', 'tbd', 'todo'].includes(normalized))
+}
+
+export function readHostCapabilities(target) {
+  const filePath = path.join(target, '.gse', 'host-capabilities.md')
+  const exists = fs.existsSync(filePath)
+  const text = exists ? readText(filePath) : ''
+  const capabilities = parseCapabilityTable(text)
+  const byCapability = new Map(capabilities.map((item) => [item.capability, item]))
+  const missingRequired = requiredCapabilities.filter((capability) => !byCapability.has(capability))
+  const invalidStatus = capabilities.filter((item) => !allowedStatuses.has(item.status))
+  const missingEvidenceForVerified = capabilities.filter((item) => item.status === 'verified' && !hasConcreteEvidence(item.evidence))
+  const nativeSlash = byCapability.get('native-slash-command') ?? null
+  const nativeSlashOverclaim =
+    nativeSlash?.status === 'verified' &&
+    (
+      !/native/i.test(nativeSlash.evidence) ||
+      /portable|text-command|run-gse-command|generate-continue-packet/i.test(nativeSlash.evidence)
+    )
+  const documentedWithoutBoundary = capabilities.filter((item) =>
+    ['documented', 'external-required'].includes(item.status) && !hasConcreteEvidence(item.claimBoundary),
+  )
+  const status = !exists
+    ? 'warning'
+    : capabilities.length === 0 ||
+      missingRequired.length > 0 ||
+      invalidStatus.length > 0 ||
+      missingEvidenceForVerified.length > 0 ||
+      nativeSlashOverclaim ||
+      documentedWithoutBoundary.length > 0
+      ? 'failed'
+      : 'passed'
+  return {
+    path: '.gse/host-capabilities.md',
+    exists,
+    status,
+    capabilities,
+    summary: {
+      requiredCapabilities,
+      total: capabilities.length,
+      verified: capabilities.filter((item) => item.status === 'verified').map((item) => item.capability),
+      documented: capabilities.filter((item) => item.status === 'documented').map((item) => item.capability),
+      unknown: capabilities.filter((item) => item.status === 'unknown').map((item) => item.capability),
+      unavailable: capabilities.filter((item) => item.status === 'unavailable').map((item) => item.capability),
+      externalRequired: capabilities.filter((item) => item.status === 'external-required').map((item) => item.capability),
+      missingRequired,
+      invalidStatus: invalidStatus.map((item) => item.capability),
+      missingEvidenceForVerified: missingEvidenceForVerified.map((item) => item.capability),
+      nativeSlashOverclaim: nativeSlashOverclaim ? ['native-slash-command'] : [],
+      documentedWithoutBoundary: documentedWithoutBoundary.map((item) => item.capability),
+    },
+  }
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [process.execPath, path.join(root, 'scripts', script), ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function createFixture(content) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-capabilities-'))
+  const init = run('init-project.mjs', ['--target', dir, '--mode', 'enterprise', '--json'])
+  if (content) {
+    fs.writeFileSync(path.join(dir, '.gse', 'host-capabilities.md'), content.trimStart().replace(/\n/g, '\r\n'), 'utf8')
+  }
+  return { dir, init }
+}
+
+function audit(target) {
+  const resolvedTarget = path.resolve(target)
+  const hostCapabilities = readHostCapabilities(resolvedTarget)
+  const hostAdapters = readText(path.join(root, 'references', 'host-adapters.md'))
+  const toolAdapters = readText(path.join(root, 'references', 'tool-adapters.md'))
+  const qualityGates = readText(path.join(root, 'references', 'quality-gates.md'))
+  const initProject = readText(path.join(root, 'scripts', 'init-project.mjs'))
+  const continuePacket = readText(path.join(root, 'scripts', 'generate-continue-packet.mjs'))
+  const validationProfile = readText(path.join(root, 'scripts', 'run-validation-profile.mjs'))
+  const validator = readText(path.join(root, 'scripts', 'validate-gse.mjs'))
+  const checks = [
+    check('HC01', 'host capability record is present or reported as warning', hostCapabilities.exists || hostCapabilities.status === 'warning', hostCapabilities.exists ? hostCapabilities.path : 'missing host capability record warning'),
+    check('HC02', 'capability table covers required capability rows when present', !hostCapabilities.exists || hostCapabilities.summary.missingRequired.length === 0, hostCapabilities.summary.missingRequired.join(', ') || 'required capabilities present'),
+    check('HC03', 'capability statuses use allowed vocabulary', !hostCapabilities.exists || hostCapabilities.summary.invalidStatus.length === 0, hostCapabilities.summary.invalidStatus.join(', ') || Array.from(allowedStatuses).join(', ')),
+    check('HC04', 'verified capabilities include concrete evidence', !hostCapabilities.exists || hostCapabilities.summary.missingEvidenceForVerified.length === 0, hostCapabilities.summary.missingEvidenceForVerified.join(', ') || 'verified rows have evidence'),
+    check('HC05', 'native slash-command is not verified from portable command evidence', !hostCapabilities.exists || hostCapabilities.summary.nativeSlashOverclaim.length === 0, hostCapabilities.summary.nativeSlashOverclaim.join(', ') || 'native slash-command boundary preserved'),
+    check('HC06', 'documented and external-required rows include claim boundaries', !hostCapabilities.exists || hostCapabilities.summary.documentedWithoutBoundary.length === 0, hostCapabilities.summary.documentedWithoutBoundary.join(', ') || 'claim boundaries present'),
+    check('HC07', 'host/tool docs explain capability record and claim boundary', hostAdapters.includes('.gse/host-capabilities.md') && toolAdapters.includes('.gse/host-capabilities.md') && qualityGates.includes('host-capabilities'), 'references host/tool/quality docs'),
+    check('HC08', 'init-project scaffolds host capability records', initProject.includes('host-capabilities.md') && initProject.includes('native-slash-command') && initProject.includes('external-required'), 'scripts/init-project.mjs'),
+    check('HC09', 'continue packet surfaces host capability readiness', continuePacket.includes('readHostCapabilities') && continuePacket.includes('CP16') && continuePacket.includes('hostCapabilities'), 'scripts/generate-continue-packet.mjs'),
+    check('HC10', 'validation routes include host capability audit', validationProfile.includes('audit-host-capabilities.mjs') && validator.includes('audit-host-capabilities.mjs'), 'validation profile and validate-gse'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? hostCapabilities.status : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      hostCapabilityRecords: failed === 0 && hostCapabilities.status !== 'failed' ? 'verified' : 'failed',
+      nativeSlashCommandBoundary: failed === 0 ? 'verified' : 'failed',
+    },
+    hostCapabilities,
+    checks,
+    limits: [
+      'Host capability records prove local record/audit mechanics and recorded project facts.',
+      'They do not create native slash-command, browser, MCP, LSP, subagent, or CI capability.',
+      'Native slash-command support still requires real host runtime invocation evidence.',
+    ],
+  }
+}
+
+function selfTestReport() {
+  const valid = createFixture()
+  const invalid = createFixture([
+    '# Host Capabilities',
+    '',
+    '| Capability | Host/Tool | Status | Evidence | Claim Boundary | Last Checked |',
+    '|---|---|---|---|---|---|',
+    '| native-slash-command | Codex | verified | portable run-gse-command smoke | Claims native slash support | 2026-07-09 |',
+    '| browser | Playwright | verified | - | Browser smoke available | 2026-07-09 |',
+    '| mcp | MCP | maybe | - | Unknown | 2026-07-09 |',
+    '| lsp | LSP | unknown | - | Unknown | 2026-07-09 |',
+    '| subagent | Host dispatch | unknown | - | Unknown | 2026-07-09 |',
+    '| ci | GitHub Actions | documented | .github/workflows/validate-gse.yml | | 2026-07-09 |',
+    '',
+  ].join('\n'))
+  const missingDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-host-capabilities-missing-'))
+  fs.mkdirSync(path.join(missingDir, '.gse'), { recursive: true })
+  const validReport = audit(valid.dir)
+  const invalidReport = audit(invalid.dir)
+  const missingReport = audit(missingDir)
+  fs.rmSync(valid.dir, { recursive: true, force: true })
+  fs.rmSync(invalid.dir, { recursive: true, force: true })
+  fs.rmSync(missingDir, { recursive: true, force: true })
+  const checks = [
+    check('HCA01', 'init-project creates host capability record scaffold', valid.init.status === 0 && validReport.hostCapabilities.exists, 'scripts/init-project.mjs'),
+    check('HCA02', 'scaffold covers required capabilities', validReport.hostCapabilities.summary.missingRequired.length === 0, validReport.hostCapabilities.capabilities.map((item) => item.capability).join(', ')),
+    check('HCA03', 'missing host capability file is warning, not hard failure', missingReport.hostCapabilities.status === 'warning', 'missing fixture'),
+    check('HCA04', 'invalid status, missing verified evidence, missing boundary, and native overclaim fail', invalidReport.summary.status === 'failed' && invalidReport.hostCapabilities.summary.invalidStatus.includes('mcp') && invalidReport.hostCapabilities.summary.missingEvidenceForVerified.includes('browser') && invalidReport.hostCapabilities.summary.nativeSlashOverclaim.includes('native-slash-command') && invalidReport.hostCapabilities.summary.documentedWithoutBoundary.includes('ci'), 'invalid fixture'),
+    check('HCA05', 'audit source is wired to continue packet and validation scripts', validReport.checks.find((item) => item.id === 'HC09')?.status === 'passed' && validReport.checks.find((item) => item.id === 'HC10')?.status === 'passed', 'continue/validation wiring'),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    root,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+    workflows: {
+      hostCapabilityRecords: failed === 0 ? 'verified' : 'failed',
+      initProjectHostCapabilityScaffold: failed === 0 ? 'verified' : 'failed',
+      nativeSlashCommandBoundary: failed === 0 ? 'verified' : 'failed',
+    },
+    fixture: {
+      validStatus: validReport.hostCapabilities.status,
+      invalidStatus: invalidReport.hostCapabilities.status,
+      missingStatus: missingReport.hostCapabilities.status,
+    },
+    checks,
+    limits: [
+      'This self-test verifies scaffold, parsing, and claim-boundary mechanics.',
+      'It does not prove live host capabilities.',
+    ],
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const report = targetArg ? audit(targetArg) : selfTestReport()
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}