Module audit 

Public wire DTO for the readiness gap-report (ossctl audit).

The versioned surface the /oss-readiness skill wraps: ossctl audit scores a repo against the gated core (README + LICENSE + CI), the tier-scaled canon (recommended artifacts scaled to the facts’ maturity), the producer-existence obligations the contract declares (a fragment changelog needs its dir, a coverage/scorecard badge needs its CI producer, a registry target needs an SPDX license), and the GitHub community standards (gh api …/community/profile). It is read-only — nothing here nor in crate::audit ever writes the repo (ADR-0001 §3).

Consumers read this document under the CLI’s canonical data envelope: {schema_version, data: <this shape>, warnings} — the same envelope every ossctl --json command shares (crate::SCHEMA_VERSION versions that wire envelope). Like the facts report, the gap-report is derived, never authored, so it has no document version of its own; the envelope’s schema_version is the single version consumers gate on.

The report reuses Maturity from the canonical contract model rather than restating its wire strings: the audit and the contract must agree on "mvp" down to the byte, and sharing the one enum makes that agreement structural instead of coincidental.

The unknown discipline

Every check distinguishes checked-and-absent from could-not-check. Filesystem probes are always determinate (Presence::Present / Presence::Absent). A GitHub-API or registry lookup that fails yields Presence::Unknown, never Absent — an outage must never be read as “the artifact is missing” (issue: registry/GH-API failure ⇒ unknown, never false).

Structs

AuditReport

The readiness gap-report — a read-only score of the repo against the gated core, the tier-scaled canon, the contract’s producer obligations, and the GitHub community standards.

CommunityProfile

GitHub’s own community-standards view of the repo — the parsed gh api repos/<owner>/<repo>/community/profile files block.

Gap

One unmet readiness obligation — an artifact that is absent (or could not be checked) but is expected at this maturity tier (or required by the contract).

Enums

Category

Which scoring axis a gap comes from.

CoreStatus

Whether the tier-scaled gated core is complete.

Presence

Tri-state presence of one checked artifact.

Severity

How much a gap matters — its gating weight.