@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-workflow-job-naming.mjs.ejs

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+// <%= projectName %> — workflow job naming convention drift detector (INV-89)
+// Validates that all workflow jobs have explicit name: fields.
+// Exits 0 when all jobs have names; exits 1 when unnamed jobs are found.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-workflow-job-naming.mjs [options]',
+    '',
+    'Validates that all workflow jobs have explicit name: fields.',
+    'Exits 0 when all jobs have names; exits 1 when unnamed jobs are found.',
+    '',
+    'Options:',
+    '  --dir <path>    Root directory to scan (default: cwd)',
+    '  --help, -h      Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const dirArg = args.indexOf('--dir');
+const CWD = dirArg >= 0 && args[dirArg + 1] ? resolve(args[dirArg + 1]) : process.cwd();
+const JOB_ID_RE = /^  ([a-z][a-z0-9_-]*):\s*$/;
+const JOB_NAME_RE = /^    name:/;
+
+function collectYamlFiles(dir) {
+  if (!existsSync(dir)) return [];
+  const results = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectYamlFiles(full));
+    } else if (entry.isFile() && (entry.name.endsWith('.yml') || entry.name.endsWith('.yaml'))) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+
+const yamlFiles = collectYamlFiles(join(CWD, '.github', 'workflows'));
+let violations = 0;
+
+for (const file of yamlFiles) {
+  let content;
+  try {
+    content = readFileSync(file, 'utf-8');
+  } catch {
+    continue;
+  }
+  const lines = content.split('\n');
+  let inJobs = false;
+  let pendingJobId = null;
+  let pendingLineIdx = -1;
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.startsWith('jobs:')) { inJobs = true; continue; }
+    if (!inJobs) continue;
+    if (pendingJobId) {
+      if (JOB_NAME_RE.test(line)) {
+        pendingJobId = null;
+      } else if (line.startsWith('    runs-on:') || line.startsWith('    steps:') || line.startsWith('    needs:')) {
+        process.stderr.write(`[FAIL] job "${pendingJobId}" in ${file}:${pendingLineIdx + 1} has no name: field\n`);
+        violations++;
+        pendingJobId = null;
+      } else if (JOB_ID_RE.test(line)) {
+        process.stderr.write(`[FAIL] job "${pendingJobId}" in ${file}:${pendingLineIdx + 1} has no name: field\n`);
+        violations++;
+        const m = JOB_ID_RE.exec(line);
+        pendingJobId = m ? m[1] : null;
+        pendingLineIdx = i;
+      }
+    } else {
+      const m = JOB_ID_RE.exec(line);
+      if (m) { pendingJobId = m[1]; pendingLineIdx = i; }
+    }
+  }
+  if (pendingJobId) {
+    process.stderr.write(`[FAIL] job "${pendingJobId}" in ${file}:${pendingLineIdx + 1} has no name: field\n`);
+    violations++;
+  }
+}
+
+if (violations > 0) {
+  process.stderr.write(`check-workflow-job-naming: FAIL — ${violations} workflow job(s) missing name: field (INV-89)\n`);
+  process.exit(1);
+}
+process.stdout.write(
+  `check-workflow-job-naming: OK — all workflow jobs have name: fields (INV-89, ${yamlFiles.length} files scanned)\n`,
+);
+process.exit(0);

package/dist/templates/scripts/check-workflow-perms.mjs.ejs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+// <%= projectName %> — workflow top-level permissions gate (INV-76)
+// Gate: verify all .github/workflows/*.yml files declare top-level permissions.
+// Exits 0: all workflows pass.
+// Exits 1: one or more missing the top-level permissions declaration.
+// Part of the anti-drift validator family (W6).
+// Usage: node scripts/check-workflow-perms.mjs [--help]
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  process.stdout.write('Usage: node scripts/check-workflow-perms.mjs [--help]\nVerify all workflow files declare top-level permissions.\n');
+  process.exit(0);
+}
+
+const CWD = process.cwd();
+const WORKFLOWS_DIR = join(CWD, '.github', 'workflows');
+
+if (!existsSync(WORKFLOWS_DIR)) {
+  console.log('  check-workflow-perms: no .github/workflows directory — skipping');
+  process.exit(0);
+}
+
+const files = readdirSync(WORKFLOWS_DIR)
+  .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))
+  .map((f) => join(WORKFLOWS_DIR, f));
+
+// A top-level permissions block must exist AND must not be the broad 'write-all'
+// shortcut. Per-scope 'write' values are allowed (they are intentional and
+// auditable); 'write-all' is a hidden wildcard that defeats least-privilege.
+const violations = [];
+for (const file of files) {
+  const content = readFileSync(file, 'utf-8');
+  const topLevel = content.match(/^permissions:[ \t]*(.*)$/m);
+  if (!topLevel) {
+    violations.push({ file: file.replace(CWD + '/', ''), reason: 'missing top-level permissions' });
+    continue;
+  }
+  const inline = topLevel[1].trim();
+  if (inline === 'write-all') {
+    violations.push({ file: file.replace(CWD + '/', ''), reason: "top-level 'write-all' is forbidden" });
+  }
+}
+
+if (violations.length === 0) {
+  console.log('  check-workflow-perms: all workflows declare top-level permissions (not write-all)');
+  process.exit(0);
+}
+
+console.log(`  check-workflow-perms: ${violations.length} workflow(s) failed permission check:`);
+for (const v of violations) {
+  console.log(`    ${v.reason}: ${v.file}`);
+}
+process.exit(1);

package/dist/templates/scripts/check-workflow-runners.mjs.ejs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+// <%= projectName %> — workflow runner label drift detector (INV-89)
+// Validates that all workflow jobs use the expected runner label.
+// Enforcing: exits 1 on unexpected labels. Use --runner or the `${{ ... }}` /
+// `$CI_` expression forms for legitimate runner-label customization.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-workflow-runners.mjs [options]',
+    '',
+    'Validates that all workflow jobs use the expected runner label.',
+    'Enforcing: exits 1 on unexpected labels (runner customization via --runner',
+    'or ${{ ... }} / $CI_ expressions is allowed).',
+    '',
+    'Options:',
+    '  --dir <path>        Root directory to scan (default: cwd)',
+    '  --runner <label>    Expected runner label (default: ubuntu-latest)',
+    '  --help, -h          Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const dirArg = args.indexOf('--dir');
+const CWD = dirArg >= 0 && args[dirArg + 1] ? resolve(args[dirArg + 1]) : process.cwd();
+const runnerArg = args.indexOf('--runner');
+const EXPECTED_RUNNER = runnerArg >= 0 && args[runnerArg + 1] ? args[runnerArg + 1] : 'ubuntu-latest';
+const RUNS_ON_RE = /^\s*runs-on:\s+(.+)$/;
+
+function collectYamlFiles(dir) {
+  if (!existsSync(dir)) return [];
+  const results = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectYamlFiles(full));
+    } else if (entry.isFile() && (entry.name.endsWith('.yml') || entry.name.endsWith('.yaml'))) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+
+const yamlFiles = collectYamlFiles(join(CWD, '.github', 'workflows'));
+let violations = 0;
+
+for (const file of yamlFiles) {
+  let content;
+  try {
+    content = readFileSync(file, 'utf-8');
+  } catch {
+    continue;
+  }
+  for (const line of content.split('\n')) {
+    const m = RUNS_ON_RE.exec(line);
+    if (!m) continue;
+    const runner = m[1].trim().replace(/^['"]|['"]$/g, '');
+    if (runner.startsWith('${{') || runner.startsWith('$CI_')) continue;
+    if (runner !== EXPECTED_RUNNER) {
+      process.stderr.write(`[FAIL] unexpected runner: "${runner}" (expected "${EXPECTED_RUNNER}") in ${file}\n`);
+      violations++;
+    }
+  }
+}
+
+if (violations > 0) {
+  process.stdout.write(
+    `check-workflow-runners: FAIL — ${violations} job(s) use non-standard runner label (INV-89). ` +
+      `Use "${EXPECTED_RUNNER}", pass --runner <label>, or use a \${{ ... }}/$CI_ expression for runner customization.\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write(
+  `check-workflow-runners: OK — all jobs use expected runner "${EXPECTED_RUNNER}" (INV-89, ${yamlFiles.length} files scanned)\n`,
+);
+process.exit(0);

package/dist/templates/scripts/check-workflow-sha-pinning.mjs.ejs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+// <%= projectName %> — workflow SHA-pinning drift detector (INV-89)
+// Validates that all third-party GitHub Actions references in .github/ are SHA-pinned.
+// Exits 0 when all refs are SHA-pinned; exits 1 when tag/branch refs are found.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-workflow-sha-pinning.mjs [options]',
+    '',
+    'Validates that all GitHub Actions references in .github/ are SHA-pinned.',
+    'Exits 0 when all refs are SHA-pinned; exits 1 when tag/branch refs are found.',
+    '',
+    'Options:',
+    '  --dir <path>    Root directory to scan (default: cwd)',
+    '  --help, -h      Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const dirArg = args.indexOf('--dir');
+const CWD = dirArg >= 0 && args[dirArg + 1] ? resolve(args[dirArg + 1]) : process.cwd();
+const SHA_RE = /^[0-9a-f]{40}$/;
+const USES_RE = /^\s*(?:-\s+)?uses:\s+(?:"([^"]+)"|'([^']+)'|(\S+))/;
+
+function collectYamlFiles(dir) {
+  if (!existsSync(dir)) return [];
+  const results = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectYamlFiles(full));
+    } else if (entry.isFile() && (entry.name.endsWith('.yml') || entry.name.endsWith('.yaml'))) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+
+const yamlFiles = [
+  ...collectYamlFiles(join(CWD, '.github', 'workflows')),
+  ...collectYamlFiles(join(CWD, '.github', 'actions')),
+];
+
+let violations = 0;
+
+for (const file of yamlFiles) {
+  let content;
+  try {
+    content = readFileSync(file, 'utf-8');
+  } catch {
+    continue;
+  }
+  for (const line of content.split('\n')) {
+    const m = USES_RE.exec(line);
+    if (!m) continue;
+    const ref = m[1] ?? m[2] ?? m[3];
+    if (!ref || ref.startsWith('.')) continue;
+    const atIdx = ref.lastIndexOf('@');
+    if (atIdx < 0) continue;
+    const pin = ref.slice(atIdx + 1);
+    if (!SHA_RE.test(pin)) {
+      process.stderr.write(`[FAIL] non-SHA action reference: ${ref} in ${file}\n`);
+      violations++;
+    }
+  }
+}
+
+if (violations > 0) {
+  process.stderr.write(
+    `check-workflow-sha-pinning: FAIL — ${violations} non-SHA-pinned action reference(s) found (INV-89)\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write(
+  `check-workflow-sha-pinning: OK — all action references are SHA-pinned (INV-89, ${yamlFiles.length} files scanned)\n`,
+);
+process.exit(0);

package/dist/templates/scripts/check-workflow-test-integrity.mjs.ejs

@@ -0,0 +1,235 @@
+#!/usr/bin/env node
+// <%= projectName %> — workflow test integrity checker (INV-89)
+// Validates that workflow files do not have syntax issues or missing required fields.
+// Exits 0 when all workflows pass integrity checks; exits 1 when issues found.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-workflow-test-integrity.mjs [options]',
+    '',
+    'Validates workflow file integrity: required fields, non-empty jobs, no continue-on-error on test steps.',
+    'Exits 0 when all workflows pass; exits 1 when issues found.',
+    '',
+    'Options:',
+    '  --dir <path>    Root directory to scan (default: cwd)',
+    '  --help, -h      Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const dirArg = args.indexOf('--dir');
+const CWD = dirArg >= 0 && args[dirArg + 1] ? resolve(args[dirArg + 1]) : process.cwd();
+const WORKFLOWS_DIR = join(CWD, '.github', 'workflows');
+const INFORMATIONAL_PATTERNS = ['heartbeat', 'nightly', 'weekly', 'monthly'];
+
+// #1319.3 (INV-80): STEP-SCOPED allowlist. drift-shadow.yml is NOT a file-wide
+// informational workflow — only its `parity` step is permitted a continue-on-error
+// (the local/CI parity comparison must not fail the nightly run; a mismatch opens
+// a drift issue instead). Any OTHER continue-on-error step in drift-shadow.yml FAILS.
+const STEP_SCOPED_ALLOWLIST = {
+  'drift-shadow.yml': new Set(['parity']),
+  // These two steps upload SUPPLEMENTARY artifacts (JUnit output, the gate's
+  // own --json result) — never a test or build step itself. Both run AFTER
+  // the real signal (the test/gate run above) already succeeded or failed on
+  // its own terms; an Artifacts-quota hiccup on the upload must not
+  // retroactively fail a job whose actual work already completed correctly.
+  '01-pr-fast.yml': new Set(['upload-test-results', 'upload-gate-result']),
+};
+
+// #1491 — fake-green-via-`|| true`: a gate/test/check command whose exit code is swallowed by a
+// trailing `|| true` / `|| exit 0` / `|| :` turns a red gate green. Distinct from legitimate
+// `|| true` idioms (best-effort cleanup `find … -delete || true`, capture `LOG=$(git log … || true)`,
+// `grep … || true`, `cp … 2>/dev/null || true`) — so it flags `|| true` ONLY when the same line
+// invokes a recognized GATE command. Conservative: a false-negative (novel runner) beats a
+// false-positive on a cleanup idiom.
+const GATE_COMMAND_RE =
+  /\b(?:check-all(?:\.mjs)?|scripts\/check-[\w.-]+\.mjs|arbiter\s+(?:verify|gold-audit|anti-fake-green)|npm\s+(?:run\s+)?test|npm\s+run\s+(?:lint|gate|check[\w:-]*)|npx\s+(?:vitest|jest|eslint|tsc|playwright)\b|pnpm\s+(?:run\s+)?test|yarn\s+test|vitest\b|jest\b|pytest\b|cargo\s+(?:test|clippy)|go\s+test\b|(?:\.\/)?gradlew\s+\w*(?:test|check|verify)|mvn\s+\w*(?:test|verify))\b/;
+const EXIT_SWALLOW_RE = /\|\|\s*(?:true|exit\s+0|:)\s*(?:#.*)?$/;
+
+// Resolve the id: of the step enclosing line index `i` (step begins at an 8-space
+// `- ` list item). Returns the step's id:, or null when the step has no id.
+function enclosingStepId(lines, i) {
+  let stepId = null;
+  for (let j = i; j >= 0; j--) {
+    const line = lines[j];
+    const idMatch = /^\s{8,}id:\s*(\S+)/.exec(line);
+    if (idMatch && stepId === null) stepId = idMatch[1];
+    if (/^\s{6}-\s/.test(line)) return stepId;
+  }
+  return stepId;
+}
+
+// #2476 — a base-branch filter on a `pull_request` trigger is a fail-open BY NO-RUN.
+//
+// On a `pull_request` event, `branches:` filters the BASE branch, not the head. A
+// merge-gate workflow declaring `branches: [main]` therefore matches NOTHING for a
+// pull request based on a stacked (task/train) branch, and no workflow run is created
+// at all. That is worse than a red check: the pull request shows no FAILING checks
+// because it has no checks, so a "no failing checks ⇒ mergeable" read is satisfied by
+// a pull request that was never tested. Branch protection is no backstop — it is
+// configured on the BASE branch, and a stacked branch usually carries none.
+//
+// The rule: run creation must be unconditional in the base branch. Per-branch economy
+// belongs INSIDE the workflow, in a job-level `if:`, where a skipped job still reports
+// a result the aggregator can read. `branches-ignore` is rejected for the same reason:
+// it is an allowlist by omission.
+//
+// SCOPE — only a workflow carrying a MERGE-GATE AGGREGATOR job (a job id ending in
+// `-required`, the required-status-check convention arbiter emits). Those are the
+// workflows whose absence reads as "CI is green". Supplementary, path-scoped lanes
+// (CodeQL, a frontend lane, contract smoke tests) carry no aggregator and are exempt.
+//
+// Implementation note: the self copy parses the workflow with the `yaml` package.
+// This emitted twin is line-based on purpose — a generated project is not required to
+// carry `yaml` as a dependency, and a gate script must never fail on a missing import.
+// The rule enforced is identical.
+const PR_TRIGGER_RE = /^ {2}(pull_request|pull_request_target):/;
+const BASE_FILTER_RE = /^ {4}(branches|branches-ignore):/;
+const AGGREGATOR_JOB_RE = /^ {2}([\w-]*-required):/;
+const STRUCTURE_FREE_RE = /^\s*(?:#|$)/;
+
+/** True when the workflow declares a merge-gate aggregator job (`*-required`). */
+function hasMergeGateAggregator(lines) {
+  let inJobs = false;
+  for (const line of lines) {
+    if (STRUCTURE_FREE_RE.test(line)) continue;
+    if (/^["']?jobs["']?:/.test(line)) {
+      inJobs = true;
+      continue;
+    }
+    if (inJobs && /^\S/.test(line)) {
+      inJobs = false;
+      continue;
+    }
+    if (inJobs && AGGREGATOR_JOB_RE.test(line)) return true;
+  }
+  return false;
+}
+
+/** The structure-bearing lines inside the top-level `on:` block. */
+function onBlockLines(lines) {
+  const block = [];
+  let inOn = false;
+  for (const line of lines) {
+    if (STRUCTURE_FREE_RE.test(line)) continue;
+    if (/^["']?on["']?:/.test(line)) {
+      inOn = true;
+      continue;
+    }
+    if (!inOn) continue;
+    if (/^\S/.test(line)) break;
+    block.push(line);
+  }
+  return block;
+}
+
+/** Base-branch filter keys declared on a merge-gate workflow's pull_request trigger(s). */
+function prBaseBranchFilters(lines) {
+  if (!hasMergeGateAggregator(lines)) return [];
+  const found = [];
+  let event = null;
+  for (const line of onBlockLines(lines)) {
+    const trigger = PR_TRIGGER_RE.exec(line);
+    if (trigger) {
+      event = trigger[1];
+      continue;
+    }
+    if (/^ {2}\S/.test(line)) {
+      event = null;
+      continue;
+    }
+    const filter = event ? BASE_FILTER_RE.exec(line) : null;
+    if (filter) found.push(`${event}.${filter[1]}`);
+  }
+  return found;
+}
+
+function collectYamlFiles(dir) {
+  if (!existsSync(dir)) return [];
+  const results = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectYamlFiles(full));
+    } else if (entry.isFile() && (entry.name.endsWith('.yml') || entry.name.endsWith('.yaml'))) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+
+const yamlFiles = collectYamlFiles(WORKFLOWS_DIR);
+let violations = 0;
+
+for (const file of yamlFiles) {
+  let content;
+  try {
+    content = readFileSync(file, 'utf-8');
+  } catch {
+    continue;
+  }
+  const fileName = file.split('/').pop() ?? '';
+  const isInformational = INFORMATIONAL_PATTERNS.some((p) => fileName.includes(p));
+
+  if (!content.includes('\non:') && !content.startsWith('on:')) {
+    process.stderr.write(`[FAIL] ${file}: missing 'on:' trigger section\n`);
+    violations++;
+  }
+  if (!content.includes('\njobs:') && !content.startsWith('jobs:')) {
+    process.stderr.write(`[FAIL] ${file}: missing 'jobs:' section\n`);
+    violations++;
+  }
+  if (!isInformational) {
+    const allowedSteps = STEP_SCOPED_ALLOWLIST[fileName];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (/^\s{6,}continue-on-error:\s*true/.test(lines[i])) {
+        if (allowedSteps && allowedSteps.has(enclosingStepId(lines, i))) continue;
+        process.stderr.write(`[FAIL] ${file}:${i + 1}: step-level continue-on-error: true found (INV-80)\n`);
+        violations++;
+      }
+    }
+  }
+
+  // #2476: a merge-gate workflow that filters the pull_request BASE branch.
+  for (const key of prBaseBranchFilters(content.split('\n'))) {
+    process.stderr.write(
+      `[FAIL] ${file}: merge-gate workflow declares a base-branch filter '${key}' on its pull_request trigger — a pull request based on a stacked branch then creates NO RUN AT ALL and shows no failing checks because it has no checks (#2476). Remove the filter; gate per-branch economy with a job-level 'if:' instead.\n`,
+    );
+    violations++;
+  }
+
+  // #1491: a GATE command whose non-zero exit is swallowed by `|| true` / `|| exit 0` / `|| :`.
+  // Applies to ALL workflows — a gate must fail the run wherever it runs. GATE_COMMAND_RE is narrow
+  // so best-effort non-gate `|| true` (mutation/fuzz/dep-report) is not flagged.
+  {
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (EXIT_SWALLOW_RE.test(lines[i]) && GATE_COMMAND_RE.test(lines[i])) {
+        process.stderr.write(`[FAIL] ${file}:${i + 1}: gate command exit code swallowed by '|| true' (fake-green, #1491): ${lines[i].trim()}\n`);
+        violations++;
+      }
+    }
+  }
+}
+
+if (violations > 0) {
+  process.stderr.write(`check-workflow-test-integrity: FAIL — ${violations} integrity issue(s) in workflows (INV-89)\n`);
+  process.exit(1);
+}
+process.stdout.write(
+  `check-workflow-test-integrity: OK — all ${yamlFiles.length} workflow(s) pass integrity checks (INV-89)\n`,
+);
+process.exit(0);

package/dist/templates/scripts/checks/check-rust-no-unsafe.mjs.ejs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+// <%= projectName %> — Rust context-aware INV-04 checker: no `unsafe` blocks in production code.
+// Re-derived from a prior internal project's `scripts/checks/inv-04-no-unsafe.sh`; rewritten in Node for cross-platform
+// portability (Windows targets) per issue #360.
+//
+// Context-aware behavior:
+//   1. Scans every `.rs` file under `src/` recursively.
+//   2. Strips comment-only lines (lines whose first non-whitespace token is `//`).
+//   3. Ignores `forbid(unsafe_code)` lint declarations (these are the *opposite* of a violation).
+//   4. Fails (exit 1) if any remaining line contains the bare `unsafe` keyword.
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SRC_DIR = 'src';
+
+function listRustFiles(dir) {
+  const out = [];
+  let entries;
+  try { entries = readdirSync(dir); } catch { return out; }
+  for (const name of entries) {
+    const full = join(dir, name);
+    let s;
+    try { s = statSync(full); } catch { continue; }
+    if (s.isDirectory()) {
+      out.push(...listRustFiles(full));
+    } else if (s.isFile() && name.endsWith('.rs')) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+function isViolation(line) {
+  // Strip comment-only lines.
+  if (/^\s*\/\//.test(line)) return false;
+  // `forbid(unsafe_code)` (with or without `#![...]` shebang) is a *declaration of safety*.
+  if (/forbid\s*\(\s*unsafe_code\s*\)/.test(line)) return false;
+  if (/deny\s*\(\s*unsafe_code\s*\)/.test(line)) return false;
+  if (/allow\s*\(\s*unsafe_code\s*\)/.test(line)) return false;
+  // Word-boundary match for the bare `unsafe` keyword.
+  return /\bunsafe\b/.test(line);
+}
+
+const offenders = [];
+for (const file of listRustFiles(SRC_DIR)) {
+  let text;
+  try { text = readFileSync(file, 'utf-8'); } catch { continue; }
+  const lines = text.split(/\r?\n/);
+  if (lines.some(isViolation)) offenders.push(file);
+}
+
+if (offenders.length > 0) {
+  console.error('INV-04 (Rust): `unsafe` keyword found in production code:');
+  for (const f of offenders) console.error('  ' + f);
+  console.error('Prefer safe abstractions; `#![forbid(unsafe_code)]` keeps modules safe by default.');
+  process.exit(1);
+}
+console.log('Rust no-unsafe check passed.');