@getarbiter/cli 0.5.0

package/dist/templates/scripts/checks/check-rust-no-unwrap.mjs.ejs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+// <%= projectName %> — Rust context-aware INV-04 checker: no .unwrap()/.expect(...) in production code.
+// Re-derived from a prior internal project's `scripts/checks/inv-20-no-unwrap.sh` awk pipeline; rewritten in Node for
+// cross-platform portability (Windows targets) per issue #360.
+//
+// Context-aware behavior (mirrors the awk reference):
+//   1. Scans every `.rs` file under `src/` recursively.
+//   2. Skips `lib.rs` — it is a re-export entrypoint, not behavioral code.
+//   3. For each remaining file, takes only the slice BEFORE the first `#[cfg(test)]` line
+//      (production code only — `mod tests { ... }` is excluded).
+//   4. Strips comment-only lines (lines whose first non-whitespace token is `//`).
+//   5. Fails (exit 1) if any remaining line contains `.unwrap()` or `.expect(`.
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, basename } from 'node:path';
+
+const SRC_DIR = 'src';
+
+function listRustFiles(dir) {
+  const out = [];
+  let entries;
+  try { entries = readdirSync(dir); } catch { return out; }
+  for (const name of entries) {
+    const full = join(dir, name);
+    let s;
+    try { s = statSync(full); } catch { continue; }
+    if (s.isDirectory()) {
+      out.push(...listRustFiles(full));
+    } else if (s.isFile() && name.endsWith('.rs')) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+function productionSlice(text) {
+  // Drop everything from the first `#[cfg(test)]` line onward.
+  const lines = text.split(/\r?\n/);
+  const cutAt = lines.findIndex((l) => /^\s*#\[\s*cfg\s*\(\s*test\s*\)\s*\]/.test(l));
+  const kept = cutAt === -1 ? lines : lines.slice(0, cutAt);
+  // Strip comment-only lines.
+  return kept.filter((l) => !/^\s*\/\//.test(l));
+}
+
+const offenders = [];
+for (const file of listRustFiles(SRC_DIR)) {
+  if (basename(file) === 'lib.rs') continue;
+  let text;
+  try { text = readFileSync(file, 'utf-8'); } catch { continue; }
+  const code = productionSlice(text).join('\n');
+  if (code.includes('.unwrap()') || code.includes('.expect(')) {
+    offenders.push(file);
+  }
+}
+
+if (offenders.length > 0) {
+  console.error('INV-04 (Rust): .unwrap() / .expect(...) found in production code:');
+  for (const f of offenders) console.error('  ' + f);
+  console.error('Use `?` or explicit error handling. Test-module usage is allowed inside `#[cfg(test)]`.');
+  process.exit(1);
+}
+console.log('Rust no-unwrap check passed.');

package/dist/templates/scripts/ci-classify-changes.mjs.ejs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// <%= projectName %> — CI change classifier
+// Reads changed files since origin/main and writes flags to $GITHUB_OUTPUT.
+// Advisory only — flag values inform job conditions, never block merge.
+// Flags: docs_only, backend_changed, frontend_changed, infra_changed, high_risk, e2e_specs, ssot
+// Usage:
+//   node scripts/ci-classify-changes.mjs            # diff BASE_SHA..HEAD_SHA
+//   node scripts/ci-classify-changes.mjs --stdin    # read paths from stdin
+//
+// Fail-closed semantics: if resolving the changed set fails for any reason
+// (shallow clone, missing refs, git not on PATH), every category flag is
+// emitted as `true` so downstream jobs run defensively. "Fail-closed" here
+// means "run everything", never skip work because classification broke.
+import { spawnSync } from 'node:child_process';
+import { appendFileSync, existsSync, readFileSync } from 'node:fs';
+
+const CATEGORY_KEYS = [
+  'docs_only',
+  'backend_changed',
+  'frontend_changed',
+  'infra_changed',
+  'high_risk',
+  'e2e_specs',
+  'ssot',
+];
+
+const base = process.env.BASE_SHA ?? 'origin/main';
+const head = process.env.HEAD_SHA ?? 'HEAD';
+const useStdin = process.argv.includes('--stdin');
+
+// A path counts as "docs" ONLY if it lives in a dedicated documentation tree
+// (docs/, website/, wiki/) or is a root-level *.md other than AGENTS.md.
+// Governance files (AGENTS.md, .claude/rules/*.md, src/templates/**/*.md) are
+// markdown but drive enforcement behavior: since docs-only PRs are mergeable
+// on green (#1296), classifying them as docs would skip the very tests that
+// validate them — so they are explicitly NOT docs (#1299).
+function isDocsPath(f) {
+  if (f.startsWith('docs/') || f.startsWith('website/') || f.startsWith('wiki/')) return true;
+  return !f.includes('/') && f.endsWith('.md') && f !== 'AGENTS.md';
+}
+
+const FRONTEND_PATTERNS = [/^src\/(?:ui|frontend|components|pages|views)\//, /\.(tsx?|css|scss|html)$/];
+const INFRA_PATTERNS = [/^\.github\//, /^(Dockerfile|docker-compose|terraform|\.tf$)/i, /^k8s\//, /^helm\//];
+const HIGH_RISK_PATTERNS = [
+  /^src\/(?:auth|security|payment|billing)\//,
+  /migrations?\//,
+  /schema\.(sql|graphql|proto)$/i,
+];
+const E2E_PATTERNS = [/^__tests__\/e2e\//, /^tests\/e2e\//];
+const SSOT_PATTERNS = [/^docs\/SYSTEM\//, /^docs\/METHOD\/SSOT_CORE_SET\.md$/, /^arbiter\.json$/];
+<% if (language === 'typescript') { %>
+const BACKEND_PATTERNS = [/^src\//, /\.(ts|js)$/];
+<% } %><% if (language === 'java') { %>
+const BACKEND_PATTERNS = [/^src\/main\/java\//, /\.(java|kt)$/];
+<% } %><% if (language === 'rust') { %>
+const BACKEND_PATTERNS = [/^src\//, /\.rs$/];
+<% } %><% if (language === 'python') { %>
+const BACKEND_PATTERNS = [/^src\//, /\.py$/];
+<% } %><% if (language === 'go') { %>
+const BACKEND_PATTERNS = [/^(?!.*_test\.go).*\.go$/, /^cmd\//, /^internal\//];
+<% } %>
+
+function readStdinPaths() {
+  return readFileSync(0, 'utf-8').split('\n').filter(Boolean);
+}
+
+function resolveChangedPaths() {
+  if (useStdin) return readStdinPaths();
+  // No silent fallback: any git failure must propagate so the outer guard
+  // can fail-closed (emit true for every category).
+  const r = spawnSync('git', ['diff', '--name-only', `${base}...${head}`], {
+    encoding: 'utf-8',
+    shell: false,
+  });
+  if (r.error) throw r.error;
+  if (typeof r.status === 'number' && r.status !== 0) {
+    throw new Error(`git diff exited ${r.status}: ${r.stderr || '(no stderr)'}`);
+  }
+  return (r.stdout || '').split('\n').filter(Boolean);
+}
+
+function emitFlag(key, value) {
+  process.stdout.write(`[ci-classify] ${key}=${value}\n`);
+  if (process.env.GITHUB_OUTPUT && existsSync(process.env.GITHUB_OUTPUT)) {
+    appendFileSync(process.env.GITHUB_OUTPUT, `${key}=${value}\n`);
+  }
+}
+
+function emitAllTrue() {
+  // Run-everything semantics per flag: docs_only=true would SKIP the code jobs,
+  // so on an error it must be FALSE — every other category=true runs everything.
+  for (const key of CATEGORY_KEYS) emitFlag(key, key !== 'docs_only');
+}
+
+let succeeded = false;
+try {
+  const changed = resolveChangedPaths();
+  const match = (patterns) => changed.some((f) => patterns.some((p) => p.test(f)));
+
+  const docs_only = changed.length > 0 && changed.every(isDocsPath);
+  const backend_changed = match(BACKEND_PATTERNS);
+  const frontend_changed = match(FRONTEND_PATTERNS);
+  const infra_changed = match(INFRA_PATTERNS);
+  const high_risk = match(HIGH_RISK_PATTERNS);
+  const e2e_specs = match(E2E_PATTERNS);
+  const ssot = match(SSOT_PATTERNS);
+
+  const flags = { docs_only, backend_changed, frontend_changed, infra_changed, high_risk, e2e_specs, ssot };
+
+  process.stdout.write('[ci-classify] changed files: ' + changed.length + '\n');
+  for (const [k, v] of Object.entries(flags)) emitFlag(k, v);
+  succeeded = true;
+} finally {
+  if (!succeeded) {
+    process.stderr.write('[ci-classify] ERROR resolving changed set — fail-closed, running everything (docs_only=false)\n');
+    emitAllTrue();
+  }
+  process.exit(0);
+}

package/dist/templates/scripts/conformance.mjs.ejs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// scripts/conformance.mjs — generated by arbiter (#1398, INV-128).
+// Advisory conformance-scorecard runner for this project.
+//
+// Self-contained (INV-96 fail-closed): the standalone `conformance` command
+// was retired, so this runner no longer shells out to it. The governance scorecard
+// now lives in `arbiter gold-audit` (level band + missing items); this script points
+// at it and exits 0. Wired as an advisory (runWarnCheck) in check-all.mjs L2 — it
+// never hard-fails the gate.
+//
+// Usage: node scripts/conformance.mjs [--check] [--help]
+// Exit codes (INV-53): 0=advisory OK, 2=ERROR.
+
+try {
+  const args = process.argv.slice(2)
+
+  if (args.includes('--help') || args.includes('-h')) {
+    process.stdout.write(
+      'Usage: node scripts/conformance.mjs [--check]\n' +
+        'Advisory runner. Run `npx @getarbiter/cli gold-audit` for the governance scorecard.\n',
+    )
+    process.exit(0)
+  }
+
+  process.stdout.write(
+    '[conformance] advisory: the standalone conformance command was retired — run ' +
+      '`npx @getarbiter/cli gold-audit` for the governance scorecard (level band + missing items).\n',
+  )
+  process.exit(0)
+} catch (err) {
+  // Fail-closed (INV-96): an unexpected error must block, never silently pass.
+  process.stderr.write(
+    `[conformance] unexpected error: ${err instanceof Error ? err.stack : String(err)}\n`,
+  )
+  process.exit(2)
+}

package/dist/templates/scripts/constraint-map.json.ejs

@@ -0,0 +1,25 @@
+{
+  "//": "INV-115 constraint-scan map (scripts/check-constraint-scan.mjs). Curate an entry",
+  "//1": "for every free-text prohibition in AGENTS.md / CANON.md / CLAUDE.md, so the scan",
+  "//2": "reports it COVERED or ACCEPTED instead of leaving it in the UNENFORCEABLE backlog.",
+  "//3": "Naming a non-existent enforcer is MAP-FICTION and fails the gate — only add an",
+  "//4": "entry once the enforcer actually exists.",
+  "//5": "Shape: \"<token>\": { \"kind\": \"gate|hook|githook|script|inv|lint|template\", \"enforcer\": \"<ref>\" }",
+  "//6": "  gate     — enforcer is a check referenced in scripts/check-all.mjs",
+  "//7": "  hook     — enforcer is a file under .claude/hooks/",
+  "//8": "  githook  — enforcer is a file under .githooks/ (e.g. pre-commit)",
+  "//9": "  script   — enforcer is a script file that exists on disk",
+  "//10": "  inv      — enforcer is an invariant id (e.g. INV-04) present in the catalog",
+  "//11": "  lint     — enforcer is a rule id active in an eslint config",
+  "//12": "  template — enforcer is a path under src/templates/",
+  "//13": "A prohibition with no grep-able token is keyed by its verbatim governance line:",
+  "//14": "  \"prose:- Skip the gate before committing\": { \"kind\": \"githook\", \"enforcer\": \"pre-commit\" }",
+  "//15": "A prose entry matching no line is MAP-DEAD (the map cannot rot silently).",
+  "//16": "A judgment-level rule no mechanism can carry is triaged, not hidden:",
+  "//17": "  \"prose:<line>\": { \"kind\": \"accepted\", \"rationale\": \"<>=40 chars of why>\" }",
+  "//18": "An accepted entry without that rationale is MAP-INVALID and fails the gate.",
+  "//19": "Coverage is ratcheted against scripts/data/constraint-coverage-baseline.json;",
+  "//20": "seed or tighten it with --update-baseline (it refuses to record a regression).",
+  "//21": "Example (uncomment and adapt once the enforcer exists):",
+  "//22": "  \"any\": { \"kind\": \"lint\", \"enforcer\": \"@typescript-eslint/no-explicit-any\" }"
+}