@getarbiter/cli 0.5.0

package/dist/templates/scripts/gate-registry.yml.ejs

@@ -0,0 +1,286 @@
+# gate-registry.yml.ejs — the DECLARATIVE gate registry (#2041, AC-2041.4).
+#
+# Every gate the generated check-all.mjs runs is declared here: id, display
+# name, lane level, kind, and spawn command. The generator
+# (src/generators/check-all.ts) renders this manifest with the project config
+# (EJS expressions in `cmd` resolve at generation time), validates the shape,
+# and consumes it to emit the gate sections of check-all.mjs — replacing the
+# hardcoded runCheck(...) calls that used to live inline in the template.
+#
+# Entry fields:
+#   id         kebab-case identifier — used by `--gate <id>` and the layering
+#              contract test (scripts/test-gate-layering.mjs).
+#   name       display name (the runCheck first argument; also accepted by
+#              `--gate <name>` for backward compatibility with #2078).
+#   level      L1 | L2 | L3 — the lane this gate belongs to. Structural
+#              containment L1 ⊂ L2 ⊂ L3: `check-all.mjs <level>` runs every
+#              gate whose level is <= the requested level.
+#   kind       check (hard) | warn (advisory) | tool (CI-aware) | inline
+#              (custom JS body in the template, declared here for manifest
+#              completeness — see the INLINE_BLOCKS section of check-all.mjs).
+#   cmd        [binary, ...args] — EJS expressions are allowed; rendered at
+#              generation time (e.g. `<%%= packageManager %>`).
+#   language   optional — wraps the gate in `if (language === '<lang>')`.
+#   condition  optional — raw expression wrapped in `if (<expr>) { ... }`.
+#   else       optional — raw body emitted in the `else` branch (used by the
+#              SKIP-report gates: audit, npm-ci drift, playwright rules).
+#   soft       true → the gate runs with `{ soft: graceActive }`.
+#   promotes_to  optional — id of a gate this one REPLACES at runtime once its
+#              own level is reached (e.g. an L3 `harness-full` entry with
+#              `promotes_to: harness-fast` skips `harness-fast` once the run
+#              level is L3+). #9003.
+#   audit      optional true — an audit-only gate, a second axis orthogonal
+#              to level; skipped at runtime when the consumer sets
+#              `ARBITER_AUDIT_MODE=off`. #9003.
+#
+# ORDER IS MEANINGFUL: the emitted script runs gates in registry order within
+# each level (the pre-#2041 inline order is preserved).
+#
+# Existing Code Survey (CANON-16): the de-facto registry was the inline
+# runCheck(...) surface of check-all.mjs.ejs (191 calls) — no separate registry
+# file existed; this manifest REPLACES that inline surface (justified by
+# AC-2041.4), it does not duplicate it.
+
+gates:
+  # ── L1 ─────────────────────────────────────────────────────────────────────
+  - { id: pii-scan, name: 'PII scan', level: L1, kind: check, cmd: ['node', ['scripts/pii-scan.mjs']] }
+  - { id: secret-scan, name: 'secret scan', level: L1, kind: check, cmd: ['node', ['scripts/check-secret-scan.mjs']] }
+  - { id: typecheck, name: typecheck, level: L1, kind: check, language: typescript, cmd: ['npx', ['tsc', '--noEmit']] }
+  - { id: format, name: format, level: L1, kind: check, language: typescript, cmd: ['npx', ['prettier', '--check', '.']] }
+  - { id: lint, name: lint, level: L1, kind: check, language: typescript, cmd: ['npx', ['eslint', '.']] }
+  - { id: static-analysis, name: 'static analysis', level: L1, kind: check, language: typescript, condition: "gateFilePresent('eslint.config.static.mjs', 'static analysis', '[CHECK] static analysis ... SKIP (run: arbiter update)')", cmd: ['npx', ['eslint', '--config', 'eslint.config.static.mjs', '--no-config-lookup', '--no-error-on-unmatched-pattern', 'src']] }
+  - { id: no-fake-db-imports, name: 'no-fake-db imports (INV-34)', level: L1, kind: check, language: typescript, condition: "gateFilePresent('eslint.config.no-fake-db.mjs', 'no-fake-db imports (INV-34)')", cmd: ['npx', ['eslint', '--config', 'eslint.config.no-fake-db.mjs', '--no-config-lookup', '--no-error-on-unmatched-pattern', '.']] }
+  - { id: unit-tests, name: 'unit tests', level: L1, kind: check, language: typescript, cmd: ['<%= packageManager %>', ['run', 'test:unit']] }
+  - { id: npm-ci-drift, name: 'npm-ci drift', level: L1, kind: inline, language: typescript, emitIf: "packageManager === 'npm'", else: "console.log('[CHECK] npm-ci drift ... SKIP (project uses <%= packageManager %>)');\npushResult('npm-ci drift', 'SKIP', 0);" }
+  - { id: rust-fmt, name: fmt, level: L1, kind: check, language: rust, cmd: ['cargo', ['fmt', '--check']] }
+  - { id: clippy, name: clippy, level: L1, kind: check, language: rust, cmd: ['cargo', ['clippy', '--', '-D', 'warnings']] }
+  - { id: rust-unit-tests, name: 'unit tests', level: L1, kind: check, language: rust, cmd: ['cargo', ['test']] }
+  - { id: no-unwrap, name: 'no .unwrap()/.expect()', level: L1, kind: check, language: rust, cmd: ['node', ['scripts/checks/check-rust-no-unwrap.mjs']] }
+  - { id: no-unsafe, name: 'no unsafe', level: L1, kind: check, language: rust, cmd: ['node', ['scripts/checks/check-rust-no-unsafe.mjs']] }
+  - { id: gradle-checkstyle, name: checkstyle, level: L1, kind: check, emitIf: "language === 'java' && buildTool === 'gradle'", cmd: ['./gradlew', ['checkstyleMain', '-q']] }
+  - { id: gradle-spotless, name: 'format (spotless)', level: L1, kind: check, emitIf: "language === 'java' && buildTool === 'gradle'", cmd: ['./gradlew', ['spotlessCheck', '-q']] }
+  - { id: gradle-unit-tests, name: 'unit tests', level: L1, kind: check, emitIf: "language === 'java' && buildTool === 'gradle'", cmd: ['./gradlew', ['test', '-q']] }
+  - { id: maven-checkstyle, name: checkstyle, level: L1, kind: check, emitIf: "language === 'java' && buildTool === 'maven'", cmd: ['mvn', ['checkstyle:check', '-q']] }
+  - { id: maven-spotless, name: 'format (spotless)', level: L1, kind: check, emitIf: "language === 'java' && buildTool === 'maven'", cmd: ['mvn', ['spotless:check', '-q']] }
+  - { id: maven-unit-tests, name: 'unit tests', level: L1, kind: check, emitIf: "language === 'java' && buildTool === 'maven'", cmd: ['mvn', ['test', '-q']] }
+  - { id: go-vet, name: vet, level: L1, kind: check, language: go, cmd: ['go', ['vet', './...']] }
+  - { id: golangci-lint, name: lint, level: L1, kind: check, language: go, cmd: ['golangci-lint', ['run']] }
+  - { id: gofmt, name: 'fmt (gofmt)', level: L1, kind: inline, language: go }
+  - { id: go-unit-tests, name: 'unit tests', level: L1, kind: check, language: go, cmd: ['go', ['test', './...']] }
+  - { id: ruff-lint, name: lint, level: L1, kind: check, language: python, cmd: ['ruff', ['check', '.']] }
+  - { id: ruff-format, name: format, level: L1, kind: check, language: python, cmd: ['ruff', ['format', '--check', '.']] }
+  - { id: pytest-unit-tests, name: 'unit tests', level: L1, kind: check, language: python, cmd: ['pytest', []] }
+  - { id: kotlin-unit-tests, name: 'unit tests', level: L1, kind: check, emitIf: "language === 'kotlin' && buildTool === 'gradle'", cmd: ['./gradlew', ['test', '-q']] }
+  - { id: detekt, name: 'detekt (beta)', level: L1, kind: check, emitIf: "language === 'kotlin' && buildTool === 'gradle'", soft: true, cmd: ['./gradlew', ['detekt']] }
+  - { id: no-tracked-artifacts, name: 'no tracked artifacts (INV-129)', level: L1, kind: check, cmd: ['node', ['scripts/check-no-tracked-artifacts.mjs']] }
+  - { id: image-pins, name: 'image pins (#1442)', level: L1, kind: check, cmd: ['node', ['scripts/check-image-pins.mjs']] }
+  - { id: e2e-quarantine, name: 'e2e quarantine (INV-130)', level: L1, kind: check, cmd: ['node', ['scripts/check-e2e-quarantine.mjs']] }
+  - { id: test-naming, name: 'test naming', level: L1, kind: check, cmd: ['node', ['scripts/check-test-naming.mjs']] }
+  - { id: min-test-execution, name: 'min test execution (INV-25)', level: L1, kind: check, cmd: ['node', ['scripts/check-min-test-execution.mjs']] }
+  - { id: exit-code-contract, name: 'exit code contract', level: L1, kind: check, cmd: ['node', ['scripts/check-exit-code-contract.mjs']] }
+  - { id: pipe-tee-hazard, name: 'pipe/tee hazard', level: L1, kind: check, cmd: ['node', ['scripts/check-pipe-tee-hazard.mjs']] }
+  - { id: self-validation-drill, name: 'self-validation drill', level: L1, kind: check, emitIf: "typeof enableSelfValidationHarness === 'undefined' || enableSelfValidationHarness !== false", cmd: ['node', ['scripts/self-validation.mjs']] }
+  - { id: config-drift, name: 'config drift', level: L1, kind: check, cmd: ['node', ['scripts/check-drift.mjs']] }
+  - { id: validator-helptext, name: 'validator help text', level: L1, kind: check, cmd: ['node', ['scripts/check-validator-helptext.mjs']] }
+  - { id: audit-toolchain, name: 'audit toolchain', level: L1, kind: warn, emitIf: "typeof enableAuditToolchain !== 'undefined' && enableAuditToolchain", cmd: ['node', ['scripts/audit-toolchain.mjs']] }
+  - { id: frontend-lane, name: 'frontend lane', level: L1, kind: check, emitIf: "_isSubtreeFE", cmd: ['node', ['scripts/check-frontend-lane.mjs']] }
+  - { id: lint-css, name: 'lint:css', level: L1, kind: tool, emitIf: "_isFE && language === 'typescript'", condition: "gateFilePresent('.stylelintrc.json', 'lint:css', null, ['.stylelintrc'])", cmd: ['npx', ['stylelint', '--allow-empty-input', 'src/**/*.css']] }
+  - { id: fsd-boundaries, name: 'fsd boundaries', level: L1, kind: check, emitIf: "_isFE && language === 'typescript'", condition: "gateFilePresent('eslint.config.frontend-spa.mjs', 'fsd boundaries')", cmd: ['npx', ['eslint', '--config', 'eslint.config.frontend-spa.mjs', '--no-config-lookup', '<%= _feGlob %>']] }
+  - { id: playwright-rules, name: 'playwright rules', level: L1, kind: inline, emitIf: "_isFE && language === 'typescript'" }
+  - { id: suppressions-expiry, name: 'suppressions expiry', level: L1, kind: check, emitIf: "enableSuppressions", cmd: ['node', ['scripts/check-suppressions.mjs']] }
+  - { id: suppression-rationale, name: 'suppression rationale', level: L1, kind: check, emitIf: "enableSuppressions", cmd: ['node', ['scripts/check-suppression-rationale.mjs']] }
+  - { id: suppression-expiry-antidrift, name: 'suppression expiry (anti-drift)', level: L1, kind: check, emitIf: "enableSuppressions", cmd: ['node', ['scripts/check-suppression-expiry.mjs']] }
+  - { id: inline-suppressions, name: 'inline suppressions', level: L1, kind: check, cmd: ['node', ['scripts/check-inline-suppressions.mjs']] }
+  - { id: claude-md-lint, name: 'claude-md lint', level: L1, kind: check, cmd: ['node', ['scripts/check-claude-md-lint.mjs']] }
+  - { id: unwired-guards, name: 'unwired guards', level: L1, kind: check, cmd: ['node', ['scripts/check-unwired-guards.mjs']] }
+  - { id: workflow-runners-inline, name: 'workflow runners', level: L1, kind: inline }
+  - { id: ci-alignment, name: 'ci alignment', level: L1, kind: inline }
+  - { id: ssot-core-set, name: 'ssot core set', level: L1, kind: check, cmd: ['node', ['scripts/check-ssot-core.mjs']] }
+  - { id: doc-links, name: 'doc links', level: L1, kind: check, cmd: ['node', ['scripts/check-doc-links.mjs']] }
+  - { id: knowledge-map, name: 'knowledge map', level: L1, kind: check, cmd: ['node', ['scripts/check-knowledge-map.mjs']] }
+  - { id: canonical-paths, name: 'canonical paths', level: L1, kind: check, cmd: ['node', ['scripts/check-canonical-paths.mjs']] }
+  - { id: collab-mode-wired, name: 'collab mode wired (INV-100)', level: L1, kind: check, cmd: ['node', ['scripts/check-collab-mode-wired.mjs']] }
+  - { id: hook-routing, name: 'hook routing (#2129)', level: L1, kind: check, cmd: ['node', ['scripts/check-hook-routing.mjs']] }
+  - { id: safety-adopt-ratchet, name: 'safety adopt ratchet', level: L1, kind: check, cmd: ['node', ['scripts/check-safety-adopt-ratchet.mjs']] }
+  - { id: emission-parity, name: 'emission parity (#2110)', level: L1, kind: check, cmd: ['node', ['scripts/check-emission-parity.mjs']] }
+  - { id: constraint-scan, name: 'constraint scan (INV-115)', level: L1, kind: check, cmd: ['node', ['scripts/check-constraint-scan.mjs']] }
+  - { id: wiki-lint, name: 'wiki lint (INV-116)', level: L1, kind: check, emitIf: "governanceLevel !== 'L1'", cmd: ['node', ['scripts/check-wiki-lint.mjs']] }
+  - { id: doc-index-drift, name: 'documentation index drift', level: L1, kind: check, emitIf: "governanceLevel !== 'L1'", condition: "existsSync('docs/INDEX.md')", cmd: ['node', ['scripts/gen-doc-index.mjs', '--check']] }
+  - { id: llms-txt-drift, name: 'llms.txt drift', level: L1, kind: check, emitIf: "governanceLevel !== 'L1'", condition: "existsSync('llms.txt')", cmd: ['node', ['scripts/gen-llms-txt.mjs', '--check']] }
+  - { id: anti-proforma, name: 'anti-proforma (INV-118)', level: L1, kind: check, cmd: ['node', ['scripts/check-anti-proforma.mjs']] }
+  - { id: test-pyramid, name: 'test pyramid (INV-124)', level: L1, kind: check, cmd: ['node', ['scripts/check-test-pyramid.mjs']] }
+  - { id: test-scope-tier, name: 'test scope-tier (INV-124)', level: L1, kind: check, cmd: ['node', ['scripts/check-test-scope-tier.mjs']] }
+  - { id: api-e2e, name: 'api e2e (INV-126)', level: L1, kind: check, cmd: ['node', ['scripts/check-api-e2e.mjs']] }
+  - { id: domain-api-surface, name: 'domain-api surface (INV-125)', level: L1, kind: check, emitIf: "hasPublicApi", cmd: ['node', ['scripts/check-domain-api-surface.mjs']] }
+  - { id: render-smoke-presence, name: 'render smoke presence (INV-127)', level: L1, kind: check, cmd: ['node', ['scripts/check-render-smoke.mjs']] }
+  - { id: smoke-journeys, name: 'smoke journeys (INV-137)', level: L1, kind: check, cmd: ['node', ['scripts/check-smoke-journeys.mjs']] }
+  - { id: e2e-escalation, name: 'e2e escalation ladder (#2043)', level: L1, kind: check, cmd: ['node', ['scripts/check-e2e-escalation.mjs']] }
+  - { id: m16-handoff, name: 'M16 handoff-contract marker (#2103)', level: L1, kind: check, cmd: ['node', ['scripts/check-m16-handoff.mjs']] }
+  - { id: stack-conformity, name: 'stack conformity (INV-121)', level: L1, kind: check, emitIf: "language", cmd: ['node', ['scripts/check-stack-conformity.mjs']] }
+  - { id: iso9001, name: 'iso9001 QMS (RTM + doc-control + CAPA)', level: L1, kind: check, condition: "gateFilePresent('scripts/check-iso9001.mjs', 'iso9001 QMS (RTM + doc-control + CAPA)')", cmd: ['node', ['scripts/check-iso9001.mjs']] }
+  - { id: regulated-overlay, name: 'regulated overlay (SoD + retention + signing + mutation)', level: L1, kind: check, condition: "gateFilePresent('scripts/check-regulated-overlay.mjs', 'regulated overlay (SoD + retention + signing + mutation)')", cmd: ['node', ['scripts/check-regulated-overlay.mjs']] }
+  - { id: ci-tiers, name: 'ci tiers (INV-73)', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-ci-tiers.mjs']] }
+  - { id: action-pins, name: 'action pins (INV-76)', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-action-pins.mjs']] }
+  - { id: workflow-perms, name: 'workflow perms (INV-77)', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-workflow-perms.mjs']] }
+  - { id: workflow-runners, name: 'workflow runners', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-workflow-runners.mjs']] }
+  - { id: workflow-docs-sync, name: 'workflow docs sync', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-workflow-docs-sync.mjs']] }
+  - { id: workflow-test-integrity, name: 'workflow test integrity', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-workflow-test-integrity.mjs']] }
+  - { id: secret-presence, name: 'secret presence (fail-loud)', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-secret-presence.mjs']] }
+  - { id: continue-on-error, name: 'continue-on-error (swallowed gate)', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-continue-on-error.mjs']] }
+  - { id: workflow-sha-pinning, name: 'workflow sha pinning', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-workflow-sha-pinning.mjs']] }
+  - { id: workflow-job-naming, name: 'workflow job naming', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-workflow-job-naming.mjs']] }
+  - { id: pr-size-gate, name: 'pr size gate', level: L1, kind: check, emitIf: "_hasGitHubWorkflows", cmd: ['node', ['scripts/check-pr-size-gate.mjs']] }
+  - { id: merge-method-ff-only, name: 'merge method ff-only (INV-101)', level: L1, kind: check, emitIf: "_hasGitHubWorkflows && governanceLevel !== 'L1'", cmd: ['node', ['scripts/check-merge-method.mjs']] }
+  - { id: muted-test, name: 'muted gate test (anti-fake-green)', level: L1, kind: check, cmd: ['node', ['scripts/check-muted-test.mjs']] }
+  - { id: skip-critical-e2e, name: 'skipped critical e2e (anti-fake-green)', level: L1, kind: check, cmd: ['node', ['scripts/check-skip-critical-e2e.mjs']] }
+  - { id: stub-redirect-husk, name: 'stub redirect husk (anti-fake-green)', level: L1, kind: check, cmd: ['node', ['scripts/check-no-stub-redirects.mjs']] }
+  - { id: grace-window, name: 'grace window (anti-fake-green)', level: L1, kind: check, cmd: ['node', ['scripts/check-grace-window.mjs']] }
+  - { id: assertion-delta, name: 'assertion delta (anti-fake-green)', level: L1, kind: check, cmd: ['node', ['scripts/check-assertion-delta.mjs']] }
+  - { id: oracle-discrimination, name: 'oracle discrimination (anti-fake-green)', level: L1, kind: check, emitIf: "archetype === 'frontend-spa' || archetype === 'backend-web-db'", cmd: ['node', ['scripts/check-oracle-discrimination.mjs']] }
+
+  - { id: tabletop-evidence, name: 'tabletop evidence (#2429)', level: L1, kind: check, cmd: ['node', ['scripts/check-tabletop-evidence.mjs']] }
+  - { id: sources, name: 'source certification (INV-147)', level: L1, kind: check, cmd: ['node', ['scripts/check-sources.mjs']] }
+  - { id: use-cases, name: 'use cases (INV-149)', level: L1, kind: check, cmd: ['node', ['scripts/check-use-cases.mjs']] }
+  - { id: milestones, name: 'milestones (INV-146)', level: L1, kind: check, cmd: ['node', ['scripts/check-milestones.mjs']] }
+
+  # ── L2 ─────────────────────────────────────────────────────────────────────
+  - { id: gitleaks, name: gitleaks, level: L2, kind: check, emitIf: "enableSecurityScanning", soft: true, cmd: ['gitleaks', ['detect', '--source', '.', '--config', '.gitleaks.toml', '--gitleaks-ignore-path', 'suppressions/.gitleaksignore', '--exit-code', '1']] }
+  - { id: npm-audit, name: audit, level: L2, kind: inline, emitIf: "language === 'typescript' && enableSecurityScanning" }
+  - { id: consumer-audit, name: 'consumer audit', level: L2, kind: check, emitIf: "language === 'typescript' && archetype === 'library' && governanceLevel !== 'L1'", cmd: ['node', ['scripts/check-consumer-audit.mjs']] }
+  - { id: ts-boundaries, name: boundaries, level: L2, kind: check, emitIf: "language === 'typescript' && architectureStyle === 'hexagonal'", soft: true, cmd: ['node', ['scripts/check-boundaries.mjs']] }
+  - { id: contract-tests-ts, name: 'contract tests', level: L2, kind: check, emitIf: "language === 'typescript'", soft: true, cmd: ['<%= packageManager %>', ['run', 'test:contract']] }
+  - { id: integration-tests-ts, name: 'integration tests', level: L2, kind: check, emitIf: "language === 'typescript'", soft: true, cmd: ['<%= packageManager %>', ['run', 'test:integration']] }
+  - { id: behavioral-tests-ts, name: 'behavioral tests', level: L2, kind: check, emitIf: "language === 'typescript'", soft: true, cmd: ['<%= packageManager %>', ['run', 'test:behavioral']] }
+  - { id: db-integration-tests, name: 'db integration tests', level: L2, kind: check, emitIf: "language === 'typescript' && hasDatabase && governanceLevel !== 'L1'", soft: true, cmd: ['<%= packageManager %>', ['run', 'test:integration']] }
+  - { id: fe-boundaries, name: 'fe boundaries (INV-102/103/104)', level: L2, kind: check, emitIf: "_isFE && governanceLevel !== 'L1'", condition: "gateFilePresent('scripts/check-fe-boundaries.mjs', 'fe boundaries (INV-102/103/104)')", soft: true, cmd: ['node', ['scripts/check-fe-boundaries.mjs']] }
+  - { id: token-discipline, name: 'token discipline (INV-105)', level: L2, kind: check, emitIf: "_isFE && governanceLevel !== 'L1'", condition: "gateFilePresent('scripts/verify-tokens.mjs', 'token discipline (INV-105)')", soft: true, cmd: ['node', ['scripts/verify-tokens.mjs']] }
+  - { id: i18n-literals, name: 'i18n literals (INV-106)', level: L2, kind: check, emitIf: "_isFE && governanceLevel !== 'L1'", condition: "gateFilePresent('scripts/i18n-literal-scanner.mjs', 'i18n literals (INV-106)')", soft: true, cmd: ['node', ['scripts/i18n-literal-scanner.mjs']] }
+  - { id: i18n-parity, name: 'i18n parity (INV-106)', level: L2, kind: check, emitIf: "_isFE && governanceLevel !== 'L1'", condition: "gateFilePresent('scripts/verify-i18n-parity.mjs', 'i18n parity (INV-106)')", soft: true, cmd: ['node', ['scripts/verify-i18n-parity.mjs']] }
+  - { id: fe-coverage-ratchet, name: 'fe coverage ratchet', level: L2, kind: check, emitIf: "_isFE && governanceLevel !== 'L1'", condition: "gateFilePresent('scripts/verify-fe-coverage.mjs', 'fe coverage ratchet') && existsSync('fe-coverage-baseline.json')", soft: true, cmd: ['node', ['scripts/verify-fe-coverage.mjs']] }
+  - { id: bundle-size-budget, name: 'bundle size budget', level: L2, kind: check, emitIf: "_isFE && governanceLevel !== 'L1'", condition: "gateFilePresent('scripts/check-bundle-size.mjs', 'bundle size budget') && gateFilePresent('bundle-budget.json', 'bundle size budget')", soft: true, cmd: ['node', ['scripts/check-bundle-size.mjs']] }
+  - { id: playwright-e2e, name: 'playwright e2e', level: L2, kind: inline, emitIf: "language === 'typescript' && (archetype === 'frontend-spa' || archetype === 'backend-web-db') && governanceLevel !== 'L1'" }
+  - { id: cargo-audit, name: audit, level: L2, kind: check, emitIf: "language === 'rust' && enableSecurityScanning", soft: true, cmd: ['cargo', ['audit']] }
+  - { id: rust-boundaries, name: boundaries, level: L2, kind: check, emitIf: "language === 'rust' && architectureStyle === 'hexagonal'", soft: true, cmd: ['node', ['scripts/check-boundaries.mjs']] }
+  - { id: rust-integration-tests, name: 'integration tests', level: L2, kind: check, emitIf: "language === 'rust' && hasDatabase && governanceLevel !== 'L1'", soft: true, cmd: ['cargo', ['test', '--tests']] }
+  - { id: gradle-integration, name: integration, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'gradle' && hasDatabase && governanceLevel !== 'L1'", soft: true, cmd: ['./gradlew', ['integrationTest', '-q']] }
+  - { id: gradle-arch-tests, name: 'architecture tests', level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'gradle' && architectureStyle !== 'none' && basePackage", soft: true, cmd: ['./gradlew', ['test', '--tests', '*.architecture.*', '-q']] }
+  - { id: trivy-gradle, name: 'dep audit (trivy fs)', level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'gradle' && enableSecurityScanning", soft: true, cmd: ['trivy', ['fs', '--scanners', 'vuln', '--severity', 'HIGH,CRITICAL', '--exit-code', '1', '--ignorefile', '.trivyignore', '.']] }
+  - { id: maven-integration, name: integration, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'maven' && hasDatabase && governanceLevel !== 'L1'", soft: true, cmd: ['mvn', ['verify', '-q']] }
+  - { id: maven-arch-tests, name: 'architecture tests', level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'maven' && architectureStyle !== 'none' && basePackage", soft: true, cmd: ['mvn', ['test', '-Dtest=*.architecture.*', '-q']] }
+  - { id: trivy-maven, name: 'dep audit (trivy fs)', level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'maven' && enableSecurityScanning", soft: true, cmd: ['trivy', ['fs', '--scanners', 'vuln', '--severity', 'HIGH,CRITICAL', '--exit-code', '1', '--ignorefile', '.trivyignore', '.']] }
+  - { id: staticcheck, name: staticcheck, level: L2, kind: check, emitIf: "language === 'go'", soft: true, cmd: ['staticcheck', ['./...']] }
+  - { id: govulncheck, name: 'dep audit', level: L2, kind: check, emitIf: "language === 'go' && enableSecurityScanning", soft: true, cmd: ['govulncheck', ['./...']] }
+  - { id: go-boundaries, name: boundaries, level: L2, kind: check, emitIf: "language === 'go' && architectureStyle === 'hexagonal'", soft: true, cmd: ['node', ['scripts/check-boundaries.mjs']] }
+  - { id: go-integration-tests, name: 'integration tests', level: L2, kind: check, emitIf: "language === 'go' && hasDatabase && governanceLevel !== 'L1'", soft: true, cmd: ['go', ['test', '-tags', 'integration', '-run', 'Integration', './...']] }
+  - { id: pip-audit, name: audit, level: L2, kind: check, emitIf: "language === 'python' && enableSecurityScanning", soft: true, cmd: ['pip-audit', []] }
+  - { id: python-boundaries, name: boundaries, level: L2, kind: check, emitIf: "language === 'python' && architectureStyle === 'hexagonal'", soft: true, cmd: ['node', ['scripts/check-boundaries.mjs']] }
+  - { id: python-integration-tests, name: 'integration tests', level: L2, kind: check, emitIf: "language === 'python' && hasDatabase && governanceLevel !== 'L1'", soft: true, cmd: ['pytest', ['tests/integration/']] }
+  - { id: pytest-playwright-e2e, name: 'pytest-playwright e2e', level: L2, kind: inline, emitIf: "language === 'python' && (archetype === 'frontend-spa' || archetype === 'backend-web-db')" }
+  - { id: kotlin-arch-tests, name: 'architecture tests (beta)', level: L2, kind: check, emitIf: "language === 'kotlin' && buildTool === 'gradle' && architectureStyle !== 'none' && basePackage", soft: true, cmd: ['./gradlew', ['test', '--tests', '*.architecture.*', '-q']] }
+  - { id: trivy-kotlin, name: 'dep audit (trivy fs)', level: L2, kind: check, emitIf: "language === 'kotlin' && buildTool === 'gradle' && enableSecurityScanning", soft: true, cmd: ['trivy', ['fs', '--scanners', 'vuln', '--severity', 'HIGH,CRITICAL', '--exit-code', '1', '--ignorefile', '.trivyignore', '.']] }
+  - { id: coverage-threshold, name: 'coverage threshold', level: L2, kind: inline, emitIf: "language === 'typescript' && coverageEnabled && enableDebtGates" }
+  - { id: dead-code, name: 'dead code', level: L2, kind: check, emitIf: "language === 'typescript' && enableDebtGates", soft: true, cmd: ['npx', ['knip']] }
+  - { id: duplication, name: duplication, level: L2, kind: check, emitIf: "language === 'typescript' && enableDebtGates", soft: true, cmd: ['node', ['scripts/check-duplication.mjs']] }
+  - { id: circular-deps, name: 'circular deps', level: L2, kind: check, emitIf: "language === 'typescript' && enableDebtGates", soft: true, cmd: ['npx', ['madge', '--circular', '--extensions', 'ts,tsx,js,jsx', 'src']] }
+  - { id: arch-boundaries, name: 'arch boundaries', level: L2, kind: check, emitIf: "language === 'typescript' && enableDebtGates", soft: true, cmd: ['<%= packageManager %>', ['run', 'check:arch']] }
+  - { id: tarpaulin, name: 'coverage threshold', level: L2, kind: check, emitIf: "language === 'rust' && coverageEnabled && enableDebtGates", soft: true, cmd: ['cargo', ['tarpaulin', '--fail-under', '<%= coverageThreshold %>']] }
+  - { id: clippy-pedantic, name: 'clippy pedantic', level: L2, kind: check, emitIf: "language === 'rust' && enableDebtGates", soft: true, cmd: ['cargo', ['clippy', '--', '-W', 'clippy::pedantic', '-D', 'warnings']] }
+  - { id: binary-size, name: 'binary size', level: L2, kind: inline, emitIf: "language === 'rust' && (archetype === 'cli' || archetype === 'embedded')" }
+  - { id: jacoco, name: coverage, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'gradle' && coverageEnabled && enableDebtGates", soft: true, cmd: ['./gradlew', ['jacocoTestCoverageVerification', '-q']] }
+  - { id: pmd-gradle, name: pmd, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'gradle' && enableDebtGates", soft: true, cmd: ['./gradlew', ['pmdMain', '-q']] }
+  - { id: spotbugs, name: spotbugs, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'gradle' && enableDebtGates", soft: true, cmd: ['./gradlew', ['spotbugsMain', '-q']] }
+  - { id: spotbugs-baseline, name: 'spotbugs baseline (INV-44)', level: L2, kind: check, emitIf: "language === 'java' && (buildTool === 'gradle' || buildTool === 'maven') && enableDebtGates", soft: true, cmd: ['node', ['scripts/verify-spotbugs.mjs']] }
+  - { id: jacoco-maven, name: coverage, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'maven' && coverageEnabled && enableDebtGates", soft: true, cmd: ['mvn', ['verify', '-Pjacoco', '-q']] }
+  - { id: pmd-maven, name: pmd, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'maven' && enableDebtGates", soft: true, cmd: ['mvn', ['pmd:check', '-q']] }
+  - { id: spotbugs-maven, name: spotbugs, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'maven' && enableDebtGates", soft: true, cmd: ['mvn', ['com.github.spotbugs:spotbugs-maven-plugin:check', '-q']] }
+  - { id: go-coverage, name: 'coverage profile', level: L2, kind: inline, emitIf: "language === 'go' && coverageEnabled && enableDebtGates" }
+  - { id: gocyclo, name: 'complexity + dead code', level: L2, kind: check, emitIf: "language === 'go' && enableDebtGates", soft: true, cmd: ['golangci-lint', ['run', '--enable', 'gocyclo,gocognit,unused']] }
+  - { id: pytest-coverage, name: 'coverage threshold', level: L2, kind: check, emitIf: "language === 'python' && coverageEnabled && enableDebtGates", soft: true, cmd: ['pytest', ['--cov', '--cov-fail-under=<%= coverageThreshold %>', '--cov-report=html:coverage/html', '--cov-report=xml:coverage/coverage.xml']] }
+  - { id: ruff-complexity, name: complexity, level: L2, kind: check, emitIf: "language === 'python' && enableDebtGates", soft: true, cmd: ['ruff', ['check', '--select', 'C901,PLR0911,PLR0912,PLR0913,PLR0915', '.']] }
+  - { id: ruff-unused-imports, name: 'unused imports', level: L2, kind: check, emitIf: "language === 'python' && enableDebtGates", soft: true, cmd: ['ruff', ['check', '--select', 'F401,F811', '.']] }
+  - { id: kover, name: 'coverage (kover, beta)', level: L2, kind: check, emitIf: "language === 'kotlin' && buildTool === 'gradle' && coverageEnabled && enableDebtGates", soft: true, cmd: ['./gradlew', ['koverVerify', 'koverXmlReport']] }
+  - { id: mutation-stryker, name: 'mutation (stryker)', level: L2, kind: tool, emitIf: "(typeof mutationEnabled !== 'undefined' && mutationEnabled) && (typeof enableMutationTesting === 'undefined' || enableMutationTesting !== false) && language === 'typescript' && enableDebtGates", soft: true, cmd: ['npx', ['stryker', 'run']] }
+  - { id: mutation-pitest-gradle, name: 'mutation (pitest)', level: L2, kind: check, emitIf: "(typeof mutationEnabled !== 'undefined' && mutationEnabled) && (typeof enableMutationTesting === 'undefined' || enableMutationTesting !== false) && language === 'java' && buildTool === 'gradle' && enableDebtGates", soft: true, cmd: ['./gradlew', ['pitest', '-q']] }
+  - { id: mutation-pitest-maven, name: 'mutation (pitest)', level: L2, kind: check, emitIf: "(typeof mutationEnabled !== 'undefined' && mutationEnabled) && (typeof enableMutationTesting === 'undefined' || enableMutationTesting !== false) && language === 'java' && buildTool === 'maven' && enableDebtGates", soft: true, cmd: ['mvn', ['org.pitest:pitest-maven:mutationCoverage', '-q']] }
+  - { id: mutation-baseline, name: 'mutation baseline (#1508)', level: L2, kind: check, emitIf: "(typeof mutationEnabled !== 'undefined' && mutationEnabled) && (typeof enableMutationTesting === 'undefined' || enableMutationTesting !== false) && enableDebtGates", condition: "gateFilePresent('scripts/verify-mutation-baseline.mjs', 'mutation baseline (#1508)')", soft: true, cmd: ['node', ['scripts/verify-mutation-baseline.mjs']] }
+  - { id: stride-raci, name: 'STRIDE/RACI traceability', level: L2, kind: check, emitIf: "enableDebtGates", soft: true, cmd: ['node', ['scripts/check-stride-traceability.mjs']] }
+  - { id: contract-pact-ts, name: 'contract tests (Pact)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'typescript' && (contractType === 'rest-owned' || contractType === 'rest-public')", condition: "process.env.PACT_BROKER_BASE_URL", else: "console.log('[CHECK] contract tests (Pact) ... SKIP — PACT_BROKER_BASE_URL unset');", soft: true, cmd: ['npx', ['pact-broker', 'can-i-deploy', '--pacticipant', '<%= projectName %>', '--latest']] }
+  - { id: contract-graphql-ts, name: 'contract tests (GraphQL schema)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'typescript' && contractType === 'graphql'", soft: true, cmd: ['npx', ['graphql-inspector', 'diff', 'schema.graphql']] }
+  - { id: contract-grpc-ts, name: 'contract tests (gRPC)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'typescript' && contractType === 'grpc'", soft: true, cmd: ['npx', ['buf', 'breaking', '--against', '.git#branch=main']] }
+  - { id: contract-schema-registry-ts, name: 'contract tests (Schema Registry)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'typescript' && contractType === 'message-queue'", condition: "process.env.SCHEMA_REGISTRY_URL", else: "console.log('[CHECK] contract tests (Schema Registry) ... SKIP — SCHEMA_REGISTRY_URL unset');", soft: true, cmd: ['npx', ['vitest', 'run', '--testPathPattern=schema-registry']] }
+  - { id: contract-pact-gradle, name: 'contract tests (Pact)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'java' && buildTool === 'gradle' && (contractType === 'rest-owned' || contractType === 'rest-public')", condition: "process.env.PACT_BROKER_BASE_URL", else: "console.log('[CHECK] contract tests (Pact) ... SKIP — PACT_BROKER_BASE_URL unset');", soft: true, cmd: ['./gradlew', ['pactPublish', 'pactVerify']] }
+  - { id: contract-pact-maven, name: 'contract tests (Pact)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'java' && buildTool === 'maven' && (contractType === 'rest-owned' || contractType === 'rest-public')", condition: "process.env.PACT_BROKER_BASE_URL", else: "console.log('[CHECK] contract tests (Pact) ... SKIP — PACT_BROKER_BASE_URL unset');", soft: true, cmd: ['mvn', ['pact:publish', 'pact:verify']] }
+  - { id: contract-graphql-java, name: 'contract tests (GraphQL)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'java' && (buildTool === 'gradle' || buildTool === 'maven') && contractType === 'graphql'", soft: true, cmd: ['<%= buildTool === "gradle" ? "./gradlew" : "mvn" %>', ['<%= buildTool === "gradle" ? "test --tests *.graphql.*" : "test -Dtest=*GraphQL*" %>']] }
+  - { id: contract-grpc-java, name: 'contract tests (gRPC)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'java' && (buildTool === 'gradle' || buildTool === 'maven') && contractType === 'grpc'", soft: true, cmd: ['<%= buildTool === "gradle" ? "./gradlew" : "mvn" %>', ['<%= buildTool === "gradle" ? "test --tests *.grpc.*" : "test -Dtest=*Grpc*" %>']] }
+  - { id: contract-schema-registry-gradle, name: 'contract tests (Schema Registry)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'java' && buildTool === 'gradle' && contractType === 'message-queue'", condition: "process.env.SCHEMA_REGISTRY_URL", else: "console.log('[CHECK] contract tests (Schema Registry) ... SKIP — SCHEMA_REGISTRY_URL unset');", soft: true, cmd: ['./gradlew', ['test', '--tests', '*SchemaRegistry*']] }
+  - { id: contract-schema-registry-maven, name: 'contract tests (Schema Registry)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'java' && buildTool === 'maven' && contractType === 'message-queue'", condition: "process.env.SCHEMA_REGISTRY_URL", else: "console.log('[CHECK] contract tests (Schema Registry) ... SKIP — SCHEMA_REGISTRY_URL unset');", soft: true, cmd: ['mvn', ['test', '-Dtest=*SchemaRegistry*']] }
+  - { id: contract-pact-rust, name: 'contract tests (Pact)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'rust' && (contractType === 'rest-owned' || contractType === 'rest-public')", condition: "process.env.PACT_BROKER_BASE_URL", else: "console.log('[CHECK] contract tests (Pact) ... SKIP — PACT_BROKER_BASE_URL unset');", soft: true, cmd: ['cargo', ['test', '--test', 'pact_consumer_test']] }
+  - { id: contract-openapi-rust, name: 'contract tests (OpenAPI)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'rust' && (contractType === 'rest-owned' || contractType === 'rest-public')", soft: true, cmd: ['cargo', ['test', '--test', 'openapi_diff_test']] }
+  - { id: contract-graphql-rust, name: 'contract tests (GraphQL)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'rust' && contractType === 'graphql'", soft: true, cmd: ['cargo', ['test', '--test', 'graphql_schema_test']] }
+  - { id: contract-grpc-rust, name: 'contract tests (gRPC)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'rust' && contractType === 'grpc'", soft: true, cmd: ['cargo', ['test', '--test', 'grpc_contract_test']] }
+  - { id: contract-schema-registry-rust, name: 'contract tests (schema registry)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'rust' && contractType === 'message-queue'", condition: "process.env.SCHEMA_REGISTRY_URL", else: "console.log('[CHECK] contract tests (Schema Registry) ... SKIP — SCHEMA_REGISTRY_URL unset');", soft: true, cmd: ['cargo', ['test', '--test', 'schema_registry_test']] }
+  - { id: contract-go, name: 'contract tests', level: L2, kind: check, emitIf: "enableDebtGates && language === 'go' && contractType !== 'none'", soft: true, cmd: ['go', ['test', '-tags', 'contract', '-run', 'Contract', './...']] }
+  - { id: contract-pact-python, name: 'contract tests (Pact)', level: L2, kind: check, emitIf: "enableDebtGates && language === 'python' && contractType !== 'none'", soft: true, cmd: ['pytest', ['tests/contract/']] }
+  - { id: bdd-ignore-check, name: 'BDD @ignore check', level: L2, kind: inline, emitIf: "enableDebtGates" }
+  - { id: gdpr-controls, name: 'gdpr controls (#1251)', level: L2, kind: check, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-gdpr-controls.mjs', 'gdpr controls (#1251)')", soft: true, cmd: ['node', ['scripts/check-gdpr-controls.mjs']] }
+  - { id: bdd-ts, name: bdd, level: L2, kind: check, emitIf: "language === 'typescript' && enableDebtGates", soft: true, cmd: ['npx', ['cucumber-js']] }
+  - { id: bdd-python, name: bdd, level: L2, kind: check, emitIf: "language === 'python' && enableDebtGates", soft: true, cmd: ['pytest', ['tests/bdd/']] }
+  - { id: bdd-go, name: bdd, level: L2, kind: inline, emitIf: "language === 'go' && enableDebtGates" }
+  - { id: bdd-gradle, name: bdd, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'gradle' && enableDebtGates", soft: true, cmd: ['./gradlew', ['cucumberTest']] }
+  - { id: bdd-maven, name: bdd, level: L2, kind: check, emitIf: "language === 'java' && buildTool === 'maven' && enableDebtGates", soft: true, cmd: ['mvn', ['test', '-Dtest=*BDD*']] }
+  - { id: bdd-rust, name: bdd, level: L2, kind: inline, emitIf: "language === 'rust' && enableDebtGates" }
+  - { id: debt-ratchet, name: 'debt ratchet', level: L2, kind: check, soft: true, emitIf: "enableDebtGates", cmd: ['node', ['scripts/debt-report.mjs', '<%= ratchetFlag %>']] }
+  - { id: commit-footer-rationale, name: 'commit-footer rationale (INV-119)', level: L2, kind: check, emitIf: "governanceLevel !== 'L1' && enableDebtGates", soft: true, cmd: ['node', ['scripts/check-commit-footer-rationale.mjs']] }
+  - { id: docs-updated, name: 'docs updated with code (#356)', level: L2, kind: warn, emitIf: "governanceLevel !== 'L1' && enableDebtGates", cmd: ['node', ['scripts/check-docs.mjs']] }
+  - { id: feature-matrix, name: 'feature matrix (INV-112)', level: L2, kind: check, emitIf: "governanceLevel !== 'L1' && enableDebtGates", cmd: ['node', ['scripts/check-feature-matrix.mjs']] }
+  - { id: gap-register, name: 'gap register', level: L2, kind: check, emitIf: "governanceLevel !== 'L1' && enableDebtGates", cmd: ['node', ['scripts/gen-gap.mjs', '--check']] }
+  - { id: conformance, name: conformance, level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/conformance.mjs', 'conformance')", cmd: ['node', ['scripts/conformance.mjs', '--check']] }
+  - { id: gold-audit, name: gold-audit, level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/gold-audit.mjs', 'gold-audit')", cmd: ['node', ['scripts/gold-audit.mjs', '--check']] }
+  # No emitIf (INV-144): the runner is emitted unconditionally, so a generation-time condition here
+  # would ship a script nothing references — a dead emission, which #1331's coherence gate rejects.
+  # The runtime gateFilePresent guard plus level L2 + kind warn is what keeps it non-disruptive.
+  - { id: arc42-slots, name: 'arc42 slots (INV-144)', level: L2, kind: warn, condition: "gateFilePresent('scripts/check-arc42-slots.mjs', 'arc42 slots (INV-144)')", cmd: ['node', ['scripts/check-arc42-slots.mjs']] }
+  - { id: doc-set, name: 'doc-set', level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-doc-set.mjs', 'doc-set')", cmd: ['node', ['scripts/check-doc-set.mjs', '--check']] }
+  - { id: decision-registry, name: 'decision registry', level: L2, kind: check, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-decision-registry.mjs', 'decision registry')", cmd: ['node', ['scripts/check-decision-registry.mjs']] }
+  - { id: reuse-registry, name: 'reuse registry', level: L2, kind: check, emitIf: "enableDebtGates && typeof includeExtendedInvariants !== 'undefined' && includeExtendedInvariants", condition: "gateFilePresent('scripts/check-reuse-registry.mjs', 'reuse registry')", cmd: ['node', ['scripts/check-reuse-registry.mjs']] }
+  - { id: anti-fake-green, name: anti-fake-green, level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-anti-fake-green.mjs', 'anti-fake-green')", cmd: ['node', ['scripts/check-anti-fake-green.mjs']] }
+  - { id: module-coverage-ratchet, name: 'module coverage ratchet', level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/verify-module-coverage.mjs', 'module coverage ratchet')", cmd: ['node', ['scripts/verify-module-coverage.mjs']] }
+  - { id: agent-return, name: 'agent-return envelope (E1 #1943)', level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-agent-return.mjs', 'agent-return envelope (E1 #1943)')", cmd: ['node', ['scripts/check-agent-return.mjs']] }
+  # #2435 AC-2: hard at L2. The `refactor` phase promises a code-review dispatch; as a `warn`
+  # this could not fail a build, so a ship reached `verification` with no review dispatched.
+  # It vacuous-passes when no sidecar binds to this task/branch, so it only refuses an owed review.
+  - { id: review-completion, name: 'review completion (#2177)', level: L2, kind: check, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-review-completion.mjs', 'review completion (#2177)')", cmd: ['node', ['scripts/check-review-completion.mjs']] }
+  - { id: refutation-majority, name: 'refutation majority (E2 #1943)', level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-refutation-verdicts.mjs', 'refutation majority (E2 #1943)')", cmd: ['node', ['scripts/check-refutation-verdicts.mjs']] }
+  - { id: audit-dry-pass, name: 'audit dry-pass (E3 #1943)', level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-audit-dry-pass.mjs', 'audit dry-pass (E3 #1943)')", cmd: ['node', ['scripts/check-audit-dry-pass.mjs', '--all']] }
+  - { id: handoff-lint, name: 'handoff lint (E6a #1943)', level: L2, kind: warn, emitIf: "enableDebtGates", condition: "gateFilePresent('scripts/check-handoff-doc.mjs', 'handoff lint (E6a #1943)')", cmd: ['node', ['scripts/check-handoff-doc.mjs']] }
+  - { id: cross-model-review, name: 'cross-model review (#2358)', level: L2, kind: warn, emitIf: "enableDebtGates", cmd: ['node', ['scripts/check-cross-model-review.mjs']] }
+  # #2405 (ADR-110 follow-up, INV-138): the acceptance-criteria anchor gate. Advisory
+  # (`warn`) because the anchor is opt-in per project — the script itself is inert unless
+  # `features.acceptanceAnchor` is on, and vacuous-passes with no active task.
+  - { id: acceptance-anchor, name: 'acceptance anchor (INV-138)', level: L2, kind: warn, condition: "gateFilePresent('scripts/check-acceptance.mjs', 'acceptance anchor (INV-138)')", cmd: ['node', ['scripts/check-acceptance.mjs']] }
+  - { id: tdd-evidence, name: 'tdd-evidence (INV-131)', level: L2, kind: check, soft: true, cmd: ['node', ['scripts/check-tdd-evidence.mjs']] }
+  - { id: todo-max-age, name: 'todo max-age (INV-133)', level: L2, kind: check, soft: true, cmd: ['node', ['scripts/check-todo-max-age.mjs']] }
+  - { id: evidence-gate, name: 'evidence gate (INV-33)', level: L3, kind: inline, emitIf: "isL3Plus" }
+  - { id: local-ci-parity, name: 'local-ci-parity (INV-59)', level: L2, kind: check, emitIf: "typeof collaborationMode !== 'undefined' && collaborationMode === 'trunk-solo'", cmd: ['node', ['scripts/check-local-ci-parity.mjs']] }
+
+  # ── L3 (nightly lane, AC-2041.1 — mirrors 06-nightly-lite.yml) ────────────
+  - { id: solo-reactivation, name: 'solo reactivation', level: L3, kind: check, emitIf: "typeof collaborationMode !== 'undefined' && collaborationMode === 'trunk-solo' && isL3Plus", cmd: ['node', ['scripts/check-solo-reactivation.mjs']] }
+  - { id: nightly-audit-prod, name: 'nightly audit (prod scope)', level: L3, kind: check, emitIf: "language === 'typescript' && packageManager === 'npm'", soft: true, cmd: ['npm', ['audit', '--omit=dev', '--audit-level=high']] }
+  # #2258: go's L3 content — solo-reactivation/evidence-gate both require
+  # isL3Plus (governanceLevel >= L3) and nightly-audit-prod is typescript-only,
+  # so a go project at any governanceLevel below L3 emitted ZERO L3 gates
+  # (the layering contract's "L3 lane declares zero gates" failure). `-race`
+  # is the standard non-TS-mutation-testing nightly-lane recipe (full run, not
+  # -short — see docs/PRODUCT research on Go/Rust nightly lanes). Requires a
+  # cgo-capable C toolchain (gcc/cc) on the runner; a race in the trunk-solo
+  # cgo-less path would need a runner-capability guard, not `soft` (soft binds
+  # to graceActive, an L1→L2 grace concept, inert at L3).
+  - { id: go-race, name: 'race detector (full)', level: L3, kind: check, language: go, cmd: ['go', ['test', '-race', './...']] }
+  # #2267: Cross-language L3 content must exist even when a consumer is generated
+  # at L2: test-gate-layering verifies the declared lane before its configured
+  # governance level advances. These are full, executable lifecycle commands;
+  # no benchmark threshold is implied.
+  - { id: rust-release-tests, name: 'release tests (all targets/features)', level: L3, kind: check, language: rust, cmd: ['cargo', ['test', '--release', '--all-targets', '--all-features']] }
+  - { id: python-doctest-strict, name: 'doctest + strict markers', level: L3, kind: check, language: python, cmd: ['pytest', ['--doctest-modules', '--strict-markers']] }
+  - { id: java-lifecycle, name: 'Java lifecycle build', level: L3, kind: check, emitIf: "language === 'java' && (buildTool === 'gradle' || buildTool === 'maven')", cmd: ['<%= buildTool === "gradle" ? "./gradlew" : "mvn" %>', ['<%= buildTool === "gradle" ? "build" : "verify" %>', '-q']] }
+  - { id: kotlin-gradle-build, name: 'Gradle lifecycle build', level: L3, kind: check, emitIf: "language === 'kotlin' && buildTool === 'gradle'", cmd: ['./gradlew', ['build', '-q']] }

package/dist/templates/scripts/gen-doc-index.mjs.ejs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: Generates docs/INDEX.md from frontmatter across the target documentation corpus.
+// CATALOG: Stays separate from link validation because it writes the canonical inventory artifact.
+// CATALOG: The --check mode makes documentation inventory drift a gate failure.
+import { readFileSync, writeFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+const SKIP_SEGMENTS = new Set(['report']);
+function gitTrackedDocPaths(root) { try { return new Set(execFileSync('git', ['ls-files', 'docs/'], { cwd: root, encoding: 'utf-8' }).split('\n').filter(Boolean)); } catch { return null; } }
+function parseFrontmatter(content) { if (!content.startsWith('---\n')) return {}; const end = content.indexOf('\n---', 4); if (end === -1) return {}; const fm = {}; for (const line of content.slice(4, end).split('\n')) { const match = line.match(/^([a-z_]+):\s*(.*)$/); if (!match) continue; const raw = match[2].trim(); fm[match[1]] = raw.startsWith('[') ? [...raw.matchAll(/'([^']+)'|"([^"]+)"/g)].map((item) => item[1] ?? item[2]) : raw.replace(/^['"]|['"]$/g, ''); } return fm; }
+function firstH1(content) { return content.match(/^#\s+(.+)$/m)?.[1].trim() ?? ''; }
+function walkMarkdown(dir, indexPath) { const out = []; for (const entry of readdirSync(dir)) { const full = join(dir, entry); if (statSync(full).isDirectory()) { if (!SKIP_SEGMENTS.has(entry)) out.push(...walkMarkdown(full, indexPath)); } else if (entry.endsWith('.md') && full !== indexPath) out.push(full); } return out; }
+function tableRow(record) { return `| [${record.title}](${record.relPath}) | ${record.id || '—'} | ${record.status} | ${record.kind || '—'} |`; }
+export function collectDocs(docsDir, indexPath) { const root = resolve(docsDir, '..'); const tracked = gitTrackedDocPaths(root); return walkMarkdown(docsDir, indexPath).filter((file) => tracked === null || tracked.has(relative(root, file).split(sep).join('/'))).sort().map((file) => { const content = readFileSync(file, 'utf-8'); const fm = parseFrontmatter(content); const relPath = relative(docsDir, file).split(sep).join('/'); const tags = Array.isArray(fm.tags) ? fm.tags : []; return { relPath, title: (fm.title || firstH1(content) || relPath).replace(/\|/g, '\\|'), id: fm.canonical_id || '', status: fm.status || '—', kind: tags.find((tag) => tag.startsWith('kind/')) ?? '', tags }; }); }
+export function buildIndex(records) { const groups = new Map(); for (const record of records) { const key = record.relPath.split('/').length > 1 ? record.relPath.split('/')[0] : ''; if (!groups.has(key)) groups.set(key, []); groups.get(key).push(record); } const header = `# Documentation Index\n\n> Generated by \`scripts/gen-doc-index.mjs\` from doc frontmatter. Do not edit by hand;\n> run \`node scripts/gen-doc-index.mjs\` after adding or relabeling a doc.\n\n${records.length} documents.\n\n`; const table = '| title | canonical_id | status | kind |\n|-------|--------------|--------|------|\n'; const rootDocs = groups.get('') ?? []; const dirs = [...groups.entries()].filter(([key]) => key !== '').sort(([a], [b]) => a.localeCompare(b)); const sections = []; if (rootDocs.length) sections.push(`## docs\n\n${table}${rootDocs.map(tableRow).join('\n')}\n`); for (const [dir, docs] of dirs) sections.push(`## ${dir}\n\n${table}${docs.map(tableRow).join('\n')}\n`); return header + sections.join('\n'); }
+export async function runCli(docsDir, indexPath, check) { try { const generated = buildIndex(collectDocs(docsDir, indexPath)); if (check) { if ((existsSync(indexPath) ? readFileSync(indexPath, 'utf-8') : '') !== generated) { process.stderr.write('docs/INDEX.md is stale. Run `node scripts/gen-doc-index.mjs` and commit the result.\n'); return 1; } process.stdout.write('docs/INDEX.md is up to date.\n'); return 0; } writeFileSync(indexPath, generated); process.stdout.write(`Wrote ${indexPath}\n`); return 0; } catch (err) { process.stderr.write(`gen-doc-index: ${err instanceof Error ? err.message : String(err)}\n`); return 1; } }
+if (process.argv[1] === fileURLToPath(import.meta.url)) { const root = resolve('.'); runCli(join(root, 'docs'), join(root, 'docs', 'INDEX.md'), process.argv.includes('--check')).then((code) => process.exit(code)).catch((err) => { process.stderr.write(`gen-doc-index: ${err instanceof Error ? err.message : String(err)}\n`); process.exit(1); }); }

package/dist/templates/scripts/gen-gap.mjs.ejs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// <%= projectName %> — docs/GAP.md gap-register gate (#1887-B)
+// Generated by arbiter (src/templates/scripts/gen-gap.mjs.ejs)
+//
+// Portable, SCOPED-DOWN sibling of arbiter's own scripts/gen-gap.mjs. Arbiter's
+// version cross-references constraint-scan output, CONVERGENCE-*.md reports, and
+// .arbiter/evidence/*/tech-debt.json, then does an exact-byte regeneration diff
+// (through prettier) — none of those extra sources have a stable equivalent in an
+// arbitrary target project, and an exact-byte diff would be sensitive to that
+// project's own prettier config (or absence of one). This version derives ONLY
+// from docs/FEATURE_MATRIX.md and checks COVERAGE instead of exact regeneration:
+// every Partial/Missing feature_id in FEATURE_MATRIX.md must still be mentioned
+// in docs/GAP.md's Feature Gaps table — catching the actual defect class (a gap
+// silently dropped from the register) without the byte-fragility.
+//
+// Modes:
+//   --check (default)  fail if a Partial/Missing feature_id is missing from GAP.md
+//   --write            regenerate the Feature Gaps table (sentinel-bounded)
+//
+// Exit codes (INV-53): 0 = PASS, 1 = FAIL (drift), 2 = ERROR (file missing/parse failure)
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const ROOT = process.cwd()
+const args = process.argv.slice(2)
+const CHECK = !args.includes('--write')
+
+const MATRIX_PATH = resolve(ROOT, 'docs', 'FEATURE_MATRIX.md')
+const GAP_PATH = resolve(ROOT, 'docs', 'GAP.md')
+
+const MATRIX_START = '<!-- FEATURE_MATRIX_START -->'
+const MATRIX_END = '<!-- FEATURE_MATRIX_END -->'
+const GAP_FEATURES_START = '<!-- GAP_FEATURES_START -->'
+const GAP_FEATURES_END = '<!-- GAP_FEATURES_END -->'
+
+/** Parse FEATURE_MATRIX.md's sentinel-bounded table into { featureId, capability, status, issueRef, note }[]. */
+function parseMatrixRows(text) {
+  const start = text.indexOf(MATRIX_START)
+  const end = text.indexOf(MATRIX_END)
+  if (start === -1 || end === -1 || end <= start) return null
+
+  const block = text.slice(start + MATRIX_START.length, end)
+  const rows = []
+  for (const line of block.split('\n')) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('|')) continue
+    const cells = trimmed
+      .split('|')
+      .map((c) => c.trim())
+      .filter((_, i) => i > 0)
+    if (cells.length < 10) continue
+    const [featureId, capability, , , status, , , , issueRef, note] = cells
+    if (!featureId || featureId === 'feature_id' || /^-+$/.test(featureId)) continue
+    if (!status) continue
+    rows.push({
+      featureId,
+      capability: capability ?? '',
+      status,
+      issueRef: issueRef ?? '',
+      note: note ?? '',
+    })
+  }
+  return rows
+}
+
+/** feature_id | capability | status | severity | blocks_v1 | issue | notes */
+function buildFeatureGapsTable(gapRows) {
+  if (gapRows.length === 0) return '_No feature gaps._'
+  const lines = gapRows.map((g) => {
+    const severity = g.status === 'Missing' ? 'high' : 'medium'
+    const blocksV1 = g.status === 'Missing' ? 'yes' : 'no'
+    return `| ${g.featureId} | ${g.capability} | ${g.status} | ${severity} | ${blocksV1} | ${g.issueRef || '—'} | ${g.note || '—'} |`
+  })
+  return [
+    '| feature_id | capability | status | severity | blocks_v1 | issue | notes |',
+    '| --- | --- | --- | --- | --- | --- | --- |',
+    ...lines,
+  ].join('\n')
+}
+
+if (!existsSync(MATRIX_PATH)) {
+  process.stdout.write(`  gen-gap: ERROR — FEATURE_MATRIX.md not found at ${MATRIX_PATH}\n`)
+  process.exit(2)
+}
+
+let matrixText
+try {
+  matrixText = readFileSync(MATRIX_PATH, 'utf-8')
+} catch (err) {
+  process.stdout.write(`  gen-gap: ERROR — cannot read ${MATRIX_PATH}: ${err.message}\n`)
+  process.exit(2)
+}
+
+const allRows = parseMatrixRows(matrixText)
+if (allRows === null) {
+  process.stdout.write(`  gen-gap: ERROR — sentinel markers (${MATRIX_START}) not found\n`)
+  process.exit(2)
+}
+
+const gapRows = allRows.filter((r) => r.status === 'Partial' || r.status === 'Missing')
+
+// ─── WRITE mode: regenerate the Feature Gaps table ────────────────────────────
+if (!CHECK) {
+  if (!existsSync(GAP_PATH)) {
+    process.stdout.write(`  gen-gap: ERROR — GAP.md not found at ${GAP_PATH}\n`)
+    process.exit(2)
+  }
+  const gapText = readFileSync(GAP_PATH, 'utf-8')
+  const startIdx = gapText.indexOf(GAP_FEATURES_START)
+  const endIdx = gapText.indexOf(GAP_FEATURES_END)
+  if (startIdx === -1 || endIdx === -1 || endIdx <= startIdx) {
+    process.stdout.write(`  gen-gap: ERROR — sentinel markers (${GAP_FEATURES_START}) not found\n`)
+    process.exit(2)
+  }
+  const table = buildFeatureGapsTable(gapRows)
+  const replaced =
+    gapText.slice(0, startIdx + GAP_FEATURES_START.length) +
+    '\n\n' +
+    table +
+    '\n\n' +
+    gapText.slice(endIdx)
+  writeFileSync(GAP_PATH, replaced, 'utf-8')
+  process.stdout.write(`  gen-gap: WROTE — Feature Gaps table updated (${gapRows.length} rows)\n`)
+  process.exit(0)
+}
+
+// ─── CHECK mode: coverage — every Partial/Missing id must be mentioned in GAP.md ──
+if (!existsSync(GAP_PATH)) {
+  process.stdout.write(`  gen-gap: ERROR — GAP.md not found at ${GAP_PATH}\n`)
+  process.exit(2)
+}
+
+let gapText
+try {
+  gapText = readFileSync(GAP_PATH, 'utf-8')
+} catch (err) {
+  process.stdout.write(`  gen-gap: ERROR — cannot read ${GAP_PATH}: ${err.message}\n`)
+  process.exit(2)
+}
+
+const dropped = gapRows.filter((g) => !gapText.includes(g.featureId))
+if (dropped.length > 0) {
+  for (const g of dropped) {
+    process.stdout.write(
+      `  gen-gap: FAIL — ${g.featureId} (${g.status}) is not mentioned in docs/GAP.md — run 'node scripts/gen-gap.mjs --write'\n`,
+    )
+  }
+  process.exit(1)
+}
+
+process.stdout.write(`  gen-gap: OK — ${gapRows.length}/${gapRows.length} gaps tracked in docs/GAP.md\n`)
+process.exit(0)

package/dist/templates/scripts/gen-llms-txt.mjs.ejs

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: Generates the agent-facing llms.txt index from its hand-maintained target config.
+// CATALOG: Stays separate from the doc index because it validates curated public entry points.
+// CATALOG: The --check mode detects drift without ever rewriting a target during a gate run.
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+function renderEntry(entry) { const extra = (entry.extraLinks ?? []).map(([label, path]) => `, [${label}](${path})`).join(''); return `- [${entry.label}](${entry.path})${extra}: ${entry.description}`; }
+export function buildLlmsTxt(config, { docCount }) { const sections = config.sections.map((section) => `## ${section.heading}\n\n${section.entries.map(renderEntry).join('\n')}`); return (`# ${config.title}\n\n> ${config.summary}\n\n${config.intro}\n\n${sections.join('\n\n')}`).replace(/\{\{docCount\}\}/g, String(docCount)); }
+export function readDocCount(indexPath) { const match = readFileSync(indexPath, 'utf-8').match(/^(\d+) documents\.$/m); if (!match) throw new Error(`could not parse doc count ("N documents.") from ${indexPath}`); return Number(match[1]); }
+function extractProseLinkTargets(text) { const targets = []; const re = /\[[^\]]*\]\(([^)]+)\)/g; let match; while ((match = re.exec(text))) if (!match[1].startsWith('#') && !/^[a-z]+:/i.test(match[1])) targets.push(match[1]); return targets; }
+export function findMissingPaths(config, root) { const missing = []; for (const section of config.sections) for (const entry of section.entries) for (const path of [entry.path, ...(entry.extraLinks ?? []).map(([, extraPath]) => extraPath), ...extractProseLinkTargets(entry.description ?? '')]) if (!existsSync(resolve(root, path.replace(/\/$/, '')))) missing.push(path); return missing; }
+function loadConfig(path) { if (!existsSync(path)) return { error: `config not found: ${path}` }; try { return { config: JSON.parse(readFileSync(path, 'utf-8')) }; } catch (err) { return { error: `invalid JSON in ${path}: ${err instanceof Error ? err.message : String(err)}` }; } }
+function loadDocCount(path) { try { return { docCount: readDocCount(path) }; } catch (err) { return { error: err instanceof Error ? err.message : String(err) }; } }
+function checkDrift(path, generated) { if ((existsSync(path) ? readFileSync(path, 'utf-8') : '') !== generated) { process.stderr.write('llms.txt is stale. Run `node scripts/gen-llms-txt.mjs` and commit the result.\n'); return 1; } process.stdout.write('llms.txt is up to date.\n'); return 0; }
+export async function runCli(configPath, indexPath, outPath, check) { try { const { config, error: configErr } = loadConfig(configPath); if (configErr) { process.stderr.write(`gen-llms-txt: ${configErr}\n`); return 2; } const { docCount, error: countErr } = loadDocCount(indexPath); if (countErr) { process.stderr.write(`gen-llms-txt: ${countErr}\n`); return 2; } const missing = findMissingPaths(config, resolve(configPath, '..')); if (missing.length) { process.stderr.write(`gen-llms-txt: path(s) in ${configPath} do not exist: ${missing.join(', ')}. Update the config.\n`); return 2; } const generated = buildLlmsTxt(config, { docCount }); if (check) return checkDrift(outPath, generated); writeFileSync(outPath, generated); process.stdout.write(`Wrote ${outPath}\n`); return 0; } catch (err) { process.stderr.write(`gen-llms-txt: ${err instanceof Error ? err.message : String(err)}\n`); return 2; } }
+if (process.argv[1] === fileURLToPath(import.meta.url)) { const arg = (flag) => process.argv.find((value) => value.startsWith(flag))?.split('=')[1]; const root = resolve('.'); const configPath = arg('--config=') ? resolve(arg('--config=')) : resolve(root, 'llms-txt.config.json'); const indexPath = arg('--index=') ? resolve(arg('--index=')) : resolve(root, 'docs/INDEX.md'); const outPath = arg('--out=') ? resolve(arg('--out=')) : resolve(root, 'llms.txt'); runCli(configPath, indexPath, outPath, process.argv.includes('--check')).then((code) => process.exit(code)).catch((err) => { process.stderr.write(`gen-llms-txt: ${err instanceof Error ? err.message : String(err)}\n`); process.exit(2); }); }