@getarbiter/cli 0.5.0

package/dist/templates/scripts/optional-emissions.json.ejs

@@ -0,0 +1,117 @@
+{
+  "$comment": "INV-123 (#1331, #1345, #1518): manifest of intentionally-optional gate scripts. Covers BOTH coherence directions. FORWARD: check-all.mjs references a script behind an existsSync() guard but the overlay/archetype that emits it is absent \u2014 a GUARDED-missing reference. REVERSE (#1518): a script is EMITTED unconditionally but wired (referenced) only at some governance levels/overlays, so at other cells it ships present-but-unreferenced. The emission-coherence gate (scripts/check-emission-coherence.mjs) scans check-all.mjs, .claude/hooks/hooks.mjs, .githooks/*, .github/workflows/*, .claude/settings.json, the Makefile, and .claude/commands/*.md; it FAILs a GUARDED-missing reference OR an emitted-but-unreferenced scripts/check-*.mjs UNLESS that path is listed here with a non-empty rationale. An UNGUARDED-missing reference (including any Makefile-recipe or command-playbook reference, which are unguarded by construction) can NEVER be silenced by this manifest.",
+  "optional": [
+    {
+      "path": "scripts/check-doc-set.mjs",
+      "rationale": "REVERSE (#1518): emitted unconditionally as an advisory root-local CLI runner (`arbiter doc-set`), but wired (runWarnCheck 'doc-set') in check-all.mjs only at L2+ (INV-135). At L1 it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-doc-freshness.mjs",
+      "rationale": "REVERSE (#1518): T4 (gold-doc-tranches-t3-t5.md \u00a72.3) emits this fixed project-local freshness thin-runner (`arbiter doc-set --freshness`) unconditionally, but it is wired ONLY from 05-release.yml (non-starter pipelineStyle) and _monthly.yml (L3+, non-trunk-solo, non-starter) \u2014 by design, kept OUTSIDE check-all.mjs so the L2 per-commit gate never carries an expensive freshness audit (solo-developer-gate-model doctrine). Any cell resolving to 'starter' pipelineStyle (trunk-solo L1/L2, peer-review L1) ships it present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-anti-fake-green.mjs",
+      "rationale": "REVERSE (#1518): emitted unconditionally as an advisory aggregate thin-runner, but wired (runWarnCheck 'anti-fake-green') in check-all.mjs only at L2+ (INV-135). At L1 it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-cross-model-review.mjs",
+      "rationale": "REVERSE (#2358): cross-model evidence tooling is emitted at every governance level, but its advisory gate is wired only in the L2 debt-gate ring. At L1 it remains available for manual invocation without adding an L1 gate."
+    },
+    {
+      "path": "scripts/check-decision-registry.mjs",
+      "rationale": "REVERSE (#2036, #1518): emitted unconditionally (self-contained, SKIPs gracefully when no registry exists), but wired (runCheck 'decision registry') in check-all.mjs only at L2+ (enableDebtGates, same tier as doc-set/anti-fake-green above). At L1 it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/ci-classify-changes.mjs",
+      "rationale": "Emitted by the github-setup generator (L2+ only); referenced by .githooks/pre-push behind a shell `[ -f ]` guard. Absent on L1 projects, where the pre-push guard skips it gracefully."
+    },
+    {
+      "path": "scripts/publish-evidence-snapshot.mjs",
+      "rationale": "Arbiter's own nightly evidence job uses this scrubber, but ordinary governed targets do not emit it. The nightly workflow probes the generated-file manifest: never-emitted skips cleanly, while a manifest-owned scrubber later deleted from disk fails before evidence can leave the repository."
+    },
+    {
+      "path": "scripts/check-iso9001.mjs",
+      "rationale": "Emitted only for the iso9001 industry-compliance overlay (QMS RTM + doc-control + CAPA). Absent on projects without that overlay."
+    },
+    {
+      "path": "scripts/check-gdpr-controls.mjs",
+      "rationale": "Emitted only for the gdpr industry-compliance overlay (enforceable controls -> gates). Absent on projects without that overlay."
+    },
+    {
+      "path": "scripts/check-fe-boundaries.mjs",
+      "rationale": "Emitted only for frontend-spa archetype or a 'frontend' lane at L2+ (INV-102/103/104). Absent on backend/library projects."
+    },
+    {
+      "path": "scripts/verify-tokens.mjs",
+      "rationale": "Emitted only when the design-token overlay is enabled (frontend). Absent on projects without design tokens."
+    },
+    {
+      "path": "scripts/i18n-literal-scanner.mjs",
+      "rationale": "Emitted only for the i18n frontend overlay (raw-literal scan). Absent on projects without i18n."
+    },
+    {
+      "path": "scripts/verify-i18n-parity.mjs",
+      "rationale": "Emitted only for the i18n frontend overlay (catalog parity). Absent on projects without i18n."
+    },
+    {
+      "path": "scripts/verify-fe-coverage.mjs",
+      "rationale": "Emitted only when the frontend coverage overlay + fe-coverage-baseline.json are present. Absent otherwise."
+    },
+    {
+      "path": "scripts/check-bundle-size.mjs",
+      "rationale": "Emitted only when the frontend bundle-budget overlay + bundle-budget.json are present. Absent otherwise."
+    },
+    {
+      "path": "scripts/check-regulated-overlay.mjs",
+      "rationale": "Emitted only when the opt-in regulated/high-assurance governance overlay is selected (#1497). check-all.mjs references it through gateFilePresent(), so a project without the overlay skips it gracefully while a later deletion fails. Absent on projects without that overlay."
+    },
+    {
+      "path": "scripts/check-touched-vs-manifest.mjs",
+      "rationale": "REVERSE (#1943, E7/M6): invoked by the wave-drain skill at harvest time (per group, with --plan/--group/--base args), NOT by check-all.mjs \u2014 check-all has no --plan context, so wiring it there would be ceremony (a gate that runs vacuous or errors on missing args every commit). The skill is the runtime wiring; emission-coherence scans check-all/hooks/workflows/commands, not .claude/skills/. Emitted unconditionally so governed targets get the same harvest GO condition."
+    },
+    {
+      "path": "scripts/check-ci-tiers.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89), but wired (runCheck 'ci tiers') in check-all.mjs only inside the useGitHub block (INV-73). Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-action-pins.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89), but wired (runCheck 'action pins') in check-all.mjs only inside the useGitHub block (INV-75). Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-workflow-perms.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89), but wired (runCheck 'workflow perms') in check-all.mjs only inside the useGitHub block (INV-76). Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-secret-presence.mjs",
+      "rationale": "REVERSE (#2642): emitted by the anti-drift family, but wired only when GitHub workflows exist; without them it remains a manual validator."
+    },
+    {
+      "path": "scripts/check-continue-on-error.mjs",
+      "rationale": "REVERSE (#2642): emitted by the anti-drift family, but wired only when GitHub workflows exist; without them it remains a manual validator."
+    },
+    {
+      "path": "scripts/check-workflow-runners.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89, #1152), but wired (runCheck 'workflow runners') in check-all.mjs only inside the useGitHub block. Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-workflow-docs-sync.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89), but wired (runCheck 'workflow docs sync') in check-all.mjs only inside the useGitHub block. Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-workflow-test-integrity.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89), but wired (runCheck 'workflow test integrity') in check-all.mjs only inside the useGitHub block. Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-workflow-sha-pinning.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89), but wired (runCheck 'workflow sha pinning') in check-all.mjs only inside the useGitHub block. Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-workflow-job-naming.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89), but wired (runCheck 'workflow job naming') in check-all.mjs only inside the useGitHub block. Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    },
+    {
+      "path": "scripts/check-pr-size-gate.mjs",
+      "rationale": "REVERSE (#1518, #2159): emitted unconditionally by the anti-drift family (INV-89), but wired (runCheck 'pr size gate') in check-all.mjs only inside the useGitHub block. Without GitHub CI configured it ships present-but-unwired, available for manual/CI invocation."
+    }
+  ]
+}

package/dist/templates/scripts/oracle-discrimination-baseline.json.ejs

@@ -0,0 +1,6 @@
+{
+  "_comment": "Pre-existing non-discriminating E2E oracles (#2160). The gate fails only if this count GROWS. Fixing a site removes it from here — it can only improve. Regenerate with: node scripts/check-oracle-discrimination.mjs --update-baseline",
+  "_generated": "scripts/check-oracle-discrimination.mjs --update-baseline",
+  "count": 0,
+  "sites": []
+}

package/dist/templates/scripts/pid-watch.sh.ejs

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# pid-watch.sh (#2103) — coordinator-side until-loop on a bg-run.sh exit file.
+#
+# M16 terminal handoff — subagents never own waits: ALL watches belong to the
+# coordinator. This is the coordinator's wait primitive: it emits EXACTLY ONE
+# stdout line when the job ends (the exit code), so the coordinator fires at
+# most one notification per job. It reads the exit FILE, never process
+# liveness — the launching agent's session is long gone by design (that is
+# the point of bg-run.sh), so a PID-based wait would hang forever.
+#
+# Usage: pid-watch.sh <name> [--timeout-min N]
+# Env:   BG_DIR (default .arbiter/bg) — must match the bg-run.sh invocation.
+# Exit:  0 job finished; 1 job vanished without an exit code; 2 timeout/usage.
+set -euo pipefail
+
+BG_DIR="${BG_DIR:-.arbiter/bg}"
+TIMEOUT_MIN=90
+
+if [ "${1:-}" = "--self-test" ]; then
+  # Fixture with NO live process at all — proves the watcher reads the exit FILE.
+  SELF_BG_DIR=$(mktemp -d)
+  printf '42' >"$SELF_BG_DIR/gate.exit"
+  OUT=$(BG_DIR="$SELF_BG_DIR" "$0" gate)
+  rm -rf "$SELF_BG_DIR"
+  set +e
+  LINES=$(printf '%s\n' "$OUT" | grep -c .)
+  set -e
+  if [ "$LINES" != "1" ]; then
+    echo "pid-watch.sh self-test FAILED: expected exactly 1 line, got $LINES" >&2
+    exit 1
+  fi
+  case "$OUT" in
+    *42*) ;;
+    *) echo "pid-watch.sh self-test FAILED: exit code missing in: $OUT" >&2
+      exit 1 ;;
+  esac
+  echo "pid-watch.sh self-test OK (exactly one exit line)"
+  exit 0
+fi
+
+NAME=""
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --timeout-min) TIMEOUT_MIN="$2"; shift 2 ;;
+    *) NAME="$1"; shift ;;
+  esac
+done
+
+if [ -z "$NAME" ]; then
+  echo "Usage: pid-watch.sh <name> [--timeout-min N]" >&2
+  echo "       pid-watch.sh --self-test" >&2
+  exit 2
+fi
+
+PID_FILE="$BG_DIR/$NAME.pid"
+EXIT_FILE="$BG_DIR/$NAME.exit"
+LOG_FILE="$BG_DIR/$NAME.log"
+
+START=$(date +%s)
+while [ ! -f "$EXIT_FILE" ]; do
+  # The process is gone but never wrote an exit code (e.g. SIGKILL): report it
+  # instead of looping until timeout — silence is the failure mode M16 kills.
+  if [ -f "$PID_FILE" ]; then
+    pid=$(cat "$PID_FILE")
+    if ! kill -0 "$pid" 2>/dev/null; then
+      echo "bg $NAME: gone without exit code (pid $pid, see $LOG_FILE)" >&2
+      exit 1
+    fi
+  fi
+  NOW=$(date +%s)
+  if [ $((NOW - START)) -ge $((TIMEOUT_MIN * 60)) ]; then
+    echo "bg $NAME: timed out after ${TIMEOUT_MIN} min (see $LOG_FILE)" >&2
+    exit 2
+  fi
+  sleep 5
+done
+
+echo "bg $NAME: exited $(cat "$EXIT_FILE")"

package/dist/templates/scripts/pii-scan.mjs.ejs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// <%= projectName %> — PII scanner (INV-12)
+// Scans source and test files for email, phone (E.164), and credit-card patterns.
+// Reads suppressions/pii-allowlist.json to skip known fixtures/test data.
+// Exit 1 on any unallowlisted PII find — HARD gate (no grace period).
+import { readdirSync, readFileSync, existsSync } from 'node:fs';
+import { join, extname, relative } from 'node:path';
+
+const ROOT = process.cwd();
+
+const ALLOWLIST_PATH = join(ROOT, 'suppressions', 'pii-allowlist.json');
+let allowlist = [];
+if (existsSync(ALLOWLIST_PATH)) {
+  try {
+    const parsed = JSON.parse(readFileSync(ALLOWLIST_PATH, 'utf-8'));
+    if (!Array.isArray(parsed)) {
+      console.error('[PII] ERROR: suppressions/pii-allowlist.json must be a JSON array');
+      process.exit(1);
+    }
+    allowlist = parsed;
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      console.error(`[PII] ERROR: suppressions/pii-allowlist.json contains invalid JSON: ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+
+const SCAN_DIRS = ['src', 'test', 'tests', '__tests__', 'spec'].filter(
+  (d) => existsSync(join(ROOT, d)),
+);
+
+const SKIP_EXTENSIONS = new Set([
+  '.lock', '.lockb', '.png', '.jpg', '.jpeg', '.gif', '.svg',
+  '.wasm', '.bin', '.pdf', '.ico', '.zip', '.tar', '.gz',
+]);
+
+const PII_PATTERNS = [
+  { label: 'email', re: /\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\b/g },
+  { label: 'phone-E164', re: /\+\d{7,15}\b/g },
+  {
+    label: 'credit-card',
+    re: /\b(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|6(?:011|5\d{2})\d{12})\b/g,
+  },
+];
+
+function isAllowed(filePath, lineNum, matchStr) {
+  const rel = relative(ROOT, filePath).split('\\').join('/');
+  return allowlist.some((entry) => {
+    const hasFile = typeof entry.file === 'string' && entry.file.length > 0;
+    const hasLine = typeof entry.line === 'number';
+    const hasPattern = typeof entry.pattern === 'string' && entry.pattern.length > 0;
+    // Specificity floor (#1669): a suppression must be NARROW — either an exact (file + line)
+    // pair, or an exact match string. A bare file-only / line-only entry (or a substring file /
+    // pattern) is rejected so one under-specified entry cannot blanket-disable this HARD gate.
+    if (!(hasPattern || (hasFile && hasLine))) return false;
+    // File is matched by path segment (exact file, or a directory prefix), never by substring:
+    // {"file":"src"} or {"file":"r"} no longer match every path that merely contains the string.
+    if (hasFile) {
+      const ef = entry.file.split('\\').join('/');
+      const prefix = ef.endsWith('/') ? ef : ef + '/';
+      if (rel !== ef && !rel.startsWith(prefix)) return false;
+    }
+    if (hasLine && entry.line !== lineNum) return false;
+    // Pattern is matched EXACTLY, not substring-contained: {"pattern":"@"} no longer suppresses
+    // every email.
+    if (hasPattern && matchStr !== entry.pattern) return false;
+    return true;
+  });
+}
+
+function scanFile(filePath) {
+  if (SKIP_EXTENSIONS.has(extname(filePath))) return [];
+  let content;
+  try {
+    content = readFileSync(filePath, 'utf-8');
+  } catch {
+    return [];
+  }
+  const findings = [];
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const { label, re } of PII_PATTERNS) {
+      const matches = [...line.matchAll(new RegExp(re.source, 'g'))];
+      for (const m of matches) {
+        if (!isAllowed(filePath, i + 1, m[0])) {
+          findings.push({ file: relative(ROOT, filePath), line: i + 1, label, match: m[0] });
+        }
+      }
+    }
+  }
+  return findings;
+}
+
+function walk(dir, results = []) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === '.git') continue;
+      walk(full, results);
+    } else {
+      results.push(full);
+    }
+  }
+  return results;
+}
+
+const allFiles = SCAN_DIRS.flatMap((d) => walk(join(ROOT, d)));
+const allFindings = allFiles.flatMap(scanFile);
+
+if (allFindings.length === 0) {
+  console.log('[PII] No PII patterns found.');
+  process.exit(0);
+}
+
+console.error('[PII] PII patterns detected — add suppressions/pii-allowlist.json entries to suppress known test fixtures:\n');
+for (const f of allFindings.slice(0, 20)) {
+  console.error(`  ${f.file}:${f.line} [${f.label}] ${f.match}`);
+}
+if (allFindings.length > 20) {
+  console.error(`  ... and ${allFindings.length - 20} more`);
+}
+process.exit(1);