@getarbiter/cli 0.5.0

package/dist/templates/ship/TICK_PROMPT.md.ejs

@@ -0,0 +1,55 @@
+# Ship driver — one stateless tick
+<% const strikeMax = (typeof e2ePolicy !== 'undefined' && e2ePolicy && e2ePolicy.escalation && typeof e2ePolicy.escalation.maxStrikes === 'number') ? e2ePolicy.escalation.maxStrikes : 2 -%>
+
+You are the ship driver agent for this repository. You operate in ONE stateless tick:
+read state, perform exactly ONE macro-action, persist state, STOP.
+
+## State (single source of truth = GitHub + the arbiter engine)
+
+- Backlog: open issues labeled `<%= shipLabel %>`. Next = label `<%= shipLabel %>:next`, else lowest number.
+- In flight: the open PR labeled `<%= shipLabel %>` (max 1 at any time).
+- Sequencing: engine-owned. Ask the engine, never decide locally:
+  - `arbiter ship #NNN` prints the current phase and the next action.
+  - `arbiter ship #NNN --advance` advances when the phase gate is green.
+- Fix-on-red is YOUR judgment from the PR's own history (no engine call): on a red gate,
+  count this gate's prior fix attempts in the PR comments and apply the <%= strikeMax %>-strike rule —
+  attempt the root-cause fix on strikes 1 through <%= strikeMax - 1 %>, escalate on strike <%= strikeMax %>.
+  Record each attempt as a PR comment so the count survives across stateless ticks.
+- `.arbiter/ship/HALT`: write a reason here when the whole run must stop.
+
+## Tick algorithm (first match wins)
+
+1. An open `<%= shipLabel %>` PR exists:
+   a. `gh pr checks <n>`; if pending, `gh pr checks <n> --watch` (the ONLY allowed wait).
+   b. All green → merge only via the method the engine prints for the merge step,
+      delete the branch, close the linked issue with an evidence comment, STOP.
+   c. Red → capture the failed log (`gh run view --log-failed > /tmp/red.log`), count
+      this gate's prior fix attempts in the PR comments, and apply the <%= strikeMax %>-strike rule:
+      - strike 1 through <%= strikeMax - 1 %> on this gate → reproduce the failed gate locally FIRST,
+        fix the ROOT CAUSE in code — never weaken tests or gates — rerun locally until
+        green, push, and comment `fix-on-red attempt <k> for <failed-check>`. STOP.
+      - the same gate already failed <%= strikeMax - 1 %> time(s) → post the diagnosis on the PR, label the
+        issue `needs-human`, pick NO new work this tick. STOP.
+2. An issue is labeled `<%= shipLabel %>:doing` but has no PR: resume it with
+   `arbiter ship #NNN` and execute the printed step (branch `task/#NNN-...`, TDD,
+   local gates, open PR "Closes #NNN" with evidence). STOP.
+3. Otherwise pick the next issue: add `<%= shipLabel %>:doing`, read it fully, comment a
+   short plan (files touched + Existing Code Survey), then proceed as in (2). STOP.
+4. No open `<%= shipLabel %>` issues: write `.arbiter/ship/HALT` ("backlog drained"),
+   post a final summary on the tracking issue. STOP.
+
+## Hard rules
+
+- Max ONE PR in flight, ONE macro-action per tick.
+- Never push without the local gate green. Never commit to main.
+- Never use `--no-verify`.
+- Never use `--admin` or any flag that bypasses branch protection, required checks,
+  or required reviews. A red required check is a red gate (fix-on-red / escalate),
+  never a merge override.
+- Merge only when the engine authorizes it: follow what `arbiter ship #NNN --advance`
+  prints for the merge step.
+- The <%= strikeMax %>-strike rule is final: once a gate has failed <%= strikeMax %> times, escalate — label `needs-human`
+  and STOP — never a further retry.
+- Never modify the driver files (`.arbiter/ship/supervisor.sh`,
+  `.arbiter/ship/TICK_PROMPT.md`) — treat edits to them as security-sensitive.
+- Ambiguity → smallest reversible interpretation, noted in the PR description.

package/dist/templates/ship/supervisor.sh.ejs

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# arbiter ship driver — stateless tick supervisor.
+# State lives on GitHub (issues, labels, PRs) and in the arbiter engine's files;
+# this loop holds none. One tick = one bounded agent run; a dead tick loses nothing.
+# Sequencing is engine-owned (`arbiter ship`); failure memory and the 2-strike policy
+# live in the PR's own comment history, read by the tick agent — this script must never
+# reimplement them.
+set -euo pipefail
+
+REPO_DIR="${1:?usage: supervisor.sh /path/to/repo}"
+MAX_TICKS="${MAX_TICKS:-40}"
+TICK_TIMEOUT="${TICK_TIMEOUT:-1500}"   # hard cap per tick, seconds
+SHIP_TICK_SLEEP="${SHIP_TICK_SLEEP:-30}"
+cd "$REPO_DIR"
+
+for i in $(seq 1 "$MAX_TICKS"); do
+  echo "=== tick $i/$MAX_TICKS $(date -Is) ==="
+  # A failed or timed-out tick logs and CONTINUES — state is already persisted;
+  # the next tick resumes from it. Only HALT or an empty backlog stop the loop.
+  if ! timeout "$TICK_TIMEOUT" <%= harnessCmd %> -p "$(cat .arbiter/ship/TICK_PROMPT.md)" \
+    --permission-mode acceptEdits --max-turns 80; then
+    echo "tick $i: exit/timeout — state persisted; next tick resumes"
+  fi
+
+  if [ -f .arbiter/ship/HALT ]; then
+    echo "HALT: $(cat .arbiter/ship/HALT)"
+    break
+  fi
+
+  # Backlog check is failure-tolerant: a GitHub hiccup must never kill the loop.
+  if ! open=$(gh issue list --label '<%= shipLabel %>' --state open --json number --jq 'length' 2>/dev/null); then
+    echo "tick $i: backlog check failed — retrying next tick"
+    sleep "$SHIP_TICK_SLEEP"
+    continue
+  fi
+  if ! [[ "$open" =~ ^[0-9]+$ ]]; then
+    echo "tick $i: backlog count unreadable — retrying next tick"
+    sleep "$SHIP_TICK_SLEEP"
+    continue
+  fi
+  if [ "$open" -eq 0 ]; then
+    echo "Backlog drained."
+    break
+  fi
+  sleep "$SHIP_TICK_SLEEP"
+done

package/dist/templates/smoke-journeys/manifest.json.ejs

@@ -0,0 +1 @@
+<%- manifestJson %>

package/dist/templates/sonar-project.properties.ejs

@@ -0,0 +1,25 @@
+# SonarCloud configuration — generated by arbiter (#211)
+# Replace PLACEHOLDER values before your first scan.
+sonar.organization=PLACEHOLDER_ORG
+sonar.projectKey=PLACEHOLDER_PROJECT_KEY
+sonar.projectName=<%- projectName.replace(/\\/g, '\\\\') %>
+sonar.qualitygate.wait=true
+<% if (language === 'java') { %>
+sonar.sources=src/main/java
+sonar.tests=src/test/java
+sonar.java.coveragePlugin=jacoco
+sonar.coverage.jacoco.xmlReportPaths=<% if (buildTool === 'gradle') { %>build/coverage/coverage.xml<% } else { %>target/coverage/jacoco.xml<% } %>
+sonar.exclusions=**/generated/**,**/target/**,**/node_modules/**
+sonar.cpd.exclusions=**/*DTO.java,**/*Request.java,**/*Response.java
+<% } else if (language === 'typescript') { %>
+sonar.sources=src
+sonar.tests=__tests__
+sonar.javascript.lcov.reportPaths=coverage/lcov.info
+sonar.exclusions=**/node_modules/**,**/dist/**,**/*.test.ts,**/*.spec.ts
+<% } else if (language === 'kotlin') { %>
+sonar.sources=src/main/kotlin
+sonar.tests=src/test/kotlin,src/test/java
+sonar.java.coveragePlugin=jacoco
+sonar.coverage.jacoco.xmlReportPaths=build/reports/kover/report.xml
+sonar.exclusions=**/generated/**,**/build/**
+<% } %>

package/dist/templates/standards/doc-profile.ejs

@@ -0,0 +1,27 @@
+# Overlays enabled for THIS repo. Conditional checks (in standards/gold-doc-set.yml) only apply
+# when their overlay is listed here. Tune to your project's shape — adding an overlay turns on the
+# doc families it gates (and the matching conditional checks in the gold registries).
+#
+# Available overlays (gate conditional doc families in standards/gold-doc-set.yml):
+#   has-plugin-api  — project exposes a public plugin/extension API
+#   has-api         — project ships an HTTP/RPC API (docs/api reference)
+#   customer-data   — project stores/processes customer or personal data
+#                     → data + security families (ER, classification, retention, PII,
+#                       threat-model, encryption, vuln-mgmt, risk-register)  [GDPR/ISO 27001]
+#   deploys         — project is deployed/operated (not a library)
+#                     → operations + legal/supply-chain + delivery + anti-falso-green families
+#                       (observability, SLO, DR-BCP, backup, incidents, SBOM, release notes)
+#   gxp             — regulated GxP context → GAMP 5 / 21 CFR Part 11 (CSV, audit-trail)
+#   has-ai          — ships AI/ML features → model card + AI risk assessment
+#   has-mobile      — ships a mobile app → store compliance + Playwright coverage
+overlays: []
+# allow: extra doc paths intentionally present that the audit should NOT flag (derogations).
+allow: []
+# tier_floor (T1b, optional): raises the collaborationMode-derived tiers{} column with max()
+# semantics (solo < small < enterprise) — a floor can only RAISE the column, never lower it, so
+# it cannot be used to dodge the anti-cathedral guardrail. Leave unset (the default): governed
+# repos are never auto-raised; right-sizing follows collaborationMode alone. Set this only when a
+# repo's OWN posture genuinely exceeds what its collaborationMode implies (e.g. a solo-maintained
+# framework published to a registry and consumed by many — see arbiter's own standards/doc-profile
+# for the worked example).
+# tier_floor: enterprise