@getarbiter/cli 0.5.0

package/dist/kit/canonical-mapping.json

@@ -0,0 +1 @@
+{"$schema":"arbiter-kit-v1","source":"[tools]/KIT_gold-standard_76-dimensions_REDACTED.xlsx","revision":"Rev01 (R-08 remap)","generated_at":"2026-05-19T00:00:00Z","total_dims":78,"tml_alias_note":"tml field uses arbiter canonical M1/M2/M3; tml_source preserves XLSX L1/L2/L3; ADR-045 records the alias","dimensions":[{"id":1,"category":"Architecture","name":"Hexagonal architecture enforcement (ArchUnit)","detail":"L2: >=8 base (R-1..R-8). L3: >=20+ (port completo 39)","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["ArchitectureTests.java"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/architecture/archunit-rules-compile-time.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-001-archunit-rules-compile-time.md"},"planning_notes":"Graduale: 1 regola alla volta, partire da conformi","canonical_id":"N01","import_source":{"import_id":1,"import_name":"ArchUnit rules compile-time"},"origin":"import"},{"id":2,"category":"Architecture","name":"Package dependency rules (no domain→infra leakage)","detail":"","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/package-dependency-rules-no-domain-infra-leakage.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N02","import_source":null,"origin":"arbiter-native"},{"id":3,"category":"Architecture","name":"Interface + implementation separation rule","detail":"Ogni service: XxxService (interface) + XxxServiceImpl","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["service/*Service.java"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/architecture/interface-impl-pattern-p5.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-002-interface-impl-pattern-p5.md"},"planning_notes":"Instance: 26 service da splittare","canonical_id":"N03","import_source":{"import_id":2,"import_name":"Interface + Impl pattern (P5)"},"origin":"import"},{"id":4,"category":"Architecture","name":"No Spring annotations in domain layer","detail":"","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/no-spring-annotations-in-domain-layer.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N04","import_source":null,"origin":"arbiter-native"},{"id":5,"category":"Architecture","name":"@Async annotation only in service layer","detail":"AsyncConfig + tenant-aware task decorator in config/. MAI raw Thread","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["config/AsyncConfig.java"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/architecture/-async-tenantawaretaskdecorator-p20.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-008--async-tenantawaretaskdecorator-p20.md"},"planning_notes":"ADR-024 icebox. Audit first, fix later","canonical_id":"N05","import_source":{"import_id":8,"import_name":"@Async + tenant-aware task decorator (P20)"},"origin":"import"},{"id":6,"category":"Architecture","name":"Bean Validation constraints in domain entities only","detail":"@Valid su ogni @RequestBody DTO. JSR-380 annotations","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["controller/*.java + dto/*Request.java"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/architecture/bean-validation-valid-p8.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-003-bean-validation-valid-p8.md"},"planning_notes":"Validazione manuale if/throw -> Bean Validation","canonical_id":"N06","import_source":{"import_id":3,"import_name":"Bean Validation @Valid (P8)"},"origin":"import"},{"id":7,"category":"Architecture","name":"No circular dependencies between modules","detail":"","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/no-circular-dependencies-between-modules.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N07","import_source":null,"origin":"arbiter-native"},{"id":8,"category":"Architecture","name":"Tamper-evident audit log insert-only rule (R-audit-insert-only)","detail":"Write service -> AuditEventService field. Mapper insert-only. record() call","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["ArchitectureTests.java rules 36-39"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/audit-trail/archunit-r-36-r-38-r-39.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-075-archunit-r-36-r-38-r-39.md"},"planning_notes":"* Condizionale: se audit_event attivo","canonical_id":"N08","import_source":{"import_id":75,"import_name":"ArchUnit R-36/R-38/R-39"},"origin":"import"},{"id":9,"category":"Static Analysis","name":"Static analysis: linting (checkstyle/eslint/ruff/golangci-lint/clippy)","detail":"","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/static-analysis-linting-checkstyle-eslint-ruff-golangci-lint-clippy.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N09","import_source":null,"origin":"arbiter-native"},{"id":10,"category":"Static Analysis","name":"Static analysis: formatting (spotless/prettier/black/gofmt/rustfmt)","detail":"Google Java Format AOSP. BLOCKING in CI","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["pom.xml spotless-maven-plugin"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/static-analysis/spotless-formatting.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-010-spotless-formatting.md"},"planning_notes":"Universale, nessun adattamento","canonical_id":"N10","import_source":{"import_id":10,"import_name":"Spotless formatting"},"origin":"import"},{"id":11,"category":"Static Analysis","name":"PMD / Semgrep rules (complexity, security anti-patterns)","detail":"CognitiveComplexity&#8804;15, failOnViolation=true","tml":"M2","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["pom.xml + pmd-ruleset.xml"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/static-analysis/pmd-code-quality.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-012-pmd-code-quality.md"},"planning_notes":"Adattare ruleset se troppe violazioni iniziali","canonical_id":"N11","import_source":{"import_id":12,"import_name":"PMD code quality"},"origin":"import"},{"id":12,"category":"Static Analysis","name":"SpotBugs / null-safety analysis","detail":"Effort=Max, Threshold=Medium, baseline diff","tml":"M2","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["pom.xml spotbugs-maven-plugin"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/static-analysis/spotbugs-bug-detection.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-011-spotbugs-bug-detection.md"},"planning_notes":"Generare baseline XML prima di attivare gate","canonical_id":"N12","import_source":{"import_id":11,"import_name":"SpotBugs bug detection"},"origin":"import"},{"id":13,"category":"Static Analysis","name":"Cyclomatic complexity gate","detail":"Custom config, CC&#8804;15, failsOnError=true","tml":"M2","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["pom.xml + checkstyle.xml"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/static-analysis/checkstyle-style-enforcement.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-013-checkstyle-style-enforcement.md"},"planning_notes":null,"canonical_id":"N13","import_source":{"import_id":13,"import_name":"Checkstyle style enforcement"},"origin":"import"},{"id":14,"category":"Static Analysis","name":"Dead code detection","detail":"","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N14","import_source":null,"origin":"arbiter-native"},{"id":15,"category":"Static Analysis","name":"Code duplication ratchet (jscpd / equivalent)","detail":"","tml":"M2","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":".github/workflows/06-nightly.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W9","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N15","import_source":null,"origin":"arbiter-native"},{"id":16,"category":"Static Analysis","name":"Style token enforcement (design tokens / style guide)","detail":"","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":".github/workflows/05-release.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W9","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N16","import_source":null,"origin":"arbiter-native"},{"id":17,"category":"Test Framework","name":"Unit test framework wired (JUnit5/Vitest/pytest/go test/cargo test)","detail":"Framework base. @SpringBootTest con profili","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["pom.xml spring-boot-starter-test"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/test-framework/junit-5-spring-boot-test.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-017-junit-5-spring-boot-test.md"},"planning_notes":">=1 test per proof-of-life a L1","canonical_id":"N17","import_source":{"import_id":17,"import_name":"JUnit 5 + Spring Boot Test"},"origin":"import"},{"id":18,"category":"Test Framework","name":"Code coverage gate (JaCoCo/V8/coverage.py/go cover/cargo-tarpaulin)","detail":"L1: report only. L2: >=20% o new-code >=70%. L3: >=60%","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["pom.xml jacoco-maven-plugin"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/static-analysis/jacoco-coverage-gate.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-009-jacoco-coverage-gate.md"},"planning_notes":"Soglia progressiva: +5%/2sett","canonical_id":"N18","import_source":{"import_id":9,"import_name":"JaCoCo coverage gate"},"origin":"import"},{"id":19,"category":"Test Framework","name":"Coverage trend ratchet (no regression allowed)","detail":"","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/coverage-trend-ratchet-no-regression-allowed.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N19","import_source":null,"origin":"arbiter-native"},{"id":20,"category":"Test Framework","name":"Mutation testing (pitest/stryker/mutmut/go-mutesting/cargo-mutants)","detail":"STRONGER mutators, target >=50%. Nightly only","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"crossdb","planning_evidence_paths":["pom.xml pitest-maven-plugin"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/static-analysis/pitest-mutation-testing.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-014-pitest-mutation-testing.md"},"planning_notes":"Non in PR gate (troppo lento)","canonical_id":"N20","import_source":{"import_id":14,"import_name":"PITest mutation testing"},"origin":"import"},{"id":21,"category":"Test Framework","name":"Test isolation — no shared mutable state between tests","detail":"","tml":"M3","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"concurrent","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/test-isolation-no-shared-mutable-state-between-tests.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N21","import_source":null,"origin":"arbiter-native"},{"id":22,"category":"Test Framework","name":"Test naming convention enforced","detail":"","tml":"M3","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/test-naming-convention-enforced.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N22","import_source":null,"origin":"arbiter-native"},{"id":23,"category":"Test Framework","name":"Test TDD evidence captured (W4 protocol)","detail":"","tml":"M2","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N23","import_source":null,"origin":"arbiter-native"},{"id":24,"category":"Test Profiles","name":"Fast test profile (L1 unit only, <2 min)","detail":"behavioral, edge-case, contract, full, noauth, noliquibase","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["pom.xml <profiles>"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/java/build-profiles/surefire-profiles-maven.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-024-surefire-profiles-maven.md"},"planning_notes":"Attivare progressivamente","canonical_id":"N24","import_source":{"import_id":24,"import_name":"Surefire profiles Maven"},"origin":"import"},{"id":25,"category":"Test Profiles","name":"Extended test profile (L2: unit + integration)","detail":"","tml":"M3","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":"docs/TEST_TAXONOMY.md","arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W7","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N25","import_source":null,"origin":"arbiter-native"},{"id":26,"category":"Test Profiles","name":"Nightly/weekly test profile (L3: full suite + mutation + security)","detail":"check (~2min) | gate (~8min) | full (~30min). Sub-comandi singoli","tml":"M1","tml_source":"L3","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["run.sh"],"arbiter_target_path":"run.sh","arbiter_target_kind":"script","invariant_id":null,"implementing_wave":"W3","disposition":"adopt-self","framework_realization":{"template":null,"generator":null,"validator":"planned:scripts/run-sh-orchestrator.mjs","docs":"docs/REFERENCE/dim-026-run-sh-orchestrator.md"},"planning_notes":"L1: solo check. L2: +gate. L3: +full","canonical_id":"N26","import_source":{"import_id":26,"import_name":"run.sh orchestrator"},"origin":"import"},{"id":27,"category":"Test Types","name":"Integration tests (Spring IT / testcontainers / real-project fixtures)","detail":"Controller test con DB reale. >=60 test file a L3","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["pom.xml rest-assured + BaseIntegrationTest"],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W7","disposition":"adopt-framework","framework_realization":{"template":"planned:src/templates/java/test-framework/rest-assured-integration-tests.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-018-rest-assured-integration-tests.md"},"planning_notes":"Iniziare dai top 5 endpoint","canonical_id":"N27","import_source":{"import_id":18,"import_name":"REST Assured integration tests"},"origin":"import"},{"id":28,"category":"Test Types","name":"Contract tests (Spring Cloud Contract / Pact)","detail":"Contract test: validazione runtime vs OpenAPI spec","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["pom.xml swagger-request-validator-restassured"],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W7","disposition":"adopt-framework","framework_realization":{"template":"planned:src/templates/java/test-framework/swagger-request-validator.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-022-swagger-request-validator.md"},"planning_notes":"Richiede OpenAPI spec aggiornata","canonical_id":"N28","import_source":{"import_id":22,"import_name":"Swagger Request Validator"},"origin":"import"},{"id":29,"category":"Test Types","name":"BDD / behavioural tests (Cucumber / pytest-bdd / godog)","detail":"REST Assured end-to-end business flow. >=15 scenarios L3","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["src/test/.../behavior/"],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W7","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-028-behavioral-tests-happy-path.md"},"planning_notes":"Flussi P0 business-critical","canonical_id":"N29","import_source":{"import_id":28,"import_name":"Behavioral tests (happy path)"},"origin":"import"},{"id":30,"category":"Test Types","name":"Architectural tests (ArchUnit / structure rules)","detail":"","tml":"M3","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"template","conditional":"contract","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"F7","disposition":"adopt-framework","framework_realization":{"template":"planned:src/templates/architectural-tests-archunit-structure-rules.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N30","import_source":null,"origin":"arbiter-native"},{"id":31,"category":"Test Types","name":"Fuzz testing (Jazzer / go-fuzz / cargo-fuzz)","detail":"","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W7","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N31","import_source":null,"origin":"arbiter-native"},{"id":32,"category":"Test Types","name":"Property-based testing (QuickCheck / Hypothesis / proptest)","detail":"","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"crossdb","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N32","import_source":null,"origin":"arbiter-native"},{"id":33,"category":"Test Types","name":"Snapshot / golden-file tests","detail":"","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W7","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N33","import_source":null,"origin":"arbiter-native"},{"id":34,"category":"CI/CD","name":"Multi-tier CI pipeline (fast → extended → release → nightly → weekly)","detail":"5 stage: lint->build->fast-test->slow-test->ship","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[".github/workflows/build.yml"],"arbiter_target_path":".github/workflows/01-pr-fast.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W4","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-034-build-yml-multi-stage.md"},"planning_notes":"L2: 4 stage (no ship). L3: 5 stage","canonical_id":"N34","import_source":{"import_id":34,"import_name":"build.yml multi-stage"},"origin":"import"},{"id":35,"category":"CI/CD","name":"PR fast-feedback gate (<5 min, L1 checks only)","detail":"Primo job: validate-*.sh. Fast fail","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["build.yml quality-gates job"],"arbiter_target_path":".github/workflows/01-pr-fast.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W4","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-035-quality-gates-job-bash-scripts.md"},"planning_notes":"Aggiungere script man mano che disponibili","canonical_id":"N35","import_source":{"import_id":35,"import_name":"Quality gates job (bash scripts)"},"origin":"import"},{"id":36,"category":"CI/CD","name":"Release pipeline (tag-triggered, artifact signing)","detail":"Docker build, Trivy CRITICAL fail, {{CONTAINER_REGISTRY}} push, Azure deploy","tml":"M3","tml_source":"L3","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["build.yml ship stage"],"arbiter_target_path":".github/workflows/06-nightly.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W10","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-037-ship-stage-docker-trivy-container-r.md"},"planning_notes":"Solo servizi con deploy containerizzato","canonical_id":"N36","import_source":{"import_id":37,"import_name":"Ship stage (Docker+Trivy+{{CONTAINER_REGISTRY}}+deploy)"},"origin":"import"},{"id":37,"category":"CI/CD","name":"Nightly extended checks (mutation, DAST, performance baseline)","detail":">=6 jobs: OWASP, PITest, SBOM, ZAP, Toxiproxy, k6","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[".github/workflows/nightly.yml"],"arbiter_target_path":".github/workflows/05-release.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W9","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-036-nightly-pipeline.md"},"planning_notes":"Aggiungere job incrementalmente","canonical_id":"N37","import_source":{"import_id":36,"import_name":"Nightly pipeline"},"origin":"import"},{"id":38,"category":"CI/CD","name":"Weekly audit pipeline (dependency audit, license scan, SBOM refresh)","detail":"","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":".github/workflows/zz-issue-state.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W8","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N38","import_source":null,"origin":"arbiter-native"},{"id":39,"category":"CI/CD","name":"CI runner label SSOT (no hardcoded runner strings)","detail":"","tml":"M3","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":".github/workflows/10-k6-on-demand.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W6","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N39","import_source":null,"origin":"arbiter-native"},{"id":40,"category":"CI/CD","name":"Artifact provenance (SLSA / sigstore)","detail":"","tml":"M3","tml_source":"L3","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":".github/workflows/_newman-runner.yml","arbiter_target_kind":"workflow","invariant_id":null,"implementing_wave":"W7","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N40","import_source":null,"origin":"arbiter-native"},{"id":41,"category":"E2E & Perf","name":"E2E API tests (RestAssured / Playwright / pytest-playwright)","detail":">=20 scenari CRUD + business flow. Auth Keycloak-compatible IdP","tml":"M3","tml_source":"L3","gate_type":"BLOCKING","stack_tag":"template","conditional":"always","planning_evidence_paths":["docs/api/{service}.postman_collection.json"],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"F7","disposition":"adopt-framework","framework_realization":{"template":"planned:src/templates/test-tooling/newman-postman-e2e-collection.ejs","generator":"planned:src/generators/newman-postman-e2e-collection.ts","validator":null,"docs":"docs/REFERENCE/dim-041-newman-postman-e2e-collection.md"},"planning_notes":"Servizio-specifico","canonical_id":"N41","import_source":{"import_id":41,"import_name":"Newman/Postman E2E collection"},"origin":"import"},{"id":42,"category":"E2E & Perf","name":"Performance / load testing baseline (k6 / Locust / Gatling)","detail":">=5 scenari. Threshold p95<500ms, error<1%","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"template","conditional":"always","planning_evidence_paths":["tests/load/*.js"],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"F6","disposition":"adopt-framework","framework_realization":{"template":"planned:src/templates/test-tooling/k6-load-test-suite.ejs","generator":"planned:src/generators/k6-load-test-suite.ts","validator":null,"docs":"docs/REFERENCE/dim-042-k6-load-test-suite.md"},"planning_notes":"Servizio-specifico","canonical_id":"N42","import_source":{"import_id":42,"import_name":"k6 load test suite"},"origin":"import"},{"id":43,"category":"E2E & Perf","name":"DAST scan (OWASP ZAP / Nuclei)","detail":"OWASP ZAP scan autenticato. Nightly","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"template","conditional":"always","planning_evidence_paths":["nightly.yml zap-dast job"],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"F6","disposition":"adopt-framework","framework_realization":{"template":"planned:src/templates/test-tooling/dast-zap-authenticated.ejs","generator":"planned:src/generators/dast-zap-authenticated.ts","validator":null,"docs":"docs/REFERENCE/dim-044-dast-zap-authenticated.md"},"planning_notes":"Richiede auth config ZAP","canonical_id":"N43","import_source":{"import_id":44,"import_name":"DAST (ZAP authenticated)"},"origin":"import"},{"id":44,"category":"E2E & Perf","name":"Auth flow E2E (Keycloak-compatible IdP integration test)","detail":"","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"template","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"F8","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N44","import_source":null,"origin":"arbiter-native"},{"id":45,"category":"Scripts Validation","name":"Format validation script (check-format.sh equivalent)","detail":"","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/format-validation-script-check-format-sh-equivalent.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N45","import_source":null,"origin":"arbiter-native"},{"id":46,"category":"Scripts Validation","name":"SPDX license header check","detail":"","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/spdx-license-header-check.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N46","import_source":null,"origin":"arbiter-native"},{"id":47,"category":"Scripts Validation","name":"Orphan TODO check (no bare TODOs without task IDs)","detail":"","tml":"M2","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/orphan-todo-check-no-bare-todos-without-task-ids.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N47","import_source":null,"origin":"arbiter-native"},{"id":48,"category":"Scripts Validation","name":"Placeholder check (no template placeholders committed)","detail":"","tml":"M3","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"template","conditional":"contract","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"F7","disposition":"adopt-framework","framework_realization":{"template":"planned:src/templates/placeholder-check-no-template-placeholders-committed.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N48","import_source":null,"origin":"arbiter-native"},{"id":49,"category":"Scripts Validation","name":"Dead link / doc link integrity check","detail":"","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"template","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"F6","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N49","import_source":null,"origin":"arbiter-native"},{"id":50,"category":"Scripts Validation","name":"Bloat ratchet (bundle size / generated artifact size)","detail":"","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":"scripts/check-drift.mjs","arbiter_target_kind":"script","invariant_id":null,"implementing_wave":"W6","disposition":"adopt-self","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N50","import_source":null,"origin":"arbiter-native"},{"id":51,"category":"Scripts Quality","name":"Debt ratchet (tech-debt score gate)","detail":"","tml":"M2","tml_source":"L1","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":"scripts/debt-report.mjs","arbiter_target_kind":"script","invariant_id":null,"implementing_wave":"W6","disposition":"adopt-self","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N51","import_source":null,"origin":"arbiter-native"},{"id":52,"category":"Scripts Quality","name":"Self-dogfood check (arbiter validates itself)","detail":"","tml":"M2","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":"scripts/check-self-dogfood.mjs","arbiter_target_kind":"script","invariant_id":null,"implementing_wave":"W6","disposition":"adopt-self","framework_realization":{"template":"planned:src/templates/self-dogfood-check-arbiter-validates-itself.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N52","import_source":null,"origin":"arbiter-native"},{"id":53,"category":"Scripts Quality","name":"API snapshot test (no unintended public surface changes)","detail":"","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":"scripts/check-api-snapshot.mjs","arbiter_target_kind":"script","invariant_id":null,"implementing_wave":"W6","disposition":"adopt-self","framework_realization":{"template":"planned:src/templates/api-snapshot-test-no-unintended-public-surface-changes.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N53","import_source":null,"origin":"arbiter-native"},{"id":54,"category":"Scripts Quality","name":"Circular dependency detection","detail":"","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":"scripts/check-pii-scan.mjs","arbiter_target_kind":"script","invariant_id":null,"implementing_wave":"W6","disposition":"adopt-self","framework_realization":{"template":"planned:src/templates/circular-dependency-detection.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N54","import_source":null,"origin":"arbiter-native"},{"id":55,"category":"Security","name":"Secret scanning (Gitleaks)","detail":"gitleaks protect --staged. BLOCKING locale","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[".githooks/pre-commit"],"arbiter_target_path":".githooks/pre-commit","arbiter_target_kind":"hook","invariant_id":null,"implementing_wave":"W6","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-055-gitleaks-pre-commit-hook.md"},"planning_notes":"Universale","canonical_id":"N55","import_source":{"import_id":55,"import_name":"Gitleaks pre-commit hook"},"origin":"import"},{"id":56,"category":"Security","name":"Dependency audit (npm audit / trivy fs / cargo audit)","detail":"failBuildOnCVSS=7.0. Nightly (rate limits NVD)","tml":"M3","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":["pom.xml dependency-check-maven"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/dependency-audit-npm-audit-trivy-fs-cargo-audit.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-015-owasp-dependency-check.md"},"planning_notes":"Tollerare rate limits con continue-on-error SOLO su download","canonical_id":"N56","import_source":{"import_id":15,"import_name":"OWASP dependency-check"},"origin":"import"},{"id":57,"category":"Security","name":"Container image scan (Trivy)","detail":"Documented false positive suppressions","tml":"M3","tml_source":"L3","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[".trivyignore, .zap/rules.tsv"],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"W9","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-057--trivyignore-zap-rules-tsv.md"},"planning_notes":"Solo se Trivy/ZAP attivi","canonical_id":"N57","import_source":{"import_id":57,"import_name":".trivyignore + .zap/rules.tsv"},"origin":"import"},{"id":58,"category":"Security","name":"License scan (FOSSA / ORT / licensee)","detail":"","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"W9","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N58","import_source":null,"origin":"arbiter-native"},{"id":59,"category":"Git & GitHub","name":"Commit message format enforced (commitlint)","detail":"pre-commit (Gitleaks), commit-msg (commitlint), pre-push (run.sh)","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[".githooks/ + scripts/setup-hooks.sh"],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":null,"disposition":"done","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-059-git-hooks-githooks-3-hooks.md"},"planning_notes":"Opt-in via setup-hooks.sh","canonical_id":"N59","import_source":{"import_id":59,"import_name":"Git hooks (.githooks/ 3 hooks)"},"origin":"import"},{"id":60,"category":"Git & GitHub","name":"Branch naming convention enforced","detail":"","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"W4","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N60","import_source":null,"origin":"arbiter-native"},{"id":61,"category":"Git & GitHub","name":"PR template (description, test plan, checklist)","detail":"Quality checklist ISO P23/P10/P12","tml":"M1","tml_source":"L1","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[".github/pull_request_template.md"],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"W8","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-061-github-pr-template.md"},"planning_notes":"Copiare 1:1","canonical_id":"N61","import_source":{"import_id":61,"import_name":"GitHub PR template"},"origin":"import"},{"id":62,"category":"Git & GitHub","name":"Issue templates (bug, feature, tech-debt)","detail":"bug-report.yml, feature-request.yml, compliance-item.yml + config","tml":"M1","tml_source":"L1","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[".github/ISSUE_TEMPLATE/"],"arbiter_target_path":null,"arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"DONE","disposition":"done","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-060-github-issue-templates-3-types.md"},"planning_notes":"Copiare 1:1","canonical_id":"N62","import_source":{"import_id":60,"import_name":"GitHub issue templates (3 types)"},"origin":"import"},{"id":63,"category":"Documentation","name":"AGENTS.md / CLAUDE.md governance document","detail":"Regole gold standard + contesto servizio","tml":"M2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["CLAUDE.md"],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"DONE","disposition":"done","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-069-claude-md-with-p1-p28.md"},"planning_notes":"Personalizzare contesto servizio","canonical_id":"N63","import_source":{"import_id":69,"import_name":"CLAUDE.md with P1-P28"},"origin":"import"},{"id":64,"category":"Documentation","name":"CI/CD developer reference card","detail":"Reference card: workflow attivi/passivi, PR lifecycle, run.sh mapping, troubleshooting. Template: TPL_cicd-developer-reference","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["docs/ci/README.md"],"arbiter_target_path":"docs/TEST_TAXONOMY.md","arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W7","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-076-docs-ci-readme-md-ci-cd-developer-r.md"},"planning_notes":null,"canonical_id":"N64","import_source":{"import_id":76,"import_name":"docs/ci/README.md -- CI/CD Developer Reference"},"origin":"import"},{"id":65,"category":"Documentation","name":"Architecture decision records (ADRs)","detail":"Decisioni servizio-specifiche + cross-service refs","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["docs/adr/ADR-*.md"],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"DONE","disposition":"done","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-065-docs-adr-5-adr.md"},"planning_notes":"Almeno ADR-016/017/018/019","canonical_id":"N65","import_source":{"import_id":65,"import_name":"docs/adr/ (>=5 ADR)"},"origin":"import"},{"id":66,"category":"Documentation","name":"API / OpenAPI specification","detail":"openapi-v1.json + collection + environment","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["docs/api/"],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"DONE","disposition":"done","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-067-docs-api-openapi-postman-env.md"},"planning_notes":"JSON generato da springdoc-openapi","canonical_id":"N66","import_source":{"import_id":67,"import_name":"docs/api/ (OpenAPI + Postman + env)"},"origin":"import"},{"id":67,"category":"Documentation","name":"Runbook (operational playbook for oncall)","detail":"rollback, troubleshooting, error-codes, faq, known-issues","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["docs/runbooks/, docs/support/"],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W9","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-068-runbooks-support-docs.md"},"planning_notes":null,"canonical_id":"N67","import_source":{"import_id":68,"import_name":"Runbooks + support docs"},"origin":"import"},{"id":68,"category":"Documentation","name":"Knowledge map (cross-repo canonical paths and signal sources)","detail":"","tml":"M3","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"DONE","disposition":"done","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N68","import_source":null,"origin":"arbiter-native"},{"id":69,"category":"Configuration","name":"Runtime version SSOT (node version pinned, .nvmrc aligned)","detail":"","tml":"M1","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":null,"disposition":"done","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N69","import_source":null,"origin":"arbiter-native"},{"id":70,"category":"Configuration","name":"Environment variable safety (.env.example only, no real .env committed)","detail":".env.local.example, .env.{{TEST_ENV}}.local.example","tml":"M3","tml_source":"L1","gate_type":"BLOCKING","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[".env.*.example"],"arbiter_target_path":"src/templates/env/.env.example.ejs","arbiter_target_kind":"template","invariant_id":null,"implementing_wave":"W3","disposition":"adopt-framework","framework_realization":{"template":null,"generator":"planned:src/generators/-env-example-files.ts","validator":null,"docs":"docs/REFERENCE/dim-070--env-example-files.md"},"planning_notes":"MAI committare .env reali","canonical_id":"N70","import_source":{"import_id":70,"import_name":".env example files"},"origin":"import"},{"id":71,"category":"Configuration","name":"Feature flag / experiment registry (no undocumented flags)","detail":"","tml":"M3","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N71","import_source":null,"origin":"arbiter-native"},{"id":72,"category":"Configuration","name":"Multi-environment config (dev/staging/prod parity)","detail":"","tml":"M1","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"java_spring","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F2","disposition":"stack-adapter","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N72","import_source":null,"origin":"arbiter-native"},{"id":73,"category":"Audit Trail *","name":"Tamper-evident audit log table DDL (security-critical operations)","detail":"Append-only. BEFORE UPDATE/DELETE trigger. Liquibase changeset","tml":"M3","tml_source":"L3","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"pharma","planning_evidence_paths":["Liquibase changeset + trigger SQL"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F5","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/audit-trail/audit-event-table-db-triggers.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-073-audit-event-table-db-triggers.md"},"planning_notes":"* Solo servizi con write su dati. Raccomandata non-pharma","canonical_id":"N73","import_source":{"import_id":73,"import_name":"audit_event table + DB triggers"},"origin":"import"},{"id":74,"category":"Audit Trail *","name":"Audit trigger presence (DB-level audit trigger enforced)","detail":"","tml":"M3","tml_source":"L3","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"pharma","planning_evidence_paths":[],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F5","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/audit-trigger-presence-db-level-audit-trigger-enforced.ejs","generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N74","import_source":null,"origin":"arbiter-native"},{"id":75,"category":"Audit Trail *","name":"Audit log service interface (AuditEventService / append-only repository pattern)","detail":"record() in ogni write @Transactional. Mapper insert-only","tml":"M3","tml_source":"L3","gate_type":"BLOCKING","stack_tag":"java_spring","conditional":"pharma","planning_evidence_paths":["service/AuditEventServiceImpl.java + mapper"],"arbiter_target_path":null,"arbiter_target_kind":"adapter","invariant_id":null,"implementing_wave":"F5","disposition":"stack-adapter","framework_realization":{"template":"planned:src/templates/audit-trail/auditeventservice-auditeventmapper.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-074-auditeventservice-auditeventmapper.md"},"planning_notes":"* Condizionale: se audit_event attivo","canonical_id":"N75","import_source":{"import_id":74,"import_name":"AuditEventService + AuditEventMapper"},"origin":"import"},{"id":76,"category":"Documentation","name":"Accessibility (a11y) audit (Axe / Lighthouse / pa11y)","detail":"","tml":"M2","tml_source":"L3","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":[],"arbiter_target_path":"docs/REFERENCE/cicd-developer-reference.md","arbiter_target_kind":"doc","invariant_id":null,"implementing_wave":"W4","disposition":"adopt-framework","framework_realization":{"template":null,"generator":null,"validator":null,"docs":null},"planning_notes":null,"canonical_id":"N76","import_source":null,"origin":"arbiter-native"},{"id":77,"name":"Spring Modulith structural verification (ApplicationModules.verify())","detail":"Emits ApplicationModulesTest.java that calls ApplicationModules.of(...).verify() to detect illegal cross-module dependencies at test time.","tml":"L2","tml_source":"L2","gate_type":"BLOCKING","stack_tag":"java","conditional":"spring-boot","planning_evidence_paths":["src/test/java"],"arbiter_target_path":"src/test/java/{basePackage}/modulith/ApplicationModulesTest.java","arbiter_target_kind":"test","invariant_id":null,"implementing_wave":"W2","disposition":"generated","framework_realization":{"template":"planned:java/modulith/ApplicationModulesTest.java.ejs","generator":"src/generators/modulith.ts","validator":null,"docs":null},"planning_notes":null,"canonical_id":"N77","import_source":null,"origin":"arbiter-native"},{"id":78,"name":"Resilience patterns guide (circuit-breaker/retry/rate-limiter/timeout)","detail":"Emits docs/GOVERNANCE/RESILIENCE.md with circuit-breaker/retry/rate-limiter/timeout defaults and external-call checklist for backend archetypes.","tml":"L2","tml_source":"L2","gate_type":"ADVISORY","stack_tag":"agnostic","conditional":"always","planning_evidence_paths":["docs/GOVERNANCE/RESILIENCE.md"],"arbiter_target_path":"docs/GOVERNANCE/RESILIENCE.md","arbiter_target_kind":"doc","invariant_id":"INV-19","implementing_wave":"W4","disposition":"done","framework_realization":{"template":"planned:resilience/RESILIENCE.md.ejs","generator":"src/generators/resilience.ts","validator":null,"docs":"docs/REFERENCE/RESILIENCE.md"},"planning_notes":null,"canonical_id":"N78","import_source":null,"origin":"arbiter-native"}],"unmapped_import_dims":[{"import_id":4,"import_name":"API versioning /v1/ (P12)","detail":"context-path=/{servizio}, controller=/v1/{risorsa}","planning_evidence_paths":["application.yml + controller"],"framework_realization":{"template":"src/templates/java/architecture/api-versioning-v1-p12.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-004-api-versioning-v1-p12.md"},"planning_notes":"MAI /api come context-path"},{"import_id":5,"import_name":"DTO in package dto/ (P17-P19)","detail":"DTO separati Request/Response, MAI in Commons/model","planning_evidence_paths":["dto/*Request.java, dto/*Response.java"],"framework_realization":{"template":"src/templates/java/architecture/dto-in-package-dto-p17-p19.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-005-dto-in-package-dto-p17-p19.md"},"planning_notes":"Migrazione progressiva da Commons"},{"import_id":6,"import_name":"Constructor injection (P7)","detail":"@RequiredArgsConstructor. MAI @Autowired su campi","planning_evidence_paths":["Tutti i @Service/@Controller"],"framework_realization":{"template":"src/templates/java/architecture/constructor-injection-p7.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-006-constructor-injection-p7.md"},"planning_notes":"Controllare anche @Component"},{"import_id":7,"import_name":"Exception hierarchy RFC 7807 (P15)","detail":"{Service}Exception + ProblemDetail. MAI raw RuntimeException","planning_evidence_paths":["exception/{Service}Exception.java"],"framework_realization":{"template":"src/templates/java/architecture/exception-hierarchy-rfc-7807-p15.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-007-exception-hierarchy-rfc-7807-p15.md"},"planning_notes":"Planning: dedicated exception type extends common base exception"},{"import_id":16,"import_name":"CycloneDX SBOM","detail":"JSON output. Supply chain tracking","planning_evidence_paths":["pom.xml cyclonedx-maven-plugin"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-016-cyclonedx-sbom.md"},"planning_notes":null},{"import_id":19,"import_name":"Testcontainers PostgreSQL","detail":"DB reale in test. Sostituisce H2/mock","planning_evidence_paths":["pom.xml testcontainers + TestcontainersConfig"],"framework_realization":{"template":"src/templates/java/test-framework/testcontainers-postgresql.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-019-testcontainers-postgresql.md"},"planning_notes":null},{"import_id":20,"import_name":"Testcontainers MariaDB + MSSQL","detail":"Cross-DB compatibility. Profili dedicati","planning_evidence_paths":["pom.xml testcontainers + profili"],"framework_realization":{"template":"src/templates/java/test-framework/testcontainers-mariadb-mssql.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-020-testcontainers-mariadb-mssql.md"},"planning_notes":"Solo se servizio supporta multi-DB"},{"import_id":21,"import_name":"Testcontainers Toxiproxy","detail":"Resilience test: DB stall, latency injection","planning_evidence_paths":["DbStallResilienceTest.java"],"framework_realization":{"template":"src/templates/java/test-framework/testcontainers-toxiproxy.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-021-testcontainers-toxiproxy.md"},"planning_notes":"Non tutti i servizi necessitano"},{"import_id":23,"import_name":"Base test infrastructure","detail":"BaseIntegrationTest + TestDataFactory + JwtTestHelper + MockServicesConfig","planning_evidence_paths":["src/test/.../config/, factory/"],"framework_realization":{"template":"src/templates/java/test-framework/base-test-infrastructure.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-023-base-test-infrastructure.md"},"planning_notes":"Domain-specific, non copiare 1:1"},{"import_id":25,"import_name":"@Tag taxonomy (25 tags)","detail":"unit, integration, behavioral, edge-case, contract, etc. ArchUnit enforcement","planning_evidence_paths":["ArchitectureTests.java tag rules"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-025--tag-taxonomy-25-tags.md"},"planning_notes":"Iniziare con 10 tag base a L2"},{"import_id":27,"import_name":"Unit tests","detail":"L1: >=1 test. L2: >=20% coverage. L3: >=60%","planning_evidence_paths":["src/test/.../service/"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-027-unit-tests.md"},"planning_notes":"Coverage-first brownfield: documentare prima"},{"import_id":29,"import_name":"Edge-case tests (boundary)","detail":"Null, overflow, boundary conditions","planning_evidence_paths":["src/test/.../boundary/"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-029-edge-case-tests-boundary.md"},"planning_notes":null},{"import_id":30,"import_name":"Contract tests (OpenAPI)","detail":"Swagger Request Validator runtime. OpenApiRuntimeValidationTest","planning_evidence_paths":["src/test/.../contract/"],"framework_realization":{"template":"src/templates/testing/contract-tests-openapi.ejs","generator":"src/generators/contract-tests-openapi.ts","validator":null,"docs":"docs/REFERENCE/dim-030-contract-tests-openapi.md"},"planning_notes":null},{"import_id":31,"import_name":"Concurrent/stress tests","detail":"Thread safety, race condition, burst. @Tag('concurrency')","planning_evidence_paths":["ConcurrentBookingTest, BatchStressTest"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-031-concurrent-stress-tests.md"},"planning_notes":"Solo servizi con logica concorrente"},{"import_id":32,"import_name":"Migration tests (Liquibase rollback)","detail":"Rollback changeset, cross-DB. >=5 classi","planning_evidence_paths":["src/test/.../migration/"],"framework_realization":{"template":"src/templates/testing/migration-tests-liquibase-rollback.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-032-migration-tests-liquibase-rollback.md"},"planning_notes":"Testcontainers PG+MariaDB+MSSQL"},{"import_id":33,"import_name":"Performance Surefire tests","detail":"@Tag('performance'). Stress unit test. >=2 classi","planning_evidence_paths":["src/test/.../stress/"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-033-performance-surefire-tests.md"},"planning_notes":"Diverso da k6 (Surefire, non HTTP)"},{"import_id":38,"import_name":"issue-state.yml automation","detail":"Lifecycle issue: In Progress->In Review->Staged->Done","planning_evidence_paths":[".github/workflows/issue-state.yml"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-038-issue-state-yml-automation.md"},"planning_notes":"Copiare 1:1 da Planning"},{"import_id":39,"import_name":"Load test workflows","detail":"Manual trigger per singoli k6 test + weekly scheduled","planning_evidence_paths":[".github/workflows/load-*.yml"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-039-load-test-workflows.md"},"planning_notes":"Solo se k6 configurato"},{"import_id":40,"import_name":"Newman CI integration","detail":"Run Postman collection in CI. Gate su assertion","planning_evidence_paths":["build.yml / nightly.yml"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-040-newman-ci-integration.md"},"planning_notes":"Richiede collection Postman"},{"import_id":43,"import_name":"k6 endurance test (30min)","detail":"Memory/thread leak detection. LT-11 pattern","planning_evidence_paths":["tests/load/endurance.js"],"framework_realization":{"template":"src/templates/test-tooling/k6-endurance-test-30min.ejs","generator":"src/generators/k6-endurance-test-30min.ts","validator":null,"docs":"docs/REFERENCE/dim-043-k6-endurance-test-30min.md"},"planning_notes":null},{"import_id":45,"import_name":"validate-mybatis-xml-crud.sh","detail":"#{param} check (no ${param} SQL injection). P16","planning_evidence_paths":["scripts/validate-mybatis-xml-crud.sh"],"framework_realization":{"template":"src/templates/scripts/validators/validate-mybatis-xml-crud-sh.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-045-validate-mybatis-xml-crud-sh.md"},"planning_notes":"Universale"},{"import_id":46,"import_name":"validate-schema-isolation.sh","detail":"No cross-tenant access. P23/ADR-019","planning_evidence_paths":["scripts/validate-schema-isolation.sh"],"framework_realization":{"template":"src/templates/scripts/validators/validate-schema-isolation-sh.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-046-validate-schema-isolation-sh.md"},"planning_notes":"Universale"},{"import_id":47,"import_name":"validate-liquibase-naming.sh + crossdb.sh","detail":"Naming convention + no PG-specific SQL","planning_evidence_paths":["scripts/validate-liquibase-*.sh"],"framework_realization":{"template":"src/templates/scripts/validators/validate-liquibase-naming-sh-crossd.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-047-validate-liquibase-naming-sh-crossd.md"},"planning_notes":"Calibrare naming per servizio"},{"import_id":48,"import_name":"validate-postman-collection.sh","detail":"Integrit&#224; collection Postman","planning_evidence_paths":["scripts/validate-postman-collection.sh"],"framework_realization":{"template":"src/templates/scripts/validators/validate-postman-collection-sh.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-048-validate-postman-collection-sh.md"},"planning_notes":"Solo se Postman collection"},{"import_id":49,"import_name":"validate-nightly-k6.sh + post-run + workflow","detail":"k6 threshold, DB post-assertions, CI integrity","planning_evidence_paths":["scripts/validate-*.sh (5 script)"],"framework_realization":{"template":"src/templates/scripts/validators/validate-nightly-k6-sh-post-run-wor.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-049-validate-nightly-k6-sh-post-run-wor.md"},"planning_notes":"Solo se k6/nightly attivi"},{"import_id":50,"import_name":"check-drift.py","detail":"Configuration drift detection cross-service","planning_evidence_paths":["scripts/check-drift.py"],"framework_realization":{"template":null,"generator":null,"validator":"scripts/check-drift-py.mjs","docs":"docs/REFERENCE/dim-050-check-drift-py.md"},"planning_notes":null},{"import_id":51,"import_name":"quality-check.sh (aggregated)","detail":"Quality gate aggregato: spotless+test+jacoco+spotbugs","planning_evidence_paths":["scripts/quality-check.sh"],"framework_realization":{"template":null,"generator":null,"validator":"scripts/quality-check-sh-aggregated.mjs","docs":"docs/REFERENCE/dim-051-quality-check-sh-aggregated.md"},"planning_notes":"Crescita incrementale"},{"import_id":52,"import_name":"coverage-report.sh + arch-verify.sh","detail":"JaCoCo HTML report + ArchUnit standalone","planning_evidence_paths":["scripts/coverage-report.sh, arch-verify.sh"],"framework_realization":{"template":null,"generator":null,"validator":"scripts/coverage-report-sh-arch-verify-sh.mjs","docs":"docs/REFERENCE/dim-052-coverage-report-sh-arch-verify-sh.md"},"planning_notes":null},{"import_id":53,"import_name":"format-fix.sh + security-scan.sh","detail":"Spotless auto-fix + Gitleaks+OWASP+SpotBugs security","planning_evidence_paths":["scripts/format-fix.sh, security-scan.sh"],"framework_realization":{"template":null,"generator":null,"validator":"scripts/format-fix-sh-security-scan-sh.mjs","docs":"docs/REFERENCE/dim-053-format-fix-sh-security-scan-sh.md"},"planning_notes":null},{"import_id":54,"import_name":"pii-scan.sh","detail":"PII pattern detection (email, phone, SSN, CF, IBAN)","planning_evidence_paths":["scripts/security/pii-scan.sh"],"framework_realization":{"template":null,"generator":null,"validator":"scripts/pii-scan-sh.mjs","docs":"docs/REFERENCE/dim-054-pii-scan-sh.md"},"planning_notes":"Universale"},{"import_id":56,"import_name":"SecurityConfig hardening","detail":"anyRequest().authenticated(), CORS restrictive, CSRF","planning_evidence_paths":["config/SecurityConfig.java"],"framework_realization":{"template":"src/templates/security/securityconfig-hardening.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-056-securityconfig-hardening.md"},"planning_notes":"Servizio-specifico"},{"import_id":58,"import_name":"Docker build-args safety","detail":"No secrets in image history. Multi-stage build","planning_evidence_paths":["Dockerfile"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-058-docker-build-args-safety.md"},"planning_notes":"Solo servizi containerizzati"},{"import_id":62,"import_name":".editorconfig","detail":"Indentation/encoding consistency","planning_evidence_paths":[".editorconfig"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-062--editorconfig.md"},"planning_notes":"Copiare 1:1"},{"import_id":63,"import_name":"docs/coding-standards.md","detail":"Regole codice, naming, pattern. Servizio-specifico","planning_evidence_paths":["docs/coding-standards.md"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-063-docs-coding-standards-md.md"},"planning_notes":"Adattare package names ed esempi"},{"import_id":64,"import_name":"docs/testing/ (3 file)","detail":"master-test-plan, test-taxonomy, rtm","planning_evidence_paths":["docs/testing/*.md"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-064-docs-testing-3-file.md"},"planning_notes":"Domain-specific test mapping"},{"import_id":66,"import_name":"docs/security/ (2 file)","detail":"risk-assessment, stride-threat-model","planning_evidence_paths":["docs/security/*.md"],"framework_realization":{"template":null,"generator":null,"validator":null,"docs":"docs/REFERENCE/dim-066-docs-security-2-file.md"},"planning_notes":"Servizio-specifico, metodologia standard"},{"import_id":71,"import_name":"Seed data scripts","detail":"seed-{service}-k6.sql, seed-test-data.sh","planning_evidence_paths":["scripts/seed-*.sql"],"framework_realization":{"template":"src/templates/bootstrap/seed-data-scripts.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-071-seed-data-scripts.md"},"planning_notes":"Per k6 e E2E test"},{"import_id":72,"import_name":"Spring Boot version alignment","detail":"Tutti i moduli stessa versione parent","planning_evidence_paths":["pom.xml parent version"],"framework_realization":{"template":"src/templates/bootstrap/spring-boot-version-alignment.ejs","generator":null,"validator":null,"docs":"docs/REFERENCE/dim-072-spring-boot-version-alignment.md"},"planning_notes":"Verificare skew tra moduli"}],"import_total":76}

package/dist/kit/catalog.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+import{dirname,resolve}from"node:path";import{fileURLToPath}from"node:url";import{KitCatalogSchema}from"./schema.js";import{readFileTranslated}from"../utils/fs.js";export function kitDataPath(file){return resolve(dirname(fileURLToPath(import.meta.url)),file)}function loadCatalogFromDisk(){return KitCatalogSchema.parse(JSON.parse(readFileTranslated(kitDataPath("catalog.json"),"utf-8")))}let _catalog=null;export function loadCatalog(){return _catalog||(_catalog=loadCatalogFromDisk()),_catalog}

package/dist/kit/catalog.json

@@ -0,0 +1 @@
+[{"id":"N01","name":"Hexagonal architecture enforcement (ArchUnit)","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal"],"excludes":[]},"invLink":"INV-22","status":"partial","note":"ArchUnit rules enforced at L2 for Java hexagonal archetype; cross-stack architecture rules vary by paradigm"},{"id":"N02","name":"Package dependency rules (no domain→infra leakage)","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal"],"excludes":[]},"invLink":"INV-22","status":"partial","note":"Hexagonal layering: domain must not import infrastructure packages"},{"id":"N03","name":"Interface + implementation separation rule","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal"],"excludes":[]},"status":"missing","note":"Port/adapter pattern: repository interfaces in domain, implementations in infrastructure"},{"id":"N04","name":"No Spring annotations in domain layer","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal","spring"],"excludes":[]},"status":"missing","note":"Java/Spring-specific: domain classes must not use @Component, @Service, @Repository etc."},{"id":"N05","name":"@Async annotation only in service layer","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal","spring"],"excludes":[]},"status":"missing","note":"Java/Spring-specific: async methods must be in application/service layer, not domain"},{"id":"N06","name":"Bean Validation constraints in domain entities only","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal","spring"],"excludes":[]},"status":"missing","note":"Java/Spring: validation annotations (@NotNull, @Size etc.) confined to domain entities"},{"id":"N07","name":"No circular dependencies between modules","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-03","status":"covered","note":"Enforced by madge (TS) / ArchUnit (Java) / cargo check (Rust)"},{"id":"N08","name":"Tamper-evident audit log insert-only rule (R-audit-insert-only)","tml":"L2","gate":"BLOCKING","categoryRef":"audit_trail","archetypeGating":{"applies":[],"excludes":[]},"conditionalFlag":"audit-write-services","requiresDbEngine":["postgresql","mysql","mongodb"],"status":"missing-tracked","followupIssue":862,"note":"Tamper-evident audit log: append-only pattern enforced by architecture rule R-audit-insert-only"},{"id":"N09","name":"Static analysis: linting (checkstyle/eslint/ruff/golangci-lint/clippy)","tml":"L1","gate":"BLOCKING","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-01","status":"covered","note":"L1 gate enforces per-stack linter with zero-warning policy"},{"id":"N10","name":"Static analysis: formatting (spotless/prettier/black/gofmt/rustfmt)","tml":"L1","gate":"BLOCKING","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Format check enforced at L1 gate"},{"id":"N11","name":"PMD / Semgrep rules (complexity, security anti-patterns)","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"PMD Java-specific; Semgrep applicable cross-stack but not yet enforced"},{"id":"N12","name":"SpotBugs / null-safety analysis","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":["java"],"excludes":[]},"status":"partial","note":"SpotBugs Java-specific; TypeScript has strict null checks; Rust/Go enforce at compiler level"},{"id":"N13","name":"Cyclomatic complexity gate","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Complexity rules in golangci-lint/ruff/eslint; Java via PMD; threshold enforcement varies by stack"},{"id":"N14","name":"Dead code detection","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"knip (TS), golangci-lint deadcode (Go), cargo unused (Rust); Java via PMD"},{"id":"N15","name":"Code duplication ratchet (jscpd / equivalent)","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"jscpd wired for TS at L2 gate; Java uses PMD CPD; other stacks partial"},{"id":"N16","name":"Style token enforcement (design tokens / style guide)","tml":"L3","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"CSS/styling tokens enforced for frontend stacks; backend services use code style only"},{"id":"N17","name":"Unit test framework wired (JUnit5/Vitest/pytest/go test/cargo test)","tml":"L1","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Each stack has a canonical unit test runner wired into L1 gate"},{"id":"N18","name":"Code coverage gate (JaCoCo/V8/coverage.py/go cover/cargo-tarpaulin)","tml":"L2","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"kitThreshold":80,"arbiterThreshold":85,"status":"covered","note":"Coverage threshold enforced at L2; arbiter default 85% lines, kit baseline 80%"},{"id":"N19","name":"Coverage trend ratchet (no regression allowed)","tml":"L2","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Coverage baseline ratchet prevents regressions across PRs"},{"id":"N20","name":"Mutation testing (pitest/stryker/mutmut/go-mutesting/cargo-mutants)","tml":"L3","gate":"ADVISORY","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-29","status":"partial","note":"INV-29 enforces mutation score threshold; tooling wired per stack at L3"},{"id":"N21","name":"Test isolation — no shared mutable state between tests","tml":"L1","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Enforced by test framework config (vitest pool isolation, JUnit @DirtiesContext)"},{"id":"N22","name":"Test naming convention enforced","tml":"L1","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-06","status":"covered","note":"check-test-naming.mjs enforces naming contract at L1"},{"id":"N23","name":"Test TDD evidence captured (W4 protocol)","tml":"L2","gate":"ADVISORY","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"W4 TDD evidence under .arbiter/evidence/tdd/; enforced by check-tdd-evidence.mjs at L2"},{"id":"N24","name":"Fast test profile (L1 unit only, <2 min)","tml":"L2","gate":"BLOCKING","categoryRef":"test_profiles","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"L1 gate runs unit tests only; integration tests excluded via vitest/gradle profile"},{"id":"N25","name":"Extended test profile (L2: unit + integration)","tml":"L2","gate":"BLOCKING","categoryRef":"test_profiles","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"L2 gate runs full test suite including integration tests"},{"id":"N26","name":"Nightly/weekly test profile (L3: full suite + mutation + security)","tml":"L3","gate":"BLOCKING","categoryRef":"test_profiles","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"T4/T5 nightly+weekly CI tiers run mutation, DAST, fuzz, full security scans"},{"id":"N27","name":"Integration tests (Spring IT / testcontainers / real-project fixtures)","tml":"L1","gate":"BLOCKING","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Real-project fixture tests run per stack; integration tests in L2 profile"},{"id":"N28","name":"Contract tests (Spring Cloud Contract / Pact)","tml":"L2","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Contract testing enforced at L2 for service APIs; coverage varies by stack"},{"id":"N29","name":"BDD / behavioural tests (Cucumber / pytest-bdd / godog)","tml":"L2","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"BDD tooling available cross-stack; enforcement level varies by archetype"},{"id":"N30","name":"Architectural tests (ArchUnit / structure rules)","tml":"L2","gate":"BLOCKING","categoryRef":"test_types","archetypeGating":{"applies":["hexagonal"],"excludes":[]},"status":"partial","note":"Architecture rule tests wired for hexagonal archetype; other archetypes use static analysis"},{"id":"N31","name":"Fuzz testing (Jazzer / go-fuzz / cargo-fuzz)","tml":"L3","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Fuzz testing supported at L3 nightly tier; tooling coverage varies by stack"},{"id":"N32","name":"Property-based testing (QuickCheck / Hypothesis / proptest)","tml":"L3","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Property-based testing not yet wired into arbiter gate; follow-up opportunity"},{"id":"N33","name":"Snapshot / golden-file tests","tml":"L2","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Snapshot tests used in arbiter self-tests (api-snapshot.mjs); pattern available cross-stack"},{"id":"N34","name":"Multi-tier CI pipeline (fast → extended → release → nightly → weekly)","tml":"L2","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-73","status":"covered","note":"6-tier CI model (T0..T5) enforced by workflow runner checks and ci-alignment gate"},{"id":"N35","name":"PR fast-feedback gate (<5 min, L1 checks only)","tml":"L2","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-73","status":"covered","note":"T1 (check subcommand) completes in ~2 min; T2 (gate) in ~10 min"},{"id":"N36","name":"Release pipeline (tag-triggered, artifact signing)","tml":"L3","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-79","status":"covered","note":"Release workflow signs artifacts with cosign; SLSA provenance via attest-build-provenance"},{"id":"N37","name":"Nightly extended checks (mutation, DAST, performance baseline)","tml":"L3","gate":"ADVISORY","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-76","status":"covered","note":"T4 nightly tier runs mutation + DAST + fuzz; heartbeat monitor keeps pipeline honest"},{"id":"N38","name":"Weekly audit pipeline (dependency audit, license scan, SBOM refresh)","tml":"L3","gate":"ADVISORY","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"T5 weekly tier runs npm audit, license scan, SBOM refresh, gitleaks full scan"},{"id":"N39","name":"CI runner label SSOT (no hardcoded runner strings)","tml":"L2","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-13","status":"covered","note":"INV-13 enforces CI_BUILD_RUNNER_LABEL repo variable as SSOT; downstream-generated check-workflow-runners gates this in target repos"},{"id":"N40","name":"Artifact provenance (SLSA / sigstore)","tml":"L3","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-78","status":"covered","note":"SLSA provenance generated via actions/attest-build-provenance for all release artifacts"},{"id":"N41","name":"E2E API tests (RestAssured / Playwright / pytest-playwright)","tml":"L3","gate":"BLOCKING","categoryRef":"e2e_perf","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"E2E tests wired at L3 nightly tier; Playwright for browser stacks, RestAssured for Java APIs"},{"id":"N42","name":"Performance / load testing baseline (k6 / Locust / Gatling)","tml":"L3","gate":"ADVISORY","categoryRef":"e2e_perf","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Performance testing tooling not yet generated by arbiter; follow-up opportunity"},{"id":"N43","name":"DAST scan (OWASP ZAP / Nuclei)","tml":"L3","gate":"ADVISORY","categoryRef":"e2e_perf","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"DAST wired at T4 nightly tier; ZAP scan against running service"},{"id":"N44","name":"Auth flow E2E (Keycloak-compatible IdP integration test)","tml":"L3","gate":"ADVISORY","categoryRef":"e2e_perf","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Auth E2E testing against a Keycloak-compatible IdP; not yet generated by arbiter"},{"id":"N45","name":"Format validation script (check-format.sh equivalent)","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Format check is part of L1 gate (prettier/spotless/black/gofmt/rustfmt)"},{"id":"N46","name":"SPDX license header check","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-20","status":"covered","note":"check-spdx-headers.mjs enforces Apache-2.0 SPDX headers at L1"},{"id":"N47","name":"Orphan TODO check (no bare TODOs without task IDs)","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-06","status":"covered","note":"check-no-orphan-todo.mjs gates orphan TODOs at L1; post-edit hook enforces inline"},{"id":"N48","name":"Placeholder check (no template placeholders committed)","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"check-no-placeholders.mjs gates placeholder patterns at L1"},{"id":"N49","name":"Dead link / doc link integrity check","tml":"L2","gate":"ADVISORY","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"check-doc-links.mjs validates internal doc links at L1 gate"},{"id":"N50","name":"Bloat ratchet (bundle size / generated artifact size)","tml":"L2","gate":"ADVISORY","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"check-bloat-ratchet.mjs enforces size baseline at L1; refuses shrink without --allow-shrink"},{"id":"N51","name":"Debt ratchet (tech-debt score gate)","tml":"L1","gate":"ADVISORY","categoryRef":"scripts_quality","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"debt-report.mjs --gate enforced at L2; debt score cannot increase without explicit override"},{"id":"N52","name":"Self-dogfood check (arbiter validates itself)","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_quality","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-75","status":"covered","note":"INV-75/76: downstream check-action-pins + check-workflow-perms gates run at L1 in target repos; arbiter self-dogfood retired during CI freeze (#862)"},{"id":"N53","name":"API snapshot test (no unintended public surface changes)","tml":"L2","gate":"BLOCKING","categoryRef":"scripts_quality","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"check-api-snapshot.mjs gates API surface at L1; changes require explicit snapshot update"},{"id":"N54","name":"Circular dependency detection","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_quality","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-03","status":"covered","note":"madge --circular at L1 gate; post-edit hook checks after every TS/JS edit"},{"id":"N55","name":"Secret scanning (Gitleaks)","tml":"L1","gate":"BLOCKING","categoryRef":"security","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-24","status":"covered","note":"Gitleaks on staged files (pre-commit hook) + full repo scan at L2 gate"},{"id":"N56","name":"Dependency audit (npm audit / trivy fs / cargo audit)","tml":"L2","gate":"BLOCKING","categoryRef":"security","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"npm audit at L2 gate; cargo audit / pip-audit supported; blocks on HIGH+ severity"},{"id":"N57","name":"Container image scan (Trivy)","tml":"L3","gate":"BLOCKING","categoryRef":"security","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Trivy container scan at T5 weekly tier; generated for services with Dockerfile"},{"id":"N58","name":"License scan (FOSSA / ORT / licensee)","tml":"L3","gate":"ADVISORY","categoryRef":"security","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"License scan at T5 weekly tier; blocks on GPL/AGPL in permissively-licensed services"},{"id":"N59","name":"Commit message format enforced (commitlint)","tml":"L1","gate":"BLOCKING","categoryRef":"git_github","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"commitlint wired at L1 gate + post-commit hook checks format after every commit"},{"id":"N60","name":"Branch naming convention enforced","tml":"L1","gate":"BLOCKING","categoryRef":"git_github","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"task/* branch convention enforced by execution protocol; pre-commit guard via AGENTS.md"},{"id":"N61","name":"PR template (description, test plan, checklist)","tml":"L1","gate":"ADVISORY","categoryRef":"git_github","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":".github/pull_request_template.md generated for target projects"},{"id":"N62","name":"Issue templates (bug, feature, tech-debt)","tml":"L1","gate":"ADVISORY","categoryRef":"git_github","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"GitHub issue templates generated for target projects"},{"id":"N63","name":"AGENTS.md / CLAUDE.md governance document","tml":"L2","gate":"BLOCKING","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"AGENTS.md generated as AAIF-standard governance doc for all arbiter-managed projects"},{"id":"N64","name":"CI/CD developer reference card","tml":"L2","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"CI developer reference template provided (TPL_cicd-developer-reference); generator deferred to Phase D"},{"id":"N65","name":"Architecture decision records (ADRs)","tml":"L2","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"docs/SYSTEM/DECISIONS.md generated and maintained as ADR log for arbiter-managed projects"},{"id":"N66","name":"API / OpenAPI specification","tml":"L3","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"OpenAPI spec generation not yet in arbiter scope; follow-up opportunity"},{"id":"N67","name":"Runbook (operational playbook for oncall)","tml":"L3","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Operational runbook template not yet generated; follow-up opportunity"},{"id":"N68","name":"Knowledge map (cross-repo canonical paths and signal sources)","tml":"L3","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Canonical signal sources self-documented via .claude/knowledge-map.json track routing + the generated wiki/ (Obsidian viewer); bespoke knowledge-map gate retired in #1244"},{"id":"N69","name":"Runtime version SSOT (node version pinned, .nvmrc aligned)","tml":"L1","gate":"BLOCKING","categoryRef":"configuration","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-14","status":"covered","note":"check-node-version-ssot.mjs enforces single source of truth for node version at L1"},{"id":"N70","name":"Environment variable safety (.env.example only, no real .env committed)","tml":"L1","gate":"BLOCKING","categoryRef":"configuration","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-24","status":"covered","note":"Gitleaks catches .env commits; arbiter generates only .env.*.example templates"},{"id":"N71","name":"Feature flag / experiment registry (no undocumented flags)","tml":"L2","gate":"ADVISORY","categoryRef":"configuration","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"src/experimental/registry.ts enforces known-experiment guard; unknown flag = exit 1"},{"id":"N72","name":"Multi-environment config (dev/staging/prod parity)","tml":"L3","gate":"ADVISORY","categoryRef":"configuration","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Multi-env config templates not yet generated by arbiter; follow-up opportunity"},{"id":"N73","name":"Tamper-evident audit log table DDL (security-critical operations)","tml":"L3","gate":"BLOCKING","categoryRef":"audit_trail","archetypeGating":{"applies":[],"excludes":[]},"conditionalFlag":"audit-write-services","requiresDbEngine":["postgresql","mysql","mongodb"],"status":"missing-tracked","followupIssue":862,"note":"Tamper-evident audit log for security-critical operations; DDL with insert-only grants and created_at immutability"},{"id":"N74","name":"Audit trigger presence (DB-level audit trigger enforced)","tml":"L3","gate":"BLOCKING","categoryRef":"audit_trail","archetypeGating":{"applies":[],"excludes":[]},"conditionalFlag":"audit-write-services","requiresDbEngine":["postgresql","mysql"],"status":"missing-tracked","followupIssue":862,"note":"Database trigger enforces audit log population for security-critical write operations"},{"id":"N75","name":"Audit log service interface (AuditEventService / append-only repository pattern)","tml":"L3","gate":"BLOCKING","categoryRef":"audit_trail","archetypeGating":{"applies":[],"excludes":[]},"conditionalFlag":"audit-write-services","requiresDbEngine":["postgresql","mysql","mongodb"],"status":"missing-tracked","followupIssue":862,"note":"Append-only repository pattern for audit events; no update/delete operations permitted in service layer"},{"id":"N76","name":"Accessibility (a11y) audit (Axe / Lighthouse / pa11y)","tml":"L3","gate":"ADVISORY","categoryRef":"a11y","archetypeGating":{"applies":["frontend","fullstack"],"excludes":["backend","api"]},"status":"partial","note":"a11y auditing for frontend archetypes; INV-61 enforces a11y gate when frontend present"},{"id":"N77","name":"Spring Modulith structural verification (ApplicationModules.verify())","tml":"L2","gate":"BLOCKING","categoryRef":"module_boundaries","archetypeGating":{"applies":["backend","api","fullstack"],"excludes":["frontend","cli","embedded"]},"conditionalFlag":"spring-boot","status":"covered","note":"Spring Modulith verifies no cyclic module dependencies and no forbidden cross-module access. Requires spring-modulith-test on the classpath."},{"id":"N78","name":"Resilience patterns guide (circuit-breaker/retry/rate-limiter/timeout)","tml":"L2","gate":"ADVISORY","categoryRef":"resilience","archetypeGating":{"applies":["backend","api","fullstack"],"excludes":["frontend","cli","embedded"]},"invLink":"INV-19","status":"covered","note":"Resilience patterns guide emitted for external-call-heavy archetypes. cockatiel (TS) + Resilience4j (Java) concrete blocks. INV-19 governs external-call resilience."}]

package/dist/kit/derived.json

@@ -0,0 +1 @@
+[{"id":"N01","name":"Hexagonal architecture enforcement (ArchUnit)","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal"],"excludes":[]},"invLink":"INV-22","status":"partial","note":"ArchUnit rules enforced at L2 for Java hexagonal archetype; cross-stack architecture rules vary by paradigm","perStack":{"java":{"kind":"tool","tool":"ArchUnit","matrixCategory":"architecture"},"typescript":{"kind":"tool","tool":"eslint-plugin-boundaries","matrixCategory":"architecture"},"python":{"kind":"tool","tool":"import-linter + ruff","matrixCategory":"architecture"},"go":{"kind":"tool","tool":"golangci-lint (depguard)","matrixCategory":"architecture"},"rust":{"kind":"tool","tool":"cargo-deny + clippy","matrixCategory":"architecture"}}},{"id":"N02","name":"Package dependency rules (no domain→infra leakage)","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal"],"excludes":[]},"invLink":"INV-22","status":"partial","note":"Hexagonal layering: domain must not import infrastructure packages","perStack":{"java":{"kind":"tool","tool":"ArchUnit","matrixCategory":"architecture"},"typescript":{"kind":"tool","tool":"eslint-plugin-boundaries","matrixCategory":"architecture"},"python":{"kind":"tool","tool":"import-linter + ruff","matrixCategory":"architecture"},"go":{"kind":"tool","tool":"golangci-lint (depguard)","matrixCategory":"architecture"},"rust":{"kind":"tool","tool":"cargo-deny + clippy","matrixCategory":"architecture"}}},{"id":"N03","name":"Interface + implementation separation rule","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal"],"excludes":[]},"status":"missing","note":"Port/adapter pattern: repository interfaces in domain, implementations in infrastructure","perStack":{"java":{"kind":"tool","tool":"ArchUnit","matrixCategory":"architecture"},"typescript":{"kind":"equivalent","arbiterSlot":"static_analysis","reason":"TypeScript interfaces enforce port/adapter separation via type system; no runtime ArchUnit equivalent needed — compiler enforces boundary at build time"},"python":{"kind":"equivalent","arbiterSlot":"static_analysis","reason":"Python abstract base classes (ABC) provide interface/implementation separation; mypy enforces type contracts at analysis time"},"go":{"kind":"equivalent","arbiterSlot":"architecture","reason":"Go implicit interfaces naturally enforce port/adapter pattern; no explicit separation tool needed — compiler guarantees interface satisfaction"},"rust":{"kind":"equivalent","arbiterSlot":"architecture","reason":"Rust traits provide strong interface/implementation separation enforced at compile time; no additional runtime rule needed"}}},{"id":"N04","name":"No Spring annotations in domain layer","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal","spring"],"excludes":[]},"status":"missing","note":"Java/Spring-specific: domain classes must not use @Component, @Service, @Repository etc.","perStack":{"java":{"kind":"tool","tool":"ArchUnit","matrixCategory":"architecture"},"typescript":{"kind":"na-by-paradigm","reason":"Spring annotations are Java/Spring-specific; TypeScript uses decorators differently and has no equivalent Spring container concept to restrict"},"python":{"kind":"na-by-paradigm","reason":"Spring annotations are Java/Spring-specific; Python frameworks use different DI patterns without the Spring component model"},"go":{"kind":"na-by-paradigm","reason":"Spring annotations are Java/Spring-specific; Go uses explicit dependency injection without annotation-based component scanning"},"rust":{"kind":"na-by-paradigm","reason":"Spring annotations are Java/Spring-specific; Rust has no annotation-based IoC container concept"}}},{"id":"N05","name":"@Async annotation only in service layer","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal","spring"],"excludes":[]},"status":"missing","note":"Java/Spring-specific: async methods must be in application/service layer, not domain","perStack":{"java":{"kind":"tool","tool":"ArchUnit","matrixCategory":"architecture"},"typescript":{"kind":"na-by-paradigm","reason":"@Async annotation is Spring-specific; TypeScript uses async/await natively at any layer without constraint enforcement needed"},"python":{"kind":"na-by-paradigm","reason":"@Async annotation is Spring-specific; Python asyncio does not require layer-restricted async placement"},"go":{"kind":"na-by-paradigm","reason":"@Async annotation is Spring-specific; Go goroutines are used without layer restrictions and require no constraint enforcement"},"rust":{"kind":"na-by-paradigm","reason":"@Async annotation is Spring-specific; Rust async/await has no layer constraint by paradigm"}}},{"id":"N06","name":"Bean Validation constraints in domain entities only","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":["hexagonal","spring"],"excludes":[]},"status":"missing","note":"Java/Spring: validation annotations (@NotNull, @Size etc.) confined to domain entities","perStack":{"java":{"kind":"tool","tool":"ArchUnit","matrixCategory":"architecture"},"typescript":{"kind":"equivalent","arbiterSlot":"static_analysis","reason":"TypeScript uses Zod or class-validator for validation; constraint on domain-only placement enforced via linting rules rather than annotation restriction"},"python":{"kind":"equivalent","arbiterSlot":"static_analysis","reason":"Pydantic models in Python serve as domain validation constraint holders; placement enforced by project structure conventions"},"go":{"kind":"na-by-paradigm","reason":"Go validation uses struct tags or explicit validation functions; no Java-style Bean Validation annotation concept exists in Go paradigm"},"rust":{"kind":"na-by-paradigm","reason":"Rust uses type-driven validation (newtype pattern, From/TryFrom traits); no annotation-based validation concept analogous to Bean Validation"}}},{"id":"N07","name":"No circular dependencies between modules","tml":"L2","gate":"BLOCKING","categoryRef":"architecture","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-03","status":"covered","note":"Enforced by madge (TS) / ArchUnit (Java) / cargo check (Rust)","perStack":{"java":{"kind":"tool","tool":"ArchUnit","matrixCategory":"architecture"},"typescript":{"kind":"tool","tool":"eslint-plugin-boundaries","matrixCategory":"architecture"},"python":{"kind":"tool","tool":"import-linter + ruff","matrixCategory":"architecture"},"go":{"kind":"tool","tool":"golangci-lint (depguard)","matrixCategory":"architecture"},"rust":{"kind":"tool","tool":"cargo-deny + clippy","matrixCategory":"architecture"}}},{"id":"N08","name":"Tamper-evident audit log insert-only rule (R-audit-insert-only)","tml":"L2","gate":"BLOCKING","categoryRef":"audit_trail","archetypeGating":{"applies":[],"excludes":[]},"conditionalFlag":"audit-write-services","requiresDbEngine":["postgresql","mysql","mongodb"],"status":"missing-tracked","followupIssue":862,"note":"Tamper-evident audit log: append-only pattern enforced by architecture rule R-audit-insert-only","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap","followupIssue":862,"reason":"Tamper-evident audit log architecture rule not yet generated for TypeScript; conditional on audit-write-services flag; Phase G of sibling epic covers per-stack generators"},"python":{"kind":"gap","followupIssue":862,"reason":"Tamper-evident audit log architecture rule not yet generated for Python; conditional on audit-write-services flag; Phase G of sibling epic covers per-stack generators"},"go":{"kind":"gap","followupIssue":862,"reason":"Tamper-evident audit log architecture rule not yet generated for Go; conditional on audit-write-services flag; Phase G of sibling epic covers per-stack generators"},"rust":{"kind":"gap","followupIssue":862,"reason":"Tamper-evident audit log architecture rule not yet generated for Rust; conditional on audit-write-services flag; Phase G of sibling epic covers per-stack generators"}}},{"id":"N09","name":"Static analysis: linting (checkstyle/eslint/ruff/golangci-lint/clippy)","tml":"L1","gate":"BLOCKING","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-01","status":"covered","note":"L1 gate enforces per-stack linter with zero-warning policy","perStack":{"java":{"kind":"tool","tool":"checkstyle+pmd+spotbugs+spotless","matrixCategory":"static_analysis"},"typescript":{"kind":"tool","tool":"eslint+prettier","matrixCategory":"static_analysis"},"python":{"kind":"tool","tool":"ruff","matrixCategory":"static_analysis"},"go":{"kind":"tool","tool":"golangci-lint","matrixCategory":"static_analysis"},"rust":{"kind":"tool","tool":"clippy","matrixCategory":"static_analysis"}}},{"id":"N10","name":"Static analysis: formatting (spotless/prettier/black/gofmt/rustfmt)","tml":"L1","gate":"BLOCKING","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Format check enforced at L1 gate","perStack":{"java":{"kind":"tool","tool":"checkstyle+pmd+spotbugs+spotless","matrixCategory":"static_analysis"},"typescript":{"kind":"tool","tool":"eslint+prettier","matrixCategory":"static_analysis"},"python":{"kind":"tool","tool":"ruff","matrixCategory":"static_analysis"},"go":{"kind":"tool","tool":"golangci-lint","matrixCategory":"static_analysis"},"rust":{"kind":"tool","tool":"clippy","matrixCategory":"static_analysis"}}},{"id":"N11","name":"PMD / Semgrep rules (complexity, security anti-patterns)","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"PMD Java-specific; Semgrep applicable cross-stack but not yet enforced","perStack":{"java":{"kind":"tool","tool":"checkstyle+pmd+spotbugs+spotless","matrixCategory":"static_analysis"},"typescript":{"kind":"tool","tool":"eslint+prettier","matrixCategory":"static_analysis"},"python":{"kind":"tool","tool":"ruff","matrixCategory":"static_analysis"},"go":{"kind":"tool","tool":"golangci-lint","matrixCategory":"static_analysis"},"rust":{"kind":"tool","tool":"clippy","matrixCategory":"static_analysis"}}},{"id":"N12","name":"SpotBugs / null-safety analysis","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":["java"],"excludes":[]},"status":"partial","note":"SpotBugs Java-specific; TypeScript has strict null checks; Rust/Go enforce at compiler level","perStack":{"java":{"kind":"tool","tool":"checkstyle+pmd+spotbugs+spotless","matrixCategory":"static_analysis"},"typescript":{"kind":"equivalent","arbiterSlot":"static_analysis","reason":"TypeScript strict null checks + noUncheckedIndexedAccess enforce null-safety at compile time; equivalent to SpotBugs null analysis for Java"},"python":{"kind":"equivalent","arbiterSlot":"static_analysis","reason":"mypy with strict mode enforces null/None safety for Python; equivalent null analysis to SpotBugs in the Python ecosystem"},"go":{"kind":"na-by-paradigm","reason":"Go eliminates null pointer exceptions via explicit error returns and zero values; SpotBugs-style null analysis is not applicable to the Go paradigm"},"rust":{"kind":"na-by-paradigm","reason":"Rust eliminates null via Option<T> enforced at compile time; SpotBugs-style null analysis has no equivalent role in the Rust paradigm"}}},{"id":"N13","name":"Cyclomatic complexity gate","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Complexity rules in golangci-lint/ruff/eslint; Java via PMD; threshold enforcement varies by stack","perStack":{"java":{"kind":"tool","tool":"checkstyle+pmd+spotbugs+spotless","matrixCategory":"static_analysis"},"typescript":{"kind":"tool","tool":"eslint+prettier","matrixCategory":"static_analysis"},"python":{"kind":"tool","tool":"ruff","matrixCategory":"static_analysis"},"go":{"kind":"tool","tool":"golangci-lint","matrixCategory":"static_analysis"},"rust":{"kind":"tool","tool":"clippy","matrixCategory":"static_analysis"}}},{"id":"N14","name":"Dead code detection","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"knip (TS), golangci-lint deadcode (Go), cargo unused (Rust); Java via PMD","perStack":{"java":{"kind":"tool","tool":"checkstyle+pmd+spotbugs+spotless","matrixCategory":"static_analysis"},"typescript":{"kind":"tool","tool":"eslint+prettier","matrixCategory":"static_analysis"},"python":{"kind":"tool","tool":"ruff","matrixCategory":"static_analysis"},"go":{"kind":"tool","tool":"golangci-lint","matrixCategory":"static_analysis"},"rust":{"kind":"tool","tool":"clippy","matrixCategory":"static_analysis"}}},{"id":"N15","name":"Code duplication ratchet (jscpd / equivalent)","tml":"L2","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"jscpd wired for TS at L2 gate; Java uses PMD CPD; other stacks partial","perStack":{"java":{"kind":"tool","tool":"checkstyle+pmd+spotbugs+spotless","matrixCategory":"static_analysis"},"typescript":{"kind":"tool","tool":"eslint+prettier","matrixCategory":"static_analysis"},"python":{"kind":"tool","tool":"ruff","matrixCategory":"static_analysis"},"go":{"kind":"tool","tool":"golangci-lint","matrixCategory":"static_analysis"},"rust":{"kind":"tool","tool":"clippy","matrixCategory":"static_analysis"}}},{"id":"N16","name":"Style token enforcement (design tokens / style guide)","tml":"L3","gate":"ADVISORY","categoryRef":"static_analysis","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"CSS/styling tokens enforced for frontend stacks; backend services use code style only","perStack":{"java":{"kind":"tool","tool":"checkstyle+pmd+spotbugs+spotless","matrixCategory":"static_analysis"},"typescript":{"kind":"tool","tool":"eslint+prettier","matrixCategory":"static_analysis"},"python":{"kind":"tool","tool":"ruff","matrixCategory":"static_analysis"},"go":{"kind":"tool","tool":"golangci-lint","matrixCategory":"static_analysis"},"rust":{"kind":"tool","tool":"clippy","matrixCategory":"static_analysis"}}},{"id":"N17","name":"Unit test framework wired (JUnit5/Vitest/pytest/go test/cargo test)","tml":"L1","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Each stack has a canonical unit test runner wired into L1 gate","perStack":{"java":{"kind":"tool","tool":"jacoco","matrixCategory":"coverage"},"typescript":{"kind":"tool","tool":"@vitest/coverage-v8","matrixCategory":"coverage"},"python":{"kind":"tool","tool":"pytest-cov","matrixCategory":"coverage"},"go":{"kind":"tool","tool":"go test -cover","matrixCategory":"coverage"},"rust":{"kind":"tool","tool":"cargo-tarpaulin","matrixCategory":"coverage"}}},{"id":"N18","name":"Code coverage gate (JaCoCo/V8/coverage.py/go cover/cargo-tarpaulin)","tml":"L2","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"kitThreshold":80,"arbiterThreshold":85,"status":"covered","note":"Coverage threshold enforced at L2; arbiter default 85% lines, kit baseline 80%","perStack":{"java":{"kind":"tool","tool":"jacoco","matrixCategory":"coverage"},"typescript":{"kind":"tool","tool":"@vitest/coverage-v8","matrixCategory":"coverage"},"python":{"kind":"tool","tool":"pytest-cov","matrixCategory":"coverage"},"go":{"kind":"tool","tool":"go test -cover","matrixCategory":"coverage"},"rust":{"kind":"tool","tool":"cargo-tarpaulin","matrixCategory":"coverage"}}},{"id":"N19","name":"Coverage trend ratchet (no regression allowed)","tml":"L2","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Coverage baseline ratchet prevents regressions across PRs","perStack":{"java":{"kind":"tool","tool":"jacoco","matrixCategory":"coverage"},"typescript":{"kind":"tool","tool":"@vitest/coverage-v8","matrixCategory":"coverage"},"python":{"kind":"tool","tool":"pytest-cov","matrixCategory":"coverage"},"go":{"kind":"tool","tool":"go test -cover","matrixCategory":"coverage"},"rust":{"kind":"tool","tool":"cargo-tarpaulin","matrixCategory":"coverage"}}},{"id":"N20","name":"Mutation testing (pitest/stryker/mutmut/go-mutesting/cargo-mutants)","tml":"L3","gate":"ADVISORY","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-29","status":"partial","note":"INV-29 enforces mutation score threshold; tooling wired per stack at L3","perStack":{"java":{"kind":"tool","tool":"jacoco","matrixCategory":"coverage"},"typescript":{"kind":"tool","tool":"@vitest/coverage-v8","matrixCategory":"coverage"},"python":{"kind":"tool","tool":"pytest-cov","matrixCategory":"coverage"},"go":{"kind":"tool","tool":"go test -cover","matrixCategory":"coverage"},"rust":{"kind":"tool","tool":"cargo-tarpaulin","matrixCategory":"coverage"}}},{"id":"N21","name":"Test isolation — no shared mutable state between tests","tml":"L1","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Enforced by test framework config (vitest pool isolation, JUnit @DirtiesContext)","perStack":{"java":{"kind":"tool","tool":"jacoco","matrixCategory":"coverage"},"typescript":{"kind":"tool","tool":"@vitest/coverage-v8","matrixCategory":"coverage"},"python":{"kind":"tool","tool":"pytest-cov","matrixCategory":"coverage"},"go":{"kind":"tool","tool":"go test -cover","matrixCategory":"coverage"},"rust":{"kind":"tool","tool":"cargo-tarpaulin","matrixCategory":"coverage"}}},{"id":"N22","name":"Test naming convention enforced","tml":"L1","gate":"BLOCKING","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-06","status":"covered","note":"check-test-naming.mjs enforces naming contract at L1","perStack":{"java":{"kind":"tool","tool":"jacoco","matrixCategory":"coverage"},"typescript":{"kind":"tool","tool":"@vitest/coverage-v8","matrixCategory":"coverage"},"python":{"kind":"tool","tool":"pytest-cov","matrixCategory":"coverage"},"go":{"kind":"tool","tool":"go test -cover","matrixCategory":"coverage"},"rust":{"kind":"tool","tool":"cargo-tarpaulin","matrixCategory":"coverage"}}},{"id":"N23","name":"Test TDD evidence captured (W4 protocol)","tml":"L2","gate":"ADVISORY","categoryRef":"test_framework","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"W4 TDD evidence under .arbiter/evidence/tdd/; enforced by check-tdd-evidence.mjs at L2","perStack":{"java":{"kind":"tool","tool":"jacoco","matrixCategory":"coverage"},"typescript":{"kind":"tool","tool":"@vitest/coverage-v8","matrixCategory":"coverage"},"python":{"kind":"tool","tool":"pytest-cov","matrixCategory":"coverage"},"go":{"kind":"tool","tool":"go test -cover","matrixCategory":"coverage"},"rust":{"kind":"tool","tool":"cargo-tarpaulin","matrixCategory":"coverage"}}},{"id":"N24","name":"Fast test profile (L1 unit only, <2 min)","tml":"L2","gate":"BLOCKING","categoryRef":"test_profiles","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"L1 gate runs unit tests only; integration tests excluded via vitest/gradle profile","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N25","name":"Extended test profile (L2: unit + integration)","tml":"L2","gate":"BLOCKING","categoryRef":"test_profiles","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"L2 gate runs full test suite including integration tests","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N26","name":"Nightly/weekly test profile (L3: full suite + mutation + security)","tml":"L3","gate":"BLOCKING","categoryRef":"test_profiles","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"T4/T5 nightly+weekly CI tiers run mutation, DAST, fuzz, full security scans","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N27","name":"Integration tests (Spring IT / testcontainers / real-project fixtures)","tml":"L1","gate":"BLOCKING","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Real-project fixture tests run per stack; integration tests in L2 profile","perStack":{"java":{"kind":"tool","tool":"pact-jvm","matrixCategory":"contract"},"typescript":{"kind":"tool","tool":"@pact-foundation/pact","matrixCategory":"contract"},"python":{"kind":"tool","tool":"pact-python","matrixCategory":"contract"},"go":{"kind":"tool","tool":"pact_consumer (Go)","matrixCategory":"contract"},"rust":{"kind":"tool","tool":"pact_consumer","matrixCategory":"contract"}}},{"id":"N28","name":"Contract tests (Spring Cloud Contract / Pact)","tml":"L2","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Contract testing enforced at L2 for service APIs; coverage varies by stack","perStack":{"java":{"kind":"tool","tool":"pact-jvm","matrixCategory":"contract"},"typescript":{"kind":"tool","tool":"@pact-foundation/pact","matrixCategory":"contract"},"python":{"kind":"tool","tool":"pact-python","matrixCategory":"contract"},"go":{"kind":"tool","tool":"pact_consumer (Go)","matrixCategory":"contract"},"rust":{"kind":"tool","tool":"pact_consumer","matrixCategory":"contract"}}},{"id":"N29","name":"BDD / behavioural tests (Cucumber / pytest-bdd / godog)","tml":"L2","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"BDD tooling available cross-stack; enforcement level varies by archetype","perStack":{"java":{"kind":"tool","tool":"pact-jvm","matrixCategory":"contract"},"typescript":{"kind":"tool","tool":"@pact-foundation/pact","matrixCategory":"contract"},"python":{"kind":"tool","tool":"pact-python","matrixCategory":"contract"},"go":{"kind":"tool","tool":"pact_consumer (Go)","matrixCategory":"contract"},"rust":{"kind":"tool","tool":"pact_consumer","matrixCategory":"contract"}}},{"id":"N30","name":"Architectural tests (ArchUnit / structure rules)","tml":"L2","gate":"BLOCKING","categoryRef":"test_types","archetypeGating":{"applies":["hexagonal"],"excludes":[]},"status":"partial","note":"Architecture rule tests wired for hexagonal archetype; other archetypes use static analysis","perStack":{"java":{"kind":"tool","tool":"pact-jvm","matrixCategory":"contract"},"typescript":{"kind":"tool","tool":"@pact-foundation/pact","matrixCategory":"contract"},"python":{"kind":"tool","tool":"pact-python","matrixCategory":"contract"},"go":{"kind":"tool","tool":"pact_consumer (Go)","matrixCategory":"contract"},"rust":{"kind":"tool","tool":"pact_consumer","matrixCategory":"contract"}}},{"id":"N31","name":"Fuzz testing (Jazzer / go-fuzz / cargo-fuzz)","tml":"L3","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Fuzz testing supported at L3 nightly tier; tooling coverage varies by stack","perStack":{"java":{"kind":"tool","tool":"pact-jvm","matrixCategory":"contract"},"typescript":{"kind":"tool","tool":"@pact-foundation/pact","matrixCategory":"contract"},"python":{"kind":"tool","tool":"pact-python","matrixCategory":"contract"},"go":{"kind":"tool","tool":"pact_consumer (Go)","matrixCategory":"contract"},"rust":{"kind":"tool","tool":"pact_consumer","matrixCategory":"contract"}}},{"id":"N32","name":"Property-based testing (QuickCheck / Hypothesis / proptest)","tml":"L3","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Property-based testing not yet wired into arbiter gate; follow-up opportunity","perStack":{"java":{"kind":"gap","suggestedTool":"junit-quickcheck or jqwik","reason":"Property-based testing for Java not yet wired into arbiter gate; jqwik and junit-quickcheck are established options worth adding to the test types matrix"},"typescript":{"kind":"gap","suggestedTool":"fast-check","reason":"fast-check is the standard property-based testing library for TypeScript/JavaScript; not yet wired into arbiter gate"},"python":{"kind":"gap","suggestedTool":"hypothesis","reason":"Hypothesis is the canonical property-based testing library for Python; mature and widely used; not yet wired into arbiter gate"},"go":{"kind":"gap","suggestedTool":"gopter or rapid","reason":"gopter and rapid provide property-based testing for Go; not yet wired into arbiter gate"},"rust":{"kind":"gap","suggestedTool":"proptest","reason":"proptest is the dominant property-based testing library for Rust; not yet wired into arbiter gate"}}},{"id":"N33","name":"Snapshot / golden-file tests","tml":"L2","gate":"ADVISORY","categoryRef":"test_types","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Snapshot tests used in arbiter self-tests (api-snapshot.mjs); pattern available cross-stack","perStack":{"java":{"kind":"tool","tool":"pact-jvm","matrixCategory":"contract"},"typescript":{"kind":"tool","tool":"@pact-foundation/pact","matrixCategory":"contract"},"python":{"kind":"tool","tool":"pact-python","matrixCategory":"contract"},"go":{"kind":"tool","tool":"pact_consumer (Go)","matrixCategory":"contract"},"rust":{"kind":"tool","tool":"pact_consumer","matrixCategory":"contract"}}},{"id":"N34","name":"Multi-tier CI pipeline (fast → extended → release → nightly → weekly)","tml":"L2","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-73","status":"covered","note":"6-tier CI model (T0..T5) enforced by workflow runner checks and ci-alignment gate","perStack":{"java":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"typescript":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"python":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"go":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"rust":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"}}},{"id":"N35","name":"PR fast-feedback gate (<5 min, L1 checks only)","tml":"L2","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-73","status":"covered","note":"T1 (check subcommand) completes in ~2 min; T2 (gate) in ~10 min","perStack":{"java":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"typescript":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"python":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"go":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"rust":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"}}},{"id":"N36","name":"Release pipeline (tag-triggered, artifact signing)","tml":"L3","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-79","status":"covered","note":"Release workflow signs artifacts with cosign; SLSA provenance via attest-build-provenance","perStack":{"java":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"typescript":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"python":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"go":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"rust":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"}}},{"id":"N37","name":"Nightly extended checks (mutation, DAST, performance baseline)","tml":"L3","gate":"ADVISORY","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-76","status":"covered","note":"T4 nightly tier runs mutation + DAST + fuzz; heartbeat monitor keeps pipeline honest","perStack":{"java":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"typescript":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"python":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"go":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"rust":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"}}},{"id":"N38","name":"Weekly audit pipeline (dependency audit, license scan, SBOM refresh)","tml":"L3","gate":"ADVISORY","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"T5 weekly tier runs npm audit, license scan, SBOM refresh, gitleaks full scan","perStack":{"java":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"typescript":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"python":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"go":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"rust":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"}}},{"id":"N39","name":"CI runner label SSOT (no hardcoded runner strings)","tml":"L2","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-13","status":"covered","note":"INV-13 enforces CI_BUILD_RUNNER_LABEL repo variable as SSOT; downstream-generated check-workflow-runners gates this in target repos","perStack":{"java":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"typescript":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"python":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"go":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"rust":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"}}},{"id":"N40","name":"Artifact provenance (SLSA / sigstore)","tml":"L3","gate":"BLOCKING","categoryRef":"cicd","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-78","status":"covered","note":"SLSA provenance generated via actions/attest-build-provenance for all release artifacts","perStack":{"java":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"typescript":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"python":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"go":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"},"rust":{"kind":"tool","tool":"gitleaks","matrixCategory":"secret_scan"}}},{"id":"N41","name":"E2E API tests (RestAssured / Playwright / pytest-playwright)","tml":"L3","gate":"BLOCKING","categoryRef":"e2e_perf","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"E2E tests wired at L3 nightly tier; Playwright for browser stacks, RestAssured for Java APIs","perStack":{"java":{"kind":"tool","tool":"RestAssured IT","matrixCategory":"e2e"},"typescript":{"kind":"tool","tool":"Playwright","matrixCategory":"e2e"},"python":{"kind":"tool","tool":"Playwright / pytest-playwright","matrixCategory":"e2e"},"go":{"kind":"tool","tool":"owasp-zap","matrixCategory":"dast"},"rust":{"kind":"tool","tool":"owasp-zap","matrixCategory":"dast"}}},{"id":"N42","name":"Performance / load testing baseline (k6 / Locust / Gatling)","tml":"L3","gate":"ADVISORY","categoryRef":"e2e_perf","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Performance testing tooling not yet generated by arbiter; follow-up opportunity","perStack":{"java":{"kind":"gap","suggestedTool":"Gatling or JMeter","followupIssue":862,"reason":"Performance testing for Java services not yet generated by arbiter; Gatling is preferred for modern JVM services in automated CI pipelines"},"typescript":{"kind":"gap","suggestedTool":"k6","followupIssue":862,"reason":"k6 is the standard load testing tool for TypeScript/Node.js services; not yet generated by arbiter; follow-up in sibling epic"},"python":{"kind":"gap","suggestedTool":"Locust","followupIssue":862,"reason":"Locust is the canonical load testing framework for Python services; not yet generated by arbiter; follow-up in sibling epic"},"go":{"kind":"gap","suggestedTool":"k6 or hey","followupIssue":862,"reason":"k6 or hey for Go service load testing; not yet generated by arbiter; follow-up in sibling epic"},"rust":{"kind":"gap","suggestedTool":"drill or criterion","followupIssue":862,"reason":"drill for HTTP load testing or criterion for micro-benchmarking in Rust; not yet generated by arbiter; follow-up in sibling epic"}}},{"id":"N43","name":"DAST scan (OWASP ZAP / Nuclei)","tml":"L3","gate":"ADVISORY","categoryRef":"e2e_perf","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"DAST wired at T4 nightly tier; ZAP scan against running service","perStack":{"java":{"kind":"tool","tool":"RestAssured IT","matrixCategory":"e2e"},"typescript":{"kind":"tool","tool":"Playwright","matrixCategory":"e2e"},"python":{"kind":"tool","tool":"Playwright / pytest-playwright","matrixCategory":"e2e"},"go":{"kind":"tool","tool":"owasp-zap","matrixCategory":"dast"},"rust":{"kind":"tool","tool":"owasp-zap","matrixCategory":"dast"}}},{"id":"N44","name":"Auth flow E2E (Keycloak-compatible IdP integration test)","tml":"L3","gate":"ADVISORY","categoryRef":"e2e_perf","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Auth E2E testing against a Keycloak-compatible IdP; not yet generated by arbiter","perStack":{"java":{"kind":"gap","suggestedTool":"WireMock + TestContainers Keycloak-compatible IdP","followupIssue":862,"reason":"Auth E2E testing with a Keycloak-compatible IdP requires TestContainers integration; not yet generated by arbiter; follow-up in sibling epic"},"typescript":{"kind":"gap","suggestedTool":"Playwright + mock OIDC provider","followupIssue":862,"reason":"Auth flow E2E for TypeScript frontend/BFF requires Playwright with a mock Keycloak-compatible IdP; not yet generated by arbiter"},"python":{"kind":"gap","suggestedTool":"pytest + mock OIDC provider","followupIssue":862,"reason":"Auth E2E for Python services requires mock Keycloak-compatible IdP integration; not yet generated by arbiter"},"go":{"kind":"gap","suggestedTool":"httptest + mock OIDC provider","followupIssue":862,"reason":"Auth E2E for Go services requires mock Keycloak-compatible IdP; not yet generated by arbiter; follow-up in sibling epic"},"rust":{"kind":"gap","suggestedTool":"reqwest + mock OIDC provider","followupIssue":862,"reason":"Auth E2E for Rust services requires mock Keycloak-compatible IdP integration; not yet generated by arbiter"}}},{"id":"N45","name":"Format validation script (check-format.sh equivalent)","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Format check is part of L1 gate (prettier/spotless/black/gofmt/rustfmt)","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N46","name":"SPDX license header check","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-20","status":"covered","note":"check-spdx-headers.mjs enforces Apache-2.0 SPDX headers at L1","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N47","name":"Orphan TODO check (no bare TODOs without task IDs)","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-06","status":"covered","note":"check-no-orphan-todo.mjs gates orphan TODOs at L1; post-edit hook enforces inline","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N48","name":"Placeholder check (no template placeholders committed)","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"check-no-placeholders.mjs gates placeholder patterns at L1","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N49","name":"Dead link / doc link integrity check","tml":"L2","gate":"ADVISORY","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"check-doc-links.mjs validates internal doc links at L1 gate","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N50","name":"Bloat ratchet (bundle size / generated artifact size)","tml":"L2","gate":"ADVISORY","categoryRef":"scripts_validation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"check-bloat-ratchet.mjs enforces size baseline at L1; refuses shrink without --allow-shrink","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N51","name":"Debt ratchet (tech-debt score gate)","tml":"L1","gate":"ADVISORY","categoryRef":"scripts_quality","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"debt-report.mjs --gate enforced at L2; debt score cannot increase without explicit override","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N52","name":"Self-dogfood check (arbiter validates itself)","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_quality","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-75","status":"covered","note":"INV-75/76: downstream check-action-pins + check-workflow-perms gates run at L1 in target repos; arbiter self-dogfood retired during CI freeze (#862)","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N53","name":"API snapshot test (no unintended public surface changes)","tml":"L2","gate":"BLOCKING","categoryRef":"scripts_quality","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"check-api-snapshot.mjs gates API surface at L1; changes require explicit snapshot update","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N54","name":"Circular dependency detection","tml":"L1","gate":"BLOCKING","categoryRef":"scripts_quality","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-03","status":"covered","note":"madge --circular at L1 gate; post-edit hook checks after every TS/JS edit","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N55","name":"Secret scanning (Gitleaks)","tml":"L1","gate":"BLOCKING","categoryRef":"security","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-24","status":"covered","note":"Gitleaks on staged files (pre-commit hook) + full repo scan at L2 gate","perStack":{"java":{"kind":"tool","tool":"trivy fs","matrixCategory":"security"},"typescript":{"kind":"tool","tool":"npm audit","matrixCategory":"security"},"python":{"kind":"tool","tool":"pip-audit","matrixCategory":"security"},"go":{"kind":"tool","tool":"govulncheck","matrixCategory":"security"},"rust":{"kind":"tool","tool":"cargo audit","matrixCategory":"security"}}},{"id":"N56","name":"Dependency audit (npm audit / trivy fs / cargo audit)","tml":"L2","gate":"BLOCKING","categoryRef":"security","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"npm audit at L2 gate; cargo audit / pip-audit supported; blocks on HIGH+ severity","perStack":{"java":{"kind":"tool","tool":"trivy fs","matrixCategory":"security"},"typescript":{"kind":"tool","tool":"npm audit","matrixCategory":"security"},"python":{"kind":"tool","tool":"pip-audit","matrixCategory":"security"},"go":{"kind":"tool","tool":"govulncheck","matrixCategory":"security"},"rust":{"kind":"tool","tool":"cargo audit","matrixCategory":"security"}}},{"id":"N57","name":"Container image scan (Trivy)","tml":"L3","gate":"BLOCKING","categoryRef":"security","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"Trivy container scan at T5 weekly tier; generated for services with Dockerfile","perStack":{"java":{"kind":"tool","tool":"trivy fs","matrixCategory":"security"},"typescript":{"kind":"tool","tool":"npm audit","matrixCategory":"security"},"python":{"kind":"tool","tool":"pip-audit","matrixCategory":"security"},"go":{"kind":"tool","tool":"govulncheck","matrixCategory":"security"},"rust":{"kind":"tool","tool":"cargo audit","matrixCategory":"security"}}},{"id":"N58","name":"License scan (FOSSA / ORT / licensee)","tml":"L3","gate":"ADVISORY","categoryRef":"security","archetypeGating":{"applies":[],"excludes":[]},"status":"partial","note":"License scan at T5 weekly tier; blocks on GPL/AGPL in permissively-licensed services","perStack":{"java":{"kind":"tool","tool":"trivy fs","matrixCategory":"security"},"typescript":{"kind":"tool","tool":"npm audit","matrixCategory":"security"},"python":{"kind":"tool","tool":"pip-audit","matrixCategory":"security"},"go":{"kind":"tool","tool":"govulncheck","matrixCategory":"security"},"rust":{"kind":"tool","tool":"cargo audit","matrixCategory":"security"}}},{"id":"N59","name":"Commit message format enforced (commitlint)","tml":"L1","gate":"BLOCKING","categoryRef":"git_github","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"commitlint wired at L1 gate + post-commit hook checks format after every commit","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N60","name":"Branch naming convention enforced","tml":"L1","gate":"BLOCKING","categoryRef":"git_github","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"task/* branch convention enforced by execution protocol; pre-commit guard via AGENTS.md","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N61","name":"PR template (description, test plan, checklist)","tml":"L1","gate":"ADVISORY","categoryRef":"git_github","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":".github/pull_request_template.md generated for target projects","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N62","name":"Issue templates (bug, feature, tech-debt)","tml":"L1","gate":"ADVISORY","categoryRef":"git_github","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"GitHub issue templates generated for target projects","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N63","name":"AGENTS.md / CLAUDE.md governance document","tml":"L2","gate":"BLOCKING","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"AGENTS.md generated as AAIF-standard governance doc for all arbiter-managed projects","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N64","name":"CI/CD developer reference card","tml":"L2","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"CI developer reference template provided (TPL_cicd-developer-reference); generator deferred to Phase D","perStack":{"java":{"kind":"gap","suggestedGenerator":"cicd-developer-reference.ts","followupIssue":862,"reason":"CI/CD developer reference card for Java services requires a generator emitting the parametric template; deferred to Phase D of sibling epic"},"typescript":{"kind":"gap","suggestedGenerator":"cicd-developer-reference.ts","followupIssue":862,"reason":"CI/CD developer reference card for TypeScript services requires a generator emitting the parametric template; deferred to Phase D of sibling epic"},"python":{"kind":"gap","suggestedGenerator":"cicd-developer-reference.ts","followupIssue":862,"reason":"CI/CD developer reference card for Python services requires a generator emitting the parametric template; deferred to Phase D of sibling epic"},"go":{"kind":"gap","suggestedGenerator":"cicd-developer-reference.ts","followupIssue":862,"reason":"CI/CD developer reference card for Go services requires a generator emitting the parametric template; deferred to Phase D of sibling epic"},"rust":{"kind":"gap","suggestedGenerator":"cicd-developer-reference.ts","followupIssue":862,"reason":"CI/CD developer reference card for Rust services requires a generator emitting the parametric template; deferred to Phase D of sibling epic"}}},{"id":"N65","name":"Architecture decision records (ADRs)","tml":"L2","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"docs/SYSTEM/DECISIONS.md generated and maintained as ADR log for arbiter-managed projects","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N66","name":"API / OpenAPI specification","tml":"L3","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"OpenAPI spec generation not yet in arbiter scope; follow-up opportunity","perStack":{"java":{"kind":"gap","suggestedGenerator":"openapi-spec.ts","followupIssue":862,"reason":"OpenAPI specification generation for Java services (SpringDoc/Springfox) not yet in arbiter scope; follow-up opportunity in sibling epic"},"typescript":{"kind":"gap","suggestedGenerator":"openapi-spec.ts","followupIssue":862,"reason":"OpenAPI spec generation for TypeScript services (tsoa/zod-openapi) not yet in arbiter scope; follow-up opportunity in sibling epic"},"python":{"kind":"gap","suggestedGenerator":"openapi-spec.ts","followupIssue":862,"reason":"OpenAPI spec generation for Python services (FastAPI auto-schema) not yet in arbiter scope; follow-up opportunity in sibling epic"},"go":{"kind":"gap","suggestedGenerator":"openapi-spec.ts","followupIssue":862,"reason":"OpenAPI spec generation for Go services (swaggo/swag) not yet in arbiter scope; follow-up opportunity in sibling epic"},"rust":{"kind":"gap","suggestedGenerator":"openapi-spec.ts","followupIssue":862,"reason":"OpenAPI spec generation for Rust services (utoipa/aide) not yet in arbiter scope; follow-up opportunity in sibling epic"}}},{"id":"N67","name":"Runbook (operational playbook for oncall)","tml":"L3","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Operational runbook template not yet generated; follow-up opportunity","perStack":{"java":{"kind":"gap","suggestedGenerator":"runbook.ts","followupIssue":862,"reason":"Operational runbook template for Java services not yet generated by arbiter; oncall playbook generation is a high-value follow-up opportunity"},"typescript":{"kind":"gap","suggestedGenerator":"runbook.ts","followupIssue":862,"reason":"Operational runbook template for TypeScript services not yet generated by arbiter; oncall playbook generation deferred to sibling epic"},"python":{"kind":"gap","suggestedGenerator":"runbook.ts","followupIssue":862,"reason":"Operational runbook template for Python services not yet generated by arbiter; oncall playbook generation deferred to sibling epic"},"go":{"kind":"gap","suggestedGenerator":"runbook.ts","followupIssue":862,"reason":"Operational runbook template for Go services not yet generated by arbiter; oncall playbook generation deferred to sibling epic"},"rust":{"kind":"gap","suggestedGenerator":"runbook.ts","followupIssue":862,"reason":"Operational runbook template for Rust services not yet generated by arbiter; oncall playbook generation deferred to sibling epic"}}},{"id":"N68","name":"Knowledge map (cross-repo canonical paths and signal sources)","tml":"L3","gate":"ADVISORY","categoryRef":"documentation","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"Canonical signal sources self-documented via .claude/knowledge-map.json track routing + the generated wiki/ (Obsidian viewer); bespoke knowledge-map gate retired in #1244","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N69","name":"Runtime version SSOT (node version pinned, .nvmrc aligned)","tml":"L1","gate":"BLOCKING","categoryRef":"configuration","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-14","status":"covered","note":"check-node-version-ssot.mjs enforces single source of truth for node version at L1","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N70","name":"Environment variable safety (.env.example only, no real .env committed)","tml":"L1","gate":"BLOCKING","categoryRef":"configuration","archetypeGating":{"applies":[],"excludes":[]},"invLink":"INV-24","status":"covered","note":"Gitleaks catches .env commits; arbiter generates only .env.*.example templates","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N71","name":"Feature flag / experiment registry (no undocumented flags)","tml":"L2","gate":"ADVISORY","categoryRef":"configuration","archetypeGating":{"applies":[],"excludes":[]},"status":"covered","note":"src/experimental/registry.ts enforces known-experiment guard; unknown flag = exit 1","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N72","name":"Multi-environment config (dev/staging/prod parity)","tml":"L3","gate":"ADVISORY","categoryRef":"configuration","archetypeGating":{"applies":[],"excludes":[]},"status":"missing","note":"Multi-env config templates not yet generated by arbiter; follow-up opportunity","perStack":{"java":{"kind":"gap","suggestedGenerator":"multi-env-config.ts","followupIssue":862,"reason":"Multi-environment config template for Java (Spring profiles dev/staging/prod) not yet generated by arbiter; Spring profile parity enforcement deferred to sibling epic"},"typescript":{"kind":"gap","suggestedGenerator":"multi-env-config.ts","followupIssue":862,"reason":"Multi-environment config template for TypeScript (dotenv-flow or similar) not yet generated by arbiter; env parity enforcement deferred to sibling epic"},"python":{"kind":"gap","suggestedGenerator":"multi-env-config.ts","followupIssue":862,"reason":"Multi-environment config template for Python (pydantic-settings profiles) not yet generated by arbiter; env parity enforcement deferred to sibling epic"},"go":{"kind":"gap","suggestedGenerator":"multi-env-config.ts","followupIssue":862,"reason":"Multi-environment config template for Go (viper profiles) not yet generated by arbiter; env parity enforcement deferred to sibling epic"},"rust":{"kind":"gap","suggestedGenerator":"multi-env-config.ts","followupIssue":862,"reason":"Multi-environment config template for Rust (config crate profiles) not yet generated by arbiter; env parity enforcement deferred to sibling epic"}}},{"id":"N73","name":"Tamper-evident audit log table DDL (security-critical operations)","tml":"L3","gate":"BLOCKING","categoryRef":"audit_trail","archetypeGating":{"applies":[],"excludes":[]},"conditionalFlag":"audit-write-services","requiresDbEngine":["postgresql","mysql","mongodb"],"status":"missing-tracked","followupIssue":862,"note":"Tamper-evident audit log for security-critical operations; DDL with insert-only grants and created_at immutability","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap","followupIssue":862,"reason":"Tamper-evident audit log DDL for TypeScript services not yet generated by arbiter; conditional on audit-write-services flag; Phase G of sibling epic covers DB migration generators"},"python":{"kind":"gap","followupIssue":862,"reason":"Tamper-evident audit log DDL for Python services not yet generated by arbiter; conditional on audit-write-services flag; Phase G of sibling epic covers DB migration generators"},"go":{"kind":"gap","followupIssue":862,"reason":"Tamper-evident audit log DDL for Go services not yet generated by arbiter; conditional on audit-write-services flag; Phase G of sibling epic covers DB migration generators"},"rust":{"kind":"gap","followupIssue":862,"reason":"Tamper-evident audit log DDL for Rust services not yet generated by arbiter; conditional on audit-write-services flag; Phase G of sibling epic covers DB migration generators"}}},{"id":"N74","name":"Audit trigger presence (DB-level audit trigger enforced)","tml":"L3","gate":"BLOCKING","categoryRef":"audit_trail","archetypeGating":{"applies":[],"excludes":[]},"conditionalFlag":"audit-write-services","requiresDbEngine":["postgresql","mysql"],"status":"missing-tracked","followupIssue":862,"note":"Database trigger enforces audit log population for security-critical write operations","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap","followupIssue":862,"reason":"DB audit trigger for TypeScript services not yet generated by arbiter; conditional on audit-write-services flag; Phase G of sibling epic covers per-engine trigger generators"},"python":{"kind":"gap","followupIssue":862,"reason":"DB audit trigger for Python services not yet generated by arbiter; conditional on audit-write-services flag; Phase G of sibling epic covers per-engine trigger generators"},"go":{"kind":"gap","followupIssue":862,"reason":"DB audit trigger for Go services not yet generated by arbiter; conditional on audit-write-services flag; Phase G of sibling epic covers per-engine trigger generators"},"rust":{"kind":"gap","followupIssue":862,"reason":"DB audit trigger for Rust services not yet generated by arbiter; conditional on audit-write-services flag; Phase G of sibling epic covers per-engine trigger generators"}}},{"id":"N75","name":"Audit log service interface (AuditEventService / append-only repository pattern)","tml":"L3","gate":"BLOCKING","categoryRef":"audit_trail","archetypeGating":{"applies":[],"excludes":[]},"conditionalFlag":"audit-write-services","requiresDbEngine":["postgresql","mysql","mongodb"],"status":"missing-tracked","followupIssue":862,"note":"Append-only repository pattern for audit events; no update/delete operations permitted in service layer","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap","followupIssue":862,"reason":"Audit log service interface for TypeScript services not yet generated by arbiter; append-only repository pattern generator deferred to Phase G of sibling epic"},"python":{"kind":"gap","followupIssue":862,"reason":"Audit log service interface for Python services not yet generated by arbiter; append-only repository pattern generator deferred to Phase G of sibling epic"},"go":{"kind":"gap","followupIssue":862,"reason":"Audit log service interface for Go services not yet generated by arbiter; append-only repository pattern generator deferred to Phase G of sibling epic"},"rust":{"kind":"gap","followupIssue":862,"reason":"Audit log service interface for Rust services not yet generated by arbiter; append-only repository pattern generator deferred to Phase G of sibling epic"}}},{"id":"N76","name":"Accessibility (a11y) audit (Axe / Lighthouse / pa11y)","tml":"L3","gate":"ADVISORY","categoryRef":"a11y","archetypeGating":{"applies":["frontend","fullstack"],"excludes":["backend","api"]},"status":"partial","note":"a11y auditing for frontend archetypes; INV-61 enforces a11y gate when frontend present","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"tool","tool":"axe-core/playwright","matrixCategory":"a11y"},"python":{"kind":"tool","tool":"axe-playwright-python","matrixCategory":"a11y"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N77","name":"Spring Modulith structural verification (ApplicationModules.verify())","tml":"L2","gate":"BLOCKING","categoryRef":"module_boundaries","archetypeGating":{"applies":["backend","api","fullstack"],"excludes":["frontend","cli","embedded"]},"conditionalFlag":"spring-boot","status":"covered","note":"Spring Modulith verifies no cyclic module dependencies and no forbidden cross-module access. Requires spring-modulith-test on the classpath.","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}},{"id":"N78","name":"Resilience patterns guide (circuit-breaker/retry/rate-limiter/timeout)","tml":"L2","gate":"ADVISORY","categoryRef":"resilience","archetypeGating":{"applies":["backend","api","fullstack"],"excludes":["frontend","cli","embedded"]},"invLink":"INV-19","status":"covered","note":"Resilience patterns guide emitted for external-call-heavy archetypes. cockatiel (TS) + Resilience4j (Java) concrete blocks. INV-19 governs external-call resilience.","perStack":{"java":{"kind":"gap"},"typescript":{"kind":"gap"},"python":{"kind":"gap"},"go":{"kind":"gap"},"rust":{"kind":"gap"}}}]

package/dist/kit/emit-issues.js

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0
+import{runCli}from"../utils/run-cli.js";function issueTitle(dimId){return`kit(#1043): enforce ${dimId}`}function fetchExistingTitles(){try{const{stdout}=runCli("gh",["issue","list","--label","kit","--state","all","--limit","500","--json","title"]),parsed=JSON.parse(stdout);if(!Array.isArray(parsed))return new Set;const titles=new Set;for(const item of parsed){const title=item.title;typeof title=="string"&&titles.add(title)}return titles}catch(err){const reason=err instanceof Error?err.message:String(err);return process.stderr.write(`[emit-issues] could not fetch existing issue titles \u2014 dedup skipped: ${reason}
+`),new Set}}export function emitWaveIssues(plan,dryRun){const w1=plan.waves.find(w=>w.label==="W1")?.dimensions??[];if(dryRun){for(const entry of w1)process.stderr.write(`[dry-run] would create issue: ${issueTitle(entry.dimId)}
+`);return{created:0,skipped:w1.length,failed:0}}if(w1.length===0)return{created:0,skipped:0,failed:0};const existing=fetchExistingTitles();let created=0,skipped=0,failed=0;for(const entry of w1){const title=issueTitle(entry.dimId);if(existing.has(title)){process.stderr.write(`[emit-issues] skip (already exists): ${title}
+`),skipped++;continue}const body=`KIT dimension \`${entry.dimId}\` (category: ${entry.category}) requires enforcement.
+
+Generated by: \`arbiter kit install --emit-issues\``;try{runCli("gh",["issue","create","--title",title,"--label","kit","--body",body]),created++,existing.add(title)}catch(err){process.stderr.write(`[emit-issues] FAILED to create "${title}": ${err instanceof Error?err.message:String(err)}
+`),failed++}}return{created,skipped,failed}}