@getarbiter/cli 0.5.0

package/dist/templates/archunit/PortsIndependenceTest.java.ejs

@@ -0,0 +1,55 @@
+package <%= basePackage ? basePackage + '.architecture' : 'architecture' %>;
+
+import com.tngtech.archunit.core.importer.ImportOption;
+import com.tngtech.archunit.junit.AnalyzeClasses;
+import com.tngtech.archunit.junit.ArchTest;
+import com.tngtech.archunit.lang.ArchRule;
+
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
+
+/**
+ * Ports independence enforcement — generated by arbiter (M22, hexagonal).
+ *
+ * Ports (application.port.in / application.port.out) must not depend on adapters
+ * or infrastructure. They define the boundary contract for the application core.
+ *
+ * Generated by arbiter. Edit the template to change enforcement.
+ */
+@AnalyzeClasses(
+    packages = "<%= basePackage ? basePackage : '' %>",
+    importOptions = ImportOption.DoNotIncludeTests.class
+)
+public class PortsIndependenceTest {
+
+    @ArchTest
+    public static final ArchRule inbound_ports_must_not_depend_on_adapters =
+        noClasses()
+            .that().resideInAPackage("<%= basePackage ? basePackage + '.application.port.in..' : 'application.port.in..' %>")
+            .should().dependOnClassesThat()
+            .resideInAPackage("<%= basePackage ? basePackage + '.adapter..' : 'adapter..' %>")
+            .because("Inbound ports define the driving-side contract and must not depend on adapters.");
+
+    @ArchTest
+    public static final ArchRule outbound_ports_must_not_depend_on_adapters =
+        noClasses()
+            .that().resideInAPackage("<%= basePackage ? basePackage + '.application.port.out..' : 'application.port.out..' %>")
+            .should().dependOnClassesThat()
+            .resideInAPackage("<%= basePackage ? basePackage + '.adapter..' : 'adapter..' %>")
+            .because("Outbound ports define the driven-side contract and must not depend on adapter implementations.");
+
+    @ArchTest
+    public static final ArchRule inbound_ports_must_not_depend_on_infrastructure =
+        noClasses()
+            .that().resideInAPackage("<%= basePackage ? basePackage + '.application.port.in..' : 'application.port.in..' %>")
+            .should().dependOnClassesThat()
+            .resideInAPackage("<%= basePackage ? basePackage + '.infrastructure..' : 'infrastructure..' %>")
+            .because("Inbound ports must not depend on infrastructure details.");
+
+    @ArchTest
+    public static final ArchRule outbound_ports_must_not_depend_on_infrastructure =
+        noClasses()
+            .that().resideInAPackage("<%= basePackage ? basePackage + '.application.port.out..' : 'application.port.out..' %>")
+            .should().dependOnClassesThat()
+            .resideInAPackage("<%= basePackage ? basePackage + '.infrastructure..' : 'infrastructure..' %>")
+            .because("Outbound ports must remain infrastructure-agnostic: implementations live in adapters.");
+}

package/dist/templates/archunit/RestAssuredArchTest.java.ejs

@@ -0,0 +1,32 @@
+package <%= basePackage ? basePackage + '.architecture' : 'architecture' %>;
+
+import com.tngtech.archunit.junit.AnalyzeClasses;
+import com.tngtech.archunit.junit.ArchTest;
+import com.tngtech.archunit.lang.ArchRule;
+
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.classes;
+
+/**
+ * RestAssured integration test enforcement — generated by arbiter (M22, hexagonal).
+ *
+ * Companion to INV-29 (NoMockMvcTest): ensures that all *ControllerIT classes
+ * extend RestAssuredBaseIT, guaranteeing a real embedded server + consistent
+ * RestAssured setup across all integration tests.
+ *
+ * Exemptions: add a suppression entry in suppressions/archunit-baseline.json
+ * with `scope` matching the legacy class pattern and a wave-migration `expiresAt`.
+ *
+ * Generated by arbiter. Edit the template to change enforcement.
+ */
+@AnalyzeClasses(packages = "<%= basePackage ? basePackage : '' %>")
+public class RestAssuredArchTest {
+
+    @ArchTest
+    public static final ArchRule all_controller_its_must_extend_rest_assured_base =
+        classes()
+            .that().haveSimpleNameEndingWith("ControllerIT")
+            .should().beAssignableTo(
+                "<%= basePackage ? basePackage + '.support.RestAssuredBaseIT' : 'support.RestAssuredBaseIT' %>"
+            )
+            .because("All *ControllerIT classes must extend RestAssuredBaseIT (INV-29: no MockMvc, real embedded server required).");
+}

package/dist/templates/archunit/RestAssuredBaseIT.java.ejs

@@ -0,0 +1,66 @@
+// Generated by arbiter — Spring Boot ONLY.
+// This template hardcodes @SpringBootTest, @LocalServerPort and org.springframework.* imports.
+// Emission is gated by archunit.ts on framework ∈ {spring-boot, *spring*} (#491).
+// Quarkus / Micronaut / unknown-framework Java projects do NOT receive this file.
+// For Quarkus, use @QuarkusTest + @QuarkusTestResource; for Micronaut, use @MicronautTest.
+package <%= basePackage ? basePackage + '.support' : 'support' %>;
+
+import io.restassured.RestAssured;
+import org.junit.jupiter.api.BeforeEach;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.server.LocalServerPort;
+import org.springframework.test.context.DynamicPropertyRegistry;
+import org.springframework.test.context.DynamicPropertySource;
+import org.testcontainers.containers.PostgreSQLContainer;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+
+/**
+ * Base class for all integration tests — generated by arbiter (M22, hexagonal).
+ *
+ * Provides:
+ *   - PostgreSQL via Testcontainers (shared container across all subclasses)
+ *   - RestAssured base URI wired to the random server port
+ *   - {@link #authHeader(String)} helper — replace with your auth flavor
+ *     (OAuth2 token endpoint, mTLS cert loader, or remove if auth-free)
+ *
+ * Generated once by arbiter (skipIfExists). Edit freely after generation.
+ */
+@Testcontainers
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+public abstract class RestAssuredBaseIT {
+
+    @Container
+    protected static final PostgreSQLContainer<?> postgres =
+        new PostgreSQLContainer<>("postgres:16-alpine")
+            .withDatabaseName("testdb")
+            .withUsername("test")
+            .withPassword("test");
+
+    @DynamicPropertySource
+    static void overrideDataSourceProperties(DynamicPropertyRegistry registry) {
+        registry.add("spring.datasource.url", postgres::getJdbcUrl);
+        registry.add("spring.datasource.username", postgres::getUsername);
+        registry.add("spring.datasource.password", postgres::getPassword);
+    }
+
+    @LocalServerPort
+    protected int port;
+
+    @BeforeEach
+    void configureRestAssured() {
+        RestAssured.port = port;
+        RestAssured.basePath = "";
+    }
+
+    /**
+     * Returns a Bearer token header value for the given subject.
+     * Replace this implementation with your project's auth mechanism.
+     */
+    protected String authHeader(String subject) {
+        // TODO(#70): replace with real JWT/OAuth2 helper for your auth flavor
+        throw new UnsupportedOperationException(
+            "RestAssuredBaseIT.authHeader() is a stub — implement for your auth provider."
+        );
+    }
+}

package/dist/templates/archunit/TestCoverageArchTest.java.ejs

@@ -0,0 +1,29 @@
+package <%= basePackage ? basePackage + '.architecture' : 'architecture' %>;
+
+import com.tngtech.archunit.junit.AnalyzeClasses;
+import com.tngtech.archunit.junit.ArchTest;
+import com.tngtech.archunit.lang.ArchRule;
+
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
+
+/**
+ * Test coverage enforcement — generated by arbiter (M22, hexagonal).
+ *
+ * Ensures integration test classes (*ControllerIT) reside in the correct package.
+ * Prevents stray IT tests from being placed outside the adapter.in.web layer.
+ *
+ * MVP: enforces correct placement. For completeness enforcement (every Controller
+ * must have an IT), replace with a custom ArchCondition — see AGENTS.md.
+ *
+ * Generated by arbiter. Edit the template to change enforcement.
+ */
+@AnalyzeClasses(packages = "<%= basePackage ? basePackage : '' %>")
+public class TestCoverageArchTest {
+
+    @ArchTest
+    public static final ArchRule every_controller_must_have_integration_test =
+        noClasses()
+            .that().haveSimpleNameEndingWith("ControllerIT")
+            .should().resideOutsideOfPackage("<%= basePackage ? basePackage + '.adapter.in.web..' : 'adapter.in.web..' %>")
+            .because("Integration tests for web controllers must reside in the adapter.in.web package (test coverage placement enforcement).");
+}

package/dist/templates/archunit/arch-test-deps-maven.md.ejs

@@ -0,0 +1,42 @@
+# Architecture Test Dependencies (Maven)
+
+Generated by arbiter (M22). Add these dependencies to your `pom.xml` under `<dependencies>`.
+
+```xml
+<!-- ArchUnit — architecture enforcement -->
+<dependency>
+    <groupId>com.tngtech.archunit</groupId>
+    <artifactId>archunit-junit5</artifactId>
+    <version>1.3.0</version>
+    <scope>test</scope>
+</dependency>
+
+<!-- RestAssured — integration testing over real HTTP -->
+<dependency>
+    <groupId>io.rest-assured</groupId>
+    <artifactId>rest-assured</artifactId>
+    <version>5.4.0</version>
+    <scope>test</scope>
+</dependency>
+
+<!-- Testcontainers — PostgreSQL container for integration tests -->
+<dependency>
+    <groupId>org.testcontainers</groupId>
+    <artifactId>postgresql</artifactId>
+    <version>1.19.7</version>
+    <scope>test</scope>
+</dependency>
+<dependency>
+    <groupId>org.testcontainers</groupId>
+    <artifactId>junit-jupiter</artifactId>
+    <version>1.19.7</version>
+    <scope>test</scope>
+</dependency>
+
+<!-- Spring Boot Testcontainers support -->
+<dependency>
+    <groupId>org.springframework.boot</groupId>
+    <artifactId>spring-boot-testcontainers</artifactId>
+    <scope>test</scope>
+</dependency>
+```

package/dist/templates/archunit/arch-test-deps.gradle.ejs

@@ -0,0 +1,14 @@
+// arch-test-deps.gradle — generated by arbiter (M22)
+// Wired automatically: applied from the root build's arbiter-managed block.
+// Re-generate: arbiter update
+
+dependencies {
+    testImplementation 'com.tngtech.archunit:archunit-junit5:1.3.0'
+<%_ if (typeof framework === 'string' && framework.includes('spring')) { _%>
+    testImplementation 'io.rest-assured:rest-assured:5.4.0'
+    testImplementation 'org.testcontainers:postgresql:1.19.7'
+    testImplementation 'org.testcontainers:junit-jupiter:1.19.7'
+    // Explicit version required when Spring Boot BOM is not applied to this configuration
+    testImplementation 'org.springframework.boot:spring-boot-testcontainers:3.3.0'
+<%_ } _%>
+}

package/dist/templates/audit/gdpr/check-gdpr-controls.mjs.ejs

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+// <%= projectName %> — GDPR controls gate (#1251)
+// Enforceable PASS/FAIL gate for the `industryOverlay: gdpr` controls.
+// Validates that every required GDPR control artifact exists and is non-trivial,
+// and that the controls→gate traceability doc covers each control. Exits 0 when
+// all controls have evidence; exits 1 (blocking an L4 release) otherwise.
+//
+// This is the "gate" half of the controls→gates overlay: each GDPR-NN control in
+// docs/compliance/gdpr/controls-to-gates.md is mapped to an artifact this script
+// asserts. It is implementation-neutral — adapt the artifacts to your stack, but
+// the gate stays green only while the evidence exists.
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-gdpr-controls.mjs [options]',
+    '',
+    'Validates that every required GDPR control artifact exists and is non-empty.',
+    'Exits 0 when all controls have evidence; exits 1 otherwise.',
+    '',
+    'Options:',
+    '  --root <path>   Project root (default: cwd)',
+    '  --help, -h      Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const rootArg = args.indexOf('--root');
+const ROOT = rootArg >= 0 && args[rootArg + 1] ? resolve(args[rootArg + 1]) : process.cwd();
+
+// GDPR controls → required evidence artifact + a token that must appear in it.
+// Each row is one PASS/FAIL control. Keep in lockstep with controls-to-gates.md.
+const CONTROLS = [
+  {
+    id: 'GDPR-01',
+    title: 'DPIA (Art. 35) is documented',
+    artifact: 'docs/compliance/gdpr/dpia.md',
+    mustContain: 'Data Protection Impact Assessment',
+  },
+  {
+    id: 'GDPR-02',
+    title: 'Personal-data flows are mapped (Art. 30 records of processing)',
+    artifact: 'docs/compliance/gdpr/data-flow-map.md',
+    mustContain: 'Data-Flow Map',
+  },
+  {
+    id: 'GDPR-03',
+    title: 'Right to erasure (Art. 17) has a documented control + test hook',
+    artifact: 'docs/compliance/gdpr/controls-to-gates.md',
+    mustContain: 'erasure',
+  },
+  {
+    id: 'GDPR-04',
+    title: 'Lawful basis / consent (Art. 6, 7) is documented',
+    artifact: 'docs/compliance/gdpr/controls-to-gates.md',
+    mustContain: 'consent',
+  },
+  {
+    id: 'GDPR-05',
+    title: 'Retention windows are enforced and documented',
+    artifact: 'docs/compliance/gdpr/data-flow-map.md',
+    mustContain: 'retention',
+  },
+];
+
+const failures = [];
+for (const c of CONTROLS) {
+  const path = join(ROOT, c.artifact);
+  if (!existsSync(path)) {
+    failures.push(`${c.id} (${c.title}): missing artifact ${c.artifact}`);
+    continue;
+  }
+  let body;
+  try {
+    if (statSync(path).size === 0) {
+      failures.push(`${c.id} (${c.title}): empty artifact ${c.artifact}`);
+      continue;
+    }
+    body = readFileSync(path, 'utf-8');
+  } catch (err) {
+    failures.push(`${c.id} (${c.title}): cannot read ${c.artifact} — ${String(err)}`);
+    continue;
+  }
+  if (!body.toLowerCase().includes(c.mustContain.toLowerCase())) {
+    failures.push(
+      `${c.id} (${c.title}): ${c.artifact} does not document "${c.mustContain}"`,
+    );
+  }
+}
+
+if (failures.length > 0) {
+  process.stderr.write(`check-gdpr-controls: FAIL — ${failures.length} GDPR control(s) without evidence:\n`);
+  for (const f of failures) process.stderr.write(`  [FAIL] ${f}\n`);
+  process.stderr.write(`\nSee docs/compliance/gdpr/controls-to-gates.md for the controls→gate map.\n`);
+  process.exit(1);
+}
+
+process.stdout.write(`check-gdpr-controls: OK — all ${CONTROLS.length} GDPR control(s) have evidence.\n`);
+process.exit(0);

package/dist/templates/audit/gdpr/controls-to-gates.md.ejs

@@ -0,0 +1,42 @@
+<%# GDPR controls→gate traceability — overlay template (#1251). %>
+# GDPR Controls → Gate Traceability — <%= projectName %>
+
+> Traceability matrix for the **gdpr** industry overlay on **<%= projectName %>**
+> (governance **<%= governanceLevel %>**). Every GDPR control below maps to the gate
+> that mechanically enforces it. The enforcing gate is `scripts/check-gdpr-controls.mjs`,
+> wired into the L2 quality gate (`check-all.mjs`) — it exits non-zero when any
+> control's evidence artifact is missing, so these controls cannot silently rot.
+
+| Control | GDPR article | Statement                                                          | Enforcing gate                       | Evidence artifact                          |
+| ------- | ------------ | ------------------------------------------------------------------ | ------------------------------------ | ------------------------------------------ |
+| GDPR-01 | Art. 35      | A DPIA is documented for high-risk processing.                     | `check-gdpr-controls.mjs` (GDPR-01)  | `docs/compliance/gdpr/dpia.md`             |
+| GDPR-02 | Art. 30      | Personal-data flows are inventoried (records of processing).       | `check-gdpr-controls.mjs` (GDPR-02)  | `docs/compliance/gdpr/data-flow-map.md`    |
+| GDPR-03 | Art. 17      | Right to erasure is implemented and tested.                        | `check-gdpr-controls.mjs` (GDPR-03)  | this doc + erasure handler test            |
+| GDPR-04 | Art. 6, 7    | A lawful basis / consent is recorded for each processing activity. | `check-gdpr-controls.mjs` (GDPR-04)  | this doc + consent ledger                  |
+| GDPR-05 | Art. 5(1)(e) | Retention windows are documented and enforced.                     | `check-gdpr-controls.mjs` (GDPR-05)  | `docs/compliance/gdpr/data-flow-map.md`    |
+
+## Erasure (GDPR-03) — implementation hook
+
+The right to **erasure** (Art. 17) requires that a data-subject request removes
+personal data from every Store listed in `data-flow-map.md`. Wire your erasure
+handler and add a test that:
+
+1. Seeds personal data across all stores.
+2. Invokes the erasure handler for a subject id.
+3. Asserts no personal data for that subject remains in any store.
+
+Reference that test here so GDPR-03 stays traceable.
+
+## Consent / lawful basis (GDPR-04) — implementation hook
+
+Each processing activity needs a recorded lawful basis. Where the basis is
+**consent** (Art. 6(1)(a) / Art. 7), record consent capture, withdrawal, and
+proof-of-consent. Reference the consent ledger and its test here.
+
+## How the gate runs
+
+```bash
+node scripts/check-gdpr-controls.mjs   # exit 0 = all controls have evidence; exit 1 = blocking gap
+```
+
+Run automatically at L2 via `node scripts/check-all.mjs --level L2`.

package/dist/templates/audit/gdpr/data-flow-map.md.ejs

@@ -0,0 +1,30 @@
+<%# GDPR personal-data flow inventory — overlay template (#1251). %>
+# Personal-Data Flow Map — <%= projectName %>
+
+> GDPR Art. 30 record of processing activities for **<%= projectName %>**.
+> Each row is a personal-data flow: where it enters, where it lives, where it
+> leaves, its lawful basis and its retention window. The `check-gdpr-controls.mjs`
+> gate (GDPR-02 / GDPR-05) fails if this Data-Flow Map is missing or omits a
+> retention column.
+
+## Processing inventory
+
+| Flow ID | Data category        | Source (in)     | Store               | Egress (out)      | Lawful basis | Retention        |
+| ------- | -------------------- | --------------- | ------------------- | ----------------- | ------------ | ---------------- |
+| FLOW-01 | TODO (e.g. email)    | TODO            | TODO                | TODO              | TODO         | TODO (e.g. 24mo) |
+| FLOW-02 | TODO                 | TODO            | TODO                | TODO              | TODO         | TODO             |
+
+## Retention & erasure
+
+- **Retention windows** above are enforced by your storage layer's purge job.
+  Document the purge mechanism here and reference the test that proves
+  data older than the window is deleted.
+- **Erasure (Art. 17):** a data-subject erasure request must remove personal data
+  from every Store column above. Reference the erasure handler + its test in
+  `controls-to-gates.md` (GDPR-03).
+
+## Cross-border transfers
+
+| Flow ID | Destination country | Transfer mechanism (SCC / adequacy / …) |
+| ------- | ------------------- | --------------------------------------- |
+| TODO    | TODO                | TODO                                    |

package/dist/templates/audit/gdpr/dpia.md.ejs

@@ -0,0 +1,45 @@
+<%# GDPR Data Protection Impact Assessment — overlay template (#1251). %>
+# Data Protection Impact Assessment (DPIA) — <%= projectName %>
+
+> GDPR Art. 35 DPIA for **<%= projectName %>** (governance **<%= governanceLevel %>**).
+> This is the screening + assessment record. Update it whenever a new processing
+> activity is introduced. The `check-gdpr-controls.mjs` gate (GDPR-01) fails if this
+> document is missing or empty.
+
+## 1. Screening — is a DPIA required?
+
+A DPIA is required when processing is likely to result in a high risk to data
+subjects (Art. 35(1)). Answer each trigger; if any is **Yes**, a full assessment
+below is mandatory.
+
+| Trigger                                                        | Yes / No |
+| ------------------------------------------------------------- | -------- |
+| Systematic and extensive profiling with significant effects   | TODO     |
+| Large-scale processing of special-category data (Art. 9)      | TODO     |
+| Systematic monitoring of a publicly accessible area           | TODO     |
+
+## 2. Description of processing
+
+- **Nature, scope, context, purposes:** TODO
+- **Categories of personal data:** TODO (cross-reference `data-flow-map.md`)
+- **Recipients / processors:** TODO
+- **Retention period:** TODO (must match `data-flow-map.md` retention column)
+
+## 3. Necessity & proportionality
+
+- **Lawful basis (Art. 6):** TODO (consent / contract / legal obligation / …)
+- **Data minimisation measures:** TODO
+- **Data-subject rights supported:** access, rectification, erasure, portability.
+
+## 4. Risk assessment & mitigations
+
+| Risk to data subjects | Likelihood | Severity | Mitigation |
+| --------------------- | ---------- | -------- | ---------- |
+| Unauthorised access   | TODO       | TODO     | TODO       |
+| Excessive retention   | TODO       | TODO     | TODO       |
+
+## 5. Sign-off
+
+- **DPO / responsible owner:** TODO
+- **Date:** TODO
+- **Outcome:** proceed / proceed-with-mitigations / consult-supervisory-authority

package/dist/templates/audit/generic/audit-gate-rules.md.ejs

@@ -0,0 +1,24 @@
+<%# Generic L4 audit-trail gate rules — language-neutral, overlay-parametrized (#1156). %>
+# Audit-Trail Gate Rules — <%= industryOverlay.toUpperCase() %> overlay
+
+> Checkable rules for the **<%= industryOverlay %>** audit-trail overlay on project
+> **<%= projectName %>** (governance **<%= governanceLevel %>**). These rules are
+> framework-agnostic — adapt the evidence column to your stack's audit
+> implementation. Each rule is PASS/FAIL; a failing rule blocks an L4 release.
+
+| Rule    | Statement                                                                 | Evidence to produce                                  |
+| ------- | ------------------------------------------------------------------------- | ---------------------------------------------------- |
+| AUD-01  | Every governed write path emits exactly one audit record.                 | Coverage report mapping write paths → audit emitters |
+| AUD-02  | Audit records are append-only (no UPDATE/DELETE on the audit store).      | Schema/permission proof; migration review            |
+| AUD-03  | `actor` is always a resolved, non-anonymous identity.                     | Test asserting rejection of anonymous mutation       |
+| AUD-04  | `timestamp` is server-assigned UTC; client values are ignored.            | Test asserting client timestamp is overridden        |
+| AUD-05  | Records are integrity-protected (hash chain or signed).                   | Integrity-verification test over a sample chain      |
+| AUD-06  | Retention window is enforced and documented.                              | Retention config + purge-after-window test           |
+| AUD-07  | Audit export is reproducible and complete for any time range.             | Export round-trip test                               |
+
+## Applying these rules
+
+These rules are the L4 audit-trail Definition of Done for the
+**<%= industryOverlay %>** overlay. They are intentionally implementation-neutral:
+the pharma overlay satisfies them via JPA `AuditEvent` + ArchUnit rules, while a
+generic project satisfies them with whatever audit store and tests fit its stack.

package/dist/templates/audit/generic/audit-trail-policy.md.ejs

@@ -0,0 +1,38 @@
+<%# Generic L4 audit-trail policy — language-neutral, overlay-parametrized (#1156). %>
+# Audit-Trail Policy — <%= industryOverlay.toUpperCase() %> overlay
+
+> Generated by arbiter for project **<%= projectName %>** at governance level
+> **<%= governanceLevel %>**. This is a language-neutral audit-trail control
+> document. It carries **no** framework- or industry-specific implementation
+> (contrast the pharma overlay, which emits Java/JPA scaffolding).
+
+## Scope
+
+Every state-changing operation on a governed entity MUST produce an immutable,
+tamper-evident audit record. This policy defines the required fields, retention,
+and verification expectations for the **<%= industryOverlay %>** compliance overlay.
+
+## Required audit-record fields
+
+| Field        | Requirement                                                        |
+| ------------ | ------------------------------------------------------------------ |
+| `actor`      | Authenticated identity that initiated the change.                  |
+| `action`     | Operation performed (create / update / delete / access).           |
+| `entity`     | Stable identifier of the affected record.                          |
+| `before`     | Prior value (null on create).                                      |
+| `after`      | New value (null on delete).                                        |
+| `timestamp`  | UTC, monotonic, server-assigned (never client-supplied).           |
+| `correlation`| Request/trace id linking the change to its originating operation.  |
+
+## Invariants (gate-enforced)
+
+1. **Append-only** — audit records are never updated or deleted in place.
+2. **Complete** — no governed mutation may occur without a corresponding record.
+3. **Tamper-evident** — records are integrity-protected (hash chain or equivalent).
+4. **Attributable** — every record names a non-anonymous actor.
+5. **Retained** — records persist for the overlay's mandated retention window.
+
+## Verification
+
+See `audit-gate-rules.md` (emitted alongside this policy) for the concrete,
+checkable gate rules an auditor or CI step applies against an implementation.

package/dist/templates/audit/iso27001/iso27001-controls-gate-map.md.ejs

@@ -0,0 +1,60 @@
+<%# #1252: ISO 27001:2022 Annex-A controls → arbiter gate traceability (overlay-driven). %>
+# ISO 27001:2022 — Annex-A Controls → Gate Traceability
+
+> Overlay-driven traceability for project **<%= projectName %>** (governance
+> **<%= governanceLevel %>**, `industryOverlay: iso27001`). Unlike a coverage
+> scorecard, this document is a **Definition-of-Done**: each listed Annex-A
+> control is bound to a concrete, fail-closed arbiter gate that an auditor can
+> re-run. A failing gate is a non-conformity — it blocks the release, it does
+> not merely warn.
+
+## Scope
+
+This overlay covers the **technological** Annex-A controls that arbiter can
+mechanically enforce. Organizational, people, and physical controls (A.5/A.6/A.7)
+remain manual and are tracked separately in the Annex-A coverage matrix. The
+controls below are the enforceable subset; each row names the gate that produces
+the evidence of conformity.
+
+## Controls → gate map
+
+| Annex-A | Control | Bound arbiter gate (fail-closed) | Evidence produced |
+| ------- | ------- | -------------------------------- | ----------------- |
+| A.8.25 | Secure development life cycle | `node scripts/check-all.mjs` (L1/L2/L3 tiers) + module-boundary rules (dependency-cruiser / ArchUnit) | Gate pass record per merge; architecture conformance report |
+| A.8.26 | Application security requirements | OWASP / ZAP dynamic application security testing (DAST) + STRIDE threat model | DAST scan report; documented threat model |
+| A.8.28 | Secure coding | Static application security testing (SAST: eslint-security / semgrep) + dependency vulnerability scan (`npm audit` / trivy fs) | SAST findings = 0 high; dependency scan report |
+| A.8.29 | Security testing in development and acceptance | Secret scanning (`gitleaks`) + PII scan (`pii-scan`) + the security test suite | gitleaks clean; pii-scan clean; security tests green |
+| A.8.32 | Change management | Commit-footer rationale audit (**INV-119**, change-management evidence) + ff-only PR/gate process (INV-101) | Per-commit rationale trailer; gated PR history |
+
+## Access control (A.5.15 / A.8.4)
+
+Source-code access and change authorization are enforced, not documented:
+
+- **Branch protection** + **CODEOWNERS** require review on every protected path.
+- **INV-23** forbids direct pushes to `main` — all change flows through a gated PR.
+- Result: no source-code change reaches the protected branch without an
+  authenticated, reviewed, gated path (A.8.4 *Access to source code*).
+
+## SBOM / supply-chain integrity (A.5.21)
+
+Supply-chain assurance for the ICT supply chain (A.5.21 *Managing information
+security in the ICT supply chain*) is produced by the release pipeline:
+
+- **SBOM** generation + **cosign** signing + **SLSA** provenance attestation on
+  release artifacts.
+- **Dependency vulnerability scan** (`npm audit` / trivy fs) gates
+  on known-vulnerable transitive dependencies.
+
+## How to use this matrix
+
+Each row is an auditable claim: run the named gate, attach its output as the
+evidence of conformity for that control. Because the gates are the same ones the
+project already runs in CI, ISO 27001 conformity for this subset is a byproduct
+of a green pipeline — re-run `node scripts/check-all.mjs` to regenerate the
+evidence. Controls outside this enforceable subset are tracked manually in the
+Annex-A coverage matrix.
+
+---
+
+*Auto-generated by arbiter for the `iso27001` industry overlay. Re-run
+`arbiter init` to regenerate the scaffold; edit to record manual control status.*