@getarbiter/cli 0.5.0

package/dist/templates/boundaries/eslint.config.boundaries.mjs.ejs

@@ -0,0 +1,112 @@
+// eslint.config.boundaries.mjs — generated by arbiter (#2272, ESLint v9 flat-config).
+// #2272 (#1491-class fix): the gate runs the flat config — ESLint v9 removed the
+// legacy --no-eslintrc/-c loader the .cjs file needs (mirrors eslint.config.frontend-spa.mjs, #1127/#1491).
+// Run in isolation by check-boundaries.mjs via
+// `eslint --config eslint.config.boundaries.mjs --no-config-lookup src/` so it
+// enforces ONLY the hexagonal boundary rules, independent of your main eslint.config.mjs.
+// The legacy .eslintrc-boundaries.cjs is retained for tooling that still reads
+// eslintrc-format config but is NOT used by the gate.
+// Peer dep: npm i -D eslint-plugin-boundaries (auto-injected into devDependencies)
+// Re-generate: arbiter update
+import tseslint from 'typescript-eslint'
+import boundaries from 'eslint-plugin-boundaries'
+
+const elements = [
+  { type: 'domain', pattern: 'src/domain/**' },
+  { type: 'application', pattern: 'src/application/**' },
+  { type: 'adapters', pattern: 'src/adapters/**' },
+  { type: 'infrastructure', pattern: 'src/infrastructure/**' },
+]
+
+export default [
+  {
+    files: ['src/**/*.ts', 'src/**/*.tsx'],
+    languageOptions: {
+      parser: tseslint.parser,
+      ecmaVersion: 2022,
+      sourceType: 'module',
+    },
+    plugins: { boundaries },
+    settings: {
+      'boundaries/elements': elements,
+      'boundaries/include': ['src/**/*.ts', 'src/**/*.tsx'],
+      // Without this, eslint-plugin-boundaries' bundled eslint-import-resolver-node
+      // cannot resolve extensionless relative imports ('../domain/entity') to a .ts
+      // file, so every cross-layer import is classified "unknown" and
+      // boundaries/no-unknown false-positives on EVERY legitimate import — including
+      // clean, rule-compliant code (verified against eslint-plugin-boundaries@7.2.0).
+      'import/resolver': { node: { extensions: ['.ts', '.tsx', '.js', '.jsx'] } },
+    },
+    rules: {
+      // Layer isolation — default deny; only listed directions allowed
+      'boundaries/element-types': [
+        'error',
+        {
+          default: 'disallow',
+          rules: [
+            { from: 'domain', allow: [] },
+            { from: 'application', allow: ['domain'] },
+            { from: 'adapters', allow: ['application', 'domain'] },
+            { from: 'infrastructure', allow: ['application', 'domain'] },
+          ],
+        },
+      ],
+      // No framework/I-O imports in domain via external modules
+      'boundaries/external': [
+        'error',
+        {
+          default: 'allow',
+          rules: [
+            {
+              from: ['domain'],
+              disallow: [
+                'express', 'fastify', 'koa', 'hapi',
+                'react', 'react-dom', 'next', 'vue', 'svelte', 'angular',
+                '@nestjs/*', '@angular/*',
+                'typeorm', 'prisma', '@prisma/*', 'mongoose', 'sequelize',
+                'axios', 'got', 'node-fetch', 'ky',
+                'node:fs', 'node:path', 'node:http', 'node:https',
+                'node:crypto', 'node:os', 'node:child_process', 'node:stream',
+              ],
+            },
+          ],
+        },
+      ],
+      'boundaries/no-unknown': 'error',
+      'boundaries/no-unknown-files': 'warn',
+    },
+  },
+  {
+    // Domain layer: pure of all I/O — no Node built-ins, no browser globals
+    files: ['src/domain/**/*.ts', 'src/domain/**/*.tsx'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['fs', 'path', 'http', 'https', 'crypto', 'os', 'child_process', 'stream', 'events', 'buffer'],
+              message: 'Domain must not import Node built-ins.',
+            },
+            {
+              group: ['node:fs', 'node:path', 'node:http', 'node:https', 'node:crypto', 'node:os', 'node:child_process', 'node:stream', 'node:events', 'node:buffer'],
+              message: 'Domain must not import Node built-ins.',
+            },
+          ],
+        },
+      ],
+      'no-restricted-globals': [
+        'error',
+        { name: 'window', message: 'Domain must not reference browser globals.' },
+        { name: 'document', message: 'Domain must not reference browser globals.' },
+        { name: 'localStorage', message: 'Domain must not reference browser globals.' },
+        { name: 'sessionStorage', message: 'Domain must not reference browser globals.' },
+        { name: 'fetch', message: 'Use a port abstraction; domain must not call fetch directly.' },
+        { name: 'navigator', message: 'Domain must not reference browser globals.' },
+        { name: 'location', message: 'Domain must not reference browser globals.' },
+        { name: 'history', message: 'Domain must not reference browser globals.' },
+        { name: 'XMLHttpRequest', message: 'Domain must not reference browser globals.' },
+      ],
+    },
+  },
+]

package/dist/templates/boundaries/eslint.config.frontend-spa.mjs.ejs

@@ -0,0 +1,93 @@
+<%
+// #1127: framework-aware FSD boundary config — flat-config counterpart of
+// .eslintrc-frontend-spa.cjs. ESLint v9 removed --no-eslintrc/-c (the legacy
+// eslintrc loader), which broke the `fsd boundaries` gate on every fresh
+// frontend-spa init (#1491-class fix, mirrors eslint.config.static.mjs).
+// Source of truth: config.frontend.framework ('react'|'vue'|'svelte'|undefined).
+const _fw = (typeof frontend !== 'undefined' && frontend && frontend.framework)
+  ? frontend.framework
+  : 'react'
+
+const _globs = _fw === 'vue'
+  ? ['src/**/*.ts', 'src/**/*.vue']
+  : _fw === 'svelte'
+  ? ['src/**/*.ts', 'src/**/*.svelte']
+  : ['src/**/*.ts', 'src/**/*.tsx', 'src/**/*.jsx']
+
+// #2277: resolver extensions track the framework the same way _globs does — a
+// resolver that cannot see .vue/.svelte leaves those imports "unknown" in exactly
+// the projects whose globs include them.
+// Extensions mirror _globs exactly (plus plain .js): a vue/svelte FSD project's
+// boundaries/include never covers .tsx, so resolving to one could not classify it
+// into an element anyway — and #1127 requires those renders not to mention .tsx.
+const _resolverExts = _fw === 'vue'
+  ? ['.ts', '.vue', '.js']
+  : _fw === 'svelte'
+  ? ['.ts', '.svelte', '.js']
+  : ['.ts', '.tsx', '.js', '.jsx']
+
+// Single-quoted literal, matching eslint.config.boundaries.mjs (#2272) — the
+// emitted file is prettier-ignored, so the two boundary configs stay readable
+// side by side rather than drifting on quote style.
+const _resolverExtsLiteral = '[' + _resolverExts.map((e) => `'${e}'`).join(', ') + ']'
+%>
+// eslint.config.frontend-spa.mjs — generated by arbiter (#1127, ESLint v9 flat-config).
+// Framework: <%- _fw %>
+// Run in isolation by check-all.mjs via
+// `eslint --config eslint.config.frontend-spa.mjs --no-config-lookup <glob>` so it
+// enforces ONLY the FSD boundary rules, independent of your main eslint.config.mjs.
+// The legacy .eslintrc-frontend-spa.cjs is retained for tooling that still reads
+// eslintrc-format config but is NOT used by the gate.
+// Peer dep: npm i -D eslint-plugin-boundaries (auto-injected into devDependencies)
+// Re-generate: arbiter update
+import tseslint from 'typescript-eslint'
+import boundaries from 'eslint-plugin-boundaries'
+
+export default [
+  {
+    files: <%- JSON.stringify(_globs) %>,
+    languageOptions: {
+      parser: tseslint.parser,
+      ecmaVersion: 2022,
+      sourceType: 'module',
+    },
+    plugins: { boundaries },
+    settings: {
+      'boundaries/elements': [
+        { type: 'app', pattern: 'src/app/**' },
+        { type: 'pages', pattern: 'src/pages/**' },
+        { type: 'widgets', pattern: 'src/widgets/**' },
+        { type: 'features', pattern: 'src/features/**' },
+        { type: 'entities', pattern: 'src/entities/**' },
+        { type: 'shared', pattern: 'src/shared/**' },
+      ],
+      'boundaries/include': <%- JSON.stringify(_globs) %>,
+      // #2277 (same defect class #2272 fixed for hexagonal): without this,
+      // eslint-plugin-boundaries' bundled eslint-import-resolver-node cannot resolve
+      // an extensionless relative import ('../entities/user') to a .ts file, so every
+      // legitimate cross-layer import classifies as "unknown" and boundaries/no-unknown
+      // false-positives on clean, rule-compliant FSD code. Verified against a real
+      // generated frontend-spa project with eslint-plugin-boundaries@7.2.0.
+      'import/resolver': { node: { extensions: <%- _resolverExtsLiteral %> } },
+    },
+    rules: {
+      // FSD layer isolation — higher layers may only import from lower layers
+      'boundaries/element-types': [
+        'error',
+        {
+          default: 'disallow',
+          rules: [
+            { from: 'app', allow: ['pages', 'widgets', 'features', 'entities', 'shared'] },
+            { from: 'pages', allow: ['widgets', 'features', 'entities', 'shared'] },
+            { from: 'widgets', allow: ['features', 'entities', 'shared'] },
+            { from: 'features', allow: ['entities', 'shared'] },
+            { from: 'entities', allow: ['shared'] },
+            { from: 'shared', allow: [] },
+          ],
+        },
+      ],
+      'boundaries/no-unknown': 'error',
+      'boundaries/no-unknown-files': 'warn',
+    },
+  },
+]

package/dist/templates/boundaries/golangci-boundaries.yml.ejs

@@ -0,0 +1,70 @@
+# Generated by arbiter (M22c) — hexagonal architecture boundary enforcement for Go
+# Peer dep: golangci-lint >= 2.0  (v2 config schema; depguard built-in)
+# Run via: golangci-lint run --config .golangci-boundaries.yml ./...
+version: "2"
+run:
+  timeout: 5m
+
+linters:
+  default: none
+  enable:
+    - depguard
+  settings:
+    depguard:
+      rules:
+        # ── Non-adapter layers: ban framework imports from domain and application ──
+        main:
+          files:
+            - "!**/internal/adapter/**"
+            - "!**/internal/infrastructure/**"
+            - "!**/cmd/**"
+            - "!**/*_test.go"
+          deny:
+            - pkg: "gorm.io/gorm"
+              desc: "Use repository interfaces (ports); ORM belongs in infrastructure adapters"
+            - pkg: "gorm.io/driver"
+              desc: "Database drivers belong in infrastructure adapters"
+            - pkg: "github.com/gin-gonic/gin"
+              desc: "HTTP framework belongs in adapter/in/web; not in domain or application"
+            - pkg: "github.com/labstack/echo/v4"
+              desc: "HTTP framework belongs in adapter/in/web"
+            - pkg: "github.com/labstack/echo"
+              desc: "HTTP framework belongs in adapter/in/web"
+            - pkg: "github.com/gofiber/fiber"
+              desc: "HTTP framework belongs in adapter/in/web"
+            - pkg: "go.uber.org/fx"
+              desc: "DI framework must not appear in domain or application layers"
+            - pkg: "github.com/go-sql-driver/mysql"
+              desc: "Database drivers belong in infrastructure adapters"
+            - pkg: "github.com/lib/pq"
+              desc: "Database drivers belong in infrastructure adapters"
+            - pkg: "github.com/jackc/pgx"
+              desc: "Database drivers belong in infrastructure adapters"
+
+        # ── Domain layer: stdlib and own domain only ─────────────────────────────
+        domain-purity:
+          files:
+            - "**/internal/domain/**"
+          deny:
+            - pkg: "gorm.io/gorm"
+              desc: "Domain must not depend on ORM"
+            - pkg: "gorm.io/driver"
+              desc: "Domain must not depend on database drivers"
+            - pkg: "github.com/gin-gonic/gin"
+              desc: "Domain must not depend on HTTP frameworks"
+            - pkg: "github.com/labstack/echo/v4"
+              desc: "Domain must not depend on HTTP frameworks"
+            - pkg: "github.com/labstack/echo"
+              desc: "Domain must not depend on HTTP frameworks"
+            - pkg: "github.com/gofiber/fiber"
+              desc: "Domain must not depend on HTTP frameworks"
+            - pkg: "go.uber.org/zap"
+              desc: "Domain must not depend on logging frameworks"
+            - pkg: "go.uber.org/fx"
+              desc: "Domain must not depend on DI frameworks"
+            - pkg: "github.com/go-sql-driver/mysql"
+              desc: "Domain must not depend on database drivers"
+            - pkg: "github.com/lib/pq"
+              desc: "Domain must not depend on database drivers"
+            - pkg: "github.com/jackc/pgx"
+              desc: "Domain must not depend on database drivers"

package/dist/templates/boundaries/ruff-boundaries.toml.ejs

@@ -0,0 +1,32 @@
+# ruff-boundaries.toml — generated by arbiter (M22d)
+# Domain-purity enforcement via ruff's flake8-tidy-imports banned-api (TID251).
+# Run: ruff check --config ruff-boundaries.toml src/domain/
+# Only the `src/domain/` target path is ever passed to ruff with this config,
+# so the banned-api list applies exclusively to domain code.
+
+target-version = "py310"
+
+[lint]
+select = ["TID251"]
+
+[lint.flake8-tidy-imports.banned-api]
+"django".msg = "framework module: not allowed in hexagonal domain"
+"django.db".msg = "framework module: not allowed in hexagonal domain"
+"flask".msg = "framework module: not allowed in hexagonal domain"
+"fastapi".msg = "framework module: not allowed in hexagonal domain"
+"fastapi.routing".msg = "framework module: not allowed in hexagonal domain"
+"starlette".msg = "framework module: not allowed in hexagonal domain"
+"sqlalchemy".msg = "framework module: not allowed in hexagonal domain"
+"sqlalchemy.orm".msg = "framework module: not allowed in hexagonal domain"
+"sqlalchemy.ext.asyncio".msg = "framework module: not allowed in hexagonal domain"
+"tortoise".msg = "framework module: not allowed in hexagonal domain"
+"peewee".msg = "framework module: not allowed in hexagonal domain"
+"pymongo".msg = "framework module: not allowed in hexagonal domain"
+"redis".msg = "framework module: not allowed in hexagonal domain"
+"requests".msg = "framework module: not allowed in hexagonal domain"
+"httpx".msg = "framework module: not allowed in hexagonal domain"
+"aiohttp".msg = "framework module: not allowed in hexagonal domain"
+"celery".msg = "framework module: not allowed in hexagonal domain"
+"boto3".msg = "framework module: not allowed in hexagonal domain"
+"psycopg".msg = "framework module: not allowed in hexagonal domain"
+"asyncpg".msg = "framework module: not allowed in hexagonal domain"

package/dist/templates/claude/CLAUDE.md.ejs

@@ -0,0 +1,78 @@
+<% /* ADR-051 (#1119): safety defaults for out-of-band renders; buildRenderContext always injects these. */
+const _collaborationMode = (typeof collaborationMode !== 'undefined' && collaborationMode) ? collaborationMode : 'peer-review';
+const _mergeMode = (typeof mergeMode !== 'undefined' && mergeMode) ? mergeMode : 'pr-ff';
+const _branchingStrategy = (typeof branchingStrategy !== 'undefined' && branchingStrategy) ? branchingStrategy : 'github-flow';
+%>
+# <%= projectName %> — Claude Code Configuration
+
+@AGENTS.md
+
+> This file imports `AGENTS.md` (canonical governance, AAIF standard) via the `@` directive above.
+> Below: Claude Code-specific configuration only — hooks, sub-agents, and slash commands.
+
+---
+
+## Quick Reference
+
+| Fact | Value |
+|------|-------|
+| **Project** | <%= projectName %> |
+| **Gate** | `node scripts/check-all.mjs` |
+| **Full governance** | `../AGENTS.md` (auto-imported above) |
+| **Collaboration mode** | `<%= _collaborationMode %>` — merge: `<%= _mergeMode %>` / branch: `<%= _branchingStrategy %>` |
+
+---
+
+## Claude Code-Specific
+
+### Hooks
+
+Configured in `.claude/settings.json`. Active hooks:
+
+| Event | Hook | Purpose |
+|-------|------|---------|
+| `PreToolUse` → Bash | `stop-dangerous.mjs` | Block dangerous commands and obvious writes to protected Arbiter state |
+| `PreToolUse` → Edit\|Write | `enforce-read-only.mjs` | Guard read-only files |
+| `PreToolUse` → Edit\|Write | `pre-edit-ssot-guard.mjs` | Prevent unauthorized SSOT edits |
+| `PostToolUse` → Bash | `post-commit-check.mjs` | Verify commit format after git commits |
+| `PostToolUse` → Edit\|Write | `check-no-orphan-todo.mjs` | Block orphan TODOs (INV-21) |
+<% if (governanceLevel !== 'L1') { -%>
+| `UserPromptSubmit` → * | `skill-forced-eval.mjs` | Phase-bound TDD evidence verifier; blocks implementation edits without a successful `Skill(tdd)` result (exit 2) |
+| `UserPromptSubmit` → * | `guard-task-completion.mjs` | Warn on premature task-completion claims |
+| `Stop` → * | `stop-evidence-guard.mjs` | Block completion claims without correlated evidence (INV-114) |
+<% } -%>
+<% if (language === 'typescript') { -%>
+| `PostToolUse` → Edit\|Write | `check-no-any.mjs` | Block `any` types (INV-04) |
+<% } -%>
+<% if (language === 'rust') { -%>
+| `PostToolUse` → Edit\|Write | `check-no-unwrap.mjs` | Block `.unwrap()` calls (INV-04) |
+<% } -%>
+
+### Slash Commands
+
+| Command | Purpose |
+|---------|---------|
+| `/ship #NNN` | **Orchestration entrypoint** — drive an issue to a merged PR (plan → review → gate → merge) |
+| `/task` | Low-level engine/CLI: `arbiter task init/advance/record-red/recover/get` |
+| `/wt-open` | Open an isolated task worktree |
+| `/wt-close` | Close or harvest a task worktree |
+| `/wt-list` | List active git worktrees with status |
+| `/wt-prune` | Prune stale worktree metadata |
+
+---
+
+## Hard Stops (Inherited from AGENTS.md)
+
+See `../AGENTS.md` §Invariants for the complete list.
+
+**Never:**
+- Skip the gate before committing
+<% if (_mergeMode !== 'direct') { %>
+- Commit directly to `main` (use PR branches — see collaboration mode above)
+<% } else { %>
+- Skip local gate before pushing to trunk (`collaborationMode: trunk-solo, mergeMode: direct`)
+<% } %>
+- Add `any` type (TS) or `.unwrap()` (Rust)
+- Leave orphan TODOs without task IDs
+
+**If gate fails:** Fix the root cause. No `--no-verify`. No skipping.

package/dist/templates/claude/agents/agent-write-classes.json

@@ -0,0 +1,30 @@
+{
+  "$schemaVersion": 1,
+  "_comment": "E5 (#1947): write-intent classification for pre-spawn-worktree-guard.mjs. A local (unscoped) name is derived from .claude/agents/*.md — an agent with a `tools:` frontmatter restricted to Read/Grep/Glob (or a description naming it a reviewer/verifier/scanner with no file-mutation role) is read-only; everything else defaults write-intent (fail-closed, see the hook). Kept in parity with .claude/agents/*.md by a carve-out in scripts/check-catalog-agents-parity.mjs (unscoped names only — Claude Code built-ins and `plugin:agent` scoped names are exempt from the local-file check, #2403). Unknown/unlisted type => write-intent by default; write-intent entries below are documented for clarity, not required for correctness.",
+  "classes": {
+    "Explore": "read-only",
+    "Plan": "read-only",
+    "codebase-scanner": "read-only",
+    "context-checker": "read-only",
+    "red-team": "read-only",
+    "bridge-reviewer": "read-only",
+    "claude-code-guide": "read-only",
+    "ai-pr-gate": "read-only",
+    "feature-dev:code-explorer": "read-only",
+    "feature-dev:code-architect": "read-only",
+    "feature-dev:code-reviewer": "read-only",
+    "pr-review-toolkit:comment-analyzer": "read-only",
+    "pr-review-toolkit:pr-test-analyzer": "read-only",
+    "pr-review-toolkit:silent-failure-hunter": "read-only",
+    "pr-review-toolkit:type-design-analyzer": "read-only",
+    "hookify:conversation-analyzer": "read-only",
+    "general-purpose": "write-intent",
+    "claude": "write-intent",
+    "fork": "write-intent",
+    "codex:codex-rescue": "write-intent",
+    "code-simplifier:code-simplifier": "write-intent",
+    "pr-review-toolkit:code-reviewer": "write-intent",
+    "pr-review-toolkit:code-simplifier": "write-intent",
+    "statusline-setup": "write-intent"
+  }
+}

package/dist/templates/claude/agents/bridge-reviewer.md.ejs

@@ -0,0 +1,68 @@
+---
+name: bridge-reviewer
+model: sonnet
+description: Phase-2 combined-verdict reviewer. Receives the REVIEW_CONTEXT from the context-checker and the INV verification result from runVerify, then applies the combined-verdict matrix to produce a single PASS/REJECT outcome.
+title: "Bridge Reviewer Agent"
+doc_version: "1.0.0"
+status: active
+last_review: "2026-05-20"
+owner: ""
+canonical_id: ""
+tags: ['audience/agent', 'audience/dev', 'kind/internal']
+related: []
+---
+
+# Bridge Reviewer Agent
+
+**Purpose:** Phase-2 of the two-phase verification bridge. Applies the combined-verdict matrix:
+
+| Context verdict | INV verdict | **Final verdict** |
+|----------------|-------------|-------------------|
+| PASS           | PASS        | **PASS**          |
+| PASS           | non-PASS    | **REJECT**        |
+| non-PASS       | PASS        | **REJECT**        |
+| non-PASS       | non-PASS    | **REJECT**        |
+
+Rule: the final outcome is `PASS` **only** when both phases pass.
+
+---
+
+## Inputs
+
+1. `REVIEW_CONTEXT` — JSON block emitted by the `context-checker` agent (Phase 1)
+2. `REVIEW.json` — verification result from `arbiter verify plan` (`runVerify`)
+
+## Protocol
+
+1. Parse the `REVIEW_CONTEXT.context_verdict` from Phase 1
+2. Parse the `verification.ok` field from `REVIEW.json` (Phase 2 INV check)
+   - `verification.ok === true` → INV verdict = `PASS`
+   - `verification.ok === false` → INV verdict = `REJECT`
+3. Apply the combined-verdict matrix (above)
+4. Emit the final outcome:
+
+```markdown
+## Bridge Review Result
+
+**Task:** <task_id>
+**Track:** <track>
+**Context verdict (Phase 1):** PASS | REJECT
+**INV verdict (Phase 2):** PASS | REJECT
+**Final verdict:** PASS | REJECT
+
+### Rationale
+<one paragraph explaining the result>
+
+### Blocking violations (if any)
+- [rule_id] message
+```
+
+## When final verdict is REJECT
+
+List all contributing violations from both phases. The task **must not proceed** to commit until all violations are resolved and both phases re-verify as PASS.
+
+## Constraints
+
+- Do not modify source files.
+- Do not bypass a REJECT verdict.
+- The combined-verdict matrix is the single source of truth — no overrides.

package/dist/templates/claude/agents/codebase-scanner.md.ejs

@@ -0,0 +1,69 @@
+---
+name: codebase-scanner
+model: haiku
+tools:
+  - Grep
+  - Glob
+  - Read
+description: Fast read-only pattern search. Use for finding usages, counting occurrences, listing files, and checking existing implementations. Cost-optimized.
+title: "Codebase Scanner Agent"
+doc_version: "1.0.0"
+status: active
+last_review: "2026-05-20"
+owner: ""
+canonical_id: ""
+tags: ['audience/agent', 'audience/dev', 'kind/internal']
+related: []
+---
+
+# Codebase Scanner Agent
+
+**Purpose:** Fast, parallel codebase pattern scanning.
+
+**Model:** Haiku (cost-optimized, fast latency)
+
+**Mode:** READ-ONLY
+
+---
+
+## Capabilities
+
+- Find class/interface/function implementations
+- Count usages of a symbol across the codebase
+- List files matching a naming pattern
+- Check whether a pattern exists before implementing
+- Locate existing adapters, handlers, or utilities to extend
+
+## Input Format
+
+Natural language requests:
+- "Find all implementations of UserRepository"
+- "Count usages of @Transactional in src/"
+- "List files matching *Controller*"
+- "Find existing error handlers in src/"
+
+## Output Format
+
+```
+[codebase-scanner]
+Query: <what was searched>
+
+Results:
+- <file>:<line> — <context>
+- <file>:<line> — <context>
+
+Count: <N> matches
+```
+
+If no results:
+```
+[codebase-scanner]
+Query: <what was searched>
+Result: No matches found.
+```
+
+## Constraints
+
+- Read-only. No edits, no writes.
+- Do not run tests or build commands.
+- Return raw findings — no recommendations.

package/dist/templates/claude/agents/context-checker.md.ejs

@@ -0,0 +1,73 @@
+---
+name: context-checker
+model: sonnet
+tools:
+  - Read
+  - Grep
+  - Glob
+description: Phase-1 context verifier. Reads CONTEXT_PACK.md and the task diff, emits a REVIEW_CONTEXT verdict for each file against the track's invariant set.
+title: "Context Checker Agent"
+doc_version: "1.0.0"
+status: active
+last_review: "2026-05-20"
+owner: ""
+canonical_id: ""
+tags: ['audience/agent', 'audience/dev', 'kind/internal']
+related: []
+---
+
+# Context Checker Agent
+
+**Purpose:** Phase-1 of the two-phase verification bridge. Reads `CONTEXT_PACK.md` and the task diff to produce a `REVIEW_CONTEXT` verdict used by the bridge-reviewer in Phase 2.
+
+**Mode:** READ-ONLY
+
+---
+
+## Inputs
+
+1. `CONTEXT_PACK.md` — a context pack containing track, invariant list, and `@source:` file citations
+2. Task diff or file contents for each `@source:` entry in the CONTEXT_PACK
+
+## Protocol
+
+For each file listed under `## Files` in `CONTEXT_PACK.md`:
+
+1. Read the file content
+2. Check for violations of each invariant listed under `## Invariants`
+3. Record an observation and per-file verdict (`PASS` / `REJECT`)
+
+After reviewing all files, emit a `REVIEW_CONTEXT` JSON block:
+
+```json
+{
+  "task_id": "<task_id>",
+  "track": "<A|B|C|D>",
+  "files": [
+    {
+      "path": "<file_path>",
+      "observation": "<one-sentence finding>",
+      "verdict": "PASS | REJECT"
+    }
+  ],
+  "invariants_checked": ["INV-XX", "..."],
+  "context_verdict": "PASS | REJECT"
+}
+```
+
+`context_verdict` is `PASS` only if **all** file verdicts are `PASS`.
+
+## Track Invariant Reference
+
+| Track | Invariant Tier |
+|-------|---------------|
+| A | Tier 1 — Architectural Integrity (INV-01..INV-06, INV-46) |
+| B | Tier 5 — Governance (INV-21..INV-28) |
+| C | Tier 2 + 3 — Data Integrity + Security (INV-07..INV-15) |
+| D | Tier 4 — Operational Excellence (INV-16..INV-20) |
+
+## Constraints
+
+- Read-only. Do not modify files.
+- Do not run build or test commands.
+- Output the `REVIEW_CONTEXT` JSON block verbatim — it is consumed by the bridge-reviewer agent in Phase 2.