@getarbiter/cli 0.5.0

package/dist/templates/codex/codex-adapter.mjs

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+// Codex CLI hook adapter — bridges the Codex hook payload to Claude Code hooks.
+// Usage: node .codex/codex-adapter.mjs [--event <HookEventName>] <hook-path>
+//
+// Codex and Claude Code deliver the SAME envelope on stdin
+// (`{ hook_event_name, tool_name, tool_input, cwd, session_id, transcript_path, ... }`);
+// only the tool vocabulary differs. This adapter rewrites the Codex tool vocabulary
+// (`Bash`/`bash` -> `Bash`, `apply_patch` -> `Edit`/`Write` once per file) and pipes the
+// rewritten payload on the hook's stdin, while ALSO exporting the legacy
+// `CLAUDE_TOOL_INPUT_*` env vars. Both channels are populated on purpose: hooks that
+// parse stdin JSON and hooks that read the env var both work, and `lib.mjs`'s
+// resolveToolInput{Path,Command} prefers stdin with an env fallback (#1565).
+import { execFileSync } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+
+const argv = process.argv.slice(2)
+let eventOverride = ''
+if (argv[0] === '--event') {
+  eventOverride = argv[1] ?? ''
+  argv.splice(0, 2)
+}
+const hookPath = argv[0]
+if (!hookPath) {
+  process.stderr.write(
+    '[codex-adapter] FATAL: no hook path provided as argument.\n' +
+      'Usage: node .codex/codex-adapter.mjs [--event <HookEventName>] <hook-path>\n' +
+      'Check .codex/config.toml for correct hook command wiring.\n',
+  )
+  process.exit(2)
+}
+
+let raw = ''
+try {
+  raw = readFileSync(0, 'utf-8').trim()
+  // FAIL-OPEN-INTENT: stdin unreadable — no payload means nothing to check, so let the
+  // tool call through rather than hard-blocking every Codex action on an adapter I/O fault.
+} catch (err) {
+  process.stderr.write(`[codex-adapter] failed to read stdin payload: ${String(err)}\n`)
+  process.exit(0)
+}
+
+if (!raw) process.exit(0)
+
+let payload
+try {
+  payload = JSON.parse(raw)
+  // FAIL-OPEN-INTENT: payload is not JSON — same reasoning as above; an unparseable
+  // envelope carries no command/path to judge, so blocking would be arbitrary.
+} catch (err) {
+  process.stderr.write(`[codex-adapter] failed to parse stdin as JSON: ${String(err)}\n`)
+  process.exit(0)
+}
+
+const toolName = payload?.tool_name ?? ''
+const toolInput = payload?.tool_input ?? {}
+const hookEventName = payload?.hook_event_name ?? eventOverride
+const env = { ...process.env }
+
+/**
+ * Runs the target hook once with `payloadOverrides` merged onto the incoming envelope.
+ * Every field Codex sent is preserved (transcript_path, session_id, turn_id, model, ...) —
+ * hooks read those directly. Exits the adapter on the first non-zero hook exit.
+ */
+function runHook(payloadOverrides, envOverrides) {
+  const childPayload = { ...payload, ...payloadOverrides }
+  if (hookEventName) childPayload.hook_event_name = hookEventName
+  try {
+    execFileSync('node', [hookPath], {
+      env: { ...env, ...envOverrides },
+      input: JSON.stringify(childPayload),
+      // fd 0 must be a pipe to carry `input`; stderr/stdout stay inherited so a blocking
+      // hook's message reaches Codex unchanged.
+      stdio: ['pipe', 'inherit', 'inherit'],
+    })
+  } catch (err) {
+    if (err instanceof Error && 'status' in err) {
+      if (typeof err.status === 'number') process.exit(err.status)
+      // null status: hook was killed by signal or timed out — hard block
+      process.stderr.write(
+        `[codex-adapter] hook '${hookPath}' was killed by signal (status=null)\n`,
+      )
+      process.exit(2)
+    }
+    process.stderr.write(`[codex-adapter] unexpected error spawning hook: ${String(err)}\n`)
+    process.exit(2)
+  }
+}
+
+// Extract file paths or command depending on tool
+if (toolName === 'apply_patch') {
+  // tool_input.command is a unified diff; extract file paths from directive lines.
+  // "Move to:" captures the rename destination so SSOT/read-only guards check the target.
+  const patchBody = toolInput.command ?? ''
+  const files = []
+  for (const line of patchBody.split('\n')) {
+    const m = line.match(/^\*\*\* (Update File|Add File|Delete File|Move to): (.+)$/)
+    // A newly created file maps to Write; every other directive edits an existing path.
+    if (m) files.push({ path: m[2].trim(), tool: m[1] === 'Add File' ? 'Write' : 'Edit' })
+  }
+
+  if (files.length === 0) process.exit(0)
+
+  // Run the hook once per file — path-scoped hooks need one file_path each.
+  // Propagates the first non-zero exit code.
+  for (const file of files) {
+    runHook(
+      { tool_name: file.tool, tool_input: { file_path: file.path } },
+      { CLAUDE_TOOL_INPUT_PATH: file.path },
+    )
+  }
+  process.exit(0)
+}
+
+// codex-cli sends 'Bash' (capital B) for shell calls; 'bash' is kept for older
+// builds. Both spellings must also be in the config.toml matcher, or the hook
+// never reaches this adapter at all.
+if (toolName === 'Bash' || toolName === 'bash') {
+  const command = toolInput.command ?? ''
+  if (!command) process.exit(0)
+  runHook({ tool_name: 'Bash', tool_input: { command } }, { CLAUDE_TOOL_INPUT_COMMAND: command })
+  process.exit(0)
+}
+
+// Non-tool events (UserPromptSubmit, SessionStart, PreCompact, ...) carry no tool
+// vocabulary to translate — forward the envelope verbatim, exactly once.
+if (!toolName) {
+  runHook({}, {})
+  process.exit(0)
+}
+
+// Unknown tool — no-op
+process.exit(0)

package/dist/templates/codex/config.toml.ejs

@@ -0,0 +1,189 @@
+<% const hasClaude = tools.includes('claude') -%>
+<% const isTs = language === 'typescript' || language === 'multi' -%>
+<% const isL2 = governanceLevel !== 'L1' -%>
+<% const hasNoAnyHook = (locals.languageHooks || []).some(h => h.name === 'check-no-any.mjs') -%>
+[features]
+hooks = true
+
+# TRUST: Codex runs a project hook only after a one-time approval, recorded as a
+# trusted_hash under [hooks.state] in ~/.codex/config.toml and keyed by
+# <config-path>:<event>:<group-index>:<hook-index>. An unapproved entry is skipped
+# SILENTLY — no stderr, no exit code, the guard simply never runs. Editing this file
+# invalidates the approval for the entries it changes. Automation must therefore
+# pre-approve interactively once, or pass `codex exec --dangerously-bypass-hook-trust`.
+
+# ── PreToolUse: bash commands ─────────────────────────────────────────────────
+
+[[hooks.PreToolUse]]
+matcher = "^(Bash|bash)$"
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/stop-dangerous.mjs"
+timeout = 5
+<% if (hasClaude) { %>
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/enforce-gate-before-pr.mjs"
+timeout = 5
+<% } %>
+<% if (hasClaude && isL2) { %>
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/closer-mode-guard.mjs"
+timeout = 5
+<% } %>
+# ── PreToolUse: file edits (apply_patch) ─────────────────────────────────────
+
+[[hooks.PreToolUse]]
+matcher = "^apply_patch$"
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/enforce-read-only.mjs"
+timeout = 3
+
+[[hooks.PreToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/pre-edit-ssot-guard.mjs"
+timeout = 3
+
+# ── PostToolUse: after file edits ─────────────────────────────────────────────
+
+[[hooks.PostToolUse]]
+matcher = "^apply_patch$"
+
+[[hooks.PostToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/check-no-orphan-todo.mjs"
+timeout = 5
+
+[[hooks.PostToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/check-no-placeholders.mjs"
+timeout = 5
+
+<% if (locals.enableNoSkippedTests !== false) { %>
+[[hooks.PostToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/check-no-skipped-tests.mjs"
+timeout = 5
+<% } %>
+<% if (enableSecurityScanning) { %>
+[[hooks.PostToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/check-no-pii.mjs"
+timeout = 5
+<% } %>
+<% if (hasClaude && hasNoAnyHook) { %>
+[[hooks.PostToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/check-no-any.mjs"
+timeout = 5
+<% } %>
+<% if (hasClaude && isTs) { %>
+[[hooks.PostToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/check-circular-deps.mjs"
+timeout = 10
+
+[[hooks.PostToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/check-no-unused-exports.mjs"
+timeout = 60
+<% } %>
+<% if (hasClaude) { %>
+# ── PostToolUse: after bash commands ─────────────────────────────────────────
+
+[[hooks.PostToolUse]]
+matcher = "^(Bash|bash)$"
+
+[[hooks.PostToolUse.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/post-commit-check.mjs"
+timeout = 3
+
+# ── PreCompact ────────────────────────────────────────────────────────────────
+
+[[hooks.PreCompact]]
+
+[[hooks.PreCompact.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/pre-compact.mjs"
+timeout = 3
+
+# ── SubagentStop ──────────────────────────────────────────────────────────────
+# #2403: cleanup companion to pre-spawn-worktree-guard.mjs. Unlike the guard (which
+# keys off `tool_input.subagent_type`), this hook reads only top-level envelope
+# fields (`agent`/`subagent_type`/`agent_type`, `cwd`) that Codex's non-tool
+# passthrough already forwards verbatim — and degrades gracefully when they are
+# absent. Always exits 0.
+
+[[hooks.SubagentStop]]
+
+[[hooks.SubagentStop.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/post-subagent-release.mjs"
+timeout = 3
+<% } %>
+<% if (hasClaude && isL2) { %>
+# ── UserPromptSubmit ──────────────────────────────────────────────────────────
+
+[[hooks.UserPromptSubmit]]
+
+[[hooks.UserPromptSubmit.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/post-brainstorm-stop.mjs"
+timeout = 3
+
+[[hooks.UserPromptSubmit.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/skill-forced-eval.mjs"
+timeout = 3
+
+[[hooks.UserPromptSubmit.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/guard-task-completion.mjs"
+timeout = 3
+<% if (locals.enableEvidenceHarness !== false) { %>
+[[hooks.UserPromptSubmit.hooks]]
+type = "command"
+command = "node .codex/codex-adapter.mjs .claude/hooks/guard-done-evidence.mjs"
+timeout = 3
+<% } %>
+<% } %>
+# ── Not bridged ───────────────────────────────────────────────────────────────
+#
+# Every Arbiter hook that is wired for Claude Code but NOT bridged above, with the
+# reason. The list covers the full Arbiter hook set; a hook this project does not
+# emit simply does not exist here. Machine-read by the codex-adapter parity test —
+# keep the `# unbridgeable: <file> — <reason>` shape.
+#
+# No Codex hook event exists:
+# unbridgeable: stop-evidence-guard.mjs — Claude `Stop`; Codex accepts a Stop handler
+#   only as an allowlisted executor MCP tool, never as a config.toml command hook.
+# unbridgeable: stop-finding-loss.mjs — Claude `Stop`; same reason as above.
+# unbridgeable: debug-state-on-failure.mjs — Claude `PostToolUseFailure`; Codex has no
+#   failed-tool-call hook event.
+# unbridgeable: exitplanmode-banner.mjs — Claude `PostToolUse:ExitPlanMode`; Codex has
+#   no plan-mode tool to hook.
+# unbridgeable: pre-spawn-worktree-guard.mjs — Claude `PreToolUse:Task|Agent`; Codex
+#   `SubagentStart` carries no `tool_input`, so the write-intent signal the guard keys
+#   off has no equivalent in the Codex payload.
+#
+# A Codex hook event exists, but bridging it would be wrong:
+# unbridgeable: post-edit-dispatch.mjs — rewrites the edited file (format + lint --fix);
+#   a hook that mutates the tree mid-turn races Codex's own apply_patch.
+# unbridgeable: wiki-on-commit.mjs — regenerates docs into the working tree; same
+#   mid-turn mutation race as post-edit-dispatch.
+# unbridgeable: pre-edit-plan-anchor.mjs — the Codex track anchors plans through
+#   `.agents/plan/PLAN.json`; bridging the Claude anchor would enforce against the
+#   wrong artifact and block every apply_patch.
+#
+# Not emitted by any generator (present only in arbiter's own .claude/settings.json),
+# so the generated config cannot reference a file it does not emit:
+# unbridgeable: check-no-direct-spawn.mjs — self-config only, no generator template.
+# unbridgeable: pre-edit-load-memory.mjs — self-config only, no generator template.
+# unbridgeable: post-edit-artifact-schema.mjs — self-config only (staged self-only in
+#   scripts/canon01-self-only.json until the target-side ID registry exists); its registered
+#   instances are arbiter's own governance SSOT paths, which a Codex-driven target does not have.

package/dist/templates/compliance/compliance-mapping.md.ejs

@@ -0,0 +1,124 @@
+# Compliance Gate Mapping — <%= projectName %>
+
+<!-- arbiter-managed: compliance-mapping (#710) -->
+
+> Maps every arbiter-generated quality gate to the compliance control it satisfies.
+> Use this document to accelerate audit preparation and evidence collection.
+>
+<% const _iso = typeof enableIso27001Mapping !== 'undefined' && enableIso27001Mapping === true; const _nis2 = typeof enableNis2Mapping !== 'undefined' && enableNis2Mapping === true; const _gdpr = typeof enableGdprMapping !== 'undefined' && enableGdprMapping === true; %>
+> Generated frameworks: <%= [_iso && 'ISO 27001:2022', _nis2 && 'NIS2 Art.21.2', _gdpr && 'GDPR'].filter(Boolean).join(' · ') || 'none' %>
+
+---
+<% if (_iso) { %>
+
+## ISO 27001:2022 Annex A — Gate Coverage
+
+Each row maps an arbiter-generated gate or artifact to the ISO 27001:2022 Annex A control it provides evidence for.
+
+| Gate / Artifact | Script / File | Annex A Control | Control title | Coverage |
+| --------------- | ------------- | --------------- | ------------- | -------- |
+| Format check | `npx prettier --check` | A.8.28 | Secure coding | ✅ Partial |
+| Lint / static analysis | `npx eslint` / language linter | A.8.28 | Secure coding | ✅ Partial |
+| Unit + integration tests | `check-all.mjs L1` | A.8.29 | Security testing in development and acceptance | ✅ Covered |
+| Coverage gate | `scripts/check-coverage.mjs` | A.8.29 | Security testing in development and acceptance | ✅ Covered |
+| Dependency audit | `npm audit` / `cargo audit` / `pip-audit` | A.8.8 | Management of technical vulnerabilities | ✅ Covered |
+| Secret scanning | `gitleaks` (nightly + pre-push hook) | A.8.12 | Data leakage prevention | ✅ Covered |
+| PII scan | `scripts/pii-scan.mjs` | A.8.11 | Data masking | ✅ Covered |
+| STRIDE threat model | `docs/SECURITY/STRIDE.md` | A.8.16 | Monitoring activities | ✅ Covered |
+| OWASP suppression log | `docs/SECURITY/owasp-suppressions.xml` | A.8.20 | Networks security | ✅ Partial |
+| Access control middleware | `src/middleware/auth*` | A.8.2 | Privileged access rights | ✅ Covered |
+| CODEOWNERS | `.github/CODEOWNERS` | A.5.2 | Information security roles | ✅ Covered |
+| AGENTS.md invariants | `AGENTS.md §Invariants` | A.5.36 | Compliance with policies | ✅ Covered |
+| Risk register | `docs/GOVERNANCE/RISK_REGISTER.md` | A.8.24 | Use of cryptography | ❌ Partial (manual) |
+| RACI matrix | `docs/GOVERNANCE/RACI.md` | A.5.2 | Roles and responsibilities | ✅ Covered |
+| Evidence harness | `scripts/collect-evidence.mjs` | A.5.36 | Compliance with policies | ✅ Covered |
+| Mutation testing | `stryker` / `cargo-mutants` | A.8.29 | Security testing | ✅ Covered |
+| Contract testing | `pact` / `buf breaking` | A.8.26 | Application security requirements | ✅ Covered |
+| Secure coding checklist | `docs/SECURE_CODING_CHECKLIST.md` | A.8.28 | Secure coding | ✅ Covered |
+| Commit signing / verified commits | `.github/workflows/` | A.8.32 | Change management | ✅ Partial |
+| Branch protection rules | GitHub branch ruleset | A.5.3 | Segregation of duties | ✅ Covered |
+<% if (hasDatabase) { %>
+| Database migration tests | Testcontainers / `check-all.mjs L2` | A.8.33 | Test information | ✅ Covered |
+<% } %><% if (hasPublicApi) { %>
+| API contract tests | Pact / OpenAPI diff | A.8.26 | Application security requirements | ✅ Covered |
+| Rate limiting middleware | `src/middleware/rate-limit*` | A.8.20 | Networks security | ✅ Covered |
+<% } %>
+
+### ISO 27001 Audit Preparation Checklist
+
+- [ ] Risk register reviewed and signed off (§6.1.2)
+- [ ] Statement of Applicability (SoA) prepared listing all 93 Annex A controls
+- [ ] Evidence collected from `scripts/collect-evidence.mjs` (if L3)
+- [ ] Internal audit scheduled (§9.2)
+- [ ] Management review documented (§9.3)
+<% } %><% if (_nis2) { %>
+
+## NIS2 Directive Art.21.2 — Gate Coverage
+
+Maps arbiter gates to NIS2 Article 21.2 cybersecurity risk-management measures.
+
+| Gate / Artifact | Script / File | NIS2 Art.21.2 Ref | Measure | Coverage |
+| --------------- | ------------- | ----------------- | ------- | -------- |
+| Access control middleware | `src/middleware/auth*` | Art.21.2(i) | Access control and asset management | ✅ Covered |
+| MFA / session management | `src/middleware/session*` | Art.21.2(i) | Access control | ✅ Partial |
+| Dependency audit | `npm audit` / `cargo audit` | Art.21.2(a) | Risk analysis and information system security | ✅ Covered |
+| Secret scanning | `gitleaks` | Art.21.2(a) | Risk analysis | ✅ Covered |
+| Incident runbook | `docs/OPERATIONS_HANDBOOK.md §Runbooks` | Art.21.2(b) | Incident handling | ✅ Covered |
+| Evidence harness | `scripts/collect-evidence.mjs` | Art.21.2(j) | Policies on the use of cryptography and encryption | ✅ Partial |
+| Supply chain audit | `npm audit` / `trivy fs` | Art.21.2(d) | Security in network and information systems acquisition | ✅ Covered |
+| STRIDE threat model | `docs/SECURITY/STRIDE.md` | Art.21.2(a) | Risk analysis | ✅ Covered |
+| Business continuity | `docs/OPERATIONS_HANDBOOK.md §Rollback` | Art.21.2(c) | Business continuity (backup, DR) | ✅ Partial |
+| Secure coding | `docs/SECURE_CODING_CHECKLIST.md` | Art.21.2(e) | Security in human resources | ✅ Covered |
+| Coverage gate | `scripts/check-coverage.mjs` | Art.21.2(a) | Risk analysis | ✅ Covered |
+| Rate limiting | `src/middleware/rate-limit*` | Art.21.2(f) | Policies and procedures for network security | ✅ Covered |
+| Nightly security scan | `.github/workflows/nightly.yml` | Art.21.2(a) | Risk analysis | ✅ Covered |
+
+### NIS2 Audit Preparation Checklist
+
+- [ ] Incident reporting procedure documented and tested (Art.23 — 72h notification SLA)
+- [ ] Supply chain security contracts reviewed (Art.21.2(d))
+- [ ] Business continuity tested (DR drill) (Art.21.2(c))
+- [ ] Security training records maintained (Art.21.2(e))
+<% } %><% if (_gdpr) { %>
+
+## GDPR — Gate Coverage
+
+Maps arbiter gates to GDPR articles they provide evidence for.
+
+| Gate / Artifact | Script / File | GDPR Article | Principle / Requirement | Coverage |
+| --------------- | ------------- | ------------ | ----------------------- | -------- |
+| PII scan | `scripts/pii-scan.mjs` | Art.5(1)(c) | Data minimisation | ✅ Covered |
+| PII scan | `scripts/pii-scan.mjs` | Art.5(1)(f) | Integrity and confidentiality | ✅ Covered |
+| PII scan | `scripts/pii-scan.mjs` | Art.25 | Data protection by design | ✅ Covered |
+| Secret scanning | `gitleaks` | Art.32 | Security of processing | ✅ Covered |
+| Dependency audit | `npm audit` | Art.32(1)(b) | Ongoing confidentiality, integrity, availability | ✅ Covered |
+| Access control middleware | `src/middleware/auth*` | Art.32(1)(a) | Pseudonymisation and encryption | ✅ Partial |
+| Rate limiting | `src/middleware/rate-limit*` | Art.32(1)(b) | Ongoing availability and resilience | ✅ Covered |
+| Session lifecycle tests | Test suite (dimension 21) | Art.5(1)(f) | Integrity and confidentiality | ✅ Covered |
+| Evidence harness | `scripts/collect-evidence.mjs` | Art.30 | Records of processing activities | ✅ Partial |
+| Audit trail dimension | Test taxonomy dim.18 | Art.30 | Records of processing activities | ✅ Covered |
+| STRIDE threat model | `docs/SECURITY/STRIDE.md` | Art.35 | Data protection impact assessment (DPIA) | ✅ Partial |
+| Incident runbook | `docs/OPERATIONS_HANDBOOK.md` | Art.33 | Notification of a personal data breach (72h) | ✅ Partial |
+<% if (hasDatabase) { %>
+| Database integration tests | Testcontainers | Art.32(1)(d) | Regular testing, assessing and evaluating | ✅ Covered |
+<% } %>
+
+### GDPR Audit Preparation Checklist
+
+- [ ] Record of Processing Activities (RoPA) maintained (Art.30)
+- [ ] Privacy notices reviewed (Art.13/14)
+- [ ] Data subject request (DSR) procedure tested (Art.15–21)
+- [ ] Data retention schedule documented (Art.5(1)(e))
+- [ ] DPA agreements with processors in place (Art.28)
+- [ ] DPIA conducted for high-risk processing (Art.35)
+<% } %>
+
+---
+
+## How to Use This Document
+
+1. **Audit preparation**: present the relevant section to auditors as evidence that gates are wired to controls
+2. **Gap analysis**: cells marked `❌ Gap` or `✅ Partial` require manual evidence collection
+3. **Update cadence**: re-run `arbiter update` after adding new gates to refresh this file
+
+_Generated by arbiter. Teams are responsible for collecting and retaining evidence artifacts._

package/dist/templates/compliance/compliance-menu.md.ejs

@@ -0,0 +1,89 @@
+# Compliance & Collaboration Menu — <%= projectName %>
+
+<!-- arbiter-managed: compliance-menu (#1254) -->
+
+> The (team × compliance) menu. arbiter declines three orthogonal axes onto your
+> project: **who merges** (collaborationMode), **how strict the gates are**
+> (governanceLevel), and **which compliance overlay** scaffolds domain controls
+> (industryOverlay). This document presents every cell with its rationale so you
+> can pick a coherent combination — then `arbiter doctor` flags incoherent ones.
+
+---
+
+## Axis 1 — Team (collaborationMode)
+
+Controls branching strategy, CI shape, and merge ceremony.
+
+| Mode           | Branching                  | Merge ceremony                         | Use when                                  |
+| -------------- | -------------------------- | -------------------------------------- | ----------------------------------------- |
+| `trunk-solo`   | `trunk-direct`             | direct push or opt-in PR fast-forward  | one author, minimal ceremony              |
+| `peer-review`  | `github-flow`              | mandatory PR, ff-only merge            | small team, shared trust (recommended)    |
+| `gated-review` | `github-flow-with-develop` | required approvals, merge queue, attestation | regulated / enterprise, audit trail |
+
+## Axis 2 — Compliance (industryOverlay)
+
+Emits domain-specific compliance scaffolding + enforceable gates. Single-valued;
+`none` = no overlay. Weight tiers drive the coherence check below.
+
+| Overlay    | Weight | What it emits                                                        |
+| ---------- | ------ | ------------------------------------------------------------------- |
+| `none`     | —      | nothing                                                             |
+| `generic`  | light  | language-neutral audit-trail policy + gate rules                    |
+| `sox`      | medium | SOX audit-trail docs + gate rules                                   |
+| `gdpr`     | medium | GDPR controls→gates traceability overlay                           |
+| `iso9001`  | medium | quality-process overlay: requirement→test RTM + doc-control + CAPA + gate |
+| `iso27001` | heavy  | ISO 27001:2022 Annex-A security controls→gate traceability         |
+| `pharma`   | heavy  | 21 CFR Part 11 audit-trail overlay (Java JPA/ArchUnit scaffolding)  |
+| `regulated`| heavy  | high-assurance bundle: separation-of-duties + retention + suppression-expiry + signing/SBOM + mutation floor |
+
+---
+
+## The menu — (team × compliance) cells
+
+Each cell pairs a team mode with a compliance overlay. The **rationale** column
+explains the intended fit; pick the row that matches your delivery context.
+
+| Team           | Compliance | Rationale                                                                        |
+| -------------- | ---------- | -------------------------------------------------------------------------------- |
+| `trunk-solo`   | `none`     | fastest path; ship-and-iterate solo project, no compliance obligation            |
+| `trunk-solo`   | `iso9001`  | solo product with a quality-management obligation; RTM + CAPA without team ceremony |
+| `peer-review`  | `generic`  | small team that wants an audit-trail policy without a named regulation           |
+| `peer-review`  | `gdpr`     | small team handling personal data; GDPR controls backed by L2 gates              |
+| `peer-review`  | `iso9001`  | small team under a quality-management system (ISO 9001)                          |
+| `gated-review` | `iso27001` | regulated team; security controls + approvals + attestation chain                |
+| `gated-review` | `pharma`   | life-sciences team under 21 CFR Part 11; full audit trail + gated review         |
+
+> The menu is illustrative, not exhaustive — any (team × overlay) pair is valid;
+> coherence is governed by the governanceLevel axis below, not by the team axis.
+
+---
+
+## Coherence — (overlay × governanceLevel)
+
+`arbiter doctor` runs this check and the wizard surfaces it after the overlay
+choice. **Heavy** overlays expect **L3+** rigour (mutation, evidence harness,
+human-approval gates); **medium** overlays expect **L2+** (debt + security
+scans). A heavy overlay at L1 scaffolds controls the gate set never enforces —
+flagged as a `WARN` (advisory, never blocking).
+
+| Overlay weight        | L1     | L2     | L3   | L4   |
+| --------------------- | ------ | ------ | ---- | ---- |
+| light (`generic`)     | OK     | OK     | OK   | OK   |
+| medium (`sox`, `gdpr`, `iso9001`) | WARN   | OK     | OK   | OK   |
+| heavy (`iso27001`, `pharma`, `regulated`) | WARN   | WARN   | OK   | OK   |
+
+**Recommended pairings:** `pharma`/`iso27001` → L3 or L4; `gdpr`/`sox`/`iso9001`
+→ L2+; `generic` → any level.
+
+---
+
+## How to choose
+
+1. Pick your **team** mode (who merges) — it sets branching + merge ceremony.
+2. Pick your **governanceLevel** (how strict) — L1 lightweight … L4 audit-grade.
+3. Pick your **compliance overlay** (which controls) — keep it coherent with the
+   level using the table above.
+4. Run `arbiter doctor` to confirm the chosen cell is coherent.
+
+Re-run `arbiter init` (or `arbiter configure`) to change any axis; overlays are
+brownfield-safe — re-init never overwrites your customised compliance documents.

package/dist/templates/contract-testing/CONTRACTS_POLICY.md.ejs

@@ -0,0 +1,30 @@
+# Contract Testing Policy
+
+**Contract strategy:** `<%= contractType %>`
+
+## Purpose
+
+Contract testing verifies that services honour the contracts they expose to consumers. This document defines the testing approach for this project.
+
+## Gate
+
+- **L2+:** Contract tests run in CI. Failures block merge.
+- **L1:** Contract testing not enforced (no gate).
+
+## Tools
+
+<% if (contractType === 'rest-owned') { %>
+**Pact** — consumer-driven contract testing. The consumer generates a pact file; the provider verifies it.
+<% } else if (contractType === 'rest-public') { %>
+**openapi-diff** — detects breaking changes in the OpenAPI spec between versions.
+<% } else if (contractType === 'graphql') { %>
+**graphql-inspector** — schema diffing to detect breaking changes in the GraphQL schema.
+<% } else if (contractType === 'grpc') { %>
+**buf breaking** — detects breaking changes in Protobuf definitions.
+<% } else if (contractType === 'message-queue') { %>
+**Confluent Schema Registry** — calls `testCompatibility()` to verify BACKWARD or FULL schema compatibility between producer and consumer. A reachability-only check does not satisfy INV-41.
+<% } %>
+
+## Running Locally
+
+See `scripts/check-all.mjs` L2 gate for the exact command.

package/dist/templates/contract-testing/api-snapshots/config-keys-baseline.json.ejs

@@ -0,0 +1 @@
+[]

package/dist/templates/contract-testing/api-snapshots/config-response-baseline.json.ejs

@@ -0,0 +1 @@
+[]

package/dist/templates/contract-testing/api-snapshots/enum-values-baseline.json.ejs

@@ -0,0 +1 @@
+{}

package/dist/templates/contract-testing/api-snapshots/error-shape-baseline.json.ejs

@@ -0,0 +1,6 @@
+{
+  "detail": "Validation failed",
+  "status": 400,
+  "title": "Validation Error",
+  "type": "about:blank"
+}

package/dist/templates/contract-testing/api-snapshots/openapi-baseline.json.ejs

@@ -0,0 +1,12 @@
+{
+  "components": {
+    "schemas": {}
+  },
+  "info": {
+    "description": <%- JSON.stringify(`${projectName || 'service'} API`) %>,
+    "title": <%- JSON.stringify(projectName || 'service') %>,
+    "version": "v1"
+  },
+  "openapi": "3.0.1",
+  "paths": {}
+}

package/dist/templates/contract-testing/api-snapshots/openapi-content-types-baseline.json.ejs

@@ -0,0 +1,3 @@
+{
+  "GET /health 200": ["application/json"]
+}

package/dist/templates/contract-testing/api-snapshots/openapi-paths-baseline.json.ejs

@@ -0,0 +1 @@
+["/health"]

package/dist/templates/contract-testing/api-snapshots/openapi-required-fields-baseline.json.ejs

@@ -0,0 +1 @@
+{}

package/dist/templates/contract-testing/api-snapshots/openapi-response-status-baseline.json.ejs

@@ -0,0 +1,3 @@
+{
+  "GET /health": ["200", "503"]
+}

package/dist/templates/contract-testing/api-snapshots/test-snapshot.json.ejs

@@ -0,0 +1,4 @@
+{
+  "contract": "open",
+  "version": "v1"
+}

package/dist/templates/contract-testing/env/.env.pact.ejs

@@ -0,0 +1,4 @@
+# Pact broker configuration — DO NOT commit populated values
+# Add this file to .gitignore (covered by .env* pattern)
+PACT_BROKER_BASE_URL=
+PACT_BROKER_TOKEN=

package/dist/templates/contract-testing/graphql/GraphqlSchemaTest.java.ejs

@@ -0,0 +1,29 @@
+package <%= basePackage || 'com.example' %>.contracts;
+
+import org.junit.jupiter.api.Test;
+
+import java.io.File;
+import java.io.IOException;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+class GraphqlSchemaTest {
+
+    @Test
+    void schemaHasNoBreakingChanges() throws IOException, InterruptedException {
+        File reference = new File("contracts/schema-reference.graphql");
+        File current = new File("contracts/schema-current.graphql");
+        if (!reference.exists() || !current.exists()) {
+            System.out.println("[WARN] GraphQL schema files not found — skipping diff");
+            return;
+        }
+        ProcessBuilder pb = new ProcessBuilder(
+            "npx", "@graphql-inspector/cli", "diff",
+            "contracts/schema-reference.graphql",
+            "contracts/schema-current.graphql"
+        );
+        pb.inheritIO();
+        int exitCode = pb.start().waitFor();
+        assertEquals(0, exitCode, "GraphQL schema has breaking changes — see diff output above");
+    }
+}