@getarbiter/cli 0.5.0

package/dist/templates/contract-testing/rest-owned/pact_consumer_test.go.ejs

@@ -0,0 +1,48 @@
+//go:build contract
+// +build contract
+
+package contracts_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/pact-foundation/pact-go/v2/consumer"
+	"github.com/pact-foundation/pact-go/v2/matchers"
+)
+
+func TestPactConsumer(t *testing.T) {
+	mockProvider, err := consumer.NewV2Pact(consumer.MockHTTPProviderConfig{
+		Consumer: "<%= projectName %>-consumer",
+		Provider: "<%= projectName %>-provider",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = mockProvider.
+		AddInteraction().
+		Given("a resource exists").
+		UponReceiving("a request for a resource").
+		WithRequest("GET", "/api/resource").
+		WillRespondWith(200, func(b *consumer.V2ResponseBuilder) {
+			b.JSONBody(matchers.Map{
+				"id":   matchers.Like(1),
+				"name": matchers.Like("example"),
+			})
+		}).
+		ExecuteTest(t, func(config consumer.MockServerConfig) error {
+			resp, err := http.Get(fmt.Sprintf("http://%s:%d/api/resource", config.Host, config.Port))
+			if err != nil {
+				return err
+			}
+			if resp.StatusCode != 200 {
+				return fmt.Errorf("expected 200, got %d", resp.StatusCode)
+			}
+			return nil
+		})
+	if err != nil {
+		t.Fatal(err)
+	}
+}

package/dist/templates/contract-testing/rest-owned/pact_consumer_test.rs.ejs

@@ -0,0 +1,23 @@
+#[cfg(test)]
+mod pact_tests {
+    use pact_consumer::prelude::*;
+    use serde_json::json;
+
+    #[tokio::test]
+    async fn test_get_resource() {
+        let pact = PactBuilder::new("<%= projectName %>-consumer", "<%= projectName %>-provider")
+            .interaction("a request for a resource", |i| {
+                i.given("a resource exists");
+                i.request.get().path("/api/resource");
+                i.response
+                    .ok()
+                    .json_utf8()
+                    .json_body(json!({"id": 1, "name": "example"}));
+            })
+            .start_mock_server();
+
+        let url = pact.path("/api/resource");
+        let result = reqwest::get(url).await.unwrap();
+        assert_eq!(result.status(), 200);
+    }
+}

package/dist/templates/contract-testing/rest-owned/test_pact_consumer.py.ejs

@@ -0,0 +1,35 @@
+import pytest
+from pact import Consumer, Provider
+
+PACT_MOCK_HOST = "localhost"
+PACT_MOCK_PORT = 1234
+
+
+@pytest.fixture(scope="module")
+def pact():
+    consumer = Consumer("<%= projectName %>-consumer")
+    p = consumer.has_pact_with(
+        Provider("<%= projectName %>-provider"),
+        host_name=PACT_MOCK_HOST,
+        port=PACT_MOCK_PORT,
+        pact_dir="./pacts",
+    )
+    p.start_service()
+    yield p
+    p.stop_service()
+
+
+def test_get_resource(pact):
+    expected = {"id": 1, "name": "example"}
+
+    (
+        pact.given("a resource exists")
+        .upon_receiving("a request for a resource")
+        .with_request("GET", "/api/resource")
+        .will_respond_with(200, body=expected)
+    )
+
+    with pact:
+        import requests
+        result = requests.get(f"http://{PACT_MOCK_HOST}:{PACT_MOCK_PORT}/api/resource")
+        assert result.status_code == 200

package/dist/templates/contract-testing/rest-public/OpenApiDiffIT.java.ejs

@@ -0,0 +1,44 @@
+package <%= basePackage || 'com.example' %>.contracts;
+
+import org.junit.jupiter.api.Test;
+import org.openapitools.openapidiff.core.OpenApiCompare;
+import org.openapitools.openapidiff.core.model.ChangedOpenApi;
+
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+/**
+ * Contract test: verify no breaking OpenAPI changes (INV-43).
+ *
+ * Run the exporter first: ./gradlew generateOpenApiDocs
+ * Bootstrap first run:    ALLOW_OPENAPI_BOOTSTRAP=1 ./gradlew test
+ */
+class OpenApiDiffIT {
+
+    @Test
+    void noBreakingChanges() {
+        Path contractsDir = Paths.get("contracts");
+        Path referenceSpec = contractsDir.resolve("openapi-reference.yaml");
+        Path currentSpec = contractsDir.resolve("openapi-current.yaml");
+
+        if (!currentSpec.toFile().exists()) {
+            fail("contracts/openapi-current.yaml not found — run: ./gradlew generateOpenApiDocs (INV-43)");
+        }
+        if (!referenceSpec.toFile().exists()) {
+            if ("1".equals(System.getenv("ALLOW_OPENAPI_BOOTSTRAP"))) {
+                System.out.println("[INFO] ALLOW_OPENAPI_BOOTSTRAP=1 — bootstrap mode, skipping diff");
+                return;
+            }
+            fail("contracts/openapi-reference.yaml not found — copy current spec as reference once (INV-43)");
+        }
+
+        ChangedOpenApi diff = OpenApiCompare.fromLocations(
+            referenceSpec.toString(), currentSpec.toString()
+        );
+        assertTrue(diff.isCompatible(),
+            "Breaking OpenAPI changes detected: " + diff.getIncompatibilities());
+    }
+}

package/dist/templates/contract-testing/rest-public/export-openapi-java.gradle.ejs

@@ -0,0 +1,13 @@
+// OpenAPI exporter — generates contracts/openapi-current.yaml (INV-43)
+// Run: ./gradlew generateOpenApiDocs
+// #1887-F: the org.springdoc.openapi-gradle-plugin declaration lives in the root
+// build's plugins block (arbiter-managed) — Gradle forbids a `plugins {}` block
+// inside an applied script (apply from: 'config/export-openapi-java.gradle').
+
+openApi {
+    apiDocsUrl = 'http://localhost:8080/v3/api-docs'
+    outputDir = file('contracts')
+    outputFileName = 'openapi-current.yaml'
+    waitTimeInSeconds = 30
+    forkProperties = '-Dspring.profiles.active=openapi-export'
+}

package/dist/templates/contract-testing/rest-public/export-openapi.mjs.ejs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * Export current OpenAPI spec to contracts/openapi-current.yaml (INV-43).
+ * Run before contract diff: node export-openapi.mjs
+ */
+import { writeFileSync, mkdirSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { stringify } from 'yaml';
+
+// Import your app instance and call getOpenApiSpec() or equivalent.
+// Example for Express + swagger-jsdoc:
+//   import swaggerJsdoc from 'swagger-jsdoc';
+//   const spec = swaggerJsdoc({ definition: { openapi: '3.0.0', info: { title: '<%= projectName %>', version: '1.0.0' } }, apis: ['./src/**/*.ts'] });
+//
+// Adjust the import below to match your app's export mechanism.
+const spec = { openapi: '3.0.0', info: { title: '<%= projectName %>', version: '1.0.0' }, paths: {} };
+
+const outDir = resolve(process.cwd(), 'contracts');
+mkdirSync(outDir, { recursive: true });
+writeFileSync(resolve(outDir, 'openapi-current.yaml'), stringify(spec), 'utf-8');
+console.log('[export-openapi] Written: contracts/openapi-current.yaml');

package/dist/templates/contract-testing/rest-public/export_openapi.go.ejs

@@ -0,0 +1,30 @@
+// Export current OpenAPI spec to contracts/openapi-current.yaml (INV-43).
+// Run before contract diff: go run ./cmd/export-openapi/main.go
+// Requires: swaggo/swag — go install github.com/swaggo/swag/cmd/swag@latest
+//
+// Alternatively, if your router exposes /openapi.yaml:
+//
+//	curl http://localhost:8080/openapi.yaml > contracts/openapi-current.yaml
+package main
+
+import (
+	"os"
+	"os/exec"
+)
+
+func main() {
+	if err := os.MkdirAll("contracts", 0o755); err != nil {
+		panic(err)
+	}
+	// Generate spec via swag and copy output to contracts/openapi-current.yaml
+	cmd := exec.Command("swag", "init", "--outputTypes", "yaml", "--output", "contracts", "--generalInfo", "main.go")
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		panic("swag init failed: " + err.Error())
+	}
+	if err := os.Rename("contracts/swagger.yaml", "contracts/openapi-current.yaml"); err != nil {
+		_ = exec.Command("cp", "contracts/swagger.yaml", "contracts/openapi-current.yaml").Run()
+	}
+	println("[export-openapi] Written: contracts/openapi-current.yaml")
+}

package/dist/templates/contract-testing/rest-public/export_openapi.py.ejs

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+"""Export current OpenAPI spec to contracts/openapi-current.yaml (INV-43).
+
+Run before contract diff: python export_openapi.py
+Requires: pip install pyyaml
+
+Adjust the import below to match your app's FastAPI instance.
+"""
+import os
+import yaml
+
+# Import your FastAPI app instance:
+# from src.main import app
+# spec = app.openapi()
+
+# Placeholder spec — replace with: spec = app.openapi()
+spec = {
+    "openapi": "3.0.0",
+    "info": {"title": "<%= projectName %>", "version": "1.0.0"},
+    "paths": {},
+}
+
+os.makedirs("contracts", exist_ok=True)
+with open("contracts/openapi-current.yaml", "w") as f:
+    yaml.dump(spec, f, default_flow_style=False, allow_unicode=True)
+
+print("[export-openapi] Written: contracts/openapi-current.yaml")

package/dist/templates/contract-testing/rest-public/export_openapi.rs.ejs

@@ -0,0 +1,32 @@
+// Export current OpenAPI spec to contracts/openapi-current.yaml (INV-43).
+// Run before contract diff: cargo run --bin export-openapi
+// Requires: utoipa, serde_yaml
+//
+// Add to Cargo.toml:
+//   [[bin]]
+//   name = "export-openapi"
+//   path = "src/bin/export_openapi.rs"
+//
+//   [dependencies]
+//   utoipa = { version = "4", features = ["actix_extras"] }
+//   serde_yaml = "0.9"
+
+use std::fs;
+
+fn main() {
+    // Import your ApiDoc struct that derives utoipa::OpenApi:
+    // use crate::ApiDoc;
+    // let spec = ApiDoc::openapi();
+    //
+    // Placeholder — replace with your actual spec:
+    let spec = serde_json::json!({
+        "openapi": "3.0.0",
+        "info": { "title": "<%= projectName %>", "version": "1.0.0" },
+        "paths": {}
+    });
+
+    fs::create_dir_all("contracts").expect("Failed to create contracts dir");
+    let yaml = serde_yaml::to_string(&spec).expect("Failed to serialize spec");
+    fs::write("contracts/openapi-current.yaml", yaml).expect("Failed to write openapi-current.yaml");
+    println!("[export-openapi] Written: contracts/openapi-current.yaml");
+}

package/dist/templates/contract-testing/rest-public/openapi-diff.ts.ejs

@@ -0,0 +1,42 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+/**
+ * Contract test: verify no breaking changes in the OpenAPI spec (INV-43).
+ *
+ * Run the exporter first: node export-openapi.mjs
+ * Reference spec: contracts/openapi-reference.yaml
+ * Current spec:   contracts/openapi-current.yaml
+ *
+ * First-run bootstrap: ALLOW_OPENAPI_BOOTSTRAP=1 skips the diff until
+ * openapi-reference.yaml is committed.
+ */
+describe('<%= projectName %> OpenAPI breaking-change detection', () => {
+  const contractsDir = path.resolve(process.cwd(), 'contracts');
+  const referenceSpec = path.join(contractsDir, 'openapi-reference.yaml');
+  const currentSpec = path.join(contractsDir, 'openapi-current.yaml');
+
+  it('has no breaking changes vs the reference spec', () => {
+    if (!existsSync(currentSpec)) {
+      throw new Error(
+        'contracts/openapi-current.yaml not found — run: node export-openapi.mjs (INV-43)',
+      );
+    }
+    if (!existsSync(referenceSpec)) {
+      if (process.env.ALLOW_OPENAPI_BOOTSTRAP === '1') {
+        console.warn('[INFO] ALLOW_OPENAPI_BOOTSTRAP=1 — bootstrap mode, skipping diff');
+        return;
+      }
+      throw new Error(
+        'contracts/openapi-reference.yaml not found — copy current spec as reference once (INV-43)',
+      );
+    }
+    const result = execFileSync(
+      'npx',
+      ['openapi-diff', referenceSpec, currentSpec, '--fail-on-incompatible'],
+      { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },
+    );
+    console.log(result);
+  });
+});

package/dist/templates/contract-testing/rest-public/openapi_diff_test.go.ejs

@@ -0,0 +1,35 @@
+//go:build contract
+// +build contract
+
+package contracts_test
+
+import (
+	"os"
+	"os/exec"
+	"testing"
+)
+
+// TestNoBreakingOpenAPIChanges verifies OpenAPI backwards compatibility (INV-43).
+// Run exporter first: go run ./cmd/export-openapi/main.go
+// Bootstrap first run: ALLOW_OPENAPI_BOOTSTRAP=1 go test ./...
+func TestNoBreakingOpenAPIChanges(t *testing.T) {
+	if _, err := os.Stat("contracts/openapi-current.yaml"); os.IsNotExist(err) {
+		t.Fatal("contracts/openapi-current.yaml not found — run exporter first (INV-43)")
+	}
+	if _, err := os.Stat("contracts/openapi-reference.yaml"); os.IsNotExist(err) {
+		if os.Getenv("ALLOW_OPENAPI_BOOTSTRAP") == "1" {
+			t.Log("[INFO] ALLOW_OPENAPI_BOOTSTRAP=1 — bootstrap mode, skipping diff")
+			return
+		}
+		t.Fatal("contracts/openapi-reference.yaml not found — copy current spec as reference once (INV-43)")
+	}
+
+	cmd := exec.Command("npx", "openapi-diff",
+		"contracts/openapi-reference.yaml",
+		"contracts/openapi-current.yaml",
+		"--fail-on-incompatible")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("Breaking OpenAPI changes detected:\n%s", out)
+	}
+}

package/dist/templates/contract-testing/rest-public/openapi_diff_test.rs.ejs

@@ -0,0 +1,36 @@
+#[cfg(test)]
+mod openapi_diff_tests {
+    use std::env;
+    use std::path::Path;
+    use std::process::Command;
+
+    /// Contract test: verify no breaking OpenAPI changes (INV-43).
+    /// Run exporter first: cargo run --bin export-openapi
+    /// Bootstrap first run: ALLOW_OPENAPI_BOOTSTRAP=1 cargo test
+    #[test]
+    fn no_breaking_changes() {
+        let current = Path::new("contracts/openapi-current.yaml");
+        let reference = Path::new("contracts/openapi-reference.yaml");
+
+        if !current.exists() {
+            panic!("contracts/openapi-current.yaml not found — run exporter first (INV-43)");
+        }
+        if !reference.exists() {
+            if env::var("ALLOW_OPENAPI_BOOTSTRAP").as_deref() == Ok("1") {
+                println!("[INFO] ALLOW_OPENAPI_BOOTSTRAP=1 — bootstrap mode, skipping diff");
+                return;
+            }
+            panic!("contracts/openapi-reference.yaml not found — copy current spec as reference once (INV-43)");
+        }
+
+        let output = Command::new("npx")
+            .args(["openapi-diff", "contracts/openapi-reference.yaml",
+                   "contracts/openapi-current.yaml", "--fail-on-incompatible"])
+            .output()
+            .expect("Failed to run openapi-diff");
+
+        assert!(output.status.success(),
+            "Breaking OpenAPI changes detected:\n{}",
+            String::from_utf8_lossy(&output.stdout));
+    }
+}

package/dist/templates/contract-testing/rest-public/test_openapi_diff.py.ejs

@@ -0,0 +1,32 @@
+"""OpenAPI breaking-change contract test (INV-43).
+
+Run exporter first: python export_openapi.py
+Bootstrap first run: ALLOW_OPENAPI_BOOTSTRAP=1 pytest
+"""
+import os
+import subprocess
+
+
+def test_no_breaking_changes():
+    if not os.path.exists("contracts/openapi-current.yaml"):
+        raise AssertionError(
+            "contracts/openapi-current.yaml not found — run: python export_openapi.py (INV-43)"
+        )
+    if not os.path.exists("contracts/openapi-reference.yaml"):
+        if os.getenv("ALLOW_OPENAPI_BOOTSTRAP") == "1":
+            print("[INFO] ALLOW_OPENAPI_BOOTSTRAP=1 — bootstrap mode, skipping diff")
+            return
+        raise AssertionError(
+            "contracts/openapi-reference.yaml not found — copy current spec as reference once (INV-43)"
+        )
+    result = subprocess.run(
+        ["npx", "openapi-diff",
+         "contracts/openapi-reference.yaml",
+         "contracts/openapi-current.yaml",
+         "--fail-on-incompatible"],
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0, (
+        f"Breaking OpenAPI changes detected:\n{result.stdout}\n{result.stderr}"
+    )

package/dist/templates/coverage/.coveragerc.ejs

@@ -0,0 +1,26 @@
+# pytest-cov configuration
+# Gate: pytest --cov --cov-report=html:coverage/html --cov-report=xml:coverage/coverage.xml (L2)
+
+[run]
+branch = True
+source = .
+omit =
+    tests/*
+    **/test_*.py
+    **/*_test.py
+    **/conftest.py
+    setup.py
+
+[report]
+fail_under = <%= coverageThreshold %>
+show_missing = True
+skip_covered = False
+
+[html]
+directory = coverage/html
+
+[xml]
+output = coverage/coverage.xml
+
+[lcov]
+output = coverage/lcov.info

package/dist/templates/coverage/.tarpaulin.toml.ejs

@@ -0,0 +1,30 @@
+# cargo-tarpaulin configuration (#354, Phase 7B — prior-project parity).
+# Gate: cargo tarpaulin --fail-under <%= coverageThreshold %> (L2 — hard fail).
+# fail-under is also embedded below so `cargo tarpaulin` without CLI flags
+# still enforces the threshold — keeps local invocations consistent with the
+# generated check-all.mjs gate.
+
+[run]
+out = ["Html", "Xml", "Lcov"]
+output-dir = "coverage/"
+
+[default]
+# Hard floor — must match the --fail-under flag in scripts/check-all.mjs.
+# Value scales with governanceLevel via computeThresholds (L2=80, L3=85).
+fail-under = <%= coverageThreshold %>
+
+# Curated exclude-files list. Every entry needs a rationale comment;
+# a future lint (`check-coverage-doc-parity.mjs`) will enforce comment-per-entry.
+exclude-files = [
+  # Binary entrypoint — bootstrap only, exercised end-to-end by integration
+  # tests rather than unit coverage.
+  "src/main.rs",
+  # Library entrypoint — re-exports; coverage is double-counted via the
+  # re-exported items themselves.
+  "src/lib.rs",
+  # Build scripts — execute at compile time, not at runtime; out of scope
+  # for runtime coverage tools.
+  "build.rs",
+  # Generated code — auto-emitted, no human-authored logic to cover.
+  "target/**",
+]

package/dist/templates/coverage/Cargo.toml.profile.release.ejs

@@ -0,0 +1,24 @@
+# Append this block to your Cargo.toml (#359, Phase 7G — prior-project parity).
+# Size-optimised release profile + binary-size invariant (INV-60).
+#
+# Binary size cap (enforced by scripts/check-all.mjs L2 step):
+#   <%= Math.round(binarySizeBytes / (1024 * 1024)) %> MB (= <%= binarySizeBytes %> bytes)
+#
+# Defaults differ per archetype:
+#   - cli       → 10 MB
+#   - embedded  →  5 MB
+# Override by setting `binarySizeBytes` on the generator data dict.
+
+[profile.release]
+# Optimise for small code size; "s" is the sweet spot for CLI binaries (vs "z"
+# which over-aggressively shrinks at runtime cost).
+opt-level = "s"
+# Link-time optimisation removes dead code across crate boundaries.
+lto = true
+# Single codegen unit unlocks the strongest LTO pass.
+codegen-units = 1
+# Strip debug symbols from the final binary.
+strip = "symbols"
+# Abort on panic — smaller code, no unwind tables. Required for the size budget
+# in cli/embedded archetypes; remove if your binary needs panic=unwind.
+panic = "abort"

package/dist/templates/coverage/jacoco-maven-setup.md.ejs

@@ -0,0 +1,72 @@
+# JaCoCo Coverage — Maven Setup
+
+Add the JaCoCo plugin to your `pom.xml` to enable coverage verification and reporting.
+
+## Required `pom.xml` additions
+
+```xml
+<build>
+  <plugins>
+    <plugin>
+      <groupId>org.jacoco</groupId>
+      <artifactId>jacoco-maven-plugin</artifactId>
+      <version>0.8.12</version>
+      <executions>
+        <!-- Instrument classes for coverage measurement -->
+        <execution>
+          <id>prepare-agent</id>
+          <goals><goal>prepare-agent</goal></goals>
+        </execution>
+        <!-- Generate HTML + XML reports -->
+        <execution>
+          <id>report</id>
+          <phase>verify</phase>
+          <goals><goal>report</goal></goals>
+          <configuration>
+            <outputDirectory>${project.build.directory}/coverage</outputDirectory>
+          </configuration>
+        </execution>
+        <!-- Enforce thresholds -->
+        <execution>
+          <id>check</id>
+          <phase>verify</phase>
+          <goals><goal>check</goal></goals>
+          <configuration>
+            <rules>
+              <rule>
+                <limits>
+                  <limit>
+                    <counter>LINE</counter>
+                    <value>COVEREDRATIO</value>
+                    <minimum><%= (coverageThreshold / 100).toFixed(2) %></minimum>
+                  </limit>
+                  <limit>
+                    <counter>BRANCH</counter>
+                    <value>COVEREDRATIO</value>
+                    <minimum><%= (Math.max(60, coverageThreshold - 10) / 100).toFixed(2) %></minimum>
+                  </limit>
+                </limits>
+                <excludes>
+                  <exclude>*Test</exclude>
+                  <exclude>*Tests</exclude>
+                  <exclude>*IT</exclude>
+                  <exclude>*Config</exclude>
+                  <exclude>*Application</exclude>
+                </excludes>
+              </rule>
+            </rules>
+          </configuration>
+        </execution>
+      </executions>
+    </plugin>
+  </plugins>
+</build>
+```
+
+## Gate command
+
+```bash
+mvn verify -Pjacoco
+```
+
+Reports are written to `target/coverage/`.

package/dist/templates/coverage/jacoco.gradle.ejs

@@ -0,0 +1,49 @@
+// Wire into build.gradle: apply from: 'gradle/jacoco.gradle'
+// Gate: ./gradlew jacocoTestCoverageVerification (L2 — hard fail)
+// Reports: ./gradlew jacocoTestReport → build/coverage/
+
+apply plugin: 'jacoco'
+
+jacoco {
+    toolVersion = '0.8.12'
+}
+
+jacocoTestReport {
+    dependsOn test
+    reports {
+        html.required = true
+        html.outputLocation = layout.buildDirectory.dir('coverage/html')
+        xml.required = true
+        xml.outputLocation = layout.buildDirectory.file('coverage/coverage.xml')
+        csv.required = false
+    }
+}
+
+jacocoTestCoverageVerification {
+    dependsOn jacocoTestReport
+    violationRules {
+        rule {
+            limit {
+                counter = 'LINE'
+                value = 'COVEREDRATIO'
+                minimum = <%= (coverageThreshold / 100).toFixed(2) %>
+            }
+            limit {
+                counter = 'BRANCH'
+                value = 'COVEREDRATIO'
+                minimum = <%= (Math.max(60, coverageThreshold - 10) / 100).toFixed(2) %>
+            }
+            excludes = [
+                '*Test',
+                '*Tests',
+                '*Spec',
+                '*IT',
+                '*Config',
+                '*Application',
+                '*.generated.*',
+            ]
+        }
+    }
+}
+
+check.dependsOn jacocoTestCoverageVerification

package/dist/templates/coverage/kover.gradle.ejs

@@ -0,0 +1,35 @@
+// Kover coverage — generated by arbiter (#1177)
+// Plugin: org.jetbrains.kotlinx.kover 0.9.x
+//
+// Prerequisites: declare the plugin in your root build.gradle plugins block:
+//   plugins {
+//     id 'org.jetbrains.kotlinx.kover' version '0.9.8'
+//   }
+// Then wire this file from build.gradle:
+//   apply from: 'kover.gradle'
+//
+// Gate: ./gradlew koverVerify koverXmlReport
+// Sonar: sonar.coverage.jacoco.xmlReportPaths=build/reports/kover/report.xml
+//        (Kover generates JaCoCo-compatible XML; sonar.java.coveragePlugin=jacoco)
+//
+// ArchUnit note: if arbiter emitted ArchUnit tests into src/test/java/,
+// add this to build.gradle:
+//   sourceSets { test { java { srcDirs += 'src/test/java' } } }
+
+kover {
+    reports {
+        total {
+            xml {
+                onCheck = true
+                xmlFile = layout.buildDirectory.file('reports/kover/report.xml')
+            }
+        }
+        verify {
+            rule {
+                bound {
+                    minValue = <%= coverageThreshold %>
+                }
+            }
+        }
+    }
+}