@getarbiter/cli 0.5.0

package/dist/templates/coverage/vitest.browser.config.ts.ejs

@@ -0,0 +1,47 @@
+<%
+// #1127: Vitest browser-mode config for component testing with real Chromium.
+// Uses Playwright as the browser provider for true DOM rendering (not jsdom).
+const _fw = (typeof frontend !== 'undefined' && frontend && frontend.framework)
+  ? frontend.framework : 'react'
+%>
+// vitest.browser.config.ts — generated by arbiter (#1127)
+// Vitest Browser Mode — real Chromium via Playwright provider.
+// Runs component tests in a real browser environment (not jsdom).
+// See docs/GOVERNANCE/FE_DESIGN_PRINCIPLES.md P7 (Visual Verification).
+// Run: npx vitest --config vitest.browser.config.ts
+
+import { defineConfig } from 'vitest/config'
+<% if (_fw === 'vue') { %>
+import vue from '@vitejs/plugin-vue'
+<% } else if (_fw === 'svelte') { %>
+import { svelte } from '@sveltejs/vite-plugin-svelte'
+<% } else { %>
+import react from '@vitejs/plugin-react'
+<% } %>
+
+export default defineConfig({
+  plugins: [
+<% if (_fw === 'vue') { %>
+    vue(),
+<% } else if (_fw === 'svelte') { %>
+    svelte(),
+<% } else { %>
+    react(),
+<% } %>
+  ],
+  test: {
+    // Use Playwright for real Chromium — not jsdom
+    browser: {
+      enabled: true,
+      name: 'chromium',
+      provider: 'playwright',
+      headless: true,
+    },
+    // Component tests under src/ — exclude unit tests (vitest.config.ts handles those)
+    include: ['src/**/*.browser.test.{ts,tsx,vue,svelte}'],
+    // VRT: screenshot comparison via toMatchScreenshot
+    // Baselines stored in __tests__/screenshots/
+    // Capture: npx vitest --config vitest.browser.config.ts --update-snapshots
+    setupFiles: ['./vitest.browser.setup.ts'],
+  },
+})

package/dist/templates/coverage/vitest.config.ts.ejs

@@ -0,0 +1,47 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    coverage: {
+      provider: 'v8',
+      // json-summary writes coverage/coverage-summary.json, which the gate's
+      // greenfield-aware coverage check (scripts/lib/coverage-gate.mjs, #1319.8)
+      // parses at runtime to distinguish "no executable statements" from a real
+      // threshold miss.
+      reporter: ['text', 'html', 'lcov', 'json-summary'],
+      reportsDirectory: './coverage',
+      include: ['src/**'],
+      // Curated exclude list (#353, Phase 7A — prior-project parity).
+      // Every entry is intentionally excluded with a rationale; do NOT add
+      // bare paths. A future lint (`check-coverage-excludes-rationale.mjs`)
+      // will enforce the comment-per-entry rule.
+      exclude: [
+        // Generated type definitions — no executable code to cover.
+        '**/*.d.ts',
+        // Config files (vitest, eslint, tsup, etc.) — bootstrap-only, untestable.
+        '**/*.config.*',
+        // Barrel exports — re-export only; coverage is double-counted via the
+        // re-exported symbols themselves.
+        '**/index.ts',
+        // Test files exclude themselves by convention; listed for clarity.
+        '**/*.test.ts',
+        '**/*.spec.ts',
+      ],
+      thresholds: {
+        // thresholdAutoUpdate:false prevents vitest from silently lowering the
+        // floor when coverage drops between runs — regressions must be an
+        // explicit edit, never auto-applied (#353, INV-30 spirit).
+        thresholdAutoUpdate: false,
+        // #1527 — all four keys mirror the SAME resolved floor as the check-all
+        // gate. `lines`/`functions`/`statements` share the line-coverage value
+        // (no mixed SSOT); `branches` uses the branch floor. The generator
+        // (src/generators/coverage.ts) overrides `thresholds` with the resolved
+        // values, so this never disagrees with the gate.
+        lines: <%= locals.thresholds ? locals.thresholds.lineCoverage : coverageThreshold %>,
+        functions: <%= locals.thresholds ? locals.thresholds.lineCoverage : coverageThreshold %>,
+        branches: <%= locals.thresholds ? locals.thresholds.branchCoverage : coverageThreshold %>,
+        statements: <%= locals.thresholds ? locals.thresholds.lineCoverage : coverageThreshold %>,
+      },
+    },
+  },
+});

package/dist/templates/docs/CODING_STANDARDS.md.ejs

@@ -0,0 +1,81 @@
+# Coding Standards
+
+_Generated by arbiter. Update to match your team's conventions._
+
+## General
+
+- Prefer immutable variables (const/val/final)
+- Functions should have a single responsibility
+- No magic numbers — use named constants
+- Maximum cyclomatic complexity: 15
+
+<% if (language === 'typescript') { %>
+## TypeScript
+
+- `strict: true` in tsconfig — mandatory
+- No `any` type — use `unknown` and narrow, or create proper types
+- Named exports preferred over default exports
+- File naming: kebab-case.ts
+- Linting: ESLint with `@typescript-eslint` ruleset
+- Dead code: Knip (zero unused exports)
+- Coverage threshold: 80% lines
+
+<% } %>
+<% if (language === 'java' || language === 'kotlin') { %>
+## JVM
+
+- Static analysis: SpotBugs — zero HIGH/CRITICAL findings
+- Coverage: JaCoCo — 80% line coverage minimum
+- Style: Checkstyle — Google Java Style Guide
+- No raw types — use generics
+- Checked exceptions only when caller must handle them
+<% if (hasPublicApi) { %>
+### Payload Size Limiting (API projects)
+
+Spring Boot does not enforce a request body size limit by default. Add a
+`OncePerRequestFilter` (or set `spring.servlet.multipart.max-request-size` for
+multipart) to reject oversized payloads before they reach the controller layer.
+Return HTTP 413 with an RFC 7807 problem-details body (`type`, `title`,
+`status`, `detail`, `instance`). See the TypeScript reference implementation in
+`src/middleware/payload-size-limit.ts` for the expected response shape.
+<% } %>
+<% } %>
+<% if (language === 'python') { %>
+## Python
+
+- Type hints mandatory on all public functions (PEP 484)
+- Black + isort for formatting (no manual exceptions)
+- pylint/flake8 zero warnings
+- Coverage threshold: 80% (pytest-cov)
+- Docstrings for all public modules, classes, and functions (Google style)
+
+<% } %>
+<% if (language === 'go') { %>
+## Go
+
+- `go vet` and `staticcheck` — zero warnings
+- `gofmt` applied before every commit
+- Error wrapping: `fmt.Errorf("...: %w", err)` — no bare `errors.New`
+- Coverage threshold: 80% (go test -cover)
+- No global mutable state
+
+<% } %>
+<% if (language === 'rust') { %>
+## Rust
+
+- `clippy` at deny level — zero warnings
+- No `unwrap()` in production code — use `?` or handle explicitly
+- `rustfmt` applied before every commit
+- Coverage threshold: 80% (cargo-tarpaulin or similar)
+- Prefer `thiserror` for error types
+
+<% } %>
+<% if (isL3Plus) { %>
+## L3 Governance
+
+- All public APIs must have OpenAPI/Swagger documentation
+- Breaking changes require an ADR
+- Architectural decision records: `docs/adr/`
+- Security review required for any auth, crypto, or external boundary changes
+
+<% } %>

package/dist/templates/docs/FEATURE_MATRIX.md.ejs

@@ -0,0 +1,84 @@
+# FEATURE_MATRIX — Product Truth RTM
+
+_Generated by arbiter at governance level <%= governanceLevel %>. This is your project's
+Product-Truth bible: the single authoritative record of what this project delivers, at what
+level, with what evidence. Update this file as your implementation matures._
+
+> **Gate:** `scripts/check-feature-matrix.mjs --check` (L1, fail-closed). Run
+> `node scripts/check-feature-matrix.mjs --write` to regenerate the summary section.
+>
+> **Export:** (planned) CSV/XLSX export for PM/stakeholder views — not yet shipped as a CLI command.
+
+---
+
+## Status vocabulary
+
+| Status | Meaning | Required fields |
+|--------|---------|-----------------|
+| `Missing` | No implementation — tracked by issue | `issue_ref` in `#NNN` format |
+| `Partial` | Code exists; test/doc incomplete | `code_ref` non-empty |
+| `Done` | Code + test + doc all present | `code_ref` + `test_ref` + `doc_ref` non-empty and files exist |
+| `Verified` | Full evidence chain — gate-checked | all four refs non-empty, `test_ref` title parsed |
+
+Promotion is fail-closed (cannot skip a step).
+
+`source_ref` (optional, 11th column): upward anchor(s) toward the
+requirement's origin (`INV-NN`, `ADR-NNN`, `PRD §N(.M)*`, comma-separated).
+Validated whenever non-empty, regardless of status. Non-canonical forms (an
+issue reference, free prose, a legacy-declared anchor) are format-only and
+never resolved (no false red). `test_ref` glob patterns (`*`/`**`) are
+banned on `Done`/`Verified` rows unless grandfathered in the committed
+ratchet baseline (`.feature-matrix-glob-baseline.json`, regenerated
+deliberately via `--update-baseline`); a `Verified` row is never
+baseline-exemptible.
+
+`verification_tier` (optional, 12th column): `SCAFFOLD` | `GATE` | `E2E` —
+the kind of proof this row needs to be fully qualified, independent of
+`status` (a `Missing`/`Partial` row can correctly declare the tier its
+eventual test must clear). `SCAFFOLD` = `arbiter init`/`update` produces the
+expected artifact; `GATE` = your own L1/L2 unit+integration suite; `E2E` =
+a real run of the generated project's own gate. Validated (enum only)
+whenever non-empty.
+
+---
+
+<!-- FEATURE_MATRIX_START -->
+| feature_id | capability | kit_dims | level | status | code_ref | test_ref | doc_ref | issue_ref | note | source_ref | verification_tier |
+|---|---|---|---|---|---|---|---|---|---|---|---|
+| REQ-001 | Architecture enforcement | N01,N02,N03,N04,N05,N06,N07 | L2 | Missing | | | | #1 | Replace with your architecture enforcement ref |
+| REQ-002 | Static analysis & linting | N09,N10,N11,N12,N13,N14,N15,N16 | L2 | Missing | | | | #2 | Replace with your static analysis ref |
+| REQ-003 | Test framework | N17,N18,N19,N20,N21,N22,N23 | L2 | Missing | | | | #3 | Replace with your test framework ref |
+| REQ-004 | Test profiles & coverage | N24,N25,N26 | L2 | Missing | | | | #4 | Replace with your coverage ref |
+| REQ-005 | Integration & mutation testing | N27,N28,N29,N30,N31,N32,N33 | L2 | Missing | | | | #5 | Replace with your integration test ref |
+| REQ-006 | CI/CD pipeline | N34,N35,N36,N37,N38,N39,N40 | L2 | Missing | | | | #6 | Replace with your CI/CD ref |
+| REQ-007 | E2E & performance | N41,N42,N43,N44 | L2 | Missing | | | | #7 | Replace with your E2E ref |
+| REQ-008 | Gate script validation | N45,N46,N47,N48,N49,N50 | L2 | Missing | | | | #8 | Replace with your gate scripts ref |
+| REQ-009 | Quality gate scripts | N51,N52,N53,N54 | L2 | Missing | | | | #9 | Replace with your quality gates ref |
+| REQ-010 | Security toolchain | N55,N56,N57,N58 | L2 | Missing | | | | #10 | Replace with your security ref |
+| REQ-011 | Git/GitHub governance | N59,N60,N61,N62 | L2 | Missing | | | | #11 | Replace with your git governance ref |
+| REQ-012 | Documentation | N63,N64,N65,N66,N67,N68 | L2 | Missing | | | | #12 | Replace with your docs ref |
+| REQ-013 | Configuration | N69,N70,N71,N72 | L1 | Missing | | | | #13 | Replace with your config ref |
+| REQ-014 | Module boundaries | N77 | L2 | Missing | | | | #14 | Replace with your boundary ref |
+| REQ-015 | Audit trail | N08,N73,N74,N75 | L4 | Missing | | | | #15 | Replace with your audit trail ref |
+| REQ-016 | Accessibility | N76 | L2 | Missing | | | | #16 | Replace with your a11y ref |
+<!-- FEATURE_MATRIX_END -->
+
+---
+
+## Summary
+
+| Status | Count |
+|---|---|
+| Verified | 0 |
+| Done | 0 |
+| Partial | 0 |
+| Missing | 16 |
+| **Total** | **16** |
+
+---
+
+## Version history
+
+| Version | Date | Changes |
+|---|---|---|
+| 1.0.0 | Initial | Scaffolded by arbiter at <%= governanceLevel %> |

package/dist/templates/docs/GAP.md.ejs

@@ -0,0 +1,58 @@
+# GAP — Gap Register
+
+_Generated by arbiter at governance level <%= governanceLevel %>. This is your project's
+gap register: a derived view of what is incomplete per docs/FEATURE_MATRIX.md.
+Update your FEATURE_MATRIX and run `node scripts/gen-gap.mjs --write` to refresh._
+
+> **Gate:** `node scripts/gen-gap.mjs --check` (L2+, fail-closed) — every Partial/Missing
+> feature_id in `docs/FEATURE_MATRIX.md` must be tracked below. Run
+> `node scripts/gen-gap.mjs --write` to regenerate the Feature Gaps table.
+
+---
+
+<!-- GAP_START -->
+
+## Feature Gaps
+
+`blocks_v1: yes` marks a `Missing`-status row (no implementation yet, tracked by issue).
+
+<!-- GAP_FEATURES_START -->
+
+| feature_id | capability | status | severity | blocks_v1 | issue | notes |
+| --- | --- | --- | --- | --- | --- | --- |
+| REQ-001 | Architecture enforcement | Missing | high | yes | #1 | Replace with your architecture enforcement ref |
+| REQ-002 | Static analysis & linting | Missing | high | yes | #2 | Replace with your static analysis ref |
+| REQ-003 | Test framework | Missing | high | yes | #3 | Replace with your test framework ref |
+| REQ-004 | Test profiles & coverage | Missing | high | yes | #4 | Replace with your coverage ref |
+| REQ-005 | Integration & mutation testing | Missing | high | yes | #5 | Replace with your integration test ref |
+| REQ-006 | CI/CD pipeline | Missing | high | yes | #6 | Replace with your CI/CD ref |
+| REQ-007 | E2E & performance | Missing | high | yes | #7 | Replace with your E2E ref |
+| REQ-008 | Gate script validation | Missing | high | yes | #8 | Replace with your gate scripts ref |
+| REQ-009 | Quality gate scripts | Missing | high | yes | #9 | Replace with your quality gates ref |
+| REQ-010 | Security toolchain | Missing | high | yes | #10 | Replace with your security ref |
+| REQ-011 | Git/GitHub governance | Missing | high | yes | #11 | Replace with your git governance ref |
+| REQ-012 | Documentation | Missing | high | yes | #12 | Replace with your docs ref |
+| REQ-013 | Configuration | Missing | high | yes | #13 | Replace with your config ref |
+| REQ-014 | Module boundaries | Missing | high | yes | #14 | Replace with your boundary ref |
+| REQ-015 | Audit trail | Missing | high | yes | #15 | Replace with your audit trail ref |
+| REQ-016 | Accessibility | Missing | high | yes | #16 | Replace with your a11y ref |
+
+<!-- GAP_FEATURES_END -->
+
+## Known Debt
+
+Not tracked by the portable gate (`scripts/gen-gap.mjs`) — arbiter's own richer register also
+cross-references constraint-scan output and convergence reports, which have no stable
+equivalent in an arbitrary target project. Track debt as GitHub issues / your own backlog.
+
+<!-- GAP_END -->
+
+---
+
+## Usage
+
+Run `node scripts/gen-gap.mjs --write` to regenerate the Feature Gaps table from
+`docs/FEATURE_MATRIX.md`. `--check` fails if a Partial/Missing feature_id has been
+dropped from this file without being resolved in the matrix first.
+
+Governance level: **<%= governanceLevel %>**

package/dist/templates/docs/ISO27001_ANNEX_A.md.ejs

@@ -0,0 +1,144 @@
+# ISO 27001:2022 Annex A Control Matrix
+
+**Project:** <%= projectName %>
+**Generated by:** arbiter (L3 governance)
+**Last updated:** <%= new Date().toISOString().slice(0,10) %>
+
+This matrix maps all 93 ISO 27001:2022 Annex A controls to project coverage.
+Controls marked ✅ are satisfied by arbiter-generated artifacts. Controls marked ❌ require manual implementation.
+
+## Summary
+
+| Section | Controls | Covered | Gap |
+|---------|----------|---------|-----|
+| A.5 Organizational | 37 | 4 | 33 |
+| A.6 People | 8 | 0 | 8 |
+| A.7 Physical | 14 | 0 | 14 |
+| A.8 Technological | 34 | 8 | 26 |
+| **Total** | **93** | **12** | **81** |
+
+---
+
+## A.5 — Organizational Controls
+
+| Control | Title | Status | Evidence |
+|---------|-------|--------|----------|
+| A.5.1 | Policies for information security | ❌ Gap | Manual: define security policy |
+| A.5.2 | Information security roles and responsibilities | ✅ Covered | CODEOWNERS, AGENTS.md §Authority Hierarchy |
+| A.5.3 | Segregation of duties | ❌ Gap | Manual: org-level process |
+| A.5.4 | Management responsibilities | ❌ Gap | Manual |
+| A.5.5 | Contact with authorities | ❌ Gap | Manual |
+| A.5.6 | Contact with special interest groups | ❌ Gap | Manual |
+| A.5.7 | Threat intelligence | ❌ Gap | Manual |
+| A.5.8 | Information security in project management | ❌ Gap | Manual |
+| A.5.9 | Inventory of information and other associated assets | ❌ Gap | Manual |
+| A.5.10 | Acceptable use of information and other assets | ❌ Gap | Manual |
+| A.5.11 | Return of assets | ❌ Gap | Manual |
+| A.5.12 | Classification of information | ❌ Gap | Manual |
+| A.5.13 | Labelling of information | ❌ Gap | Manual |
+| A.5.14 | Information transfer | ❌ Gap | Manual |
+| A.5.15 | Access control | ❌ Gap | Manual |
+| A.5.16 | Identity management | ❌ Gap | Manual |
+| A.5.17 | Authentication information | ❌ Gap | Manual |
+| A.5.18 | Access rights | ❌ Gap | Manual |
+| A.5.19 | Information security in supplier relationships | ❌ Gap | Manual |
+| A.5.20 | Addressing information security within supplier agreements | ❌ Gap | Manual |
+| A.5.21 | Managing information security in the ICT supply chain | ❌ Gap | Manual |
+| A.5.22 | Monitoring, review, and change management of supplier services | ❌ Gap | Manual |
+| A.5.23 | Information security for use of cloud services | ❌ Gap | Manual |
+| A.5.24 | Information security incident management planning and preparation | ❌ Gap | Manual |
+| A.5.25 | Assessment and decision on information security events | ❌ Gap | Manual |
+| A.5.26 | Response to information security incidents | ❌ Gap | Manual |
+| A.5.27 | Learning from information security incidents | ❌ Gap | Manual |
+| A.5.28 | Collection of evidence | ❌ Gap | Manual |
+| A.5.29 | Information security during disruption | ❌ Gap | Manual |
+| A.5.30 | ICT readiness for business continuity | ❌ Gap | Manual |
+| A.5.31 | Legal, statutory, regulatory, and contractual requirements | ❌ Gap | Manual |
+| A.5.32 | Intellectual property rights | ❌ Gap | Manual |
+| A.5.33 | Protection of records | ❌ Gap | Manual |
+| A.5.34 | Privacy and protection of PII | ✅ Covered | scripts/pii-scan.mjs + suppressions/pii-allowlist.json |
+| A.5.35 | Independent review of information security | ❌ Gap | Manual |
+| A.5.36 | Compliance with policies, rules, and standards | ✅ Covered | AGENTS.md invariants + check-all gate |
+| A.5.37 | Documented operating procedures | ✅ Covered | AGENTS.md, docs/CODING_STANDARDS.md |
+
+---
+
+## A.6 — People Controls
+
+| Control | Title | Status | Evidence |
+|---------|-------|--------|----------|
+| A.6.1 | Screening | ❌ Gap | Manual: HR process |
+| A.6.2 | Terms and conditions of employment | ❌ Gap | Manual: HR process |
+| A.6.3 | Information security awareness, education and training | ❌ Gap | Manual |
+| A.6.4 | Disciplinary process | ❌ Gap | Manual: HR process |
+| A.6.5 | Responsibilities after termination or change of employment | ❌ Gap | Manual: HR process |
+| A.6.6 | Confidentiality or non-disclosure agreements | ❌ Gap | Manual: legal |
+| A.6.7 | Remote working | ❌ Gap | Manual: policy |
+| A.6.8 | Information security event reporting | ❌ Gap | Manual: incident process |
+
+---
+
+## A.7 — Physical Controls
+
+| Control | Title | Status | Evidence |
+|---------|-------|--------|----------|
+| A.7.1 | Physical security perimeters | ❌ Gap | Manual: facilities |
+| A.7.2 | Physical entry | ❌ Gap | Manual: facilities |
+| A.7.3 | Securing offices, rooms and facilities | ❌ Gap | Manual: facilities |
+| A.7.4 | Physical security monitoring | ❌ Gap | Manual: facilities |
+| A.7.5 | Protecting against physical and environmental threats | ❌ Gap | Manual: facilities |
+| A.7.6 | Working in secure areas | ❌ Gap | Manual: policy |
+| A.7.7 | Clear desk and clear screen | ❌ Gap | Manual: policy |
+| A.7.8 | Equipment siting and protection | ❌ Gap | Manual: facilities |
+| A.7.9 | Security of assets off-premises | ❌ Gap | Manual: policy |
+| A.7.10 | Storage media | ❌ Gap | Manual: policy |
+| A.7.11 | Supporting utilities | ❌ Gap | Manual: facilities |
+| A.7.12 | Cabling security | ❌ Gap | Manual: facilities |
+| A.7.13 | Equipment maintenance | ❌ Gap | Manual: facilities |
+| A.7.14 | Secure disposal or re-use of equipment | ❌ Gap | Manual: policy |
+
+---
+
+## A.8 — Technological Controls
+
+| Control | Title | Status | Evidence |
+|---------|-------|--------|----------|
+| A.8.1 | User end point devices | ❌ Gap | Manual: device management |
+| A.8.2 | Privileged access rights | ❌ Gap | Manual: IAM |
+| A.8.3 | Information access restriction | ❌ Gap | Manual: IAM |
+| A.8.4 | Access to source code | ✅ Covered | Branch protection rules, AGENTS.md INV-23 (no direct push to main) |
+| A.8.5 | Secure authentication | ❌ Gap | Manual: IAM |
+| A.8.6 | Capacity management | ❌ Gap | Manual |
+| A.8.7 | Protection against malware | ❌ Gap | Manual: endpoint security |
+| A.8.8 | Management of technical vulnerabilities | ✅ Covered | npm audit (L2 gate), gitleaks (L2 gate) |
+| A.8.9 | Configuration management | ✅ Covered | arbiter-generated config files + check-all gate |
+| A.8.10 | Information deletion | ❌ Gap | Manual: data retention policy |
+| A.8.11 | Data masking | ❌ Gap | Manual: data layer |
+| A.8.12 | Data leakage prevention | ✅ Covered | pii-scan.mjs (L2 gate, no grace) |
+| A.8.13 | Information backup | ❌ Gap | Manual: infra |
+| A.8.14 | Redundancy of information processing facilities | ❌ Gap | Manual: infra |
+| A.8.15 | Logging | ❌ Gap | Manual: observability |
+| A.8.16 | Monitoring activities | ❌ Gap | Manual: observability |
+| A.8.17 | Clock synchronisation | ❌ Gap | Manual: infra |
+| A.8.18 | Use of privileged utility programs | ❌ Gap | Manual |
+| A.8.19 | Installation of software on operational systems | ❌ Gap | Manual: change management |
+| A.8.20 | Networks security | ❌ Gap | Manual: network team |
+| A.8.21 | Security of network services | ❌ Gap | Manual: network team |
+| A.8.22 | Segregation of networks | ❌ Gap | Manual: network team |
+| A.8.23 | Web filtering | ❌ Gap | Manual |
+| A.8.24 | Use of cryptography | ❌ Gap | Manual: crypto policy |
+| A.8.25 | Secure development life cycle | ✅ Covered | node scripts/check-all.mjs (L1/L2/L3 gates) |
+| A.8.26 | Application security requirements | ✅ Covered | docs/SECURE_CODING_CHECKLIST.md + STRIDE threat model |
+| A.8.27 | Secure system architecture and engineering principles | ✅ Covered | dependency-cruiser / ArchUnit arch boundary enforcement |
+| A.8.28 | Secure coding | ✅ Covered | docs/CODING_STANDARDS.md + eslint-security rules |
+| A.8.29 | Security testing in development and acceptance | ❌ Gap | Manual: pentest / DAST |
+| A.8.30 | Outsourced development | ❌ Gap | Manual: contract |
+| A.8.31 | Separation of development, test and production environments | ❌ Gap | Manual: infra |
+| A.8.32 | Change management | ✅ Covered | PR + gate process, AGENTS.md INV-22/23 |
+| A.8.33 | Test information | ❌ Gap | Manual: test data policy |
+| A.8.34 | Protection of information systems during audit testing | ❌ Gap | Manual |
+
+---
+
+*This matrix was auto-generated by arbiter. Update manually as controls are implemented.*
+*Re-run `arbiter init` to regenerate the scaffold; edit this file to track manual control status.*

package/dist/templates/docs/MASTER_TEST_PLAN.md.ejs

@@ -0,0 +1,52 @@
+# Master Test Plan
+
+_Generated by arbiter. Update to match your project's test strategy._
+
+## Test Coverage Requirements
+
+- **Minimum coverage threshold**: 80% line coverage
+- All public APIs must have tests
+- Tests run in CI on every PR
+
+## Mandatory Test Patterns
+
+Every feature implementation must include tests for each of the following patterns:
+
+| Pattern              | Description                                                        | Required |
+|----------------------|--------------------------------------------------------------------|----------|
+| Happy path           | The primary success case with valid inputs                         | ✓        |
+| Null / empty input   | Behavior when required inputs are absent or empty                  | ✓        |
+| Not found            | Resource lookup when the target does not exist                     | ✓        |
+| Business rule        | Domain invariant violations (invalid state transitions, etc.)      | ✓        |
+| Auth / unauthorized  | Access attempt without valid credentials or insufficient privilege  | ✓        |
+<% if (isL3Plus) { %>
+| Tenant isolation     | Data from tenant A must not leak to tenant B                       | ✓        |
+| Concurrency          | Concurrent access does not produce incorrect results               | ✓        |
+<% } %>
+
+## Test Pyramid
+
+| Level          | Tool                  | When          | Coverage Target |
+|----------------|-----------------------|---------------|-----------------|
+| Unit           | language-specific     | pre-commit    | 80%             |
+| Integration    | language-specific     | pre-push      | key paths       |
+| E2E            | language-specific     | CI / L3       | happy paths     |
+<% if (isL3Plus) { %>
+| Chaos / Soak   | language-specific     | nightly       | resilience      |
+<% } %>
+
+## Review Checklist
+
+Before marking a PR as ready for review, verify:
+
+- [ ] Happy path test exists
+- [ ] Null/empty input test exists
+- [ ] Not-found test exists
+- [ ] Business rule test exists
+- [ ] Auth/unauthorized test exists
+<% if (isL3Plus) { %>
+- [ ] Tenant isolation test exists
+- [ ] Concurrency test exists
+<% } %>
+- [ ] All tests pass locally
+- [ ] Coverage threshold met (80%)

package/dist/templates/docs/POST_MERGE_REVIEW_TEMPLATE.md.ejs

@@ -0,0 +1,63 @@
+# Post-Merge Review — YYYY-MM-DD
+
+**Project:** <%= projectName %>
+**Scope:** Tasks #NNN–#MMM (N worktrees, N commits)
+**Reviewers:** N (security findings weighted 2×)
+**Generated by:** arbiter (L<%= governanceLevel.slice(1) %> governance)
+
+---
+
+## Summary
+
+| Bundle | Scope | Score | Verdict |
+|--------|-------|-------|---------|
+| #NNN | Feature description | 84/100 | PASS |
+
+**Verdict thresholds:** PASS ≥75 | CONCERNS 60–74 | FAIL <60
+
+---
+
+## Bundle Details
+
+### #NNN — Title (Score: 84/100)
+
+**Findings:**
+- P2: [description] — tracked as #XXX
+- P4: [description] — deferred, icebox
+
+**Known limitations (by design):**
+- [description] — tracked in #YYY
+
+---
+
+## Finding Classification
+
+| Class | Definition | Action |
+|-------|------------|--------|
+| P1 | Critical — security, data loss, correctness | Fix before merge; block release |
+| P2 | Blocks next milestone | Create issue, fix before next sprint |
+| P3 | Impactful, not blocking | Create issue, schedule |
+| P4 | Nice to have | Create issue, icebox |
+| P5 | Cosmetic / trivial | Optional follow-up |
+| Known limitation | Phase trade-off | Document rationale, link tracking issue |
+
+> **Security findings are weighted 2×** in the final bundle score.
+> A P2 security finding counts as P1 for scoring purposes.
+
+---
+
+## Retrospective Notes
+
+*What went well:*
+- [observation]
+
+*What to improve:*
+- [observation]
+
+*Carry-forward to next batch:*
+- [action item] — owner: @handle
+
+---
+
+*This document was generated from `docs/testing/POST_MERGE_REVIEW_TEMPLATE.md` by arbiter.*
+*Fill in actual task numbers, scores, and findings after batch merge.*

package/dist/templates/docs/SECURE_CODING_CHECKLIST.md.ejs

@@ -0,0 +1,61 @@
+# Secure Coding Checklist
+
+_Generated by arbiter. Review before every PR merge._
+
+## Input Validation
+
+- [ ] All user input validated at system boundaries (no raw string interpolation in SQL/shell/HTML)
+- [ ] Parameterized queries only — no string concatenation in database calls
+- [ ] File uploads: validate type, size, and filename; store outside webroot
+- [ ] JSON/XML input parsed with size limits
+
+## Authentication & Authorization
+
+- [ ] JWT tokens validated (signature + expiry + audience)
+- [ ] No hardcoded credentials in source code or config files
+- [ ] Default-deny authorization: explicit allow-list, not blocklist
+- [ ] Session tokens invalidated on logout and password change
+
+## Secrets
+
+- [ ] No secrets in source code, logs, or version control
+- [ ] Environment variables used for all configuration values
+- [ ] Secret scanning gate passes (`gitleaks detect`)
+- [ ] Secrets rotated if any exposure suspected
+
+## Dependency Security
+
+- [ ] `npm audit --omit=dev --audit-level=high` (or equivalent) passes
+- [ ] No CVEs suppressed without justification + review date
+- [ ] CVSS ≥ 9.0 CVEs must have written ADR before suppression
+- [ ] Dependencies pinned to minor version or have lockfile
+
+## Error Handling
+
+- [ ] No stack traces in API responses (structured error format only)
+- [ ] All Promise rejections handled (`.catch()` or `try/catch`)
+- [ ] No swallowed exceptions (`catch {}` without logging or rethrow)
+- [ ] Error codes documented — no magic numbers in error responses
+
+## Logging & PII
+
+- [ ] No PII in log output (names, emails, phone numbers, IDs)
+- [ ] Correlation ID present in all service-to-service calls
+- [ ] Log level appropriate: debug not in production by default
+- [ ] PII scan gate passes (`node scripts/pii-scan.mjs`)
+<% if (isL3Plus) { %>
+
+## Tenant Isolation
+
+- [ ] Cross-tenant data access impossible by design (tenant ID in every DB query)
+- [ ] API responses filtered by tenant before serialization
+- [ ] Background jobs scoped to single tenant; no shared state between tenants
+- [ ] Tenant ID not guessable from public identifiers
+
+## Cryptography
+
+- [ ] Approved algorithms only: AES-256-GCM, RSA-2048+, SHA-256+
+- [ ] No MD5/SHA-1 for security purposes (hash comparison, signatures)
+- [ ] Key rotation policy documented and tested
+- [ ] Random number generation uses `crypto.randomBytes` / `SecureRandom` — not `Math.random()`
+<% } %>

package/dist/templates/docs/adr/ADR-000_template.md.ejs

@@ -0,0 +1,28 @@
+# ADR-NNN: Title
+
+**Project:** <%= projectName %>
+**Date:** YYYY-MM-DD
+**Status:** Proposed | Accepted | Deprecated | Superseded
+
+## Context
+
+What is the issue that we're seeing that motivates this decision or change?
+
+## Decision
+
+What is the change that we're proposing and/or doing?
+
+## Consequences
+
+### Positive
+
+- What becomes easier or possible because of this decision?
+
+### Negative
+
+- What becomes harder or is no longer possible?
+
+## Links
+
+- Related ADRs: ADR-NNN
+- Issues: #NNN