@getarbiter/cli 0.5.0

package/dist/templates/github/PULL_REQUEST_TEMPLATE.md.ejs

@@ -0,0 +1,52 @@
+## Summary
+
+<!-- What does this PR do? Why? (1-3 bullets) -->
+
+## Changes
+
+<!-- Bullet list of what changed -->
+
+## Gate Checklist
+
+- [ ] `node scripts/check-all.mjs L1` passes
+<% if (governanceLevel !== 'L1') { %>
+- [ ] `node scripts/check-all.mjs L2` passes
+<% } %>
+- [ ] No orphan TODOs (all TODO have task IDs)
+- [ ] No invariant violations (see AGENTS.md)
+- [ ] Tests added/updated for changed code
+- [ ] Commit messages follow convention: `type(scope): summary`
+<% if (governanceLevel !== 'L1') { %>
+- [ ] No CANON violations (applicable CANON-NN IDs: <!-- list or "none" -->)
+<% } %>
+
+## Pipeline Artifacts
+
+<!-- Optional: link relevant artifacts from CI pipeline -->
+
+| Artifact     | Link |
+| ------------ | ---- |
+| Spec / Plan  |      |
+| Review score |      |
+| Log          |      |
+
+## Test Plan
+
+<!-- How was this tested? What scenarios were covered? -->
+<% if (governanceLevel !== 'L1') { %>
+
+## AI-PR Gate
+
+<!-- If this PR was authored by a bot/AI: -->
+- [ ] Human reviewer approved and `approved-by-human` label applied (INV-91)
+<% } %>
+
+## Security Checklist
+
+<!-- L2/L3 projects: verify SECURE_CODING_CHECKLIST.md before merging -->
+<% if (governanceLevel !== 'L1') { %>
+- [ ] Reviewed `docs/SECURE_CODING_CHECKLIST.md` (if present in this project)
+- [ ] No deprecated endpoints added without `Sunset` header (RFC 8594) — N/A if no public API changes
+<% } else { %>
+- [ ] No obvious security regressions introduced
+<% } %>

package/dist/templates/github/actions/build-cache/action.yml.ejs

@@ -0,0 +1,84 @@
+<%
+// C3 — parametric cross-job build cache (run-id key + non-blocking rebuild fallback).
+//
+// Generalises the Maven-reactor-only artifact handoff into a strategy that is
+// fixed at generation time from (language, buildTool). Supported strategies:
+//   node-workspace | python-wheel | maven-reactor | gradle
+//
+// Two properties are invariant across every strategy:
+//   1. Immutable run-id key — the artifact name embeds ${{ github.run_id }}, so
+//      every job in one workflow run shares exactly one build and there is never
+//      cross-run collision or a stale restore.
+//   2. Non-blocking rebuild fallback — on `restore`, a missing or expired
+//      artifact NEVER fails the run; the job rebuilds the outputs locally.
+const _bcStrategies = {
+  'node-workspace': {
+    build: (typeof buildCommand !== 'undefined' && buildCommand) ? buildCommand : 'npm run build',
+    pack: 'dist',
+  },
+  'python-wheel': {
+    build: 'python -m build --wheel --outdir dist',
+    pack: 'dist',
+  },
+  'maven-reactor': {
+    build: 'mvn --batch-mode -DskipTests install',
+    pack: 'target',
+  },
+  'gradle': {
+    build: './gradlew assemble',
+    pack: 'build',
+  },
+};
+let _bcStrategy;
+if (language === 'python') _bcStrategy = 'python-wheel';
+else if (language === 'java' && buildTool === 'gradle') _bcStrategy = 'gradle';
+else if (language === 'java') _bcStrategy = 'maven-reactor';
+else _bcStrategy = 'node-workspace';
+const _bc = _bcStrategies[_bcStrategy];
+%>name: Build cache (<%= _bcStrategy %>)
+description: >-
+  Parametric cross-job build cache (strategy: <%= _bcStrategy %>). The cache key is
+  the immutable workflow run id, so every job in a run shares one build. On `restore`,
+  a missing or expired cache entry is NON-BLOCKING: the job rebuilds locally instead of
+  failing the run. Strategy is one of node-workspace | python-wheel | maven-reactor |
+  gradle, fixed at generation time from the project archetype.
+  Uses actions/cache, not upload/download-artifact (#2058): this is pure cross-job
+  scratch data for a single run, never downloaded by a human, so it belongs in
+  Actions' auto-evicting Cache storage (soft-fail by design) — not the manually-
+  retained, hard-quota Artifacts store that a build-cache-shaped payload does
+  nothing to deserve.
+
+inputs:
+  op:
+    description: "Operation: save (build + upload) or restore (download or rebuild)"
+    required: true
+
+runs:
+  using: composite
+  steps:
+    # ── restore: fetch under the same run-id key, else rebuild (non-blocking) ──
+    - name: Restore cached workspace build (non-blocking)
+      id: build-cache-restore
+      if: ${{ inputs.op == 'restore' }}
+      uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+      with:
+        path: <%= _bc.pack %>
+        key: build-cache-<%= _bcStrategy %>-${{ github.run_id }}
+    - name: Rebuild fallback (cache unavailable)
+      if: ${{ inputs.op == 'restore' && steps.build-cache-restore.outputs.cache-hit != 'true' }}
+      shell: bash
+      run: |
+        echo "::notice::build-cache unavailable — rebuilding locally (non-blocking fallback)"
+        <%= _bc.build %>
+
+    # ── save: build once, cache under the immutable run-id key ──────────────────
+    - name: Build (<%= _bcStrategy %>)
+      if: ${{ inputs.op == 'save' }}
+      shell: bash
+      run: <%= _bc.build %>
+    - name: Save workspace build (run-id keyed)
+      if: ${{ inputs.op == 'save' }}
+      uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+      with:
+        path: <%= _bc.pack %>
+        key: build-cache-<%= _bcStrategy %>-${{ github.run_id }}

package/dist/templates/github/actions/nas-ssh/action.yml.ejs

@@ -0,0 +1,53 @@
+name: NAS SSH setup
+description: >-
+  Materialises the NAS SSH key and a PINNED known_hosts entry into a private temp
+  dir, and exports $NAS_SSH — the ssh command prefix the nas-compose deploy lane
+  uses. Host-key policy lives here so no caller can drift from it.
+inputs:
+  key:
+    description: Private SSH key authorised on the NAS (secrets.NAS_SSH_KEY).
+    required: true
+  known-hosts:
+    description: >-
+      known_hosts line for the NAS (secrets.NAS_SSH_KNOWN_HOSTS). Pinned, not
+      discovered: the runner container has no known_hosts of its own, so
+      StrictHostKeyChecking=accept-new would trust whatever answers first — on the
+      lane that ships a production image and recreates the prod container.
+    required: true
+  host:
+    description: NAS hostname or address (secrets.NAS_SSH_HOST).
+    required: true
+  user:
+    description: SSH user (secrets.NAS_SSH_USER).
+    required: true
+  port:
+    description: SSH port.
+    required: false
+    default: '5022'
+runs:
+  using: composite
+  steps:
+    - name: Materialise SSH identity and pinned host key
+      shell: bash
+      env:
+        NAS_KEY: ${{ inputs.key }}
+        NAS_KNOWN_HOSTS: ${{ inputs.known-hosts }}
+        NAS_HOST: ${{ inputs.host }}
+        NAS_USER: ${{ inputs.user }}
+        NAS_PORT: ${{ inputs.port }}
+      run: |
+        set -euo pipefail
+        dir="${RUNNER_TEMP}/nas-ssh"
+        mkdir -p "$dir"
+        chmod 700 "$dir"
+        umask 077
+        printf '%s\n' "$NAS_KEY" > "$dir/id"
+        printf '%s\n' "$NAS_KNOWN_HOSTS" > "$dir/known_hosts"
+        chmod 600 "$dir/id" "$dir/known_hosts"
+        # ssh-keygen -y fails on a truncated or misencoded secret, which otherwise
+        # surfaces much later as an opaque "Permission denied".
+        ssh-keygen -y -P "" -f "$dir/id" > /dev/null
+        {
+          echo "NAS_SSH=ssh -i ${dir}/id -p ${NAS_PORT} -o IdentitiesOnly=yes -o UserKnownHostsFile=${dir}/known_hosts -o StrictHostKeyChecking=yes -o BatchMode=yes -o ConnectTimeout=15 ${NAS_USER}@${NAS_HOST}"
+          echo "NAS_SSH_DIR=${dir}"
+        } >> "$GITHUB_ENV"

package/dist/templates/github/actions/setup-java-maven/action.yml.ejs

@@ -0,0 +1,53 @@
+name: Setup Java + Maven cache
+description: >-
+  Sets up Java (Temurin) with configurable version and restores the Maven local
+  repository from a job-isolated runner.temp path. Used by every Java workflow
+  job so that setup-java is never inlined directly.
+
+inputs:
+  java-version:
+    description: Java version to install (default 21)
+    required: false
+    default: '21'
+
+outputs:
+  m2-repo-path:
+    description: Path to the restored Maven local repository
+    value: ${{ steps.m2-path.outputs.path }}
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Java (Temurin)
+      uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+      with:
+        distribution: temurin
+        java-version: ${{ inputs.java-version }}
+    - name: Resolve M2 repo path
+      id: m2-path
+      shell: bash
+      run: |
+        M2_PATH="${{ runner.temp }}/.m2-reactor"
+        echo "path=${M2_PATH}" >> "$GITHUB_OUTPUT"
+    - name: Restore Maven local repository from reactor artifact
+      shell: bash
+      run: |
+        M2_REACTOR="${{ runner.temp }}/.m2-reactor"
+        if [[ -f "${M2_REACTOR}/m2-reactor.tar" ]]; then
+          mkdir -p "$HOME/.m2/repository"
+          tar -xf "${M2_REACTOR}/m2-reactor.tar" -C "$HOME/.m2/repository"
+          echo "M2 reactor restored from ${M2_REACTOR}"
+        else
+          echo "No reactor artifact found at ${M2_REACTOR} — fresh Maven cache will be used"
+        fi
+    - name: Restore compiled target/ trees from reactor artifact
+      shell: bash
+      run: |
+        M2_REACTOR="${{ runner.temp }}/.m2-reactor"
+        if [[ -f "${M2_REACTOR}/target-reactor.tar" ]]; then
+          # Additive (#1278): restore every module's compiled target/ (main + test
+          # classes) into the workspace so run-only test goals (surefire:test)
+          # skip recompilation. No-op for jobs that did not download the artifact.
+          tar -xf "${M2_REACTOR}/target-reactor.tar" -C "${{ github.workspace }}"
+          echo "Compiled target/ trees restored from ${M2_REACTOR}"
+        fi

package/dist/templates/github/actions/setup-node-pnpm/action.yml.ejs

@@ -0,0 +1,39 @@
+# NOTE: directory is named `setup-node-pnpm` for historical reasons; it sets up
+# Node + npm (not pnpm). The name is retained to avoid orphaning the dir in
+# already-generated repos on their next `arbiter update` (#1131).
+name: Setup Node.js + npm ci
+description: >-
+  Sets up Node.js from .nvmrc, then runs `npm ci`. Remote npm caching is enabled
+  only on ephemeral GitHub-hosted runners; self-hosted slots retain their local cache.
+  Set the `install` input to 'false' for setup-only jobs.
+
+inputs:
+  node-version-file:
+    description: Path to the node version file
+    required: false
+    default: .nvmrc
+  install:
+    description: Run `npm ci` after setup (set 'false' to skip install)
+    required: false
+    default: 'true'
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+<% if (language === 'typescript') { -%>
+        node-version-file: ${{ inputs.node-version-file }}
+        package-manager-cache: false
+        cache: ${{ runner.environment == 'github-hosted' && 'npm' || '' }}
+<% } else { -%>
+        node-version-file: ${{ inputs.node-version-file }}
+        package-manager-cache: false
+<% } -%>
+<% if (language === 'typescript') { -%>
+    - name: Install dependencies (npm ci)
+      if: ${{ inputs.install == 'true' }}
+      shell: bash
+      run: npm ci
+<% } -%>

package/dist/templates/github/actions/sign-and-attest/action.yml.ejs

@@ -0,0 +1,53 @@
+<%
+const _verifyOnSign = governanceLevel !== 'L1';
+%>name: Sign and Attest Artifact
+description: >-
+  Keyless cosign sign-blob + CycloneDX SBOM attestation + GitHub native attest-build-provenance.
+  Used by release workflow for consistent signing across archetypes (INV-92, #885).
+inputs:
+  artifact-name:
+    description: GitHub Actions artifact name to download
+    required: true
+  artifact-path:
+    description: Local path to the artifact file to sign
+    required: true
+  sbom-path:
+    description: Path to CycloneDX SBOM file for attestation (optional)
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
+      with:
+        name: ${{ inputs.artifact-name }}
+    - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+    - name: Sign artifact (keyless OIDC)
+      shell: bash
+      run: cosign sign-blob --yes "${{ inputs.artifact-path }}" --bundle "${{ inputs.artifact-path }}.bundle"
+<% if (_verifyOnSign) { %>
+    - name: Verify signature (L2+ strict)
+      shell: bash
+      run: |
+        cosign verify-blob \
+          --bundle "${{ inputs.artifact-path }}.bundle" \
+          --certificate-identity-regexp ".*" \
+          --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+          "${{ inputs.artifact-path }}"
+<% } %>
+    - name: Attest SBOM (cosign attest --predicate, CycloneDX)
+      if: ${{ inputs.sbom-path != '' }}
+      shell: bash
+      run: |
+        cosign attest --yes \
+          --predicate "${{ inputs.sbom-path }}" \
+          --type cyclonedx \
+          "${{ inputs.artifact-path }}"
+    - uses: actions/attest-build-provenance@520aba26e2f010aaab88f4a9c58cdbb3f3965fc2  # v2
+      with:
+        subject-path: ${{ inputs.artifact-path }}
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+      with:
+        name: ${{ inputs.artifact-name }}-signatures
+        path: ${{ inputs.artifact-path }}.bundle
+        retention-days: 90

package/dist/templates/github/dependabot.yml.ejs

@@ -0,0 +1,66 @@
+version: 2
+updates:
+<% if (buildTool === 'npm') { %>
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    labels: ["deps"]
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+      prod-dependencies:
+        dependency-type: "production"
+<% } %><% if (buildTool === 'cargo') { %>
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels: ["deps"]
+<% } %><% if (buildTool === 'gradle') { %>
+  - package-ecosystem: "gradle"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    labels: ["deps"]
+    groups:
+      build-plugins:
+        patterns: ["*plugin*", "org.gradle.*"]
+      prod-dependencies:
+        dependency-type: "production"
+<% } %><% if (buildTool === 'maven') { %>
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    labels: ["deps"]
+    groups:
+      prod-dependencies:
+        dependency-type: "production"
+<% } %><% if (buildTool === 'go') { %>
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels: ["deps"]
+<% } %><% if (buildTool === 'pip') { %>
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    labels: ["deps"]
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+      prod-dependencies:
+        dependency-type: "production"
+<% } %>
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels: ["ci", "deps"]

package/dist/templates/github/extended-ci-paths.txt.ejs

@@ -0,0 +1,38 @@
+# Extended-CI sensitive paths — version-controlled SSOT.
+#
+# One POSIX extended regex per line (matched against `git diff --name-only`).
+# A pull request that touches ANY path matching a pattern below runs the slow
+# extended test suites regardless of size — see .github/workflows/02-pr-extended.yml
+# (the check-trigger job reads this file via `grep -E -f`).
+#
+# Blank lines and lines starting with `#` are ignored. Edit this list to change
+# which paths are "sensitive" — no workflow change is needed. The size threshold
+# is parameterized separately by the EXTENDED_CI_LOC_THRESHOLD repository
+# variable (default 100 changed LOC).
+
+# Database / schema / API contracts
+^migrations/
+^openapi/
+^schemas/
+(^|/)schema[^/]*\.(sql|prisma|graphql)$
+
+# Infrastructure & container/runtime definitions
+^infra/
+(^|/)Dockerfile[^/]*$
+(^|/)docker-compose[^/]*\.ya?ml$
+
+# CI / workflow definitions (a change here can mask broken gates)
+^\.github/workflows/.*\.ya?ml$
+
+# Security-sensitive code paths
+(^|/)security/
+(^|/)auth[^/]*\.(ts|js|go|py|java|rs)$
+
+# Dependency manifests / lockfiles (supply-chain surface)
+(^|/)package-lock\.json$
+(^|/)yarn\.lock$
+(^|/)go\.sum$
+(^|/)Cargo\.lock$
+(^|/)requirements[^/]*\.txt$
+(^|/)poetry\.lock$
+(^|/)pom\.xml$

package/dist/templates/github/issue-templates/bug-report.yml

@@ -0,0 +1,72 @@
+name: Bug Report
+description: Report a defect or unexpected behavior
+labels: ['bug']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Before filing:** Check open issues for duplicates.
+
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      options:
+        - 'Critical — data loss, security breach, or service down'
+        - 'High — major feature broken, no workaround'
+        - 'Medium — feature degraded, workaround exists'
+        - 'Low — cosmetic or minor inconvenience'
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: '1. Context'
+      description: Environment and relevant state when the bug was observed.
+      placeholder: |
+        **Environment:** Local / CI / Staging / Production
+        **Version / commit:** abc1234
+        **Pre-conditions:** What state was the system in?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: '2. Steps to Reproduce / Observed vs Expected'
+      placeholder: |
+        **Steps:**
+        1.
+        2.
+        3.
+
+        **Expected:** What should have happened
+        **Actual:** What actually happened
+    validations:
+      required: true
+
+  - type: textarea
+    id: invariant
+    attributes:
+      label: '3. Related Invariant Violation (optional)'
+      description: If this bug violates a known project invariant, reference it here.
+      placeholder: |
+        Violates INV-XX: description
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: '4. Evidence (optional)'
+      description: Logs, screenshots, stack traces, or links to artifacts.
+      placeholder: |
+        <paste stack trace or attach screenshot>
+
+  - type: checkboxes
+    id: acceptance
+    attributes:
+      label: '5. Acceptance Criteria'
+      options:
+        - label: 'Bug is no longer reproducible following the steps above'
+        - label: 'Regression test added to prevent recurrence'
+        - label: 'CI pipeline passes green'

package/dist/templates/github/issue-templates/compliance-item.yml.ejs

@@ -0,0 +1,75 @@
+name: Compliance Item
+description: Track a compliance requirement, audit finding, or regulatory obligation
+title: "[COMPLIANCE] "
+labels: ["compliance", "governance"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template to track compliance requirements, regulatory obligations, or audit findings.
+
+  - type: input
+    id: standard-reference
+    attributes:
+      label: Standard / Rule reference
+      description: "e.g. ISO 27001 A.8.1, SOC 2 CC6.1, GDPR Art. 32"
+      placeholder: "Standard name + control reference"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: compliance-type
+    attributes:
+      label: Compliance type
+      options:
+        - Regulatory (external law/standard)
+        - Internal policy
+        - Audit finding
+        - Security control
+    validations:
+      required: true
+
+  - type: dropdown
+    id: risk-level
+    attributes:
+      label: Risk level
+      description: Impact if this item is not addressed
+      options:
+        - Critical
+        - High
+        - Medium
+        - Low
+    validations:
+      required: true
+
+  - type: input
+    id: deadline
+    attributes:
+      label: Deadline
+      description: When must this be resolved? (YYYY-MM-DD)
+      placeholder: "YYYY-MM-DD"
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What is the compliance requirement or finding?
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance-criteria
+    attributes:
+      label: Acceptance criteria
+      description: How do we know when this is resolved?
+      placeholder: |
+        - [ ] Criterion 1
+        - [ ] Criterion 2
+    validations:
+      required: true
+
+  - type: textarea
+    id: verification
+    attributes:
+      label: Verification method
+      description: How will compliance be verified (audit, automated test, manual review)?

package/dist/templates/github/issue-templates/config.yml

@@ -0,0 +1,2 @@
+blank_issues_enabled: false
+contact_links: []

package/dist/templates/github/issue-templates/epic.yml

@@ -0,0 +1,66 @@
+name: Epic
+description: A collection of related tasks delivering a larger capability
+labels: ['feature']
+body:
+  - type: textarea
+    id: goal
+    attributes:
+      label: '1. Goal & Business Value'
+      description: What does this epic achieve? Why does it matter?
+      placeholder: |
+        This epic delivers...
+
+        **Business value:** Users can now...
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: '2. Scope & Boundaries'
+      description: What is in scope and what is explicitly out of scope?
+      placeholder: |
+        **In scope:**
+        - Feature A
+        - Feature B
+
+        **Out of scope:**
+        - Feature C (tracked separately in #NNN)
+    validations:
+      required: true
+
+  - type: textarea
+    id: subtasks
+    attributes:
+      label: '3. Sub-tasks'
+      description: Link to the task-brief issues that make up this epic.
+      placeholder: |
+        - [ ] #NNN Task A
+        - [ ] #NNN Task B
+        - [ ] #NNN Task C
+    validations:
+      required: true
+
+  - type: textarea
+    id: success
+    attributes:
+      label: '4. Success Metrics / Definition of Done'
+      description: How do we know the epic is complete?
+      placeholder: |
+        - All sub-tasks closed
+        - End-to-end scenario passes
+        - Performance target met: < 200ms p99
+    validations:
+      required: true
+
+  - type: textarea
+    id: risks
+    attributes:
+      label: '5. Risks & Dependencies'
+      description: External blockers, risky assumptions, or cross-team dependencies.
+      placeholder: |
+        **Dependencies:**
+        - Requires #NNN to be merged first
+
+        **Risks:**
+        - Third-party API may change without notice

package/dist/templates/github/issue-templates/feature-request.yml

@@ -0,0 +1,24 @@
+name: Feature Request
+description: Propose a new feature or improvement
+labels: ['feature']
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Context and motivation
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: What should change and how?
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered