@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/_shared-security.yml.ejs

@@ -0,0 +1,132 @@
+<%
+// #1723: serviceBucket/isService are injected by withServiceBucket
+// (src/utils/render.ts), the single canonical archetype->bucket resolver — do not
+// re-declare the archetype map here.
+const _bucket = serviceBucket;
+const _isService = isService;
+%>name: Shared security jobs (reusable)
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  dast-full:
+    name: OWASP ZAP full scan
+<% if (!_isService) { %>
+    if: false
+<% } %>
+    continue-on-error: true
+    # #1756: pinned to a LITERAL GitHub-hosted runner, not the usual
+    # `vars.RUNNER_LABELS_TEST` self-hosted-capable fallback. zaproxy/action-full-scan
+    # is a Docker-outside-of-Docker action (it internally runs `docker run` against the
+    # ZAP image) — on a self-hosted runner whose own process runs inside a container,
+    # the workspace bind-mount resolves against the DOCKER HOST path, not the runner's
+    # own checkout. GitHub-hosted runners are not containerized this way and are
+    # unaffected. Enforced by scripts/check-docker-action-runner-safety.mjs.
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # E4 (#1502): the PR-path dast-baseline (02-pr-extended) consolidated here at
+      # nightly cadence. Start the application so the full active scan has a live
+      # target — the prior nightly scan pointed at localhost:8080 with nothing running.
+      - name: Start application
+        run: docker compose up -d --wait
+      - name: ZAP full scan
+        uses: zaproxy/action-full-scan@d2a07475d467566c9a3e3c700f31f47724aa1060  # v0.10.0
+        with:
+          target: 'http://localhost:8080'
+          fail_action: false
+          artifact_name: zap-full-report
+          cmd_options: '-J zap-report.json'
+<% if (archetype === 'backend-web-db' && enableSecurityScanning) { %>      # #898/#1887-E: scripts/ingest-zap-report.mjs is emitted by generateSecurity
+      # (security.ts) under this same (archetype === 'backend-web-db' &&
+      # enableSecurityScanning) gate — its own header comment already documents
+      # zap-full-report as one of its two supported producers.
+      - name: Ingest ZAP report (HIGH/MEDIUM threshold gate)
+        run: node scripts/ingest-zap-report.mjs --report zap-report.json
+<% } %>      - name: Stop application
+        if: always()
+        run: docker compose down
+
+  dep-cve-refresh:
+    name: Dependency CVE refresh
+    # #1756/#1767/#1785: was previously pinned to a LITERAL GitHub-hosted
+    # runner on the (later disproven, #1767/#1785) assumption that
+    # GitHub-hosted runners are immune to the Docker-outside-of-Docker
+    # workspace-bind-mount defect that docker-container actions hit on a
+    # self-hosted runner whose own process runs inside a container. That
+    # literal pin also puts this job on paid GitHub-hosted minutes, which
+    # fails outright on billing/spending-limit issues (#1904). The
+    # typescript branch's osv-scanner step (#1767) is now a pinned static
+    # binary and the java branch's Trivy fs step (ADR-104) is a composite
+    # action with no workspace bind-mount — no docker-container action
+    # remains in this job, so scripts/check-docker-action-runner-safety.mjs
+    # does not flag switching back to the shared self-hosted-capable runner.
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: npm audit
+        run: npm audit --omit=dev --audit-level=high
+      - name: Install osv-scanner (pinned static binary)
+        # #1767: google/osv-scanner-action is a Docker-outside-of-Docker
+        # action. A static binary has no workspace bind-mount to break,
+        # sidestepping the class of bug entirely.
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -sSfL -o "$RUNNER_TEMP/bin/osv-scanner" \
+            https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64
+          echo "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc  $RUNNER_TEMP/bin/osv-scanner" | sha256sum -c -
+          chmod +x "$RUNNER_TEMP/bin/osv-scanner"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: osv-scanner (prod-dependency gate; dev-only findings warn, not block)
+        # #1786: dev-only vulnerable packages are reported but non-blocking,
+        # matching the npm-audit step's --omit=dev prod-only policy.
+        run: |
+          # FAIL-OPEN-INTENT: osv-scanner exits non-zero whenever ANY vuln is found (incl. dev-only); the real gate is the prod-only check below.
+          osv-scanner scan source --lockfile=package-lock.json --format json --output-file osv-results.json || true
+          PROD=$(jq '[.results[]?.packages[]? | select((.vulnerabilities // []) | length > 0) | select((.dependency_groups // []) | index("dev") | not)] | length' osv-results.json)
+          DEV=$(jq '[.results[]?.packages[]? | select((.vulnerabilities // []) | length > 0) | select((.dependency_groups // []) | index("dev"))] | length' osv-results.json)
+          if [ "$DEV" -gt 0 ]; then
+            echo "::warning::osv-scanner: $DEV dev-only vulnerable package(s), not gating"
+            jq -r '.results[]?.packages[]? | select((.vulnerabilities // []) | length > 0) | select((.dependency_groups // []) | index("dev")) | "  - \(.package.name)@\(.package.version)"' osv-results.json
+          fi
+          if [ "$PROD" -gt 0 ]; then
+            echo "::error::osv-scanner: $PROD production-impacting vulnerable package(s)"
+            jq -r '.results[]?.packages[]? | select((.vulnerabilities // []) | length > 0) | select((.dependency_groups // []) | index("dev") | not) | "  - \(.package.name)@\(.package.version)"' osv-results.json
+            exit 1
+          fi
+<% } else if (language === 'java') { %>
+<%- include('_partials/trivy-fs-java.ejs') %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: govulncheck
+        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee  # v1
+        with:
+          # The action re-checkouts by default; after the explicit checkout above the
+          # second internal checkout adds a duplicate Authorization extraheader and
+          # git fails with 400 "Duplicate header" on private repos (#1865).
+          repo-checkout: false
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install pip-audit
+      - name: pip-audit
+        run: pip-audit --strict
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - name: cargo-audit
+        run: |
+          cargo install cargo-audit --locked
+          cargo audit
+<% } %>

package/dist/templates/github/workflows/_sigstore-retry-sign.yml.ejs

@@ -0,0 +1,102 @@
+name: Sigstore OCI re-sign (manual dispatch)
+
+# Manual OCI image re-sign for post-outage recovery (H3-S1). Triggered via
+# `workflow_dispatch` only — the repository owner re-signs an image ref after
+# a Sigstore (Fulcio/Rekor) outage that left a release artifact unsigned.
+#
+# NOTE (#1663, #1887-G): an earlier `workflow_call` (sign-with-retry) half was
+# emitted here as opt-in scaffolding for the live release sign path, but was
+# never wired into `05-release.yml` (which signs inline). The dead half was
+# removed to stop shipping an unwired scaffold; `05-release.yml`'s cosign-sign
+# job continues to sign inline. Re-introduce a reusable retry wrapper here
+# only when a caller actually `uses:` it.
+#
+# Generated by arbiter (#885). CANON-18 compliant.
+# INV-76: all third-party action refs are SHA-pinned.
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_ref:
+        description: "OCI image reference to re-sign (e.g. ghcr.io/org/app@sha256:...)"
+        required: true
+        type: string
+      justification:
+        description: "Reason for manual re-sign (audit trail — required)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  resign-oci-image:
+    name: Re-sign OCI image (manual dispatch, post-outage)
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+    steps:
+      - name: Owner-only guard
+        run: |
+          if [[ "${{ github.actor }}" != "${{ github.repository_owner }}" ]]; then
+            echo "::error::Only the repository owner may trigger manual OCI re-sign"
+            exit 1
+          fi
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
+      - name: Sigstore preflight check
+        run: |
+          STATUS=$(curl -sf https://status.sigstore.dev/api/v2/status.json \
+            --max-time 10 | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status',{}).get('indicator','unknown'))" 2>/dev/null || echo "unknown")
+          if [[ "$STATUS" != "none" ]]; then
+            echo "::warning::Sigstore status is '${STATUS}' — cosign sign may fail"
+          fi
+          if [[ "$STATUS" == "major" || "$STATUS" == "critical" ]]; then
+            echo "::error::Sigstore is degraded (${STATUS}) — aborting re-sign"
+            exit 1
+          fi
+          echo "sigstore-status=$STATUS"
+
+      - name: Configure Docker credential store (macOS keychain bypass)
+        if: runner.os == 'macOS'
+        run: |
+          mkdir -p "$HOME/.docker"
+          echo '{"credsStore":""}' > "$HOME/.docker/config.json"
+
+      - name: Log in to container registry
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c  # v4.5.2
+        with:
+          registry: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: cosign sign OCI image (keyless OIDC)
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: cosign sign --yes "${{ inputs.image_ref }}"
+
+      - name: cosign verify OCI image
+        run: |
+          cosign verify \
+            --certificate-identity-regexp "https://github.com/${{ github.repository }}/" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            "${{ inputs.image_ref }}"
+
+      - name: Audit log
+        run: |
+          {
+            echo "## OCI Re-sign Audit Log"
+            echo ""
+            echo "| Field | Value |"
+            echo "| --- | --- |"
+            echo "| Image | \`${{ inputs.image_ref }}\` |"
+            echo "| Actor | \`${{ github.actor }}\` |"
+            echo "| Justification | ${{ inputs.justification }} |"
+            echo "| Run | ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} |"
+            echo "| Timestamp | $(date -u +%Y-%m-%dT%H:%M:%SZ) |"
+          } >> "$GITHUB_STEP_SUMMARY"

package/dist/templates/github/workflows/_weekly.yml.ejs

@@ -0,0 +1,313 @@
+name: Weekly jobs (reusable)
+
+<%
+// #1723: serviceBucket/isService/isCli are injected by withServiceBucket
+// (src/utils/render.ts), the single canonical archetype->bucket resolver — do not
+// re-declare the archetype map here.
+const _bucket = serviceBucket;
+const _isService = isService;
+const _isCli = isCli;
+%>
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+<% if (_isService) { %>
+  cross-db-matrix:
+    name: Cross-DB matrix (Postgres / MySQL / MSSQL / MariaDB)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        db: [postgres, mysql, mssql, mariadb]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Run integration tests against ${{ matrix.db }}
+        run: npm run test:integration
+        env:
+          DB_TYPE: ${{ matrix.db }}
+<% } else if (language === 'java') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% if (buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+      - name: Run integration tests against ${{ matrix.db }}
+        run: ./gradlew integrationTest
+        env:
+          DB_TYPE: ${{ matrix.db }}
+<% } else { %>
+      - name: Run integration tests against ${{ matrix.db }}
+        run: mvn test -Pintegration
+        env:
+          DB_TYPE: ${{ matrix.db }}
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Run integration tests against ${{ matrix.db }}
+        run: go test -tags integration ./...
+        env:
+          DB_TYPE: ${{ matrix.db }}
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install -e ".[dev]"
+      - name: Run integration tests against ${{ matrix.db }}
+        run: pytest -m integration
+        env:
+          DB_TYPE: ${{ matrix.db }}
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - name: Run integration tests against ${{ matrix.db }}
+        run: cargo test --test integration
+        env:
+          DB_TYPE: ${{ matrix.db }}
+<% } %>
+
+<% } %>
+<% if (_isCli) { %>
+  cross-os-matrix:
+    name: Cross-OS / cross-arch matrix
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        arch: [amd64, arm64]
+        exclude:
+          - os: windows-latest
+            arch: arm64
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<% if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Build CLI binary (${{ matrix.os }} / ${{ matrix.arch }})
+        run: |
+          GOARCH=${{ matrix.arch }} go build -o dist/cli-${{ matrix.os }}-${{ matrix.arch }} ./cmd/...
+      - name: Smoke test binary
+        run: dist/cli-${{ matrix.os }}-${{ matrix.arch }} --version
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - name: Build CLI binary (${{ matrix.os }} / ${{ matrix.arch }})
+        run: cargo build --release
+      - name: Smoke test binary
+        run: target/release/cli --version || true
+<% } else if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Build and smoke test CLI
+        run: |
+          npm run build
+          node dist/index.js --version || true
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install -e ".[dev]" pyinstaller
+      - name: Build CLI binary (${{ matrix.os }} / ${{ matrix.arch }})
+        run: pyinstaller --onefile src/main.py || true
+      - name: Smoke test binary
+        run: dist/main --version || true
+<% } else if (language === 'java') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+      - name: Build and smoke test CLI
+        run: |
+<% if (buildTool === 'gradle') { %>
+          ./gradlew build
+<% } else { %>
+          mvn package
+<% } %>
+<% } %>
+
+<% } %>
+  dep-freshness:
+    name: Dependency freshness report
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Check outdated packages
+        run: |
+          # FAIL-OPEN-INTENT: npm outdated exits 1 when packages are stale; step is informational
+          npm outdated || true
+<% } else if (language === 'java') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+      - name: Check outdated dependencies
+        run: |
+<% if (buildTool === 'gradle') { %>
+          ./gradlew dependencyUpdates || true
+<% } else { %>
+          mvn versions:display-dependency-updates || true
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Check outdated Go modules
+        run: go list -u -m all 2>/dev/null | grep '\[' || true
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install pip-review
+      - name: Check outdated packages
+        run: pip-review || true
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - name: Check outdated crates
+        run: |
+          cargo install cargo-outdated --locked || true
+          cargo outdated || true
+<% } %>
+
+  perf-trend:
+    name: k6 performance trend
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: k6 performance smoke vs 7-day baseline
+        uses: grafana/k6-action@e4714b734f2b0afaabeb7b4a69142745548ab9ec  # v0.3.1
+        with:
+          filename: k6/perf-trend.js
+          flags: '--duration=120s'
+        continue-on-error: true
+
+  action-version-audit:
+    name: Stale action pin audit
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Find SHA-pinned actions older than 180 days
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          WORKFLOWS=$(find .github/workflows -name '*.yml' | head -20)
+          STALE=0
+          # Runners here are always GNU/Linux regardless of the runs-on label (#1785) —
+          # no BSD/macOS `date` fallback is ever reachable in this environment.
+          CUTOFF=$(date -d '180 days ago' +%s)
+          for wf in $WORKFLOWS; do
+            # FAIL-OPEN-INTENT: grep exits 1 on no matches; empty REFS is valid
+            REFS=$(grep -oP 'uses: \S+@[a-f0-9]{40}' "$wf" | sed 's/uses: //' || true)
+            for ref in $REFS; do
+              ACTION=$(echo "$ref" | cut -d@ -f1)
+              SHA=$(echo "$ref" | cut -d@ -f2)
+              PUSHED=$(gh api "repos/$ACTION/git/commits/$SHA" --jq '.committer.date' 2>/dev/null || echo "")
+              if [ -n "$PUSHED" ]; then
+                # FAIL-OPEN-INTENT: an unparseable committer date (e.g. a null/odd API
+                # response) must not crash the whole audit — skip just this ref.
+                if ! PUSHED_EPOCH=$(date -d "$PUSHED" +%s 2>/dev/null); then
+                  echo "::warning::Could not parse commit date '$PUSHED' for $ref in $wf — skipping"
+                  continue
+                fi
+                if [ "$PUSHED_EPOCH" -lt "$CUTOFF" ]; then
+                  echo "::warning::Stale pin in $wf: $ref (pushed $PUSHED)"
+                  STALE=$((STALE + 1))
+                fi
+              fi
+            done
+          done
+          echo "Stale pins found: $STALE"
+
+  shared-security:
+    uses: ./.github/workflows/_shared-security.yml
+
+<% if (locals.runnerProfile === 'solo') { -%>
+<%- include('_partials/scheduled-heavy-jobs.ejs') -%>
+<%_ } _%>
+  weekly-required:
+    name: Weekly gate
+    needs:
+      - dep-freshness
+      - perf-trend
+      - action-version-audit
+      - shared-security
+<% if (_isService) { %>
+      - cross-db-matrix
+<% } %>
+<% if (_isCli) { %>
+      - cross-os-matrix
+<% } %>
+<%_ if (locals.runnerProfile === 'solo') { _%>
+      - fuzz
+      - soak-e2e
+<%_ } _%>
+    if: always()
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - name: Weekly gate summary
+        run: |
+          echo "Weekly checks completed."
+          echo "All jobs ran (some informational, failures create issues)."
+
+      - name: File issue on hard failures
+        if: needs.dep-freshness.result == 'failure' || needs.action-version-audit.result == 'failure' || needs.shared-security.result == 'failure'<% if (locals.runnerProfile === 'solo') { %> || needs.fuzz.result == 'failure' || needs.soak-e2e.result == 'failure'<% } %>
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          # FAIL-OPEN-INTENT: idempotent create — label may already exist (labels.yml/_label-sync.yml own the canonical definition); self-heals an unsynced repo instead of crashing this step.
+          gh label create weekly-regression --color b60205 --description "Weekly (T5) workflow detected a regression" --repo "$GH_REPO" 2>/dev/null || true
+          EXISTING=$(gh issue list \
+            --label weekly-regression \
+            --state open \
+            --limit 1 \
+            --json number \
+            --repo "$GH_REPO" \
+            --jq '.[0].number // empty')
+          if [ -z "$EXISTING" ]; then
+            gh issue create \
+              --title "[weekly] regression detected (${{ github.run_id }})" \
+              --body "Weekly workflow failed. Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --label weekly-regression \
+              --repo "$GH_REPO"
+          fi
+<%_ if (locals.runnerProfile === 'solo') { _%>
+      - name: Assert heavy-sweep jobs did not fail (runnerProfile=solo)
+        # #1693 (ADR-101/B1): fuzz + soak-e2e moved here from nightly. This step
+        # MUST come after "File issue on hard failures" — that step's bare-expression
+        # `if:` carries an implicit success(), so it is skipped once a prior step in
+        # this job has failed. Placing the hard-fail LAST preserves both the
+        # issue-filing side-effect and the hard gate on a solo heavy-sweep failure.
+        run: |
+          RESULTS=(
+            "${{ needs.fuzz.result }}"
+            "${{ needs.soak-e2e.result }}"
+          )
+          FAILED=0
+          for r in "${RESULTS[@]}"; do
+            if [ "$r" = "failure" ]; then FAILED=1; fi
+          done
+          if [ "$FAILED" = "1" ]; then
+            echo "::error::fuzz/soak-e2e (moved to weekly by runnerProfile=solo) failed."
+            exit 1
+          fi
+          echo "Solo heavy-sweep gate passed."
+<%_ } _%>

package/dist/templates/github/workflows/drift-shadow.yml.ejs

@@ -0,0 +1,51 @@
+name: Drift Shadow (INV-59)
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  drift-check:
+    name: Gate Result Drift Check
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    # Job-level permissions REPLACE workflow-level (GitHub never merges them):
+    # contents: read must be restated here or the checkout below runs with
+    # contents: none and fails "Repository not found" on a private repo (#1865).
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Emit local L1 gate result
+        run: node scripts/check-all.mjs L1 --json .arbiter/gate/local-result.json
+      - name: Compare local vs CI parity hash
+        id: parity
+        run: node scripts/check-local-ci-parity.mjs
+        continue-on-error: true
+      - name: Open drift issue if mismatch
+        if: steps.parity.outcome == 'failure'
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const title = 'INV-59 drift detected — local/CI gate parity mismatch';
+            const { data: issues } = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'inv-59-drift',
+            });
+            if (issues.length === 0) {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title,
+                body: `Nightly drift shadow detected a parity mismatch between local and CI gate results.\n\nSee the [workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}) for details.\n\nResolve before enabling or continuing solo-dev mode (INV-59, #470).`,
+                labels: ['inv-59-drift'],
+              });
+            }

package/dist/templates/github/workflows/five-lane/ci.yml.ejs

@@ -0,0 +1,54 @@
+# A1 (#1817): tier — PR-blocking. Budget — <=15min. A red here blocks merge NOW: fix,
+# demote to nightly, or delete within 48h (AGENTS.md INV-136 tier-assignment rule).
+name: CI (PR-blocking)
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+# Cancel in-progress runs on the same ref; a new push supersedes the stale one.
+concurrency:
+  group: ci-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    name: Gate (L2)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'typescript') { -%>
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+      - run: npm ci
+<% } else if (language === 'java') { -%>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% } else if (language === 'rust') { -%>
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+<% } else if (language === 'go') { -%>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+<% } else if (language === 'python') { -%>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - run: pip install -e ".[dev]"
+<% } -%>
+      - name: Run gate (L2)
+        run: node scripts/check-all.mjs L2