@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/five-lane/nightly.yml.ejs

@@ -0,0 +1,70 @@
+# A1 (#1817): tier — nightly. Budget — <=45min. A red here does NOT block merge; it
+# changes tomorrow's first action (AGENTS.md INV-136 tier-assignment rule). A red
+# tolerated more than 48h must be fixed, demoted to weekly, or deleted.
+# A6 (#1817): scheduled-lane failures update ONE sticky issue (append run link +
+# counter) instead of filing a new issue per failure; auto-closed on green.
+name: Nightly
+
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+# Scheduled lane: never cancel a run in favor of the next scheduled tick.
+concurrency:
+  group: nightly
+  cancel-in-progress: false
+
+jobs:
+  nightly-gate:
+    name: Nightly Gate (L3)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'typescript') { -%>
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+      - run: npm ci
+<% } else if (language === 'java') { -%>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% } else if (language === 'rust') { -%>
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+<% } else if (language === 'go') { -%>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+<% } else if (language === 'python') { -%>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - run: pip install -e ".[dev]"
+<% } -%>
+      - name: Run gate (L3)
+        id: gate
+        run: node scripts/check-all.mjs L3
+      - name: Record sticky failure issue
+        if: failure() && steps.gate.outcome == 'failure'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: .github/scripts/sticky-failure-issue.sh record nightly
+      - name: Close sticky failure issue (green)
+        if: success()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: .github/scripts/sticky-failure-issue.sh close nightly

package/dist/templates/github/workflows/five-lane/release.yml.ejs

@@ -0,0 +1,53 @@
+# A1 (#1817): tier — release-seal. Budget — on tag (runs once, at the moment that
+# matters: before a version ships). Not scheduled, so A6's sticky-issue mechanism
+# does not apply here — a release-seal red blocks THIS tag, it does not accumulate
+# a streak (AGENTS.md INV-136 tier-assignment rule).
+name: Release Seal
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release-gate:
+    name: Release Gate (L2)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'typescript') { -%>
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+      - run: npm ci
+<% } else if (language === 'java') { -%>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% } else if (language === 'rust') { -%>
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+<% } else if (language === 'go') { -%>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+<% } else if (language === 'python') { -%>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - run: pip install -e ".[dev]"
+<% } -%>
+      - name: Run gate (L2, release seal)
+        run: node scripts/check-all.mjs L2

package/dist/templates/github/workflows/five-lane/weekly.yml.ejs

@@ -0,0 +1,72 @@
+# A1 (#1817): tier — weekly. Budget — unbounded (no dev is waiting on this run; the
+# ceiling below is GitHub's hosted-runner limit, not a tier SLA). Deep/slow checks
+# live here so they never inflate the nightly or PR-blocking budget (AGENTS.md
+# INV-136 tier-assignment rule). A red tolerated more than 48h must be fixed,
+# demoted, or deleted.
+# A6 (#1817): scheduled-lane failures update ONE sticky issue (append run link +
+# counter) instead of filing a new issue per failure; auto-closed on green.
+name: Weekly
+
+on:
+  schedule:
+    - cron: '0 3 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+# Scheduled lane: never cancel a run in favor of the next scheduled tick.
+concurrency:
+  group: weekly
+  cancel-in-progress: false
+
+jobs:
+  weekly-gate:
+    name: Weekly Gate (L4)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 360
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'typescript') { -%>
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+      - run: npm ci
+<% } else if (language === 'java') { -%>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% } else if (language === 'rust') { -%>
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+<% } else if (language === 'go') { -%>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+<% } else if (language === 'python') { -%>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+      - run: pip install -e ".[dev]"
+<% } -%>
+      - name: Run gate (L4)
+        id: gate
+        run: node scripts/check-all.mjs L4
+      - name: Record sticky failure issue
+        if: failure() && steps.gate.outcome == 'failure'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: .github/scripts/sticky-failure-issue.sh record weekly
+      - name: Close sticky failure issue (green)
+        if: success()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: .github/scripts/sticky-failure-issue.sh close weekly

package/dist/templates/github/workflows/issue-state.yml.ejs

@@ -0,0 +1,93 @@
+name: Issue State Automation
+
+# Automated issue label transitions driven by PR lifecycle.
+# Cycle: in-progress (manual) → in-review (auto) → closed (auto on merge to main)
+#
+# Requirements:
+#   - PR body must contain "closes #N" / "fixes #N" / "resolves #N"
+#     for the in-review and close transitions.
+#
+# Security: PR body is read via env: (never interpolated directly into
+# run: blocks) to prevent template injection.
+
+on:
+  pull_request:
+    types: [opened, ready_for_review, closed]
+    branches: [main]
+
+permissions:
+  issues: write
+  pull-requests: read
+
+jobs:
+  update-state:
+    name: Update issue state
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+
+    steps:
+      - name: Extract linked issue number
+        id: issue
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
+        with:
+          result-encoding: string
+          script: |
+            const body = process.env.PR_BODY || '';
+            const m = body.match(/(?:closes?|fixes?|resolves?)\s+#(\d+)/i);
+            if (m) {
+              console.log(`Linked issue: #${m[1]}`);
+              return m[1];
+            }
+            console.log('No linked issue found in PR body -- skipping');
+            return '';
+
+      - name: "→ In Review"
+        if: |
+          steps.issue.outputs.result != '' &&
+          (github.event.action == 'opened' || github.event.action == 'ready_for_review')
+        env:
+          ISSUE_NUMBER: ${{ steps.issue.outputs.result }}
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
+        with:
+          script: |
+            const issueNumber = parseInt(process.env.ISSUE_NUMBER);
+            await github.rest.issues.addLabels({
+              ...context.repo,
+              issue_number: issueNumber,
+              labels: ['in-review']
+            });
+            try {
+              await github.rest.issues.removeLabel({
+                ...context.repo,
+                issue_number: issueNumber,
+                name: 'in-progress'
+              });
+            } catch { /* label might not be set */ }
+            console.log(`Issue #${issueNumber} → in-review`);
+
+      - name: "→ Done"
+        if: |
+          steps.issue.outputs.result != '' &&
+          github.event.action == 'closed' &&
+          github.event.pull_request.merged == true &&
+          github.event.pull_request.base.ref == 'main'
+        env:
+          ISSUE_NUMBER: ${{ steps.issue.outputs.result }}
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
+        with:
+          script: |
+            const issueNumber = parseInt(process.env.ISSUE_NUMBER);
+            await github.rest.issues.update({
+              ...context.repo,
+              issue_number: issueNumber,
+              state: 'closed'
+            });
+            try {
+              await github.rest.issues.removeLabel({
+                ...context.repo,
+                issue_number: issueNumber,
+                name: 'in-review'
+              });
+            } catch { /* label might not be set */ }
+            console.log(`Issue #${issueNumber} → closed`);

package/dist/templates/global-invariants/GLOBAL_INVARIANTS.md.ejs

@@ -0,0 +1,34 @@
+# <%= projectName %> — Global Invariants Reference
+
+> **Deep reference companion to AGENTS.md.**
+> AGENTS.md lists invariants concisely (one line each). This file adds descriptions,
+> rationale, enforcement details, and language-specific guidance.
+>
+> Invariant tiers active for this project: **<%= invariantTiers.join(', ') %>**
+
+---
+
+<% for (const [tier, tierInvariants] of invariantsByTier.entries()) { -%>
+## <%- tierLabels[tier] %>
+
+<% for (const inv of tierInvariants) { -%>
+### <%- inv.id %>: <%- (inv.languageDetail && inv.languageDetail[language]) ? inv.languageDetail[language] : inv.title %>
+
+<%- inv.description %>
+<% if (inv.languageDetail && inv.languageDetail[language] && inv.languageDetail[language] !== inv.title) { -%>
+
+**<%- language.charAt(0).toUpperCase() + language.slice(1) %> guidance:** <%- inv.languageDetail[language] %>
+<% } -%>
+<% if (inv.enforcement) { -%>
+
+**Enforcement:** <%- inv.enforcement %>
+<% } -%>
+<% if (inv.minGovernanceLevel) { -%>
+
+**Minimum governance level:** <%- inv.minGovernanceLevel %>+
+<% } -%>
+
+---
+<% } -%>
+
+<% } -%>

package/dist/templates/governance/RACI.md.ejs

@@ -0,0 +1,21 @@
+# RACI Matrix — <%= projectName %>
+
+<!-- arbiter-managed: claim-verified-governance (INV-90) -->
+<!-- HIGH and CRITICAL responsibilities require a @RACI:<id>-tagged test. -->
+<!-- Run: node scripts/check-stride-traceability.mjs to verify. -->
+
+## Responsibility Matrix
+
+| ID | Responsibility | Accountable | Responsible | Consulted | Informed | Priority |
+|----|----------------|-------------|-------------|-----------|----------|----------|
+
+<!--
+## How to use this table
+
+1. Add a row for each key responsibility or decision area.
+2. Set Priority: CRITICAL, HIGH, MEDIUM, or LOW.
+3. For HIGH and CRITICAL responsibilities, annotate the verifying test with:
+       // @RACI:<id>
+   where <id> matches the ID column (e.g., // @RACI:R001).
+4. Run: node scripts/check-stride-traceability.mjs
+-->

package/dist/templates/governance/ci-mental-model.md.ejs

@@ -0,0 +1,268 @@
+---
+title: 'CI Pipeline Mental Model — <%= projectName %>'
+doc_version: '1.0.0'
+governance_level: '<%= governanceLevel %>'
+---
+
+# CI Pipeline Mental Model — <%= projectName %>
+
+> **Purpose:** This document explains what runs at each pipeline stage, how long it takes,
+> and where it blocks. Generated for governance level **<%= governanceLevel %>**.
+
+---
+
+## Pipeline Overview
+
+This project uses a five-stage pipeline (T0 → T4) aligned with the DORA/Farley model:
+
+| Stage | Name | Trigger | Wall-clock target | Gating |
+|-------|------|---------|-------------------|--------|
+| T0 | Local pre-push | Dev machine | < 30 s | Blocks push (hook) |
+| T1 | PR-fast | PR open/sync | < 5 min (ceil 10) | **Blocking** |
+| T2 | PR-extended | Path/size/label | < 20 min | **Blocking when triggered** |
+| T3 | Release | Merge to main / tag | < 40 min | **Blocking** |
+| T4 | Nightly | Cron 02:00–03:00 UTC | Up to 4 h | Informational + alert |
+<% if (collaborationMode === 'trunk-solo') { %>
+| T4+ | Solo reactivation | Nightly (T4 run) | < 1 min | **Blocking if triggered** |
+<% } %>
+
+---
+
+## T0 — Local Pre-Push
+
+**Trigger:** `git push` (pre-push hook)
+**Wall-clock:** < 30 seconds
+**Gating:** Blocks push; developer must fix before pushing
+
+<% if (governanceLevel === 'L1') { %>
+At **L1**, T0 runs:
+- Format check (`<%= formatCommand ?? 'npx prettier --check .' %>`)
+- Lint (`<%= lintCommand ?? 'npm run lint' %>`)
+<% } %>
+<% if (governanceLevel === 'L2') { %>
+At **L2**, T0 runs:
+- Format check
+- Lint
+- Unit tests (`<%= testCommand ?? 'npm test' %>`)
+- Build (`<%= buildCommand ?? 'npm run build' %>`)
+<% } %>
+<% if (isL3Plus) { %>
+At **<%= governanceLevel %>**, T0 runs:
+- Format check
+- Lint
+- Unit tests + coverage check
+- Build
+- Type-check
+- Debt ratchet (duplication + complexity must not regress)
+<% } %>
+
+**Script:** `node scripts/check-all.mjs L1` (pre-commit) + `node scripts/check-all.mjs L2` (pre-push)
+
+---
+
+## T1 — PR-Fast
+
+<% if (collaborationMode === 'trunk-solo') { %>
+> **trunk-solo mode:** No PR is required by default. T1 gates run as part of the pre-push hook
+> (L2 gate). The developer merges directly to main after local L2 passes.
+<% } else { %>
+**Trigger:** PR open or sync
+**Wall-clock:** < 5 minutes (ceil 10)
+**Gating:** Required check — merge is blocked until green
+
+What runs:
+<% if (governanceLevel === 'L1') { %>
+- Build + lint + unit tests
+<% } %>
+<% if (governanceLevel === 'L2') { %>
+- Build + lint + unit tests
+- Integration tests (subset)
+- SCA (dependency vulnerability scan)
+<% } %>
+<% if (isL3Plus) { %>
+- Build + lint + unit tests + coverage
+- Integration tests (subset)
+- SCA + SAST baseline
+- Contract tests (if enabled)
+<% } %>
+
+**Workflow:** `.github/workflows/01-pr-fast.yml`
+<% } %>
+
+---
+
+## T2 — PR-Extended
+
+<% if (collaborationMode === 'trunk-solo') { %>
+> **trunk-solo mode:** T2 is not triggered for solo pushes. Full integration and security
+> scans run at T4 (nightly) instead.
+<% } else { %>
+**Trigger:** Large changeset, path-based labels, or manual dispatch
+**Wall-clock:** < 20 minutes
+**Gating:** Blocking when triggered
+
+What runs:
+- Full integration test suite
+- DAST baseline (ZAP/OWASP)
+- SCA deep scan
+<% if (isL3Plus) { %>
+- Architecture tests (ArchUnit / boundaries)
+- Mutation test sample
+<% } %>
+
+**Workflow:** `.github/workflows/02-pr-extended.yml`
+<% } %>
+
+---
+
+## T3 — Release
+
+**Trigger:** Merge to main (or tag push)
+**Wall-clock:** < 40 minutes
+**Gating:** Blocking
+
+What runs:
+- Full build + test suite
+<% if (isL2Plus) { %>
+- SLSA provenance generation
+- Artifact signing (cosign keyless)
+- SBOM generation (CycloneDX)
+<% } %>
+<% if (isL3Plus) { %>
+- Release notes generation
+- Container image build + push + sign
+<% } %>
+<% if (governanceLevel === 'L4') { %>
+- SLSA L3 provenance (slsa-github-generator)
+- Binary attestation pinning
+<% } %>
+
+**Workflow:** `.github/workflows/05-release.yml`
+
+---
+
+## T4 — Nightly
+
+**Trigger:** Cron 02:00–03:00 UTC + manual dispatch
+**Wall-clock:** Up to 4 hours
+**Gating:** Informational + alert (does not block PRs)
+
+What runs:
+<% if (governanceLevel === 'L1') { %>
+- Not enabled at L1
+<% } %>
+<% if (governanceLevel === 'L2') { %>
+<% if (collaborationMode === 'trunk-solo') { %>
+- Integration tests (full)
+- Dependency CVE refresh
+- **Solo reactivation check** (`scripts/check-solo-reactivation.mjs`)
+<% } else { %>
+- Full nightly suite (mutation + DAST + soak)
+- Dependency CVE refresh
+- Gitleaks history scan
+<% } %>
+<% } %>
+<% if (isL3Plus) { %>
+<% if (collaborationMode === 'trunk-solo') { %>
+- Integration tests (full)
+- Dependency CVE refresh
+- **Solo reactivation check** — counts distinct active authors trailing 30 days;
+  triggers error if ≥3 authors or `EXTERNAL_AUDIT=true` (see `SOLO_DEV_EXCEPTION.md`)
+<% } else { %>
+- Full mutation test suite
+- Full DAST scan
+- Extended soak / load tests
+- Dependency CVE refresh (all severities)
+- Gitleaks history scan
+- License audit
+- Architecture drift detection
+<% } %>
+<% } %>
+
+<% if (collaborationMode === 'trunk-solo') { %>
+**Workflow:** `.github/workflows/06-nightly-lite.yml` (trunk-solo uses lightweight nightly)
+<% } else { %>
+**Workflow:** `.github/workflows/06-nightly.yml`
+<% } %>
+
+---
+
+<% if (collaborationMode === 'trunk-solo' && isL3Plus) { %>
+## Solo Reactivation Check (T4+)
+
+**When:** Runs inside the nightly workflow (T4)
+**Wall-clock:** < 1 minute
+**Gating:** Hard failure — blocks the nightly run and alerts via workflow failure
+
+The reactivation check (`scripts/check-solo-reactivation.mjs`) detects when the
+project's team composition has grown beyond the single-developer threshold:
+
+| Condition | Threshold | Action |
+|-----------|-----------|--------|
+| Distinct active authors (30d) | ≥ 3 | Exit 1, print remediation |
+| `EXTERNAL_AUDIT=true` env var | any value | Exit 1, print remediation |
+
+**Remediation when triggered:**
+
+1. Update `arbiter.json`: `collaborationMode` → `"peer-review"` or `"gated-review"`
+2. Add `CODEOWNERS` file with required reviewers
+3. Enable branch protection: `required_approving_review_count: 1`
+4. Re-run `node arbiter update` to regenerate CI with full review gates
+
+This check is the technical enforcement of the reactivation trigger declared in
+`docs/governance/SOLO_DEV_EXCEPTION.md`.
+
+<% } %>
+
+---
+
+## Where Failures Block
+
+| Failure type | Where it blocks |
+|-------------|-----------------|
+| Format / lint | T0 (pre-push) — blocks push |
+| Unit tests | T0 (pre-push) — blocks push |
+| Build | T0 (pre-push) — blocks push |
+<% if (collaborationMode !== 'trunk-solo') { %>
+| Coverage threshold | T1 (PR-fast) — blocks merge |
+| Integration tests | T1/T2 (PR) — blocks merge |
+| SAST | T1/T2 (PR) — blocks merge |
+<% } else { %>
+| Coverage threshold | T0 (L2 pre-push hook) — blocks push |
+| Integration tests | T4 (nightly) — alerts; does not block push |
+<% } %>
+| Release artifact signing | T3 (release) — blocks release |
+<% if (collaborationMode === 'trunk-solo' && isL3Plus) { %>
+| Reactivation trigger | T4 (nightly) — alerts; requires immediate remediation |
+<% } %>
+| Nightly CVE scan (high+) | T4 (nightly) — alerts via workflow failure |
+
+---
+
+## Governance Level: <%= governanceLevel %> Summary
+
+<% if (governanceLevel === 'L1') { %>
+**L1 — Starter:** Format + lint + unit tests locally. No nightly. No mutation. Minimal CI.
+Best for: prototypes, internal tools, early-stage projects.
+<% } %>
+<% if (governanceLevel === 'L2') { %>
+**L2 — Standard:** Full local gate + PR CI with integration tests + nightly CVE refresh.
+Coverage threshold: 80%. SLSA L2 on releases. Best for: production services, team projects.
+<% } %>
+<% if (governanceLevel === 'L3') { %>
+**L3 — Regulated:** L2 + mutation testing + SAST + architecture tests + coverage 85%.
+<% if (collaborationMode === 'trunk-solo') { %>
+With `trunk-solo`: nightly reactivation check instead of PR reviewer gates.
+<% } %>
+Best for: regulated contexts, financial, healthcare, compliance-audited systems.
+<% } %>
+<% if (governanceLevel === 'L4') { %>
+**L4 — Maximum:** L3 + SLSA L3 provenance + SBOM + cosign attestation + binary pinning.
+Full audit trail for every artifact. Requires peer-review or gated-review collaboration mode
+for sustained operation (trunk-solo at L4 is blocked by arbiter coherence check).
+Best for: publicly audited, open-source critical infrastructure, regulated release pipelines.
+<% } %>
+
+---
+
+_Generated by arbiter. Review and update when pipeline configuration changes._