@getarbiter/cli 0.5.0

package/dist/templates/governance/risk-register.md.ejs

@@ -0,0 +1,76 @@
+# Risk Register — <%= projectName %>
+
+<!-- arbiter-managed: risk-register (#712) -->
+
+> ISO 27001:2022 §6.1.2 — Information security risk assessment and treatment.
+> P×I (Probability × Impact) scoring. Review at least annually or after significant architecture changes.
+
+---
+
+## Probability × Impact Matrix
+
+| Probability \ Impact | Low (1) | Medium (2) | High (3) | Critical (4) |
+| -------------------- | ------- | ---------- | -------- | ------------ |
+| **Unlikely (1)**     | 1       | 2          | 3        | 4            |
+| **Possible (2)**     | 2       | 4          | 6        | 8            |
+| **Likely (3)**       | 3       | 6          | 9        | 12           |
+| **Almost Certain (4)** | 4     | 8          | 12       | 16           |
+
+### Risk Classification Thresholds (ISO 27001 A.8.2)
+
+| Score | Tier     | Response SLA                                        |
+| ----- | -------- | --------------------------------------------------- |
+| ≤ 4   | Low      | Monitor; review at next quarterly cycle             |
+| 5–8   | Medium   | Mitigate within 90 days; add to backlog             |
+| 9–12  | High     | Mitigate within 30 days; notify security lead       |
+| > 12  | Critical | Immediate action; escalate to management            |
+
+---
+
+## Risk Register
+
+Add a `RISK_ASSESSMENT_TEMPLATE.md`-based assessment for each new risk before adding a row here.
+
+| ID    | Category        | Threat                                   | Asset                   | P | I | Score | Tier     | Status    | Mitigation summary                          | Owner | Review date |
+| ----- | --------------- | ---------------------------------------- | ----------------------- | - | - | ----- | -------- | --------- | ------------------------------------------- | ----- | ----------- |
+| R-001 | Confidentiality | Unauthorized access to production data   | Database / secrets      | 2 | 4 | 8     | Medium   | Open      | MFA + least-privilege IAM + secret rotation | TBD   | TBD         |
+| R-002 | Integrity       | Dependency supply-chain compromise       | Build pipeline          | 2 | 4 | 8     | Medium   | Open      | Lockfile pinning + `npm audit` / Trivy FS   | TBD   | TBD         |
+| R-003 | Availability    | Service outage due to unhandled failure  | Core service endpoints  | 2 | 3 | 6     | Medium   | Open      | Circuit-breakers + graceful degradation     | TBD   | TBD         |
+| R-004 | Confidentiality | PII leakage through logs or error output | Log streams             | 2 | 3 | 6     | Medium   | Open      | PII scan gate (`pii-scan.mjs`) + masking    | TBD   | TBD         |
+| R-005 | Integrity       | Broken access control (OWASP A01)        | API endpoints           | 2 | 4 | 8     | Medium   | Open      | Auth middleware + RBAC + STRIDE review      | TBD   | TBD         |
+<% if (archetype === 'backend-web-db' || archetype === 'data-pipeline') { %>
+| R-006 | Availability    | Database corruption / accidental deletion | Production database    | 1 | 4 | 4     | Low      | Open      | Point-in-time backups + migration tests     | TBD   | TBD         |
+| R-007 | Integrity       | Schema migration failure at deploy time  | Database schema         | 2 | 3 | 6     | Medium   | Open      | Blue/green deploy + rollback tested in CI   | TBD   | TBD         |
+<% } %><% if (archetype === 'frontend-spa') { %>
+| R-006 | Confidentiality | XSS / client-side injection              | Browser session / DOM   | 2 | 3 | 6     | Medium   | Open      | CSP headers + no `innerHTML` + sanitization | TBD   | TBD         |
+<% } %><% if (isMultiTenant) { %>
+| R-008 | Confidentiality | Tenant data cross-contamination          | All tenant data stores  | 1 | 4 | 4     | Low      | Open      | Isolation topology enforced (row-level, schema, DB, or file-per-tenant); tenant routing/validation at request-time      | TBD   | TBD         |
+<% } %><% if (hasPublicApi) { %>
+| R-009 | Availability    | API abuse / rate-limit bypass            | Public API endpoints    | 3 | 2 | 6     | Medium   | Open      | Rate-limiting middleware + WAF rules        | TBD   | TBD         |
+<% } %>
+
+_Add new rows using the P×I assessment template in `RISK_ASSESSMENT_TEMPLATE.md`._
+
+---
+
+## Treatment Plan
+
+For each **High** or **Critical** risk, document the treatment decision:
+
+| ID    | Treatment option       | Rationale | Target score (post-mitigation) | Owner | Due date |
+| ----- | ---------------------- | --------- | ------------------------------ | ----- | -------- |
+| R-001 | Mitigate               | —         | 4 (Low)                        | TBD   | TBD      |
+| R-002 | Mitigate               | —         | 4 (Low)                        | TBD   | TBD      |
+| R-003 | Mitigate               | —         | 3 (Low)                        | TBD   | TBD      |
+| R-004 | Mitigate               | —         | 3 (Low)                        | TBD   | TBD      |
+| R-005 | Mitigate               | —         | 4 (Low)                        | TBD   | TBD      |
+
+_Treatment options: Mitigate / Accept / Transfer / Avoid._
+
+---
+
+## Review History
+
+| Date           | Reviewer | Changes                    |
+| -------------- | -------- | -------------------------- |
+| _YYYY-MM-DD_   | _Name_   | Initial register generated |

package/dist/templates/governance/solo-dev-exception.md.ejs

@@ -0,0 +1,96 @@
+---
+title: 'Single-Developer Exception — <%= projectName %>'
+doc_version: '1.0.0'
+governance_level: '<%= governanceLevel %>'
+collaboration_mode: '<%= collaborationMode %>'
+---
+
+# Single-Developer Exception — <%= projectName %>
+
+> **Regulatory reference:** §11.10(k) — Appropriate use of authority checks to ensure
+> that only authorized individuals can use the system, electronically sign a record, access
+> the operation or computer system input or output device, alter a record, or perform the
+> operation at issue.
+
+## Declaration
+
+This document attests that **<%= projectName %>** operates under a single-developer exception
+for regulated software development at governance level **<%= governanceLevel %>**.
+
+Under this exception:
+
+- The project's **arbiter review pipeline** serves as the declared rigor-equivalent reviewer
+  (replacing human peer-review for routine changes)
+- The developer's identity is bound to all git commits and signed artifacts via cosign keyless
+  attestation using GitHub OIDC
+- **All automated gates must pass** before any change reaches the main branch
+
+## Governance Level Declarations
+
+| Attribute | Value |
+|-----------|-------|
+| Governance level | `<%= governanceLevel %>` |
+| Collaboration mode | `<%= collaborationMode %>` |
+| Review mechanism | arbiter review pipeline (rigor-equivalent) |
+| Signing method | cosign keyless / GPG commit signing |
+| Reactivation threshold | ≥3 active authors (trailing 30 days) OR external audit |
+
+## Regulatory Basis (§11.10(k))
+
+The single-developer exception is valid when:
+
+1. **Identity control** — all commits are signed with a verified developer identity
+2. **Audit trail** — every change is recorded with timestamp, SHA, and CI gate status
+3. **Automated rigor** — arbiter's pipeline enforces all quality and security gates
+4. **Reactivation trigger** — the exception auto-expires when team composition changes
+
+## Reactivation Trigger
+
+**This exception expires automatically when either condition is met:**
+
+- **Author threshold:** ≥3 distinct active authors detected in the trailing 30-day git log
+- **External audit:** `EXTERNAL_AUDIT=true` environment variable is set
+
+**On trigger, the following MUST be activated:**
+
+1. Enable CODEOWNERS (`CODEOWNERS` file with required reviewers)
+2. Configure branch protection: `required_approving_review_count: 1`
+3. Update `arbiter.json` `collaborationMode` from `trunk-solo` to `peer-review` or `gated-review`
+
+The reactivation check runs nightly via `scripts/check-solo-reactivation.mjs`
+(integrated into the nightly CI workflow).
+
+## Attestation
+
+| Field | Value |
+|-------|-------|
+| Document version | 1.0.0 |
+| Generated by | arbiter <%= typeof arbiterVersion !== 'undefined' ? arbiterVersion : 'unknown' %> |
+| Project | <%= projectName %> |
+| Date | _[fill in: YYYY-MM-DD]_ |
+| Developer identity | _[fill in: verified email / GitHub handle]_ |
+| GPG key fingerprint | _[fill in: if using GPG signing]_ |
+| Last review date | _[fill in: YYYY-MM-DD]_ |
+| Next review date | _[fill in: YYYY-MM-DD + 90 days]_ |
+
+> **Signature:** I attest that the controls documented herein are active and effective.
+>
+> `_____________________________` Date: `_______________`
+
+## Evidence of Automated Controls
+
+The following automated controls are active:
+
+- `scripts/check-all.mjs L1` — runs on every commit (pre-commit hook)
+- `scripts/check-all.mjs L2` — runs on every push (pre-push hook)
+- Nightly CI (`06-nightly-lite.yml`) — dependency CVE refresh + integration tests
+- Cosign attestation — every release artifact is signed with OIDC identity
+- `scripts/check-solo-reactivation.mjs` — author-count reactivation check (nightly)
+
+## References
+
+- ADR-051: collaborationMode trunk-solo design
+- ADR-091: single-developer exception attestation policy
+- `docs/governance/CI_MENTAL_MODEL.md` — pipeline stage mental model
+- `docs/governance/VALIDATION_EVIDENCE_TEMPLATE.md` — per-run evidence template
+- `docs/METHOD/EVIDENCE_RETENTION.md` — evidence retention policy

package/dist/templates/governance/validation-evidence.md.ejs

@@ -0,0 +1,131 @@
+---
+title: 'Validation Evidence Template — <%= projectName %>'
+doc_version: '1.0.0'
+governance_level: '<%= governanceLevel %>'
+---
+
+# Validation Evidence Template — <%= projectName %>
+
+> **Instructions:** Complete one copy of this document per validation run.
+> Sign with GPG or cosign before archiving. Retain per the policy in
+> `docs/METHOD/EVIDENCE_RETENTION.md` (ADR-091 retention schedule).
+
+---
+
+## Run Identification
+
+| Field | Value |
+|-------|-------|
+| Run date | _[YYYY-MM-DD HH:MM:SS UTC]_ |
+| Git commit SHA | _[40-char hex]_ |
+| Branch / tag | _[branch name or release tag]_ |
+| Arbiter version | _[arbiter --version output]_ |
+| Governance level | `<%= governanceLevel %>` |
+| Operator | _[verified email / GitHub handle]_ |
+
+---
+
+## Gate Status (Real-Run Measured)
+
+| Gate | Status | Duration | Notes |
+|------|--------|----------|-------|
+| L1 (build + lint + unit) | _[ PASS / FAIL ]_ | _[Xs]_ | |
+| L2 (L1 + coverage + integration) | _[ PASS / FAIL ]_ | _[Xs]_ | |
+<% if (isL3Plus) { %>
+| Mutation testing | _[ PASS / FAIL ]_ | _[Xs]_ | |
+| SAST / CodeQL | _[ PASS / FAIL ]_ | _[Xs]_ | |
+<% } %>
+<% if (governanceLevel === 'L4') { %>
+| SLSA provenance | _[ PASS / FAIL ]_ | _[Xs]_ | |
+| SBOM attestation | _[ PASS / FAIL ]_ | _[Xs]_ | |
+| Cosign signature verification | _[ PASS / FAIL ]_ | _[Xs]_ | |
+<% } %>
+
+---
+
+## Measured Metrics
+
+| Metric | Value | Threshold | Status |
+|--------|-------|-----------|--------|
+| Unit test count | _[N]_ | — | |
+| Unit test pass rate | _[N/N (100%)]_ | 100% | _[ PASS / FAIL ]_ |
+| Branch coverage | _[NN%]_ | <%= isL3Plus ? '85%' : '80%' %> | _[ PASS / FAIL ]_ |
+| Line coverage | _[NN%]_ | <%= isL3Plus ? '85%' : '80%' %> | _[ PASS / FAIL ]_ |
+<% if (isL3Plus) { %>
+| Mutation score | _[NN%]_ | 70% | _[ PASS / FAIL ]_ |
+| Duplication ratio | _[NN%]_ | 3% | _[ PASS / FAIL ]_ |
+<% } %>
+| Dependency CVE (high+critical) | _[N]_ | 0 | _[ PASS / FAIL ]_ |
+
+---
+
+## Evidence Artefacts
+
+List all artefacts captured in this run (SHA-pinned):
+
+| Artefact | SHA-256 | Location |
+|----------|---------|----------|
+| L1 gate output | _[sha256:...]_ | `.evidence/run-NNNN/L1.txt` |
+| L2 gate output | _[sha256:...]_ | `.evidence/run-NNNN/L2.txt` |
+| Coverage report | _[sha256:...]_ | `.evidence/run-NNNN/coverage.json` |
+<% if (isL3Plus) { %>
+| Mutation report | _[sha256:...]_ | `.evidence/run-NNNN/mutation.json` |
+<% } %>
+<% if (governanceLevel === 'L4') { %>
+| SBOM (CycloneDX) | _[sha256:...]_ | `.evidence/run-NNNN/sbom.json` |
+| Cosign bundle | _[sha256:...]_ | `.evidence/run-NNNN/artifact.bundle` |
+<% } %>
+
+---
+
+## Reactivation Check (trunk-solo projects only)
+
+<% if (collaborationMode === 'trunk-solo') { %>
+| Check | Result |
+|-------|--------|
+| Distinct active authors (trailing 30d) | _[N]_ |
+| Threshold (≥3 triggers reactivation) | 3 |
+| External audit flag active | _[ YES / NO ]_ |
+| Reactivation triggered | _[ YES / NO ]_ |
+
+> If reactivation triggered: STOP — switch to peer-review mode before proceeding.
+<% } else { %>
+_Not applicable — project uses `<%= collaborationMode %>` collaboration mode._
+<% } %>
+
+---
+
+## Signature (Cosign / GPG)
+
+**Sign this document after filling in all fields:**
+
+```sh
+# GPG signature
+gpg --armor --detach-sign docs/governance/validation-evidence-<RUN-DATE>.md
+
+# OR cosign blob signature (keyless OIDC)
+cosign sign-blob docs/governance/validation-evidence-<RUN-DATE>.md \
+  --bundle docs/governance/validation-evidence-<RUN-DATE>.md.bundle
+```
+
+| Field | Value |
+|-------|-------|
+| Signature type | _[ GPG / cosign ]_ |
+| Key fingerprint / OIDC identity | _[fill in]_ |
+| Bundle path | _[fill in, if cosign]_ |
+
+---
+
+## Retention Policy
+
+Retain this document per `docs/METHOD/EVIDENCE_RETENTION.md` (ADR-091):
+
+- **Local mode:** keep last 5 runs under `.evidence/` (gitignored)
+- **External mode:** upload to configured bucket; local copy pruned after upload
+- **Minimum retention:** 2 years (regulated contexts requiring §11.10 compliance)
+
+Run `node scripts/evidence-rotate.mjs` after archiving to enforce the rotation policy.
+
+---
+
+_This document was generated by arbiter. Fill in measured values immediately after each run._

package/dist/templates/infra/azure/containerapp.tpl.yaml.ejs

@@ -0,0 +1,74 @@
+# containerapp.tpl.yaml — generated by arbiter — Azure Container Apps initial-provisioning spec
+# SCAFFOLD (OPTIONAL) — one-time `az containerapp create` seed for the first deployment.
+#
+# This is NOT the CD deploy path. The generated GitHub Actions deploy workflows
+# (`.github/workflows/04-deploy-test.yml`, `10-deploy-prod.yml`) promote new images
+# with `az containerapp update --image` directly and do NOT touch this file. This
+# template exists only for the initial `az containerapp create` of the resource.
+#
+# To provision the resource once, run:
+#   envsubst < infra/azure/containerapp.tpl.yaml | az containerapp create --yaml -
+#
+# Required env vars at deploy time:
+#   REGISTRY_IMAGE      — fully-qualified image reference, e.g. "myacr.azurecr.io/app:v1.2.3"
+#   RESOURCE_GROUP      — Azure resource group name
+#   CONTAINER_APP_NAME  — name of the Container App resource (no spaces)
+#   ENVIRONMENT         — Container Apps environment name (managed environment)
+#   LOCATION            — Azure region, e.g. "westeurope"
+#   MIN_REPLICAS        — minimum replica count (e.g. 0)
+#   MAX_REPLICAS        — maximum replica count (e.g. 10)
+#   TARGET_PORT         — container listening port (e.g. 8080)
+#
+# Ref: docs/SYSTEM/CI-TIER-MODEL.md §2 (infra slot, Azure target)
+# Parent issue: #875 (F11)
+
+# Project: <%= projectName %>
+
+containerApp:
+  name: ${CONTAINER_APP_NAME}
+  location: ${LOCATION}
+  resourceGroup: ${RESOURCE_GROUP}
+
+  environment:
+    name: ${ENVIRONMENT}
+
+  configuration:
+    activeRevisionsMode: Single
+
+    ingress:
+      external: true
+      targetPort: ${TARGET_PORT}
+      transport: http
+      allowInsecure: false
+
+    registries: []
+    # Populate with your registry credentials if not using managed identity:
+    # registries:
+    #   - server: myacr.azurecr.io
+    #     identity: system
+
+  template:
+    containers:
+      - name: <%= projectName %>
+        image: ${REGISTRY_IMAGE}
+        resources:
+          cpu: 0.5
+          memory: 1Gi
+        env: []
+        # Add environment variables as needed:
+        # env:
+        #   - name: NODE_ENV
+        #     value: production
+        #   - name: MY_SECRET
+        #     secretRef: my-secret-ref
+
+    scale:
+      minReplicas: ${MIN_REPLICAS}
+      maxReplicas: ${MAX_REPLICAS}
+      rules: []
+      # Add HTTP scaling rule:
+      # rules:
+      #   - name: http-scaling
+      #     http:
+      #       metadata:
+      #         concurrentRequests: "100"

package/dist/templates/infra/nas-compose/deploy.sh.ejs

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# deploy.sh — generated by arbiter — pull-by-digest NAS deploy via docker-compose
+# (deployTarget: nas-compose). Ported from a proven fleet reference deploy script,
+# adapted for a NAS that already holds registry credentials (`docker login` persisted
+# in /root/.docker/config.json) — the NAS pulls the signed image itself; no more
+# `docker save | ssh | docker load`.
+#
+# Called by .github/workflows/_deploy/nas-compose.ejs:
+#   infra/nas-compose/deploy.sh <IMAGE_REF>   # e.g. ghcr.io/org/<%= projectName %>@sha256:...
+#
+# Required env (exported by .github/actions/nas-ssh + the calling workflow step):
+#   NAS_SSH          full ssh command prefix
+#   NAS_SUDO_PASS    NAS sudo password — consumed by `sudo -S` on stdin only, never a
+#                     command-line argument
+#
+# Config (repo/org vars — see _deploy/nas-compose.ejs):
+#   NAS_ROOT          compose project root on the NAS (default /volume1/docker/app)
+#   SERVICES          space-separated ordered service list for staged
+#                      `docker-compose up -d --no-deps <svc>` (first entry is the
+#                      "primary" service that gates health); empty = plain `up -d`
+#                      bringing every service up together
+#   HEALTH_TIMEOUT_S  seconds to wait for the primary service to report healthy
+#   BACKUP_CMD        optional shell command run on the NAS before recreating the
+#                      stack (app-specific — sqlite `.backup`, pg_dump, etc.);
+#                      empty = no-op (ponytail: eval'd as-is, no sandboxing — this is
+#                      an admin-configured repo var, not user input)
+#
+# This file is a SCAFFOLD (skipIfExists): customize it for your app, arbiter will
+# not overwrite your edits on re-init.
+set -euo pipefail
+
+IMAGE_REF="${1:?usage: deploy.sh <IMAGE_REF>}"
+NAS_ROOT="${NAS_ROOT:-/volume1/docker/app}"
+SERVICES="${SERVICES:-}"
+HEALTH_TIMEOUT_S="${HEALTH_TIMEOUT_S:-90}"
+BACKUP_CMD="${BACKUP_CMD:-}"
+
+fail() { printf 'nas-compose deploy: FAIL — %s\n' "$1" >&2; exit 1; }
+
+[[ -n "${NAS_SSH:-}" ]] || fail 'NAS_SSH is not set (expected from .github/actions/nas-ssh)'
+[[ -n "${NAS_SUDO_PASS:-}" ]] || fail 'NAS_SUDO_PASS is not set'
+
+# The password is the first line of stdin, consumed by `sudo -S`; bash -s reads the
+# rest as the script. Nothing secret ever appears in a command line or in the log.
+remote_script=$(cat <<'REMOTE'
+set -euo pipefail
+IMAGE_REF="$1"
+ROOT="$2"
+SERVICES="$3"
+HEALTH_TIMEOUT_S="$4"
+BACKUP_CMD="$5"
+DOCKER=/usr/local/bin/docker
+COMPOSE=/usr/local/bin/docker-compose
+
+step() { printf '  [nas] %s\n' "$1"; }
+die()  { printf '  [nas] FAIL — %s\n' "$1" >&2; exit 1; }
+
+step "pulling ${IMAGE_REF}"
+"$DOCKER" pull "$IMAGE_REF" || die "docker pull failed for ${IMAGE_REF}"
+
+# Fail-closed: verification at the destination, on the exact bytes about to run —
+# stronger than only verifying in CI (the image already left CI's custody).
+command -v cosign >/dev/null 2>&1 || die 'cosign is not installed on the NAS — required for destination admission'
+step 'verifying signature on the NAS (destination admission gate)'
+cosign verify "$IMAGE_REF" >/dev/null || die "cosign verify failed for ${IMAGE_REF}"
+
+if [[ -n "$BACKUP_CMD" ]]; then
+  step 'running pre-deploy backup hook'
+  eval "$BACKUP_CMD" || die 'BACKUP_CMD failed'
+fi
+
+cd "$ROOT"
+[[ -f docker-compose.yml ]] || die "no docker-compose.yml in ${ROOT} — refusing to deploy by hand"
+export IMAGE_REF
+"$COMPOSE" config >/dev/null || die 'docker-compose config rejected the stack'
+"$COMPOSE" pull || die 'docker-compose pull failed'
+
+if [[ -n "$SERVICES" ]]; then
+  for svc in $SERVICES; do
+    step "recreating service: ${svc}"
+    "$COMPOSE" up -d --no-deps "$svc" || die "up -d --no-deps ${svc} failed"
+  done
+  primary="$(awk '{print $1}' <<< "$SERVICES")"
+else
+  "$COMPOSE" up -d || die 'docker-compose up -d failed'
+  primary=""
+fi
+
+if [[ -n "$primary" ]]; then
+  step "waiting up to ${HEALTH_TIMEOUT_S}s for ${primary} to be healthy"
+  for _ in $(seq 1 "$HEALTH_TIMEOUT_S"); do
+    status="$("$DOCKER" inspect "$primary" --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' 2>/dev/null || echo '')"
+    [[ "$status" == "healthy" || "$status" == "none" ]] && break
+    sleep 1
+  done
+  final="$("$DOCKER" inspect "$primary" --format '{{.State.Running}} {{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' 2>/dev/null || echo 'absent')"
+  if [[ "$final" != "true healthy" && "$final" != "true none" ]]; then
+    # Stop the restart policy from cycling a broken container while it is inspected —
+    # never leave a broken container auto-restarting.
+    "$DOCKER" update --restart=no "$primary" 2>/dev/null || true
+    "$DOCKER" logs --tail 40 "$primary" 2>&1 || true
+    die "${primary} is not running+healthy after ${HEALTH_TIMEOUT_S}s (got '${final}') — restart policy set to 'no'"
+  fi
+  step "verified: ${primary} healthy"
+fi
+REMOTE
+)
+
+printf 'nas-compose deploy: deploying %s on the NAS\n' "$IMAGE_REF"
+printf '%s\n%s' "$NAS_SUDO_PASS" "$remote_script" |
+  $NAS_SSH "sudo -S bash -s -- '${IMAGE_REF}' '${NAS_ROOT}' '${SERVICES}' '${HEALTH_TIMEOUT_S}' '${BACKUP_CMD}'" ||
+  fail 'NAS deployment failed — see the [nas] lines above'
+
+printf 'nas-compose deploy: PASS — %s is live on the NAS\n' "$IMAGE_REF"

package/dist/templates/integration-testing/AbstractIntegrationTest.java.ejs

@@ -0,0 +1,36 @@
+package <%= locals.basePackage ? locals.basePackage + '.support' : 'support' %>;
+
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.DynamicPropertyRegistry;
+import org.springframework.test.context.DynamicPropertySource;
+import org.testcontainers.containers.PostgreSQLContainer;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+
+/**
+ * Base class for integration tests — generated by arbiter (M26).
+ *
+ * Provides:
+ *   - PostgreSQL 16 via Testcontainers (shared container across subclasses)
+ *   - DynamicPropertySource to override spring.datasource.* at test time
+ *
+ * Generated once (skipIfExists). Edit freely after generation.
+ */
+@Testcontainers
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+public abstract class AbstractIntegrationTest {
+
+    @Container
+    protected static final PostgreSQLContainer<?> postgres =
+        new PostgreSQLContainer<>("postgres:16-alpine")
+            .withDatabaseName("testdb")
+            .withUsername("test")
+            .withPassword("test");
+
+    @DynamicPropertySource
+    static void overrideDataSourceProperties(DynamicPropertyRegistry registry) {
+        registry.add("spring.datasource.url", postgres::getJdbcUrl);
+        registry.add("spring.datasource.username", postgres::getUsername);
+        registry.add("spring.datasource.password", postgres::getPassword);
+    }
+}

package/dist/templates/integration-testing/NoH2ArchTest.java.ejs

@@ -0,0 +1,24 @@
+package <%= basePackage ? basePackage + '.architecture' : 'architecture' %>;
+
+import com.tngtech.archunit.junit.AnalyzeClasses;
+import com.tngtech.archunit.junit.ArchTest;
+import com.tngtech.archunit.lang.ArchRule;
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
+
+/**
+ * Bans H2 in-memory database imports — generated by arbiter (M26, INV-34).
+ *
+ * Enforces that test classes do not import H2, SQLite, or other in-memory
+ * databases. Real integration tests must use Testcontainers + PostgreSQL.
+ */
+@AnalyzeClasses(packages = "<%= basePackage ?? 'com.example' %>")
+public class NoH2ArchTest {
+
+    @ArchTest
+    static final ArchRule no_h2_imports =
+        noClasses()
+            .should()
+            .dependOnClassesThat()
+            .resideInAnyPackage("org.h2..")
+            .because("Use Testcontainers + PostgreSQL for integration tests (INV-34). H2 in-memory mode masks real SQL compatibility issues.");
+}

package/dist/templates/integration-testing/conftest.py.ejs

@@ -0,0 +1,20 @@
+# Integration test fixtures — generated by arbiter (M26, INV-34)
+# File: tests/conftest.py
+
+import os
+import pytest
+from testcontainers.postgres import PostgreSQLContainer
+
+
+@pytest.fixture(scope="session")
+def postgres_container():
+    """Start a PostgreSQL Testcontainer for the test session."""
+    with PostgreSQLContainer("postgres:16-alpine") as postgres:
+        os.environ["DATABASE_URL"] = postgres.get_connection_url()
+        yield postgres
+
+
+@pytest.fixture(scope="session")
+def database_url(postgres_container):
+    """Return the DATABASE_URL for the running PostgreSQL container."""
+    return os.environ["DATABASE_URL"]

package/dist/templates/integration-testing/db_fixture.rs.ejs

@@ -0,0 +1,48 @@
+// Integration test database fixture — generated by arbiter (M26, INV-34)
+// File: tests/db_fixture.rs
+//
+// Starts a real PostgreSQL container via testcontainers-rs for integration tests.
+// Add to Cargo.toml [dev-dependencies]:
+//   testcontainers = "0.23"
+//
+// Run integration tests:
+//   cargo test --tests
+
+use std::sync::OnceLock;
+use testcontainers::clients::Cli;
+use testcontainers::core::WaitFor;
+use testcontainers::GenericImage;
+use testcontainers::Container;
+
+static DOCKER: OnceLock<Cli> = OnceLock::new();
+
+/// Starts a PostgreSQL 16-alpine container and returns the connection URL.
+/// The container is kept alive for the lifetime of the returned `Container`.
+pub fn start_postgres() -> (String, Container<'static, GenericImage>) {
+    let docker = DOCKER.get_or_init(Cli::default);
+    let image = GenericImage::new("postgres", "16-alpine")
+        .with_env_var("POSTGRES_USER", "test")
+        .with_env_var("POSTGRES_PASSWORD", "test")
+        .with_env_var("POSTGRES_DB", "testdb")
+        .with_wait_for(WaitFor::message_on_stderr(
+            "database system is ready to accept connections",
+        ));
+    let container = docker.run(image);
+    let port = container.get_host_port_ipv4(5432);
+    let url = format!("postgres://test:test@127.0.0.1:{}/testdb", port);
+    (url, container)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn postgres_container_starts_and_accepts_connections() {
+        let (url, _container) = start_postgres();
+        assert!(
+            url.starts_with("postgres://"),
+            "connection URL must be a PostgreSQL connection string"
+        );
+    }
+}

package/dist/templates/integration-testing/eslint-no-fake-db.json.ejs

@@ -0,0 +1,19 @@
+{
+  "rules": {
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          {
+            "name": "sqlite3",
+            "message": "Use Testcontainers + PostgreSQL for integration tests (INV-34). sqlite3 is banned in test files."
+          },
+          {
+            "name": "better-sqlite3",
+            "message": "Use Testcontainers + PostgreSQL for integration tests (INV-34). better-sqlite3 is banned in test files."
+          }
+        ]
+      }
+    ]
+  }
+}