@getarbiter/cli 0.5.0

package/dist/templates/perf/k6/scenarios/ramp-up.js.ejs

@@ -0,0 +1,32 @@
+// k6 ramp-up test — gradually increase load to verify linear scalability (#895)
+import { check, sleep } from 'k6'
+import http from 'k6/http'
+
+export const options = {
+  stages: [
+    { duration: '1m', target: 10 },
+    { duration: '1m', target: 20 },
+    { duration: '1m', target: 30 },
+    { duration: '1m', target: 40 },
+    { duration: '1m', target: 50 },
+    { duration: '1m', target: 60 },
+    { duration: '1m', target: 70 },
+    { duration: '1m', target: 80 },
+    { duration: '1m', target: 90 },
+    { duration: '1m', target: 100 },
+  ],
+  thresholds: {
+    http_req_failed: ['rate<0.01'],
+    http_req_duration: ['p(95)<800'],
+  },
+}
+
+const BASE_URL = __ENV.K6_BASE_URL || 'http://localhost:8080'
+
+export default function () {
+  const res = http.get(`${BASE_URL}/api/v1/resource`)
+  check(res, {
+    'status is 200': (r) => r.status === 200,
+  })
+  sleep(1)
+}

package/dist/templates/perf/k6/scenarios/smoke.js.ejs

@@ -0,0 +1,23 @@
+// k6 smoke test — minimal VU count to verify the system is up (#895)
+import { check, sleep } from 'k6'
+import http from 'k6/http'
+
+export const options = {
+  vus: 1,
+  duration: '30s',
+  thresholds: {
+    http_req_failed: ['rate<0.01'],
+    http_req_duration: ['p(95)<500'],
+  },
+}
+
+const BASE_URL = __ENV.K6_BASE_URL || 'http://localhost:8080'
+
+export default function () {
+  const res = http.get(`${BASE_URL}/health`)
+  check(res, {
+    'status is 200': (r) => r.status === 200,
+    'response time < 500ms': (r) => r.timings.duration < 500,
+  })
+  sleep(1)
+}

package/dist/templates/perf/k6/scenarios/soak.js.ejs

@@ -0,0 +1,26 @@
+// k6 soak test — sustained load over extended duration to detect memory leaks (#895)
+import { check, sleep } from 'k6'
+import http from 'k6/http'
+
+export const options = {
+  stages: [
+    { duration: '2m', target: 50 },
+    { duration: '3h56m', target: 50 },
+    { duration: '2m', target: 0 },
+  ],
+  thresholds: {
+    http_req_failed: ['rate<0.01'],
+    http_req_duration: ['p(95)<500', 'p(99)<1000'],
+  },
+}
+
+const BASE_URL = __ENV.K6_BASE_URL || 'http://localhost:8080'
+
+export default function () {
+  const res = http.get(`${BASE_URL}/api/v1/resource`)
+  check(res, {
+    'status is 200': (r) => r.status === 200,
+    'no degradation in response time': (r) => r.timings.duration < 500,
+  })
+  sleep(1)
+}

package/dist/templates/perf/k6/scenarios/spike.js.ejs

@@ -0,0 +1,29 @@
+// k6 spike test — sudden, extreme spike in load (#895)
+import { check, sleep } from 'k6'
+import http from 'k6/http'
+
+export const options = {
+  stages: [
+    { duration: '10s', target: 100 },
+    { duration: '1m', target: 100 },
+    { duration: '10s', target: 1400 },
+    { duration: '3m', target: 1400 },
+    { duration: '10s', target: 100 },
+    { duration: '3m', target: 100 },
+    { duration: '10s', target: 0 },
+  ],
+  thresholds: {
+    http_req_failed: ['rate<0.1'],
+    http_req_duration: ['p(95)<2000'],
+  },
+}
+
+const BASE_URL = __ENV.K6_BASE_URL || 'http://localhost:8080'
+
+export default function () {
+  const res = http.get(`${BASE_URL}/api/v1/resource`)
+  check(res, {
+    'status is 2xx or 429': (r) => (r.status >= 200 && r.status < 300) || r.status === 429,
+  })
+  sleep(0.1)
+}

package/dist/templates/perf/k6/scenarios/steady-state.js.ejs

@@ -0,0 +1,31 @@
+// k6 steady-state test — constant load at expected operating point (#895)
+import { check, sleep } from 'k6'
+import http from 'k6/http'
+
+export const options = {
+  scenarios: {
+    steady: {
+      executor: 'constant-arrival-rate',
+      rate: 100,
+      timeUnit: '1s',
+      duration: '10m',
+      preAllocatedVUs: 100,
+      maxVUs: 200,
+    },
+  },
+  thresholds: {
+    http_req_failed: ['rate<0.01'],
+    http_req_duration: ['p(50)<200', 'p(95)<500', 'p(99)<1000'],
+  },
+}
+
+const BASE_URL = __ENV.K6_BASE_URL || 'http://localhost:8080'
+
+export default function () {
+  const res = http.get(`${BASE_URL}/api/v1/resource`)
+  check(res, {
+    'status is 200': (r) => r.status === 200,
+    'p50 < 200ms': (r) => r.timings.duration < 200,
+  })
+  sleep(1)
+}

package/dist/templates/perf/k6/scenarios/stress.js.ejs

@@ -0,0 +1,29 @@
+// k6 stress test — beyond normal load to find breaking point (#895)
+import { check, sleep } from 'k6'
+import http from 'k6/http'
+
+export const options = {
+  stages: [
+    { duration: '2m', target: 100 },
+    { duration: '5m', target: 100 },
+    { duration: '2m', target: 200 },
+    { duration: '5m', target: 200 },
+    { duration: '2m', target: 300 },
+    { duration: '5m', target: 300 },
+    { duration: '5m', target: 0 },
+  ],
+  thresholds: {
+    http_req_failed: ['rate<0.05'],
+    http_req_duration: ['p(95)<1000', 'p(99)<3000'],
+  },
+}
+
+const BASE_URL = __ENV.K6_BASE_URL || 'http://localhost:8080'
+
+export default function () {
+  const res = http.get(`${BASE_URL}/api/v1/resource`)
+  check(res, {
+    'status is 2xx': (r) => r.status >= 200 && r.status < 300,
+  })
+  sleep(1)
+}

package/dist/templates/perf/k6/scenarios/volume.js.ejs

@@ -0,0 +1,36 @@
+// k6 volume test — high data volume with moderate concurrency (#895)
+import { check, sleep } from 'k6'
+import http from 'k6/http'
+
+export const options = {
+  scenarios: {
+    volume: {
+      executor: 'per-vu-iterations',
+      vus: 50,
+      iterations: 1000,
+      maxDuration: '30m',
+    },
+  },
+  thresholds: {
+    http_req_failed: ['rate<0.01'],
+    http_req_duration: ['p(95)<800'],
+    iteration_duration: ['p(95)<10000'],
+  },
+}
+
+const BASE_URL = __ENV.K6_BASE_URL || 'http://localhost:8080'
+
+const PAYLOAD = JSON.stringify({
+  data: 'x'.repeat(1024),
+  items: Array.from({ length: 100 }, (_, i) => ({ id: i, value: `item-${i}` })),
+})
+
+export default function () {
+  const res = http.post(`${BASE_URL}/api/v1/resource`, PAYLOAD, {
+    headers: { 'Content-Type': 'application/json' },
+  })
+  check(res, {
+    'status is 200 or 201': (r) => r.status === 200 || r.status === 201,
+  })
+  sleep(0.5)
+}

package/dist/templates/perf/k6/seed/test-data.sql.ejs

@@ -0,0 +1,59 @@
+-- k6 performance test seed data for <%= projectName %> (#895)
+-- Run before load tests to ensure consistent baseline data.
+-- Adjust table names and columns to match your schema.
+
+BEGIN;
+
+-- ── Users / tenants ──────────────────────────────────────────────────────────
+INSERT INTO users (id, username, email, created_at)
+SELECT
+  gen_random_uuid(),
+  'perf-user-' || i,
+  'perf-user-' || i || '@example.com',
+  NOW() - (random() * INTERVAL '30 days')
+FROM generate_series(1, 10000) AS i
+ON CONFLICT DO NOTHING;
+
+-- ── Resources ────────────────────────────────────────────────────────────────
+INSERT INTO resources (id, name, status, owner_id, created_at)
+SELECT
+  gen_random_uuid(),
+  'perf-resource-' || i,
+  (ARRAY['active', 'inactive', 'pending'])[1 + (i % 3)],
+  (SELECT id FROM users ORDER BY RANDOM() LIMIT 1),
+  NOW() - (random() * INTERVAL '60 days')
+FROM generate_series(1, 50000) AS i
+ON CONFLICT DO NOTHING;
+
+-- ── Audit events (for heavy read tests) ──────────────────────────────────────
+INSERT INTO audit_events (id, resource_id, action, actor, occurred_at)
+SELECT
+  gen_random_uuid(),
+  (SELECT id FROM resources ORDER BY RANDOM() LIMIT 1),
+  (ARRAY['CREATE', 'UPDATE', 'DELETE', 'READ'])[1 + (i % 4)],
+  'perf-actor-' || (i % 100),
+  NOW() - (random() * INTERVAL '90 days')
+FROM generate_series(1, 100000) AS i;
+
+-- ── Indexes to support load test query patterns ───────────────────────────────
+CREATE INDEX IF NOT EXISTS idx_resources_status ON resources (status);
+CREATE INDEX IF NOT EXISTS idx_resources_owner ON resources (owner_id);
+CREATE INDEX IF NOT EXISTS idx_audit_occurred ON audit_events (occurred_at DESC);
+CREATE INDEX IF NOT EXISTS idx_audit_resource ON audit_events (resource_id);
+
+COMMIT;
+
+-- Verify row counts
+DO $$
+DECLARE
+  user_count  BIGINT;
+  res_count   BIGINT;
+  audit_count BIGINT;
+BEGIN
+  SELECT COUNT(*) INTO user_count  FROM users WHERE username LIKE 'perf-user-%';
+  SELECT COUNT(*) INTO res_count   FROM resources WHERE name LIKE 'perf-resource-%';
+  SELECT COUNT(*) INTO audit_count FROM audit_events WHERE actor LIKE 'perf-actor-%';
+  RAISE NOTICE 'Seed complete: % users, % resources, % audit events',
+    user_count, res_count, audit_count;
+END;
+$$;

package/dist/templates/perf/lighthouserc.json.ejs

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://github.com/GoogleChrome/lighthouse-ci/blob/main/docs/configuration.md",
+  "ci": {
+    "collect": {
+      "url": ["http://localhost:<%= process.env && process.env.E2E_PORT ? process.env.E2E_PORT : '4173' %>"],
+      "numberOfRuns": 3,
+      "settings": {
+        "preset": "desktop",
+        "formFactor": "desktop",
+        "screenEmulation": {
+          "mobile": false,
+          "width": 1350,
+          "height": 940,
+          "deviceScaleFactor": 1
+        }
+      }
+    },
+    "assert": {
+      "assertions": {
+        "categories:performance": ["error", { "minScore": 0.8 }],
+        "categories:accessibility": ["error", { "minScore": 0.9 }],
+        "categories:best-practices": ["warn", { "minScore": 0.8 }],
+        "categories:seo": ["warn", { "minScore": 0.8 }],
+
+        "total-blocking-time": "off",
+
+        "interactive": ["error", { "maxNumericValue": 200 }],
+
+        "largest-contentful-paint": ["error", { "maxNumericValue": 2500 }],
+
+        "cumulative-layout-shift": ["error", { "maxNumericValue": 0.1 }]
+      },
+      "preset": "no-pwa"
+    },
+    "upload": {
+      "target": "filesystem",
+      "outputDir": ".lighthouse-results",
+      "reportFilenamePattern": "%%PATHNAME%%-%%DATETIME%%-report.%%EXTENSION%%"
+    }
+  }
+}

package/dist/templates/quality/iso9001/CAPA_LOG.md.ejs

@@ -0,0 +1,36 @@
+<%# ISO 9001 §10.2 CAPA log — corrective & preventive action register (#1253). %>
+# CAPA Log — Corrective & Preventive Actions (ISO 9001 §10.2)
+
+_Generated by arbiter for **<%= projectName %>** (governance **<%= governanceLevel %>**).
+Records every nonconformity, its corrective action, and any preventive action taken to
+stop recurrence. ISO 9001 §10.2 requires a controlled record of corrective action; this
+log is gate-checked (`scripts/check-iso9001.mjs`) for structural integrity._
+
+> Each open CAPA in `open` status MUST carry a tracking `issue_ref` (`#NNN`) so the
+> corrective action is visible in your tracker. The gate fails closed on an open CAPA
+> with no issue_ref.
+
+---
+
+<!-- CAPA_START -->
+| capa_id | nonconformity | corrective_action | preventive_action | status | issue_ref |
+|---|---|---|---|---|---|
+| CAPA-000 | _Example: documented information out of date_ | _Update + bump doc_version_ | _Add review_due to control register_ | closed | |
+<!-- CAPA_END -->
+
+---
+
+## CAPA lifecycle
+
+1. **Detect** — a nonconformity is found (audit, defect, customer complaint).
+2. **Correct** — record the corrective action and the responsible owner.
+3. **Prevent** — record a preventive action that removes the root cause.
+4. **Verify & close** — confirm the action is effective, set `status` to `closed`.
+
+`status` is one of `open` | `in_progress` | `closed`. Open CAPAs require an `issue_ref`.
+
+## Version history
+
+| doc_version | Date | Changes |
+|---|---|---|
+| 1.0.0 | Initial | Scaffolded by arbiter at <%= governanceLevel %> |

package/dist/templates/quality/iso9001/DOCUMENT_CONTROL.md.ejs

@@ -0,0 +1,36 @@
+<%# ISO 9001 §7.5 document-control register — controlled documents + doc_version (#1253). %>
+# Document Control Register — ISO 9001 §7.5
+
+_Generated by arbiter for **<%= projectName %>** (governance **<%= governanceLevel %>**).
+Lists every controlled document, its current `doc_version`, owner, and review status.
+ISO 9001 §7.5 requires documented information to be controlled: versioned, owned, and
+reviewed. The gate (`scripts/check-iso9001.mjs`) fails closed if a controlled document
+is missing on disk or lacks a `doc_version`._
+
+> Each controlled document MUST carry a `doc_version` (semver) in its front-matter or
+> version-history section. Bump `doc_version` on every substantive change.
+
+---
+
+<!-- DOC_CONTROL_START -->
+| doc_id | controlled_document | doc_version | owner | status | review_due |
+|---|---|---|---|---|---|
+| DOC-001 | docs/quality/REQUIREMENTS_TRACEABILITY.md | 1.0.0 | quality-lead | active | annual |
+| DOC-002 | docs/quality/CAPA_LOG.md | 1.0.0 | quality-lead | active | annual |
+| DOC-003 | docs/quality/DOCUMENT_CONTROL.md | 1.0.0 | quality-lead | active | annual |
+<!-- DOC_CONTROL_END -->
+
+---
+
+## How control is enforced
+
+- Every row's `controlled_document` path MUST exist on disk (gate-checked, fail-closed).
+- Every controlled document carries a `doc_version`; the gate rejects a `0`/blank version.
+- `status` is one of `active` | `superseded` | `retired`.
+- Add a row here whenever you place a new document under quality control.
+
+## Version history
+
+| doc_version | Date | Changes |
+|---|---|---|
+| 1.0.0 | Initial | Scaffolded by arbiter at <%= governanceLevel %> |

package/dist/templates/quality/iso9001/REQUIREMENTS_TRACEABILITY.md.ejs

@@ -0,0 +1,61 @@
+<%# ISO 9001 §8.3 requirement→test RTM — mirrors the FEATURE_MATRIX RTM schema (#1253). %>
+# Requirements Traceability Matrix (RTM) — ISO 9001 §8.3 / §8.5
+
+_Generated by arbiter for **<%= projectName %>** (governance **<%= governanceLevel %>**).
+The quality-process overlay's single authoritative requirement→test record. Each quality
+requirement traces to the test that verifies it. Update as your implementation matures._
+
+> **Gate:** `scripts/check-iso9001.mjs` (fail-closed). Validates this RTM, the
+> document-control register, and the CAPA log on every run.
+>
+> Reuses the FEATURE_MATRIX RTM machinery: same sentinel-delimited table and the same
+> `status` ladder so the requirement→test chain is gate-checkable, not just prose.
+
+---
+
+## Status vocabulary
+
+| Status    | Meaning                              | Required fields                     |
+| --------- | ------------------------------------ | ----------------------------------- |
+| `Missing` | No verification — tracked by issue   | `issue_ref` in `#NNN` format        |
+| `Partial` | Code exists; test incomplete         | `code_ref` non-empty                |
+| `Done`    | Requirement verified by a test       | `code_ref` + `test_ref` non-empty   |
+
+Promotion is fail-closed (cannot skip a step).
+
+This RTM shares its schema with FEATURE_MATRIX.md but does not carry the optional
+`source_ref` (upward anchor) column or the `test_ref` glob-ban ratchet added there for
+arbiter #2163 — both are validated by `scripts/check-feature-matrix.mjs`, not
+`scripts/check-iso9001.mjs`. A project that wants upward traceability and glob-ban
+enforcement on this RTM's own rows should adopt those rules directly in
+`FEATURE_MATRIX.md`; retrofitting them into this ISO 9001 overlay's separate gate is a
+future, separately-scoped change.
+
+---
+
+<!-- ISO9001_RTM_START -->
+| requirement_id | requirement | code_ref | test_ref | status | issue_ref | note |
+|---|---|---|---|---|---|---|
+| QR-001 | Customer requirements captured and reviewed (§8.2) | | | Missing | #1 | Replace with your requirements-review ref |
+| QR-002 | Design & development verification (§8.3) | | | Missing | #2 | Replace with your design-verification ref |
+| QR-003 | Nonconformity detection & control (§8.7) | | | Missing | #3 | Replace with your nonconformity ref |
+<!-- ISO9001_RTM_END -->
+
+---
+
+## Summary
+
+| Status | Count |
+|---|---|
+| Done | 0 |
+| Partial | 0 |
+| Missing | 3 |
+| **Total** | **3** |
+
+---
+
+## Version history
+
+| doc_version | Date | Changes |
+|---|---|---|
+| 1.0.0 | Initial | Scaffolded by arbiter at <%= governanceLevel %> |

package/dist/templates/regulated/overlay.json.ejs

@@ -0,0 +1,26 @@
+{
+  "$comment": <%- JSON.stringify(`Regulated / high-assurance compliance overlay policy for ${projectName}. Enforced by scripts/check-regulated-overlay.mjs (fail-closed). You MAY tighten any value above the regulated floor; the gate FAILS if you weaken it below the floor or drop a pillar. Generated by arbiter (industryOverlay: regulated).`) %>,
+  "separationOfDuties": {
+    "requireHumanApprovalOnAiAuthoredPR": true,
+    "minHumanApprovals": 1,
+    "aiAuthorMarkers": [
+      "Co-Authored-By: Claude",
+      "Co-Authored-By: GitHub Copilot",
+      "Generated with"
+    ]
+  },
+  "auditTrail": {
+    "retentionDays": 365
+  },
+  "suppressionExpiry": {
+    "mandatory": true,
+    "maxValidityDays": 90
+  },
+  "attestation": {
+    "cosign": true,
+    "sbom": true
+  },
+  "mutationCoverage": {
+    "minScore": <%= typeof thresholds !== 'undefined' && thresholds && thresholds.mutationScore ? thresholds.mutationScore : 60 %>
+  }
+}

package/dist/templates/regulated/regulated-overlay.md.ejs

@@ -0,0 +1,40 @@
+<!-- Generated by arbiter — regulated / high-assurance compliance overlay. -->
+# Regulated / High-Assurance Overlay — <%= projectName %>
+
+> **Overlay:** `industryOverlay: regulated` · **Governance:** <%= governanceLevel %>
+> **Gate:** `scripts/check-regulated-overlay.mjs` (fail-closed)
+> **Policy:** `.arbiter/regulated/overlay.json`
+
+This overlay bundles the controls a high-assurance project is expected to keep
+wired and makes the **floor** machine-enforceable. The gate fails closed: if the
+policy manifest is missing, unparseable, or any pillar is weakened below the
+floor, the gate exits non-zero and blocks the release. You may **tighten** any
+value above the floor; you may not drop below it while claiming `regulated`.
+
+## Pillars
+
+| Pillar | Floor (enforced) | Why |
+| ------ | ---------------- | --- |
+| **Separation of duties** | An AI-authored PR requires `>= 1` independent human approval; AI authorship is recognised via configured markers. | No actor both authors and approves a change — the bedrock of high-assurance change control. Composes with the `ai-draft-check` workflow. |
+| **Audit-trail retention** | A declared retention horizon `>= 365` days. | A change must remain reconstructable long after it merges. |
+| **Suppression expiry** | Every suppression is mandatory-expiring and bounded (`maxValidityDays`). | A waiver is a dated exception, never a permanent hole — enforced by `scripts/check-suppressions.mjs`. |
+| **Signing + SBOM** | Release artefacts are cosign-signed and ship an SBOM. | Provenance and supply-chain integrity are attestable, not assumed. |
+| **Mutation coverage** | A minimum mutation score floor. | Tests must kill real mutants — coverage that does not catch defects is theatre. |
+
+## How it is enforced
+
+1. `.arbiter/regulated/overlay.json` declares the policy (the floor + any tightening).
+2. `scripts/check-regulated-overlay.mjs` validates every pillar against the floor.
+3. The generated `check-all.mjs` runs the gate (present only when this overlay is selected).
+
+## Editing the policy
+
+Open `.arbiter/regulated/overlay.json` and raise any value — for example a longer
+retention horizon, a higher mutation floor, or `minHumanApprovals: 2` for
+four-eyes-plus review. Lowering a value below the regulated floor is a gate
+violation by design.
+
+> This overlay is **opt-in** and de-identified: it expresses high-assurance
+> controls in neutral terms, with no domain-, sector-, or regulation-specific
+> identifiers. Select it during `arbiter init` (or set `industryOverlay: regulated`
+> and run `arbiter update`); without it, none of these artefacts are emitted.