@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-all.mjs.ejs

@@ -0,0 +1,1746 @@
+#!/usr/bin/env node
+// <%= projectName %> quality gate
+// Usage: node scripts/check-all.mjs [L1|L2] [--json [path]]
+// L1: format + lint + unit tests (fast, pre-commit)
+// L2: L1 + coverage + audit (full, pre-push)
+// --json [path]: emit gate result JSON (schema arbiter-gate-v1) to path
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// Helper trinity (#351, CANON-01) — runCheck (HARD), runWarnCheck (info),
+// runToolCheck (CI-aware tool gate). pushResult/getResults/getFailed power the
+// inline ad-hoc gates that classify status outside of spawnSync.
+import {
+  runCheck,
+  runWarnCheck,
+  runToolCheck,
+  pushResult,
+  getResults,
+  getFailed,
+  setMode,
+  setOrphanGuard,
+  resolveTmpfsTmpdir,
+  gateFileState,
+} from './lib/run-helpers.mjs';
+import { GATE_MUTEX_HELD_ENV, gateLockPathFor } from './lib/gate-mutex.mjs';
+
+// ─── TMPDIR on tmpfs (dominant wall-clock lever for fsync-bound suites) ──────
+// Set BEFORE any child spawns so every one of them inherits it; see
+// resolveTmpfsTmpdir for the measurement and why the guard is free space, not
+// existence. An explicit TMPDIR always wins — note it also partitions Go's test
+// cache (TMPDIR is hashed into the test-input ID), so anyone running tests by
+// hand should export the same value the gate picks or they warm a second,
+// separate cache.
+if (!process.env.TMPDIR) {
+  const _tmpfs = resolveTmpfsTmpdir();
+  if (_tmpfs) process.env.TMPDIR = _tmpfs;
+}
+<% const packageManager = locals.packageManager ?? 'npm'; if (language === 'typescript' && enableDebtGates && coverageEnabled) { %>
+// #1319.8 — greenfield-aware coverage decision (PASS on 0 executable statements;
+// enforce threshold otherwise; FAIL on missing/malformed summary).
+import { evaluateCoverageGate } from './lib/coverage-gate.mjs';
+<% } %>
+
+const IS_CI = process.env.CI === 'true' || process.env.GITHUB_ACTIONS === 'true';
+<% if (language === 'typescript' && enableDebtGates && coverageEnabled) { %>
+let _coverageRunStartedAt = null;
+<% } %>
+
+// Guard an arbiter-emitted gate artifact using the emission-time manifest rather
+// than filesystem existence alone. A missing optional artifact that was never
+// emitted stays a normal skip; a delivered guard later deleted is a gate failure.
+function gateFilePresent(_path, _label, _neverEmittedLine = null, _alternatePaths = []) {
+  if (_alternatePaths.some((_alternatePath) => existsSync(_alternatePath))) return true;
+  const _state = gateFileState(_path);
+  if (_state === 'present') return true;
+  if (_state === 'never-emitted') {
+    if (_neverEmittedLine) console.log(_neverEmittedLine);
+    return false;
+  }
+  if (_state === 'deleted') {
+    // Keep the prerequisite in the same inspection contract as runCheck: a
+    // single-check rerun ignores another check's guard, and a dry-run reports
+    // what a normal gate would do without changing its result to FAIL.
+    if (only !== null && only !== _label) return false;
+    if (dryRun) {
+      console.log(
+        `[CHECK] ${_label} ... DRY-RUN (would FAIL — ${_path} was emitted by arbiter and is now missing)`,
+      );
+      return false;
+    }
+    console.error(
+      `[CHECK] ${_label} ... FAIL — ${_path} was emitted by arbiter and is now missing; run arbiter update or restore it from git.`,
+    );
+    pushResult(_label, 'FAIL', 0);
+    return false;
+  }
+  console.error(
+    `[CHECK] ${_label} ... DEGRADED — cannot determine whether ${_path} was emitted because .arbiter-generated-manifest.json is unavailable or invalid; run arbiter update or restore the manifest.`,
+  );
+  return false;
+}
+
+// >>> ARG-PARSE-START (#1504) — robust, fail-loud gate-arg parsing.
+// Accept EVERY invocation form arbiter emits: the positional level
+// (`check-all.mjs L2`), the subcommand aliases the Makefile + git hooks use
+// (`check`/`gate`/`full`/`simulate-nightly`/`simulate-weekly`), the flag form
+// (`--level L2` / `--level=L2`), and `--json [path]` — in any order. Plus the
+// #2078 inspection flags: `--dry-run` (print which checks WOULD run at this level,
+// spawn nothing) and `--gate <name>` (re-run one check by its display name).
+// A garbage or missing level FAILS LOUD (exit 2). It must NEVER silently degrade
+// to a weaker level than asked: a positional parser that reads the literal
+// `--level` as the level string skips the L2 branch while the job stays green —
+// that silent L2→L1 downgrade is the exact fake-green this gate exists to kill.
+const _LEVELS = ['L1', 'L2', 'L3', 'L4'];
+// Subcommand alias → level. `check` is the fast pre-commit lane; everything
+// heavier maps to L2 (the strongest tier this generated gate implements).
+const _SUBCOMMAND_LEVEL = {
+  check: 'L1',
+  gate: 'L2',
+  full: 'L2',
+  'simulate-nightly': 'L2',
+  'simulate-weekly': 'L2',
+};
+let level = 'L2';
+let jsonPath = null;
+let dryRun = false; // #2078: print-what-would-run, spawn nothing
+let only = null; // #2078: --gate <name>, re-run a single check
+const _rawArgs = process.argv.slice(2);
+const _gateUsage =
+  'Usage: node scripts/check-all.mjs [L1|L2|L3|L4 | check|gate|full|simulate-nightly|simulate-weekly] [--level <L1|L2|L3|L4>] [--json [path]] [--dry-run] [--gate <name>]';
+function _gateFatal(_msg) {
+  console.error(`[GATE] FATAL: ${_msg}`);
+  console.error(`[GATE] ${_gateUsage}`);
+  process.exit(2);
+}
+for (let _i = 0; _i < _rawArgs.length; _i++) {
+  const _a = _rawArgs[_i];
+  if (_a === '--json') {
+    jsonPath = _i + 1 < _rawArgs.length && !_rawArgs[_i + 1].startsWith('-') ? _rawArgs[++_i] : '';
+  } else if (_a === '--level') {
+    const _val = _rawArgs[_i + 1];
+    if (!_LEVELS.includes(_val))
+      _gateFatal(`--level requires one of ${_LEVELS.join('|')}, got "${_val ?? '(missing)'}"`);
+    level = _val;
+    _i++;
+  } else if (_a.startsWith('--level=')) {
+    const _val = _a.slice('--level='.length);
+    if (!_LEVELS.includes(_val))
+      _gateFatal(`--level requires one of ${_LEVELS.join('|')}, got "${_val}"`);
+    level = _val;
+  } else if (_a === '--dry-run') {
+    dryRun = true;
+  } else if (_a === '--gate') {
+    const _g = _rawArgs[_i + 1];
+    if (!_g || _g.startsWith('-')) _gateFatal('--gate requires a check name');
+    only = _g;
+    _i++;
+  } else if (_a.startsWith('--gate=')) {
+    const _g = _a.slice('--gate='.length);
+    if (!_g) _gateFatal('--gate= requires a check name');
+    only = _g;
+  } else if (_LEVELS.includes(_a)) {
+    level = _a;
+  } else if (Object.prototype.hasOwnProperty.call(_SUBCOMMAND_LEVEL, _a)) {
+    level = _SUBCOMMAND_LEVEL[_a];
+  } else {
+    _gateFatal(`unrecognized argument "${_a}"`);
+  }
+}
+// <<< ARG-PARSE-END (#1504)
+
+// ─── one gate per repo, and never an orphan (#2427) ─────────────────────────
+// Two gates in one checkout trample each other's temp files and starve each
+// other's test workers, and the orphan of a killed `git push` once ran to
+// completion and stamped a green marker for a tree it had never finished
+// testing. Both are fixed here.
+//
+// The mutex is the per-repo flock `arbiter gate-exec` takes, keyed off
+// ARBITER_HOOK_GIT_CWD when set — the pre-push '#'-in-path branch runs this file
+// from an rsync'd copy under /tmp, and keying off cwd there would mint a fresh
+// key per push, i.e. a null mutex. A synchronous gate cannot hold a kernel lock
+// across its own lifetime, so it re-execs itself once under the wrapper; the
+// wrapper publishes ARBITER_GATE_MUTEX_HELD so this branch runs exactly once.
+//
+// FAIL-OPEN-INTENT (narrow): a checkout git cannot answer for has no per-repo
+// mutex to take at all. The start/end evidence binding below is what actually
+// prevents a false green there.
+const _mutexRoot = process.env.ARBITER_HOOK_GIT_CWD ?? process.cwd();
+{
+  let _lockPath = null;
+  try {
+    _lockPath = gateLockPathFor(_mutexRoot);
+  } catch { _lockPath = null; }
+  // #2427: compare the held lock by EXACT PATH, never by mere presence. Only
+  // THIS repo's lock path may skip the relay — the env var exists to stop a
+  // process re-acquiring the flock it already owns. Any other non-empty value
+  // (a stale export, or another repo's lock) would otherwise skip the mutex
+  // and run the gate unserialised, silently. gate-mutex.mjs compares by
+  // equality; these two must agree.
+  const _alreadyHeld = _lockPath !== null && process.env[GATE_MUTEX_HELD_ENV] === _lockPath;
+  if (_lockPath !== null && !_alreadyHeld) {
+    const _wrapper = resolve(dirname(fileURLToPath(import.meta.url)), 'lib/gate-mutex.mjs');
+    const _relayed = spawnSync(
+      process.execPath,
+      [_wrapper, 'run', '--dir', _mutexRoot, '--', process.execPath, ...process.argv.slice(1)],
+      { stdio: 'inherit' },
+    );
+    process.exit(_relayed.status ?? 1);
+  }
+}
+
+// Between every two checks, confirm the process this gate was launched to serve
+// is still alive. SIGKILL cannot be trapped or forwarded, so this is the only
+// thing that stops a gate whose parent was killed by pid.
+setOrphanGuard();
+
+// #2427 AC-1: the identity of the tree this gate is about to measure, sampled
+// BEFORE the first check. buildGateEvidence re-measures at the end and refuses
+// to stamp anything if the two disagree.
+const _gateStart = await (async () => {
+  try {
+    const { captureGateStart } = await import('./lib/gate-evidence.mjs');
+    return captureGateStart(_mutexRoot);
+  } catch { return null; }
+})();
+<%// #1127/#1330: FE-signal helpers used by the registry's generation-time emitIf
+// expressions — declared BEFORE the effective-gate set (which evals them).
+const _isSubtreeFE = typeof archetype !== 'undefined' && archetype !== 'frontend-spa'
+  && Array.isArray(lanes) && lanes.includes('frontend')
+const _isFE = archetype === 'frontend-spa' || (Array.isArray(lanes) && lanes.includes('frontend'))
+// #2257: whether this project HAS GitHub workflows on disk — the predicate the
+// 12 workflow gates (ci-tiers, action-pins, workflow-perms/runners/docs-sync/
+// test-integrity/sha-pinning/job-naming, secret-presence, continue-on-error,
+// pr-size-gate, merge-method-ff-only) must follow. They used to key off bare
+// `useGitHub`, which is NOT that: resolveProjectConfig sets it from the LIVE-API
+// flag (`--github`), so a routine `arbiter update` resolved it false and STRIPPED
+// all 12 from a project whose .github/workflows and guard scripts stayed on disk
+// — REDding the project's own `unwired guards` gate on a day-2 no-op command.
+// `permitGitHub` is the persisted capability, and is already the predicate
+// registry.ts uses to EMIT those workflows and guards; the `?? useGitHub` tail
+// (the same idiom registry.ts/ci-tier.ts/anti-drift-validators.ts use) covers the
+// init path, which builds a ProjectConfig carrying only `useGitHub`. `typeof`
+// because that init-path ProjectConfig leaves `permitGitHub` undefined and a bare
+// reference would ReferenceError the generator for every non-GitHub project.
+const _hasGitHubWorkflows = typeof permitGitHub !== 'undefined'
+  ? permitGitHub === true : useGitHub === true
+const _feFramework = (typeof frontend !== 'undefined' && frontend && frontend.framework)
+  ? frontend.framework : 'react'
+const _feGlob = _feFramework === 'vue'
+  ? 'src/**/*.{ts,vue}'
+  : _feFramework === 'svelte'
+  ? 'src/**/*.{ts,svelte}'
+  : 'src/**/*.{ts,tsx,jsx}'
+%>
+// ─── Embedded gate registry (#2041, AC-2041.4) ────────────────────────────────
+// The declarative registry rendered from gate-registry.yml.ejs — consumed by
+// `--dry-run` (manifest), `--gate <id|name>` (single-check re-run), and the
+// emitted layering contract test (scripts/test-gate-layering.mjs). ORDER IS
+// MEANINGFUL: gates run in registry order within each level.
+<%
+// The EFFECTIVE gate set — generation-time emitIf/language conditions resolved
+// once here, then embedded below and iterated by the lanes. The embedded
+// registry carries only the gates that will actually RUN (or render an
+// explicit SKIP), so the --dry-run manifest, the layering contract test, and
+// --gate <id> all see the same set the lanes execute. Conditions
+// (gateFilePresent/existsSync) are runtime and stay runtime `if` wrappers in
+// the emitted script. emitIf expressions are trusted repo-owned template data
+// resolved at GENERATION time (never emitted into the consumer script), so
+// eval here is safe — a typo'd emitIf key fails the generator LOUD
+// (ReferenceError), never a silent gate drop.
+//
+// A gate carrying a GENERATION-time `else` (npm-ci drift — body-vs-else decided
+// at render) is NEVER filtered: its emitIf decides body-vs-else in the inline
+// branch (mirroring the pre-#2041 `if (cond) { body } else { SKIP }` emission),
+// so a pnpm project still gets the SKIP-report line. A gate with a RUNTIME else
+// (condition + else, e.g. the contract env-gates) is filtered by emitIf like any
+// other gate — otherwise a Maven project's manifest would carry the ./gradlew
+// Pact gate whose runtime else only fires when the gate is actually selected.
+const _effectiveGates = gates.filter((g) => {
+  const _generationElse = g.else !== undefined && g.condition === undefined;
+  if (g.emitIf !== undefined && !_generationElse && !eval('(' + g.emitIf + ')')) return false;
+  if (g.language && g.language !== language) return false;
+  return true;
+});
+// #9003 — render-time set of gate ids that are the BASE of some promotion
+// (i.e. some other gate declares `promotes_to: <this id>`), and the reverse
+// map (base id -> promoting gate id) used for the SKIP-reason message below.
+// Only gates in this set (and audit-tagged gates) get the runtime skip-wrap
+// below — every other gate's emission is byte-identical to pre-#9003 output.
+const _promotionBases = new Set(_effectiveGates.filter((g) => typeof g.promotes_to === 'string').map((g) => g.promotes_to));
+const _promotedByMap = new Map(_effectiveGates.filter((g) => typeof g.promotes_to === 'string').map((g) => [g.promotes_to, g.id]));
+const _hasAudit = _effectiveGates.some((g) => g.audit === true);
+// #9003 — the `_promotedAway`/`_auditGatesOff` runtime machinery below is
+// ONLY emitted when at least one gate in THIS consumer's registry opts in —
+// a consumer whose gates never declare promotes_to/audit gets byte-identical
+// output to pre-#9003 (no dead consts, no snapshot churn on `arbiter update`).
+const _hasSkipMachinery = _promotionBases.size > 0 || _hasAudit;
+%>
+const GATE_REGISTRY = <%- JSON.stringify(_effectiveGates) %>;
+<%_ if (_hasSkipMachinery) { _%>
+
+// #9003 — promoted-gate suppression: a gate whose id is the `promotes_to`
+// target of some OTHER gate is skipped once that promoting gate's own level
+// is reached (same L1⊆L2⊆L3 ordinal comparison the --dry-run manifest uses
+// above — e.g. an L3 `harness-full` gate declaring
+// `promotes_to: harness-fast` suppresses `harness-fast` once L3 is reached).
+const _promotedAway = new Set();
+for (const _pg of GATE_REGISTRY) {
+  if (_pg.promotes_to && _LEVELS.indexOf(_pg.level) <= _LEVELS.indexOf(level)) {
+    _promotedAway.add(_pg.promotes_to);
+  }
+}
+// #9003 — audit-mode gating: a gate tagged `audit: true` is a second axis
+// orthogonal to level. Default is ON (gates run); set
+// ARBITER_AUDIT_MODE=off to skip them.
+// Boolean-shaped (registered in env-registry.ts as type: 'boolean') — accept
+// the same off-forms a boolean env read accepts (mirrors parseBooleanEnv;
+// duplicated inline since this file ships to consumers with no arbiter dep).
+const _auditGatesOff = ['off', 'false', '0', 'no'].includes(
+  (process.env.ARBITER_AUDIT_MODE ?? '').trim().toLowerCase(),
+);
+<%_ } _%>
+
+// ─── #2078 (GATE-1 of #2041) — inspection modes, re-based on the registry.
+// `--dry-run` prints the registry manifest without executing (exit 0, zero
+// executions); `--gate <id|name>` re-runs a single check with timing. Both are
+// diagnostic: they must NEVER stamp a gate-pass marker / result JSON (guarded
+// at the write sites below), so a dry-run or single-check rerun cannot fake a
+// green gate for the fail-closed Stop hook. `setMode` threads the mode into the
+// runCheck/runWarnCheck/runToolCheck trio; a normal run leaves it a no-op.
+if (dryRun) {
+  console.log('[DRY-RUN] gate manifest (registry):');
+  // #2257: the lanes are structurally contained (L1 ⊂ L2 ⊂ L3 — see the L3 lane
+  // below, which runs only AFTER the L1 and L2 bodies), so the manifest must use
+  // the same containment. The old `_g.level === level` equality omitted EVERY L2
+  // gate from `--dry-run L3`, i.e. the diagnostic that exists to answer "what
+  // does this lane run" under-reported the L3 lane by ~40 gates.
+  for (const _g of GATE_REGISTRY) {
+    if (_LEVELS.indexOf(_g.level) <= _LEVELS.indexOf(level)) {
+<%_ if (_hasSkipMachinery) { _%>
+      // #9003: the manifest must reflect the SAME runtime skip a real run
+      // would apply — a promoted-away or audit-off gate is not silently
+      // listed as if it would execute (the #2257 "diagnostic that lies" class).
+      const _dryPromo = _promotedAway.has(_g.id) ? '  [SKIP: promoted]' : '';
+      const _dryAudit = (_g.audit === true && _auditGatesOff) ? '  [SKIP: ARBITER_AUDIT_MODE=off]' : '';
+      console.log(`  ${_g.level}  ${_g.id}  ${_g.name}${_dryPromo}${_dryAudit}`);
+<%_ } else { _%>
+      console.log(`  ${_g.level}  ${_g.id}  ${_g.name}`);
+<%_ } _%>
+    }
+  }
+}
+if (only !== null) {
+  // --gate accepts a registry id (re-based on the registry) OR the display name
+  // (#2078 backward compatibility — the trio matches by name).
+  const _regGate = GATE_REGISTRY.find((_g) => _g.id === only);
+  if (_regGate) only = _regGate.name;
+}
+const _inspect = dryRun || only !== null;
+setMode({ dryRun, only });
+
+// #2041 (AC-2041.5/6): inline gate bodies bypass the runCheck trio, so they must
+// honour the inspection modes themselves — --dry-run prints and spawns NOTHING
+// (the #2078 contract: "print-what-would-run, spawn nothing"; a direct spawn
+// would also hang an offline consumer), and --gate <id|name> filters to the
+// named gate. Returns true when the caller must skip.
+function _inlineInspect(_name, _wouldRun) {
+  if (dryRun) {
+    console.log(`[CHECK] ${_name} ... DRY-RUN (would run: ${_wouldRun})`);
+    pushResult(_name, 'SKIP', 0);
+    return true;
+  }
+  if (only !== null && only !== _name) return true;
+  return false;
+}
+
+// ─── Grace Period Guard (ADR-028) ─────────────────────────────────────────────
+// A freshly-upgraded L1→L2 project may run its new L2 gates WARN-only for a
+// bounded settling window (set ONLY by `arbiter upgrade-level`, never by hand).
+//
+// Three guards close the L2 fake-green vector this mechanism could otherwise open:
+//   1. CURRENT-LEVEL binding — grace is honored only while THIS project is at L2
+//      (the level baked into this script at generation time). Once it climbs to
+//      L3/L4, `arbiter update` re-renders this script at the higher level and the
+//      guard below evaluates false, so a stale L1→L2 graceEndsAt can no longer
+//      silence the (now higher) gate. A grace from L1 only ever softens L2.
+//   2. BOUNDED window — graceEndsAt is honored only if it is at most
+//      GRACE_MAX_DAYS ahead of now. A hand-edited far-future date (the classic
+//      "neuter the gate forever" edit) exceeds the bound and is IGNORED, with a
+//      loud warning — it cannot make the gate advisory.
+//   3. HARD checks stay hard — PII/secret early-fail (above) and the anti-fake-green
+//      aggregate are never softened by grace.
+const GRACE_MAX_DAYS = 35; // upgrade-level default is 30; +5 slack for one --extend
+const _projectLevel = '<%= governanceLevel %>';
+let graceActive = false;
+const _arbiterJsonPath = join(process.cwd(), 'arbiter.json');
+if (existsSync(_arbiterJsonPath)) {
+  try {
+    const _cfg = JSON.parse(readFileSync(_arbiterJsonPath, 'utf-8'));
+    const _ends = _cfg.graceEndsAt ? Date.parse(_cfg.graceEndsAt) : NaN;
+    const _now = Date.now();
+    // Grace from L1 is only meaningful while the project is itself at L2.
+    const _levelOk = _cfg.graceFromLevel === 'L1' && _projectLevel === 'L2';
+    if (_levelOk && Number.isFinite(_ends) && _ends > _now) {
+      const _maxEnds = _now + GRACE_MAX_DAYS * 86400000;
+      if (_ends > _maxEnds) {
+        const _endsDate = _cfg.graceEndsAt.slice(0, 10);
+        console.log(`[GRACE] IGNORED — graceEndsAt (${_endsDate}) exceeds the ${GRACE_MAX_DAYS}-day bound; treating L2 gates as HARD. Re-run \`arbiter upgrade-level --extend\` instead of hand-editing arbiter.json.`);
+      } else {
+        graceActive = true;
+        const _daysLeft = Math.ceil((_ends - _now) / 86400000);
+        const _endsDate = _cfg.graceEndsAt.slice(0, 10);
+        console.log(`[GRACE] Grace period ends in ${_daysLeft} day(s) (${_endsDate}). L2 gates WARN-only until then.`);
+      }
+    } else if (_cfg.graceFromLevel === 'L1' && _projectLevel !== 'L2' && Number.isFinite(_ends) && _ends > _now) {
+      // Stale grace carried into a higher level — never soften the higher gate.
+      console.log(`[GRACE] IGNORED — graceFromLevel=L1 but project is now ${_projectLevel}; L2 grace does not apply to a ${_projectLevel} gate.`);
+    }
+  } catch { /* ignore parse errors — arbiter.json absent or malformed */ }
+}
+
+console.log('');
+console.log(`=== <%= projectName %> Quality Gate: ${level} ===`);
+console.log('');
+
+<%
+// #1720 (gap 4) RESOLVED by #2041 (AC-2041.1): L3/L4 are now executable LOCAL
+// lanes — the L3 registry set runs below (solo-reactivation + nightly audits,
+// mirroring 06-nightly-lite.yml). The pre-#2041 clamp is gone: an explicit
+// L3/L4 request runs the full L1+L2+L3 body, never a silent downgrade.
+const ratchetFlag = isL3Plus ? '--require-improvement' : '--gate';
+%>
+
+// ─── Gate execution (registry-driven, #2041) ─────────────────────────────────
+// Each registry entry renders as a level-conditioned call: L1 gates always run,
+// L2 gates run at L2+, L3 gates run at L3+ (the local nightly lane). Language
+// and data conditions (emitIf) are resolved at GENERATION time; runtime guards
+// (gateFilePresent/existsSync) remain runtime `if` wrappers. Inline gates keep
+// their custom JS bodies (declared in the registry so --dry-run/--gate and the
+// layering test see them). ORDER IS THE REGISTRY ORDER.
+
+<% const l1 = _effectiveGates.filter(g => g.level === 'L1'); const l2 = _effectiveGates.filter(g => g.level === 'L2'); const l3 = _effectiveGates.filter(g => g.level === 'L3'); %>
+// ── L1 (fast checks — pre-commit) ────────────────────────────────────────
+if (true) {
+<% for (const g of l1) { %>
+<% if (g.emitIf !== undefined && !eval('(' + g.emitIf + ')')) continue; %>
+<% if (g.language && g.language !== language) continue; %>
+<%_ const _isPromoted = _promotionBases.has(g.id); const _isAudit = g.audit === true; const _promoterId = _isPromoted ? _promotedByMap.get(g.id) : null; const _skipCond = []; if (_isPromoted) _skipCond.push("_promotedAway.has('" + g.id + "')"); if (_isAudit) _skipCond.push('_auditGatesOff'); _%>
+<%_ if (_skipCond.length) { _%>
+if (<%- _skipCond.join(' || ') %>) {
+<%_ if (_isPromoted && _isAudit) { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (' + (_promotedAway.has('<%= g.id %>') ? 'promoted by <%- _promoterId %>' : 'ARBITER_AUDIT_MODE=off') + ')');
+<%_ } else if (_isPromoted) { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (promoted by <%- _promoterId %>)');
+<%_ } else { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (ARBITER_AUDIT_MODE=off)');
+<%_ } _%>
+  pushResult('<%= g.name %>', 'SKIP', 0);
+} else {
+<%_ } _%>
+<% if (g.kind === 'inline') { %>
+<% if(g.id === 'npm-ci-drift') { %>
+<% if (g.emitIf !== undefined && !eval('(' + g.emitIf + ')')) { %><%- g.else %><% } else { %>
+if (_inlineInspect('npm-ci drift', 'npx -y npm@<pin> ci --dry-run')) {} else {
+  const _driftStart = Date.now();
+  process.stdout.write('[CHECK] npm-ci drift ... ');
+  let _driftStatus = 'PASS';
+  try {
+    const _pin = existsSync('package.json')
+      ? (JSON.parse(readFileSync('package.json', 'utf-8')).packageManager || '').match(/^npm@(\d+\.\d+\.\d+)/)
+      : null;
+    if (!_pin || !existsSync('package-lock.json')) {
+      console.log('SKIP (no packageManager npm pin or lockfile)');
+    } else {
+      const _r = spawnSync('npx', ['-y', 'npm@' + _pin[1], 'ci', '--dry-run'], { encoding: 'utf-8', shell: false });
+      if (_r.error) {
+        console.log('SKIP (pinned npm@' + _pin[1] + ' unavailable)');
+      } else if (_r.status === 0) {
+        console.log('PASS');
+      } else {
+        console.log('FAIL');
+        process.stdout.write('package-lock.json is out of sync under npm@' + _pin[1] + ' — relock: npx -y npm@' + _pin[1] + ' install --package-lock-only\n');
+        _driftStatus = 'FAIL';
+      }
+    }
+  } catch (_e) {
+    console.log('SKIP (' + (_e && _e.message ? _e.message : 'unreadable package.json') + ')');
+  }
+  pushResult('npm-ci drift', _driftStatus, Date.now() - _driftStart);
+}
+<% } %>
+<% } else if(g.id === 'workflow-runners-inline') { %>
+{
+  const _wrStart = Date.now();
+  process.stdout.write('[CHECK] workflow runners ... ');
+  const _wrWorkflowsDir = join(process.cwd(), '.github', 'workflows');
+  // Allowlisted runs-on forms (INV-89, ADR-023 amendment #959 — ubuntu-latest default):
+  //   1. ${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }}  — global override (auxiliary jobs)
+  //   2. ${{ fromJSON(vars.RUNNER_LABELS_BUILD  || '["ubuntu-latest"]') }}  — build job-class pool
+  //   3. ${{ fromJSON(vars.RUNNER_LABELS_TEST   || '["ubuntu-latest"]') }}  — test job-class pool
+  //   4. ${{ fromJSON(vars.RUNNER_LABELS_DEPLOY || '["ubuntu-latest"]') }}  — deploy job-class pool
+  //   5. ${{ matrix.os }} — explicit OS matrix, always allowed
+  // The per-job-class map lets a project point build/test/deploy at distinct runner
+  // pools (self-hosted / cloud / GitHub-hosted) via org vars without editing workflows;
+  // each var falls back to ubuntu-latest, so an unset var is never a broken runner.
+  const _wrAllowedPattern = /\$\{\{\s*(?:vars\.CI_BUILD_RUNNER_LABEL|fromJSON\(vars\.RUNNER_LABELS_(?:BUILD|TEST|DEPLOY)|matrix\.os)/;
+  const _wrRunsOnPattern = /^\s*runs-on:/;
+  let _wrViolations = 0;
+  let _wrFiles;
+  try {
+    _wrFiles = readdirSync(_wrWorkflowsDir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
+  } catch (err) {
+    if (err.code !== 'ENOENT') {
+      console.log(`FAIL (cannot read .github/workflows — ${err.message})`);
+      pushResult('workflow runners', 'FAIL', Date.now() - _wrStart);
+      _wrFiles = null;
+    } else {
+      _wrFiles = [];
+    }
+  }
+  if (_wrFiles !== null) {
+    for (const _wrFile of _wrFiles) {
+      let _wrContent;
+      try {
+        _wrContent = readFileSync(join(_wrWorkflowsDir, _wrFile), 'utf-8');
+      } catch (err) { console.log(`FAIL (cannot read workflow file: ${_wrFile} — ${err.message})`); _wrViolations++; continue; }
+      const _wrLines = _wrContent.split('\n');
+      for (let _wi = 0; _wi < _wrLines.length; _wi++) {
+        if (_wrRunsOnPattern.test(_wrLines[_wi]) && !_wrAllowedPattern.test(_wrLines[_wi])) {
+          _wrViolations++;
+        }
+      }
+    }
+    if (_wrViolations > 0) {
+      console.log(`FAIL (${_wrViolations} violation(s) — use \${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }})`);
+      pushResult('workflow runners', 'FAIL', Date.now() - _wrStart);
+    } else {
+      console.log(`PASS (${Date.now() - _wrStart}ms)`);
+      pushResult('workflow runners', 'PASS', Date.now() - _wrStart);
+    }
+  }
+}
+<% } else if(g.id === 'ci-alignment') { %>
+{
+  const _caStart = Date.now();
+  process.stdout.write('[CHECK] ci alignment ... ');
+  const _caManifestPath = join(process.cwd(), 'scripts', 'check-all.mjs');
+  const _caCiPath = join(process.cwd(), '.github', 'workflows', 'ci.yml');
+  const _caInfraPrefixes = ['npm ci', 'npm install', 'git fetch', 'git checkout', 'curl ', 'echo ', 'mkdir ', 'cp ', 'tar ', 'pip install', 'apt-get'];
+  const _caDesignExemptions = new Set(['npx:commitlint', 'npm:test']);
+  function _caIsInfra(cmd) { return _caInfraPrefixes.some((p) => cmd.startsWith(p)); }
+  function _caNormalizeKey(cmd, firstArg) {
+    switch (cmd) {
+      case 'node': return (firstArg && firstArg.startsWith('scripts/')) ? firstArg : null;
+      case 'npx': { if (!firstArg) return null; const tool = firstArg.replace(/@.+$/, ''); return 'npx:' + tool; }
+      case 'npm': if (firstArg === 'test') return 'npm:test'; if (firstArg === 'audit') return 'npm:audit'; return null;
+      default: return null;
+    }
+  }
+  function _caExtractManifestGates(text) {
+    const gates = new Set();
+    const re = /runCheck\(\s*"[^"]*"\s*,\s*"([^"]+)"\s*,\s*\[([^\]]*)\]/g;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      const k = _caNormalizeKey(m[1].trim(), (m[2].match(/"([^"]+)"/) || [])[1] || '');
+      if (k !== null) gates.add(k);
+    }
+    return gates;
+  }
+  function _caParseRun(cmd, gates) {
+    if (!cmd || _caIsInfra(cmd)) return;
+    const toks = cmd.split(/\s+/);
+    const c0 = toks[0]; const a0 = toks[1] ?? '';
+    const k = (c0 === 'node' && a0) ? _caNormalizeKey('node', a0) : _caNormalizeKey(c0, a0);
+    if (k !== null) gates.add(k);
+  }
+  function _caExtractCiGates(ciPath) {
+    const gates = new Set();
+    let ciText;
+    try { ciText = readFileSync(ciPath, 'utf-8'); } catch (e) { if (e.code === 'ENOENT') return gates; throw e; }
+    const ciLines = ciText.split('\n');
+    let _ci = 0;
+    while (_ci < ciLines.length) {
+      const cl = ciLines[_ci];
+      if (/^\s*-?\s*uses:\s*.+/.test(cl)) { _ci++; continue; }
+      const blk = cl.match(/^(\s*)-?\s*run:\s*[|>]\s*$/);
+      if (blk) {
+        const bi = blk[1].length; _ci++;
+        while (_ci < ciLines.length) {
+          const bl = ciLines[_ci];
+          if (bl.trim() === '') { _ci++; continue; }
+          if ((bl.match(/^(\s*)/)?.[1].length ?? 0) <= bi && bl.trim() !== '') break;
+          _caParseRun(bl.trim(), gates); _ci++;
+        }
+        continue;
+      }
+      const sl = cl.match(/^\s*-?\s*run:\s*(.+)/);
+      if (sl) { _caParseRun(sl[1].trim(), gates); }
+      _ci++;
+    }
+    return gates;
+  }
+  let _caStatus = 'PASS';
+  try {
+    const _caManifestText = readFileSync(_caManifestPath, 'utf-8');
+    const _caManifestGates = _caExtractManifestGates(_caManifestText);
+    const _caCiGates = _caExtractCiGates(_caCiPath);
+    for (const k of _caDesignExemptions) { _caManifestGates.delete(k); _caCiGates.delete(k); }
+    const _caManifestOnly = [..._caManifestGates].filter((k) => !_caCiGates.has(k));
+    const _caCiOnly = [..._caCiGates].filter((k) => !_caManifestGates.has(k));
+    if (_caManifestOnly.length > 0 || _caCiOnly.length > 0) {
+      console.log(`FAIL (${_caManifestOnly.length + _caCiOnly.length} alignment violation(s))`);
+      for (const k of _caManifestOnly) process.stderr.write('  manifest-only: ' + k + '\n');
+      for (const k of _caCiOnly) process.stderr.write('  ci-only: ' + k + '\n');
+      _caStatus = 'FAIL';
+    } else {
+      console.log(`PASS (${_caManifestGates.size} gates aligned, ${Date.now() - _caStart}ms)`);
+    }
+  } catch (_caErr) {
+    console.log('FAIL (error: ' + _caErr.message + ')');
+    _caStatus = 'FAIL';
+  }
+  pushResult('ci alignment', _caStatus, Date.now() - _caStart);
+}
+<% } else if(g.id === 'playwright-rules') { %>
+if (existsSync(join('node_modules', 'eslint-plugin-playwright'))) {
+  // --no-error-on-unmatched-pattern: the glob is source-co-located-spec-oriented;
+  // a project whose specs live only under tests/e2e/ (arbiter's own scaffold
+  // convention) legitimately matches zero files here — that must stay a PASS,
+  // not a Day-1 RED (#1491-class fix).
+  runCheck('playwright rules', 'npx', ['eslint', '--config', 'eslint.config.playwright.mjs', '--no-config-lookup', '--no-error-on-unmatched-pattern', 'src/**/*.spec.ts']);
+} else {
+  console.log('[CHECK] playwright rules ... SKIP (run: npm install -D eslint-plugin-playwright)');
+}
+<% } else if(g.id === 'playwright-e2e') { %>
+  // ─── L2: Playwright E2E (#348, CANON-02) — matrix proven for TS frontend-spa / backend-web-db.
+  // Wrapped via scripts/lib/ephemeral-server.mjs (#358): the runner starts the
+  // server, polls TCP readiness, runs Playwright, then tears the server down.
+  // runToolCheck SKIPs locally when the binary is missing, FAILs in CI.
+  const _e2eStartCommand = process.env.E2E_START_CMD?.trim();
+  let _hasStartTestScript = false;
+  try {
+    const _e2ePackage = JSON.parse(readFileSync('package.json', 'utf-8'));
+    _hasStartTestScript = typeof _e2ePackage.scripts?.['start:test'] === 'string'
+      && _e2ePackage.scripts['start:test'].trim().length > 0;
+  } catch {
+    // No package.json means arbiter cannot supply an application start command.
+  }
+  if (!_e2eStartCommand && !_hasStartTestScript) {
+    console.log('[CHECK] playwright e2e ... SKIP (E2E_START_CMD unset and package.json has no start:test script)');
+    pushResult('playwright e2e', 'SKIP', 0);
+  } else {
+    runToolCheck(
+      'playwright e2e',
+      'node',
+      [
+        'scripts/lib/ephemeral-server.mjs',
+        '--start', _e2eStartCommand || 'npm run start:test',
+        '--test',  'npx playwright test',
+        '--port',  process.env.E2E_PORT || '4173',
+      ],
+      { soft: graceActive },
+    );
+  }
+<% } else if(g.id === 'pytest-playwright-e2e') { %>
+  // ─── L2: pytest-playwright E2E (#348, CANON-02) — matrix proven for Python web archetypes.
+  // Wrapped via scripts/lib/ephemeral-server.mjs (#358) so the server is up
+  // before pytest collects the e2e tests. runToolCheck SKIPs locally when
+  // pytest is missing, FAILs in CI.
+  runToolCheck(
+    'pytest-playwright e2e',
+    'node',
+    [
+      'scripts/lib/ephemeral-server.mjs',
+      '--start', process.env.E2E_START_CMD || 'python -m uvicorn app.main:app --port 8000',
+      '--test',  'pytest tests/e2e',
+      '--port',  process.env.E2E_PORT || '8000',
+    ],
+    { soft: graceActive },
+  );
+<% } else if(g.id === 'npm-audit') { %>
+<% if (enableSecurityScanning && packageManager === 'npm') { %>
+  runCheck('audit', 'npm', ['audit', '--omit=dev', '--audit-level=high'], { soft: graceActive });
+<% } else if (enableSecurityScanning) { %>
+  console.log('[CHECK] audit ... SKIP (project uses <%= packageManager %>)');
+  pushResult('audit', 'SKIP', 0);
+<% } %>
+<% } else if(g.id === 'coverage-threshold') { %>
+  // ─── L2: coverage threshold (greenfield-aware, #1319.8) ─────────────────────
+  // Run vitest with the json-summary reporter so we can inspect the real coverage
+  // totals at runtime. A virgin project has zero executable statements ⇒ the
+  // greenfield guard PASSES instead of false-failing the line threshold. A coverage
+  // run that crashed (no summary) FAILS — never silently skipped.
+  if (_inlineInspect('coverage threshold', 'npx vitest run --coverage --coverage.reporter=json-summary')) {} else {
+    const _covStart = Date.now();
+    _coverageRunStartedAt = _covStart;
+    process.stdout.write('[CHECK] coverage threshold ... ');
+    const _covThreshold = <%= coverageThreshold %>;
+    const _cov = spawnSync(
+      'npx',
+      ['vitest', 'run', '--coverage', '--coverage.reporter=json-summary'],
+      { encoding: 'utf-8', shell: false },
+    );
+    let _covStatus = 'PASS';
+    let _covReason = '';
+    let _covSummary = null;
+    const _covSummaryPath = resolve(process.cwd(), 'coverage', 'coverage-summary.json');
+    if (existsSync(_covSummaryPath)) {
+      try {
+        _covSummary = JSON.parse(readFileSync(_covSummaryPath, 'utf-8'));
+      } catch {
+        _covSummary = null; // malformed JSON ⇒ evaluateCoverageGate fails closed
+      }
+    }
+    const _covResult = evaluateCoverageGate(_covSummary, _covThreshold);
+    _covStatus = _covResult.status;
+    _covReason = _covResult.reason;
+    if (_covStatus === 'FAIL' && graceActive) {
+      console.log(`WARN (grace period — ${_covReason})`);
+      _covStatus = 'PASS';
+    } else if (_covStatus === 'FAIL') {
+      console.log(`FAIL (${_covReason})`);
+    } else {
+      console.log(`PASS (${_covReason})`);
+    }
+    pushResult('coverage threshold', _covStatus, Date.now() - _covStart);
+  }
+<% } else if(g.id === 'bdd-ignore-check') { %>
+  // ─── L2: BDD gate (INV-40) ──────────────────────────────────────────────────
+  if (_inlineInspect('BDD @ignore check', 'grep -rql --include=*.feature @ignore .')) {} else {
+    // @ignore-tagged scenarios are HARD-fail (soft: false per INV-40 — never graced)
+    const _bddIgnoreStart = Date.now();
+    const _bddIgnore = spawnSync('grep', ['-rql', '--include=*.feature', '@ignore', '.'], { encoding: 'utf-8', shell: false });
+    process.stdout.write('[CHECK] BDD @ignore check ... ');
+    let _bddIgnoreStatus = 'PASS';
+    if (_bddIgnore.error?.code === 'ENOENT') {
+      console.log('FAIL (grep not found — cannot check @ignore tags)');
+      _bddIgnoreStatus = 'FAIL';
+    } else if (_bddIgnore.status === null || _bddIgnore.status === 2) {
+      console.log(`FAIL (grep error — exit ${_bddIgnore.status ?? 'signal'}: ${_bddIgnore.stderr ?? ''})`);
+      _bddIgnoreStatus = 'FAIL';
+    } else if (_bddIgnore.status === 0) {
+      console.log('FAIL (@ignore-tagged scenarios found — remove tags or move to issue tracker)');
+      _bddIgnoreStatus = 'FAIL';
+    } else {
+      console.log('PASS');
+    }
+    pushResult('BDD @ignore check', _bddIgnoreStatus, Date.now() - _bddIgnoreStart);
+  }
+<% } else if(g.id === 'bdd-go') { %>
+  // direct parallel of Python's `pytest.importorskip("pytest_bdd")`.
+  {
+    const _goBddStart = Date.now();
+    const _goMod = existsSync('go.mod') ? readFileSync('go.mod', 'utf-8') : '';
+    if (_goMod.includes('github.com/cucumber/godog')) {
+      runCheck('bdd', 'go', ['test', '-tags', 'bdd', './internal/bdd/...'], { soft: graceActive });
+    } else {
+      console.log('[CHECK] bdd ... SKIP (github.com/cucumber/godog not in go.mod — run: go get github.com/cucumber/godog)');
+      pushResult('bdd', 'SKIP', Date.now() - _goBddStart);
+    }
+  }
+<% } else if(g.id === 'bdd-rust') { %>
+  // graceful-skip contract as the Go/Python BDD gates above.
+  {
+    const _rustBddStart = Date.now();
+    const _cargoToml = existsSync('Cargo.toml') ? readFileSync('Cargo.toml', 'utf-8') : '';
+    if (/^\s*bdd\s*=/m.test(_cargoToml) || _cargoToml.includes('cucumber')) {
+      runCheck('bdd', 'cargo', ['test', '--features', 'bdd'], { soft: graceActive });
+    } else {
+      console.log('[CHECK] bdd ... SKIP (no `bdd` feature / cucumber dep in Cargo.toml — see tests/example_bdd_test.rs)');
+      pushResult('bdd', 'SKIP', Date.now() - _rustBddStart);
+    }
+  }
+<% } else if(g.id === 'evidence-gate') { %>
+  // ─── L3/L4: Evidence gate (INV-33) ───────────────────────────────────────────
+  // Validates nightly evidence produced by evidence-collect.mjs.
+  // Warns when absent (first run); fails when present but obs_gate !== 'PASS'.
+  const _evidenceStart = Date.now();
+  let _evidenceStatus = 'PASS';
+  process.stdout.write('[CHECK] evidence gate (INV-33) ... ');
+  {
+    const _summaryPath = join(process.cwd(), '.evidence', 'SUMMARY.json');
+    if (!existsSync(_summaryPath)) {
+      console.log('WARN — .evidence/SUMMARY.json absent (run nightly pipeline first)');
+    } else {
+      try {
+        const _summary = JSON.parse(readFileSync(_summaryPath, 'utf-8'));
+        if (_summary.obs_gate === 'PASS') {
+          console.log('PASS');
+        } else {
+          console.log('FAIL (obs_gate=' + _summary.obs_gate + ')');
+          _evidenceStatus = 'FAIL';
+        }
+      } catch {
+        console.log('FAIL (could not parse .evidence/SUMMARY.json)');
+        _evidenceStatus = 'FAIL';
+      }
+    }
+  }
+  pushResult('evidence gate (INV-33)', _evidenceStatus, Date.now() - _evidenceStart);
+<% } else if(g.id === 'gofmt') { %>
+  // #157: gofmt -l — FAIL on any unformatted file (Go ships no formatter in CI).
+  if (_inlineInspect('fmt (gofmt)', 'gofmt -l .')) {} else {
+    const _gofmtStart = Date.now();
+    process.stdout.write('[CHECK] fmt (gofmt) ... ');
+    const _gofmt = spawnSync('gofmt', ['-l', '.'], { encoding: 'utf-8', shell: false });
+    let _gofmtStatus = 'PASS';
+    if (_gofmt.error?.code === 'ENOENT') {
+      console.log('FAIL (binary not found: gofmt)');
+      _gofmtStatus = 'FAIL';
+    } else if (_gofmt.stdout?.trim()) {
+      console.log('FAIL');
+      process.stdout.write('Files need gofmt formatting:\n' + _gofmt.stdout);
+      _gofmtStatus = 'FAIL';
+    } else {
+      console.log('PASS');
+    }
+    pushResult('fmt (gofmt)', _gofmtStatus, Date.now() - _gofmtStart);
+  }
+<% } %>
+<% } else { %>
+<% if (g.condition) { %>if (<%- g.condition %>) {<% } %>
+<% const _fn = g.kind === 'warn' ? 'runWarnCheck' : g.kind === 'tool' ? 'runToolCheck' : 'runCheck'; %>
+<%= _fn %>('<%= g.name %>', '<%= g.cmd[0] %>', [<% if (g.cmd.length > 1) { %>'<%- g.cmd.slice(1).join("', '") %>'<% } %>]<%= g.soft ? ', { soft: graceActive }' : '' %>);
+<% if (g.else) { %>} else {
+<%- g.else %>
+}<% } else if (g.condition) { %>}<% } %>
+<% } %>
+<%_ if (_skipCond.length) { _%>
+}
+<%_ } _%>
+<% } %>
+}
+// ── L2 (full checks — pre-push) ──────────────────────────────────────────
+if (level !== 'L1') {
+<% for (const g of l2) { %>
+<% if (g.emitIf !== undefined && !eval('(' + g.emitIf + ')')) continue; %>
+<% if (g.language && g.language !== language) continue; %>
+<%_ const _isPromoted = _promotionBases.has(g.id); const _isAudit = g.audit === true; const _promoterId = _isPromoted ? _promotedByMap.get(g.id) : null; const _skipCond = []; if (_isPromoted) _skipCond.push("_promotedAway.has('" + g.id + "')"); if (_isAudit) _skipCond.push('_auditGatesOff'); _%>
+<%_ if (_skipCond.length) { _%>
+if (<%- _skipCond.join(' || ') %>) {
+<%_ if (_isPromoted && _isAudit) { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (' + (_promotedAway.has('<%= g.id %>') ? 'promoted by <%- _promoterId %>' : 'ARBITER_AUDIT_MODE=off') + ')');
+<%_ } else if (_isPromoted) { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (promoted by <%- _promoterId %>)');
+<%_ } else { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (ARBITER_AUDIT_MODE=off)');
+<%_ } _%>
+  pushResult('<%= g.name %>', 'SKIP', 0);
+} else {
+<%_ } _%>
+<% if (g.kind === 'inline') { %>
+<% if(g.id === 'npm-ci-drift') { %>
+<% if (g.emitIf !== undefined && !eval('(' + g.emitIf + ')')) { %><%- g.else %><% } else { %>
+if (_inlineInspect('npm-ci drift', 'npx -y npm@<pin> ci --dry-run')) {} else {
+  const _driftStart = Date.now();
+  process.stdout.write('[CHECK] npm-ci drift ... ');
+  let _driftStatus = 'PASS';
+  try {
+    const _pin = existsSync('package.json')
+      ? (JSON.parse(readFileSync('package.json', 'utf-8')).packageManager || '').match(/^npm@(\d+\.\d+\.\d+)/)
+      : null;
+    if (!_pin || !existsSync('package-lock.json')) {
+      console.log('SKIP (no packageManager npm pin or lockfile)');
+    } else {
+      const _r = spawnSync('npx', ['-y', 'npm@' + _pin[1], 'ci', '--dry-run'], { encoding: 'utf-8', shell: false });
+      if (_r.error) {
+        console.log('SKIP (pinned npm@' + _pin[1] + ' unavailable)');
+      } else if (_r.status === 0) {
+        console.log('PASS');
+      } else {
+        console.log('FAIL');
+        process.stdout.write('package-lock.json is out of sync under npm@' + _pin[1] + ' — relock: npx -y npm@' + _pin[1] + ' install --package-lock-only\n');
+        _driftStatus = 'FAIL';
+      }
+    }
+  } catch (_e) {
+    console.log('SKIP (' + (_e && _e.message ? _e.message : 'unreadable package.json') + ')');
+  }
+  pushResult('npm-ci drift', _driftStatus, Date.now() - _driftStart);
+}
+<% } %>
+<% } else if(g.id === 'workflow-runners-inline') { %>
+{
+  const _wrStart = Date.now();
+  process.stdout.write('[CHECK] workflow runners ... ');
+  const _wrWorkflowsDir = join(process.cwd(), '.github', 'workflows');
+  // Allowlisted runs-on forms (INV-89, ADR-023 amendment #959 — ubuntu-latest default):
+  //   1. ${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }}  — global override (auxiliary jobs)
+  //   2. ${{ fromJSON(vars.RUNNER_LABELS_BUILD  || '["ubuntu-latest"]') }}  — build job-class pool
+  //   3. ${{ fromJSON(vars.RUNNER_LABELS_TEST   || '["ubuntu-latest"]') }}  — test job-class pool
+  //   4. ${{ fromJSON(vars.RUNNER_LABELS_DEPLOY || '["ubuntu-latest"]') }}  — deploy job-class pool
+  //   5. ${{ matrix.os }} — explicit OS matrix, always allowed
+  // The per-job-class map lets a project point build/test/deploy at distinct runner
+  // pools (self-hosted / cloud / GitHub-hosted) via org vars without editing workflows;
+  // each var falls back to ubuntu-latest, so an unset var is never a broken runner.
+  const _wrAllowedPattern = /\$\{\{\s*(?:vars\.CI_BUILD_RUNNER_LABEL|fromJSON\(vars\.RUNNER_LABELS_(?:BUILD|TEST|DEPLOY)|matrix\.os)/;
+  const _wrRunsOnPattern = /^\s*runs-on:/;
+  let _wrViolations = 0;
+  let _wrFiles;
+  try {
+    _wrFiles = readdirSync(_wrWorkflowsDir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
+  } catch (err) {
+    if (err.code !== 'ENOENT') {
+      console.log(`FAIL (cannot read .github/workflows — ${err.message})`);
+      pushResult('workflow runners', 'FAIL', Date.now() - _wrStart);
+      _wrFiles = null;
+    } else {
+      _wrFiles = [];
+    }
+  }
+  if (_wrFiles !== null) {
+    for (const _wrFile of _wrFiles) {
+      let _wrContent;
+      try {
+        _wrContent = readFileSync(join(_wrWorkflowsDir, _wrFile), 'utf-8');
+      } catch (err) { console.log(`FAIL (cannot read workflow file: ${_wrFile} — ${err.message})`); _wrViolations++; continue; }
+      const _wrLines = _wrContent.split('\n');
+      for (let _wi = 0; _wi < _wrLines.length; _wi++) {
+        if (_wrRunsOnPattern.test(_wrLines[_wi]) && !_wrAllowedPattern.test(_wrLines[_wi])) {
+          _wrViolations++;
+        }
+      }
+    }
+    if (_wrViolations > 0) {
+      console.log(`FAIL (${_wrViolations} violation(s) — use \${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }})`);
+      pushResult('workflow runners', 'FAIL', Date.now() - _wrStart);
+    } else {
+      console.log(`PASS (${Date.now() - _wrStart}ms)`);
+      pushResult('workflow runners', 'PASS', Date.now() - _wrStart);
+    }
+  }
+}
+<% } else if(g.id === 'ci-alignment') { %>
+{
+  const _caStart = Date.now();
+  process.stdout.write('[CHECK] ci alignment ... ');
+  const _caManifestPath = join(process.cwd(), 'scripts', 'check-all.mjs');
+  const _caCiPath = join(process.cwd(), '.github', 'workflows', 'ci.yml');
+  const _caInfraPrefixes = ['npm ci', 'npm install', 'git fetch', 'git checkout', 'curl ', 'echo ', 'mkdir ', 'cp ', 'tar ', 'pip install', 'apt-get'];
+  const _caDesignExemptions = new Set(['npx:commitlint', 'npm:test']);
+  function _caIsInfra(cmd) { return _caInfraPrefixes.some((p) => cmd.startsWith(p)); }
+  function _caNormalizeKey(cmd, firstArg) {
+    switch (cmd) {
+      case 'node': return (firstArg && firstArg.startsWith('scripts/')) ? firstArg : null;
+      case 'npx': { if (!firstArg) return null; const tool = firstArg.replace(/@.+$/, ''); return 'npx:' + tool; }
+      case 'npm': if (firstArg === 'test') return 'npm:test'; if (firstArg === 'audit') return 'npm:audit'; return null;
+      default: return null;
+    }
+  }
+  function _caExtractManifestGates(text) {
+    const gates = new Set();
+    const re = /runCheck\(\s*"[^"]*"\s*,\s*"([^"]+)"\s*,\s*\[([^\]]*)\]/g;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      const k = _caNormalizeKey(m[1].trim(), (m[2].match(/"([^"]+)"/) || [])[1] || '');
+      if (k !== null) gates.add(k);
+    }
+    return gates;
+  }
+  function _caParseRun(cmd, gates) {
+    if (!cmd || _caIsInfra(cmd)) return;
+    const toks = cmd.split(/\s+/);
+    const c0 = toks[0]; const a0 = toks[1] ?? '';
+    const k = (c0 === 'node' && a0) ? _caNormalizeKey('node', a0) : _caNormalizeKey(c0, a0);
+    if (k !== null) gates.add(k);
+  }
+  function _caExtractCiGates(ciPath) {
+    const gates = new Set();
+    let ciText;
+    try { ciText = readFileSync(ciPath, 'utf-8'); } catch (e) { if (e.code === 'ENOENT') return gates; throw e; }
+    const ciLines = ciText.split('\n');
+    let _ci = 0;
+    while (_ci < ciLines.length) {
+      const cl = ciLines[_ci];
+      if (/^\s*-?\s*uses:\s*.+/.test(cl)) { _ci++; continue; }
+      const blk = cl.match(/^(\s*)-?\s*run:\s*[|>]\s*$/);
+      if (blk) {
+        const bi = blk[1].length; _ci++;
+        while (_ci < ciLines.length) {
+          const bl = ciLines[_ci];
+          if (bl.trim() === '') { _ci++; continue; }
+          if ((bl.match(/^(\s*)/)?.[1].length ?? 0) <= bi && bl.trim() !== '') break;
+          _caParseRun(bl.trim(), gates); _ci++;
+        }
+        continue;
+      }
+      const sl = cl.match(/^\s*-?\s*run:\s*(.+)/);
+      if (sl) { _caParseRun(sl[1].trim(), gates); }
+      _ci++;
+    }
+    return gates;
+  }
+  let _caStatus = 'PASS';
+  try {
+    const _caManifestText = readFileSync(_caManifestPath, 'utf-8');
+    const _caManifestGates = _caExtractManifestGates(_caManifestText);
+    const _caCiGates = _caExtractCiGates(_caCiPath);
+    for (const k of _caDesignExemptions) { _caManifestGates.delete(k); _caCiGates.delete(k); }
+    const _caManifestOnly = [..._caManifestGates].filter((k) => !_caCiGates.has(k));
+    const _caCiOnly = [..._caCiGates].filter((k) => !_caManifestGates.has(k));
+    if (_caManifestOnly.length > 0 || _caCiOnly.length > 0) {
+      console.log(`FAIL (${_caManifestOnly.length + _caCiOnly.length} alignment violation(s))`);
+      for (const k of _caManifestOnly) process.stderr.write('  manifest-only: ' + k + '\n');
+      for (const k of _caCiOnly) process.stderr.write('  ci-only: ' + k + '\n');
+      _caStatus = 'FAIL';
+    } else {
+      console.log(`PASS (${_caManifestGates.size} gates aligned, ${Date.now() - _caStart}ms)`);
+    }
+  } catch (_caErr) {
+    console.log('FAIL (error: ' + _caErr.message + ')');
+    _caStatus = 'FAIL';
+  }
+  pushResult('ci alignment', _caStatus, Date.now() - _caStart);
+}
+<% } else if(g.id === 'playwright-rules') { %>
+if (existsSync(join('node_modules', 'eslint-plugin-playwright'))) {
+  // --no-error-on-unmatched-pattern: the glob is source-co-located-spec-oriented;
+  // a project whose specs live only under tests/e2e/ (arbiter's own scaffold
+  // convention) legitimately matches zero files here — that must stay a PASS,
+  // not a Day-1 RED (#1491-class fix).
+  runCheck('playwright rules', 'npx', ['eslint', '--config', 'eslint.config.playwright.mjs', '--no-config-lookup', '--no-error-on-unmatched-pattern', 'src/**/*.spec.ts']);
+} else {
+  console.log('[CHECK] playwright rules ... SKIP (run: npm install -D eslint-plugin-playwright)');
+}
+<% } else if(g.id === 'playwright-e2e') { %>
+  // ─── L2: Playwright E2E (#348, CANON-02) — matrix proven for TS frontend-spa / backend-web-db.
+  // Wrapped via scripts/lib/ephemeral-server.mjs (#358): the runner starts the
+  // server, polls TCP readiness, runs Playwright, then tears the server down.
+  // runToolCheck SKIPs locally when the binary is missing, FAILs in CI.
+  const _e2eStartCommand = process.env.E2E_START_CMD?.trim();
+  let _hasStartTestScript = false;
+  try {
+    const _e2ePackage = JSON.parse(readFileSync('package.json', 'utf-8'));
+    _hasStartTestScript = typeof _e2ePackage.scripts?.['start:test'] === 'string'
+      && _e2ePackage.scripts['start:test'].trim().length > 0;
+  } catch {
+    // No package.json means arbiter cannot supply an application start command.
+  }
+  if (!_e2eStartCommand && !_hasStartTestScript) {
+    console.log('[CHECK] playwright e2e ... SKIP (E2E_START_CMD unset and package.json has no start:test script)');
+    pushResult('playwright e2e', 'SKIP', 0);
+  } else {
+    runToolCheck(
+      'playwright e2e',
+      'node',
+      [
+        'scripts/lib/ephemeral-server.mjs',
+        '--start', _e2eStartCommand || 'npm run start:test',
+        '--test',  'npx playwright test',
+        '--port',  process.env.E2E_PORT || '4173',
+      ],
+      { soft: graceActive },
+    );
+  }
+<% } else if(g.id === 'pytest-playwright-e2e') { %>
+  // ─── L2: pytest-playwright E2E (#348, CANON-02) — matrix proven for Python web archetypes.
+  // Wrapped via scripts/lib/ephemeral-server.mjs (#358) so the server is up
+  // before pytest collects the e2e tests. runToolCheck SKIPs locally when
+  // pytest is missing, FAILs in CI.
+  runToolCheck(
+    'pytest-playwright e2e',
+    'node',
+    [
+      'scripts/lib/ephemeral-server.mjs',
+      '--start', process.env.E2E_START_CMD || 'python -m uvicorn app.main:app --port 8000',
+      '--test',  'pytest tests/e2e',
+      '--port',  process.env.E2E_PORT || '8000',
+    ],
+    { soft: graceActive },
+  );
+<% } else if(g.id === 'npm-audit') { %>
+<% if (enableSecurityScanning && packageManager === 'npm') { %>
+  runCheck('audit', 'npm', ['audit', '--omit=dev', '--audit-level=high'], { soft: graceActive });
+<% } else if (enableSecurityScanning) { %>
+  console.log('[CHECK] audit ... SKIP (project uses <%= packageManager %>)');
+  pushResult('audit', 'SKIP', 0);
+<% } %>
+<% } else if(g.id === 'coverage-threshold') { %>
+  // ─── L2: coverage threshold (greenfield-aware, #1319.8) ─────────────────────
+  // Run vitest with the json-summary reporter so we can inspect the real coverage
+  // totals at runtime. A virgin project has zero executable statements ⇒ the
+  // greenfield guard PASSES instead of false-failing the line threshold. A coverage
+  // run that crashed (no summary) FAILS — never silently skipped.
+  if (_inlineInspect('coverage threshold', 'npx vitest run --coverage --coverage.reporter=json-summary')) {} else {
+    const _covStart = Date.now();
+    _coverageRunStartedAt = _covStart;
+    process.stdout.write('[CHECK] coverage threshold ... ');
+    const _covThreshold = <%= coverageThreshold %>;
+    const _cov = spawnSync(
+      'npx',
+      ['vitest', 'run', '--coverage', '--coverage.reporter=json-summary'],
+      { encoding: 'utf-8', shell: false },
+    );
+    let _covStatus = 'PASS';
+    let _covReason = '';
+    let _covSummary = null;
+    const _covSummaryPath = resolve(process.cwd(), 'coverage', 'coverage-summary.json');
+    if (existsSync(_covSummaryPath)) {
+      try {
+        _covSummary = JSON.parse(readFileSync(_covSummaryPath, 'utf-8'));
+      } catch {
+        _covSummary = null; // malformed JSON ⇒ evaluateCoverageGate fails closed
+      }
+    }
+    const _covResult = evaluateCoverageGate(_covSummary, _covThreshold);
+    _covStatus = _covResult.status;
+    _covReason = _covResult.reason;
+    if (_covStatus === 'FAIL' && graceActive) {
+      console.log(`WARN (grace period — ${_covReason})`);
+      _covStatus = 'PASS';
+    } else if (_covStatus === 'FAIL') {
+      console.log(`FAIL (${_covReason})`);
+    } else {
+      console.log(`PASS (${_covReason})`);
+    }
+    pushResult('coverage threshold', _covStatus, Date.now() - _covStart);
+  }
+<% } else if(g.id === 'bdd-ignore-check') { %>
+  // ─── L2: BDD gate (INV-40) ──────────────────────────────────────────────────
+  if (_inlineInspect('BDD @ignore check', 'grep -rql --include=*.feature @ignore .')) {} else {
+    // @ignore-tagged scenarios are HARD-fail (soft: false per INV-40 — never graced)
+    const _bddIgnoreStart = Date.now();
+    const _bddIgnore = spawnSync('grep', ['-rql', '--include=*.feature', '@ignore', '.'], { encoding: 'utf-8', shell: false });
+    process.stdout.write('[CHECK] BDD @ignore check ... ');
+    let _bddIgnoreStatus = 'PASS';
+    if (_bddIgnore.error?.code === 'ENOENT') {
+      console.log('FAIL (grep not found — cannot check @ignore tags)');
+      _bddIgnoreStatus = 'FAIL';
+    } else if (_bddIgnore.status === null || _bddIgnore.status === 2) {
+      console.log(`FAIL (grep error — exit ${_bddIgnore.status ?? 'signal'}: ${_bddIgnore.stderr ?? ''})`);
+      _bddIgnoreStatus = 'FAIL';
+    } else if (_bddIgnore.status === 0) {
+      console.log('FAIL (@ignore-tagged scenarios found — remove tags or move to issue tracker)');
+      _bddIgnoreStatus = 'FAIL';
+    } else {
+      console.log('PASS');
+    }
+    pushResult('BDD @ignore check', _bddIgnoreStatus, Date.now() - _bddIgnoreStart);
+  }
+<% } else if(g.id === 'bdd-go') { %>
+  // direct parallel of Python's `pytest.importorskip("pytest_bdd")`.
+  {
+    const _goBddStart = Date.now();
+    const _goMod = existsSync('go.mod') ? readFileSync('go.mod', 'utf-8') : '';
+    if (_goMod.includes('github.com/cucumber/godog')) {
+      runCheck('bdd', 'go', ['test', '-tags', 'bdd', './internal/bdd/...'], { soft: graceActive });
+    } else {
+      console.log('[CHECK] bdd ... SKIP (github.com/cucumber/godog not in go.mod — run: go get github.com/cucumber/godog)');
+      pushResult('bdd', 'SKIP', Date.now() - _goBddStart);
+    }
+  }
+<% } else if(g.id === 'bdd-rust') { %>
+  // graceful-skip contract as the Go/Python BDD gates above.
+  {
+    const _rustBddStart = Date.now();
+    const _cargoToml = existsSync('Cargo.toml') ? readFileSync('Cargo.toml', 'utf-8') : '';
+    if (/^\s*bdd\s*=/m.test(_cargoToml) || _cargoToml.includes('cucumber')) {
+      runCheck('bdd', 'cargo', ['test', '--features', 'bdd'], { soft: graceActive });
+    } else {
+      console.log('[CHECK] bdd ... SKIP (no `bdd` feature / cucumber dep in Cargo.toml — see tests/example_bdd_test.rs)');
+      pushResult('bdd', 'SKIP', Date.now() - _rustBddStart);
+    }
+  }
+<% } else if(g.id === 'evidence-gate') { %>
+  // ─── L3/L4: Evidence gate (INV-33) ───────────────────────────────────────────
+  // Validates nightly evidence produced by evidence-collect.mjs.
+  // Warns when absent (first run); fails when present but obs_gate !== 'PASS'.
+  const _evidenceStart = Date.now();
+  let _evidenceStatus = 'PASS';
+  process.stdout.write('[CHECK] evidence gate (INV-33) ... ');
+  {
+    const _summaryPath = join(process.cwd(), '.evidence', 'SUMMARY.json');
+    if (!existsSync(_summaryPath)) {
+      console.log('WARN — .evidence/SUMMARY.json absent (run nightly pipeline first)');
+    } else {
+      try {
+        const _summary = JSON.parse(readFileSync(_summaryPath, 'utf-8'));
+        if (_summary.obs_gate === 'PASS') {
+          console.log('PASS');
+        } else {
+          console.log('FAIL (obs_gate=' + _summary.obs_gate + ')');
+          _evidenceStatus = 'FAIL';
+        }
+      } catch {
+        console.log('FAIL (could not parse .evidence/SUMMARY.json)');
+        _evidenceStatus = 'FAIL';
+      }
+    }
+  }
+  pushResult('evidence gate (INV-33)', _evidenceStatus, Date.now() - _evidenceStart);
+<% } else if(g.id === 'go-coverage') { %>
+  // #2104: Go keeps the default covermode (set) — a lost counter increment under
+  // `set` can only under-report, and the threshold is a floor (see the registry).
+  if (_inlineInspect('coverage profile', 'go test -coverprofile=coverage.out ./...')) {} else {
+  runCheck('coverage profile', 'go', ['test', '-coverprofile=coverage.out', './...'], { soft: graceActive });
+  const _coverThreshStart = Date.now();
+  process.stdout.write('[CHECK] coverage threshold ... ');
+  const coverResult = spawnSync('go', ['tool', 'cover', '-func=coverage.out'], { encoding: 'utf-8', shell: false });
+  let _coverThreshStatus = 'PASS';
+  if (coverResult.status !== 0) {
+    console.log(graceActive ? 'WARN (grace period)' : 'FAIL (could not parse coverage)');
+    if (!graceActive) { _coverThreshStatus = 'FAIL'; }
+  } else {
+    const match = coverResult.stdout.match(/total:\s+\(statements\)\s+([\d.]+)%/);
+    const pct = match ? parseFloat(match[1]) : 0;
+    if (pct < <%= coverageThreshold %>) {
+      console.log(graceActive ? `WARN (grace period, ${pct.toFixed(1)}% < <%= coverageThreshold %>%)` : `FAIL (${pct.toFixed(1)}% < <%= coverageThreshold %>%)`);
+      if (!graceActive) { _coverThreshStatus = 'FAIL'; }
+    } else { console.log(`PASS (${pct.toFixed(1)}%)`); }
+  }
+  pushResult('coverage threshold', _coverThreshStatus, Date.now() - _coverThreshStart);
+  if (existsSync('coverage.out')) {
+    mkdirSync('coverage', { recursive: true });
+    const _coverHtmlStart = Date.now();
+    process.stdout.write('[CHECK] coverage HTML report ... ');
+    const htmlResult = spawnSync('go', ['tool', 'cover', '-html=coverage.out', '-o', 'coverage/coverage.html'], { encoding: 'utf-8', shell: false });
+    let _coverHtmlStatus = 'PASS';
+    if (htmlResult.status !== 0) {
+      console.log('FAIL (go tool cover -html)');
+      if (htmlResult.stderr) process.stderr.write(htmlResult.stderr);
+      if (!graceActive) { _coverHtmlStatus = 'FAIL'; }
+    } else { console.log('PASS'); }
+    pushResult('coverage HTML report', _coverHtmlStatus, Date.now() - _coverHtmlStart);
+  }
+  }
+<% } else if(g.id === 'binary-size') { %>
+  // ── Binary size cap (#359, INV-60) ─────────────────────────────────────────
+  // Asserts the release binary stays under the archetype budget. Only emitted
+  // for archetypes that produce a binary (cli, embedded). Skips gracefully
+  // when the binary has not yet been built — the size budget only matters at
+  // release time, not pre-build.
+  if (_inlineInspect('binary size', 'stat target/release binary')) {} else {
+  {
+    const _binSizeStart = Date.now();
+    process.stdout.write('[CHECK] binary size ... ');
+    const _maxBytes = <%= binarySizeBytes %>;
+    let _binSizeStatus = 'PASS';
+    let _binPath = null;
+    try {
+      const _releaseDir = resolve(process.cwd(), 'target/release');
+      if (existsSync(_releaseDir)) {
+        const _entries = readdirSync(_releaseDir);
+        for (const _e of _entries) {
+          const _full = join(_releaseDir, _e);
+          const _st = statSync(_full);
+          if (_st.isFile() && (_st.mode & 0o111)) {
+            _binPath = _full;
+            const _bytes = _st.size;
+            if (_bytes > _maxBytes) {
+              console.log(graceActive
+                ? `WARN (grace period, ${_bytes} > ${_maxBytes})`
+                : `FAIL (${_bytes} > ${_maxBytes})`);
+              if (!graceActive) { _binSizeStatus = 'FAIL'; }
+            } else {
+              console.log(`PASS (${_bytes} bytes / ${_maxBytes} cap)`);
+            }
+            break;
+          }
+        }
+      }
+      if (_binPath === null) {
+        console.log('SKIP (no release binary built yet)');
+      }
+    } catch (_e) {
+      console.log(graceActive ? 'WARN (grace period, ' + _e.message + ')' : 'FAIL (' + _e.message + ')');
+      if (!graceActive) { _binSizeStatus = 'FAIL'; }
+    }
+    pushResult('binary size', _binSizeStatus, Date.now() - _binSizeStart);
+  }
+  }
+<% } %>
+<% } else if (g.id === 'debt-ratchet' && language === 'typescript' && enableDebtGates && coverageEnabled) { %>
+const _debtRatchetArgs = _coverageRunStartedAt === null
+  ? ['scripts/debt-report.mjs', '--gate']
+  : ['scripts/debt-report.mjs', '--gate', '--coverage-summary', 'coverage/coverage-summary.json', '--coverage-started-at', String(_coverageRunStartedAt)];
+runCheck('debt ratchet', 'node', _debtRatchetArgs, { soft: graceActive });
+<% } else { %>
+<% if (g.condition) { %>if (<%- g.condition %>) {<% } %>
+<% const _fn = g.kind === 'warn' ? 'runWarnCheck' : g.kind === 'tool' ? 'runToolCheck' : 'runCheck'; %>
+<%= _fn %>('<%= g.name %>', '<%= g.cmd[0] %>', [<% if (g.cmd.length > 1) { %>'<%- g.cmd.slice(1).join("', '") %>'<% } %>]<%= g.soft ? ', { soft: graceActive }' : '' %>);
+<% if (g.else) { %>} else {
+<%- g.else %>
+}<% } else if (g.condition) { %>}<% } %>
+<% } %>
+<%_ if (_skipCond.length) { _%>
+}
+<%_ } _%>
+<% } %>
+  // ── L2: gate-layering contract test (#2041, AC-2041.3) — asserts the
+  // L1 ⊂ L2 ⊂ L3 containment from the embedded registry.
+  if (gateFilePresent('scripts/test-gate-layering.mjs', 'gate layering')) {
+    runCheck('gate layering', 'node', ['scripts/test-gate-layering.mjs'])
+  }
+}
+// ── L3 (nightly lane — AC-2041.1, mirrors 06-nightly-lite.yml) ───────────
+if (level === 'L3' || level === 'L4') {
+<% for (const g of l3) { %>
+<% if (g.emitIf !== undefined && !eval('(' + g.emitIf + ')')) continue; %>
+<% if (g.language && g.language !== language) continue; %>
+<%_ const _isPromoted = _promotionBases.has(g.id); const _isAudit = g.audit === true; const _promoterId = _isPromoted ? _promotedByMap.get(g.id) : null; const _skipCond = []; if (_isPromoted) _skipCond.push("_promotedAway.has('" + g.id + "')"); if (_isAudit) _skipCond.push('_auditGatesOff'); _%>
+<%_ if (_skipCond.length) { _%>
+if (<%- _skipCond.join(' || ') %>) {
+<%_ if (_isPromoted && _isAudit) { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (' + (_promotedAway.has('<%= g.id %>') ? 'promoted by <%- _promoterId %>' : 'ARBITER_AUDIT_MODE=off') + ')');
+<%_ } else if (_isPromoted) { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (promoted by <%- _promoterId %>)');
+<%_ } else { _%>
+  console.log('[CHECK] <%= g.name %> ... SKIP (ARBITER_AUDIT_MODE=off)');
+<%_ } _%>
+  pushResult('<%= g.name %>', 'SKIP', 0);
+} else {
+<%_ } _%>
+<% if (g.kind === 'inline') { %>
+<% if(g.id === 'npm-ci-drift') { %>
+<% if (g.emitIf !== undefined && !eval('(' + g.emitIf + ')')) { %><%- g.else %><% } else { %>
+if (_inlineInspect('npm-ci drift', 'npx -y npm@<pin> ci --dry-run')) {} else {
+  const _driftStart = Date.now();
+  process.stdout.write('[CHECK] npm-ci drift ... ');
+  let _driftStatus = 'PASS';
+  try {
+    const _pin = existsSync('package.json')
+      ? (JSON.parse(readFileSync('package.json', 'utf-8')).packageManager || '').match(/^npm@(\d+\.\d+\.\d+)/)
+      : null;
+    if (!_pin || !existsSync('package-lock.json')) {
+      console.log('SKIP (no packageManager npm pin or lockfile)');
+    } else {
+      const _r = spawnSync('npx', ['-y', 'npm@' + _pin[1], 'ci', '--dry-run'], { encoding: 'utf-8', shell: false });
+      if (_r.error) {
+        console.log('SKIP (pinned npm@' + _pin[1] + ' unavailable)');
+      } else if (_r.status === 0) {
+        console.log('PASS');
+      } else {
+        console.log('FAIL');
+        process.stdout.write('package-lock.json is out of sync under npm@' + _pin[1] + ' — relock: npx -y npm@' + _pin[1] + ' install --package-lock-only\n');
+        _driftStatus = 'FAIL';
+      }
+    }
+  } catch (_e) {
+    console.log('SKIP (' + (_e && _e.message ? _e.message : 'unreadable package.json') + ')');
+  }
+  pushResult('npm-ci drift', _driftStatus, Date.now() - _driftStart);
+}
+<% } %>
+<% } else if(g.id === 'workflow-runners-inline') { %>
+{
+  const _wrStart = Date.now();
+  process.stdout.write('[CHECK] workflow runners ... ');
+  const _wrWorkflowsDir = join(process.cwd(), '.github', 'workflows');
+  // Allowlisted runs-on forms (INV-89, ADR-023 amendment #959 — ubuntu-latest default):
+  //   1. ${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }}  — global override (auxiliary jobs)
+  //   2. ${{ fromJSON(vars.RUNNER_LABELS_BUILD  || '["ubuntu-latest"]') }}  — build job-class pool
+  //   3. ${{ fromJSON(vars.RUNNER_LABELS_TEST   || '["ubuntu-latest"]') }}  — test job-class pool
+  //   4. ${{ fromJSON(vars.RUNNER_LABELS_DEPLOY || '["ubuntu-latest"]') }}  — deploy job-class pool
+  //   5. ${{ matrix.os }} — explicit OS matrix, always allowed
+  // The per-job-class map lets a project point build/test/deploy at distinct runner
+  // pools (self-hosted / cloud / GitHub-hosted) via org vars without editing workflows;
+  // each var falls back to ubuntu-latest, so an unset var is never a broken runner.
+  const _wrAllowedPattern = /\$\{\{\s*(?:vars\.CI_BUILD_RUNNER_LABEL|fromJSON\(vars\.RUNNER_LABELS_(?:BUILD|TEST|DEPLOY)|matrix\.os)/;
+  const _wrRunsOnPattern = /^\s*runs-on:/;
+  let _wrViolations = 0;
+  let _wrFiles;
+  try {
+    _wrFiles = readdirSync(_wrWorkflowsDir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
+  } catch (err) {
+    if (err.code !== 'ENOENT') {
+      console.log(`FAIL (cannot read .github/workflows — ${err.message})`);
+      pushResult('workflow runners', 'FAIL', Date.now() - _wrStart);
+      _wrFiles = null;
+    } else {
+      _wrFiles = [];
+    }
+  }
+  if (_wrFiles !== null) {
+    for (const _wrFile of _wrFiles) {
+      let _wrContent;
+      try {
+        _wrContent = readFileSync(join(_wrWorkflowsDir, _wrFile), 'utf-8');
+      } catch (err) { console.log(`FAIL (cannot read workflow file: ${_wrFile} — ${err.message})`); _wrViolations++; continue; }
+      const _wrLines = _wrContent.split('\n');
+      for (let _wi = 0; _wi < _wrLines.length; _wi++) {
+        if (_wrRunsOnPattern.test(_wrLines[_wi]) && !_wrAllowedPattern.test(_wrLines[_wi])) {
+          _wrViolations++;
+        }
+      }
+    }
+    if (_wrViolations > 0) {
+      console.log(`FAIL (${_wrViolations} violation(s) — use \${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }})`);
+      pushResult('workflow runners', 'FAIL', Date.now() - _wrStart);
+    } else {
+      console.log(`PASS (${Date.now() - _wrStart}ms)`);
+      pushResult('workflow runners', 'PASS', Date.now() - _wrStart);
+    }
+  }
+}
+<% } else if(g.id === 'ci-alignment') { %>
+{
+  const _caStart = Date.now();
+  process.stdout.write('[CHECK] ci alignment ... ');
+  const _caManifestPath = join(process.cwd(), 'scripts', 'check-all.mjs');
+  const _caCiPath = join(process.cwd(), '.github', 'workflows', 'ci.yml');
+  const _caInfraPrefixes = ['npm ci', 'npm install', 'git fetch', 'git checkout', 'curl ', 'echo ', 'mkdir ', 'cp ', 'tar ', 'pip install', 'apt-get'];
+  const _caDesignExemptions = new Set(['npx:commitlint', 'npm:test']);
+  function _caIsInfra(cmd) { return _caInfraPrefixes.some((p) => cmd.startsWith(p)); }
+  function _caNormalizeKey(cmd, firstArg) {
+    switch (cmd) {
+      case 'node': return (firstArg && firstArg.startsWith('scripts/')) ? firstArg : null;
+      case 'npx': { if (!firstArg) return null; const tool = firstArg.replace(/@.+$/, ''); return 'npx:' + tool; }
+      case 'npm': if (firstArg === 'test') return 'npm:test'; if (firstArg === 'audit') return 'npm:audit'; return null;
+      default: return null;
+    }
+  }
+  function _caExtractManifestGates(text) {
+    const gates = new Set();
+    const re = /runCheck\(\s*"[^"]*"\s*,\s*"([^"]+)"\s*,\s*\[([^\]]*)\]/g;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      const k = _caNormalizeKey(m[1].trim(), (m[2].match(/"([^"]+)"/) || [])[1] || '');
+      if (k !== null) gates.add(k);
+    }
+    return gates;
+  }
+  function _caParseRun(cmd, gates) {
+    if (!cmd || _caIsInfra(cmd)) return;
+    const toks = cmd.split(/\s+/);
+    const c0 = toks[0]; const a0 = toks[1] ?? '';
+    const k = (c0 === 'node' && a0) ? _caNormalizeKey('node', a0) : _caNormalizeKey(c0, a0);
+    if (k !== null) gates.add(k);
+  }
+  function _caExtractCiGates(ciPath) {
+    const gates = new Set();
+    let ciText;
+    try { ciText = readFileSync(ciPath, 'utf-8'); } catch (e) { if (e.code === 'ENOENT') return gates; throw e; }
+    const ciLines = ciText.split('\n');
+    let _ci = 0;
+    while (_ci < ciLines.length) {
+      const cl = ciLines[_ci];
+      if (/^\s*-?\s*uses:\s*.+/.test(cl)) { _ci++; continue; }
+      const blk = cl.match(/^(\s*)-?\s*run:\s*[|>]\s*$/);
+      if (blk) {
+        const bi = blk[1].length; _ci++;
+        while (_ci < ciLines.length) {
+          const bl = ciLines[_ci];
+          if (bl.trim() === '') { _ci++; continue; }
+          if ((bl.match(/^(\s*)/)?.[1].length ?? 0) <= bi && bl.trim() !== '') break;
+          _caParseRun(bl.trim(), gates); _ci++;
+        }
+        continue;
+      }
+      const sl = cl.match(/^\s*-?\s*run:\s*(.+)/);
+      if (sl) { _caParseRun(sl[1].trim(), gates); }
+      _ci++;
+    }
+    return gates;
+  }
+  let _caStatus = 'PASS';
+  try {
+    const _caManifestText = readFileSync(_caManifestPath, 'utf-8');
+    const _caManifestGates = _caExtractManifestGates(_caManifestText);
+    const _caCiGates = _caExtractCiGates(_caCiPath);
+    for (const k of _caDesignExemptions) { _caManifestGates.delete(k); _caCiGates.delete(k); }
+    const _caManifestOnly = [..._caManifestGates].filter((k) => !_caCiGates.has(k));
+    const _caCiOnly = [..._caCiGates].filter((k) => !_caManifestGates.has(k));
+    if (_caManifestOnly.length > 0 || _caCiOnly.length > 0) {
+      console.log(`FAIL (${_caManifestOnly.length + _caCiOnly.length} alignment violation(s))`);
+      for (const k of _caManifestOnly) process.stderr.write('  manifest-only: ' + k + '\n');
+      for (const k of _caCiOnly) process.stderr.write('  ci-only: ' + k + '\n');
+      _caStatus = 'FAIL';
+    } else {
+      console.log(`PASS (${_caManifestGates.size} gates aligned, ${Date.now() - _caStart}ms)`);
+    }
+  } catch (_caErr) {
+    console.log('FAIL (error: ' + _caErr.message + ')');
+    _caStatus = 'FAIL';
+  }
+  pushResult('ci alignment', _caStatus, Date.now() - _caStart);
+}
+<% } else if(g.id === 'playwright-rules') { %>
+if (existsSync(join('node_modules', 'eslint-plugin-playwright'))) {
+  // --no-error-on-unmatched-pattern: the glob is source-co-located-spec-oriented;
+  // a project whose specs live only under tests/e2e/ (arbiter's own scaffold
+  // convention) legitimately matches zero files here — that must stay a PASS,
+  // not a Day-1 RED (#1491-class fix).
+  runCheck('playwright rules', 'npx', ['eslint', '--config', 'eslint.config.playwright.mjs', '--no-config-lookup', '--no-error-on-unmatched-pattern', 'src/**/*.spec.ts']);
+} else {
+  console.log('[CHECK] playwright rules ... SKIP (run: npm install -D eslint-plugin-playwright)');
+}
+<% } else if(g.id === 'playwright-e2e') { %>
+  // ─── L2: Playwright E2E (#348, CANON-02) — matrix proven for TS frontend-spa / backend-web-db.
+  // Wrapped via scripts/lib/ephemeral-server.mjs (#358): the runner starts the
+  // server, polls TCP readiness, runs Playwright, then tears the server down.
+  // runToolCheck SKIPs locally when the binary is missing, FAILs in CI.
+  const _e2eStartCommand = process.env.E2E_START_CMD?.trim();
+  let _hasStartTestScript = false;
+  try {
+    const _e2ePackage = JSON.parse(readFileSync('package.json', 'utf-8'));
+    _hasStartTestScript = typeof _e2ePackage.scripts?.['start:test'] === 'string'
+      && _e2ePackage.scripts['start:test'].trim().length > 0;
+  } catch {
+    // No package.json means arbiter cannot supply an application start command.
+  }
+  if (!_e2eStartCommand && !_hasStartTestScript) {
+    console.log('[CHECK] playwright e2e ... SKIP (E2E_START_CMD unset and package.json has no start:test script)');
+    pushResult('playwright e2e', 'SKIP', 0);
+  } else {
+    runToolCheck(
+      'playwright e2e',
+      'node',
+      [
+        'scripts/lib/ephemeral-server.mjs',
+        '--start', _e2eStartCommand || 'npm run start:test',
+        '--test',  'npx playwright test',
+        '--port',  process.env.E2E_PORT || '4173',
+      ],
+      { soft: graceActive },
+    );
+  }
+<% } else if(g.id === 'pytest-playwright-e2e') { %>
+  // ─── L2: pytest-playwright E2E (#348, CANON-02) — matrix proven for Python web archetypes.
+  // Wrapped via scripts/lib/ephemeral-server.mjs (#358) so the server is up
+  // before pytest collects the e2e tests. runToolCheck SKIPs locally when
+  // pytest is missing, FAILs in CI.
+  runToolCheck(
+    'pytest-playwright e2e',
+    'node',
+    [
+      'scripts/lib/ephemeral-server.mjs',
+      '--start', process.env.E2E_START_CMD || 'python -m uvicorn app.main:app --port 8000',
+      '--test',  'pytest tests/e2e',
+      '--port',  process.env.E2E_PORT || '8000',
+    ],
+    { soft: graceActive },
+  );
+<% } else if(g.id === 'npm-audit') { %>
+<% if (enableSecurityScanning && packageManager === 'npm') { %>
+  runCheck('audit', 'npm', ['audit', '--omit=dev', '--audit-level=high'], { soft: graceActive });
+<% } else if (enableSecurityScanning) { %>
+  console.log('[CHECK] audit ... SKIP (project uses <%= packageManager %>)');
+  pushResult('audit', 'SKIP', 0);
+<% } %>
+<% } else if(g.id === 'coverage-threshold') { %>
+  // ─── L2: coverage threshold (greenfield-aware, #1319.8) ─────────────────────
+  // Run vitest with the json-summary reporter so we can inspect the real coverage
+  // totals at runtime. A virgin project has zero executable statements ⇒ the
+  // greenfield guard PASSES instead of false-failing the line threshold. A coverage
+  // run that crashed (no summary) FAILS — never silently skipped.
+  if (_inlineInspect('coverage threshold', 'npx vitest run --coverage --coverage.reporter=json-summary')) {} else {
+    const _covStart = Date.now();
+    _coverageRunStartedAt = _covStart;
+    process.stdout.write('[CHECK] coverage threshold ... ');
+    const _covThreshold = <%= coverageThreshold %>;
+    const _cov = spawnSync(
+      'npx',
+      ['vitest', 'run', '--coverage', '--coverage.reporter=json-summary'],
+      { encoding: 'utf-8', shell: false },
+    );
+    let _covStatus = 'PASS';
+    let _covReason = '';
+    let _covSummary = null;
+    const _covSummaryPath = resolve(process.cwd(), 'coverage', 'coverage-summary.json');
+    if (existsSync(_covSummaryPath)) {
+      try {
+        _covSummary = JSON.parse(readFileSync(_covSummaryPath, 'utf-8'));
+      } catch {
+        _covSummary = null; // malformed JSON ⇒ evaluateCoverageGate fails closed
+      }
+    }
+    const _covResult = evaluateCoverageGate(_covSummary, _covThreshold);
+    _covStatus = _covResult.status;
+    _covReason = _covResult.reason;
+    if (_covStatus === 'FAIL' && graceActive) {
+      console.log(`WARN (grace period — ${_covReason})`);
+      _covStatus = 'PASS';
+    } else if (_covStatus === 'FAIL') {
+      console.log(`FAIL (${_covReason})`);
+    } else {
+      console.log(`PASS (${_covReason})`);
+    }
+    pushResult('coverage threshold', _covStatus, Date.now() - _covStart);
+  }
+<% } else if(g.id === 'bdd-ignore-check') { %>
+  // ─── L2: BDD gate (INV-40) ──────────────────────────────────────────────────
+  if (_inlineInspect('BDD @ignore check', 'grep -rql --include=*.feature @ignore .')) {} else {
+    // @ignore-tagged scenarios are HARD-fail (soft: false per INV-40 — never graced)
+    const _bddIgnoreStart = Date.now();
+    const _bddIgnore = spawnSync('grep', ['-rql', '--include=*.feature', '@ignore', '.'], { encoding: 'utf-8', shell: false });
+    process.stdout.write('[CHECK] BDD @ignore check ... ');
+    let _bddIgnoreStatus = 'PASS';
+    if (_bddIgnore.error?.code === 'ENOENT') {
+      console.log('FAIL (grep not found — cannot check @ignore tags)');
+      _bddIgnoreStatus = 'FAIL';
+    } else if (_bddIgnore.status === null || _bddIgnore.status === 2) {
+      console.log(`FAIL (grep error — exit ${_bddIgnore.status ?? 'signal'}: ${_bddIgnore.stderr ?? ''})`);
+      _bddIgnoreStatus = 'FAIL';
+    } else if (_bddIgnore.status === 0) {
+      console.log('FAIL (@ignore-tagged scenarios found — remove tags or move to issue tracker)');
+      _bddIgnoreStatus = 'FAIL';
+    } else {
+      console.log('PASS');
+    }
+    pushResult('BDD @ignore check', _bddIgnoreStatus, Date.now() - _bddIgnoreStart);
+  }
+<% } else if(g.id === 'bdd-go') { %>
+  // direct parallel of Python's `pytest.importorskip("pytest_bdd")`.
+  {
+    const _goBddStart = Date.now();
+    const _goMod = existsSync('go.mod') ? readFileSync('go.mod', 'utf-8') : '';
+    if (_goMod.includes('github.com/cucumber/godog')) {
+      runCheck('bdd', 'go', ['test', '-tags', 'bdd', './internal/bdd/...'], { soft: graceActive });
+    } else {
+      console.log('[CHECK] bdd ... SKIP (github.com/cucumber/godog not in go.mod — run: go get github.com/cucumber/godog)');
+      pushResult('bdd', 'SKIP', Date.now() - _goBddStart);
+    }
+  }
+<% } else if(g.id === 'bdd-rust') { %>
+  // graceful-skip contract as the Go/Python BDD gates above.
+  {
+    const _rustBddStart = Date.now();
+    const _cargoToml = existsSync('Cargo.toml') ? readFileSync('Cargo.toml', 'utf-8') : '';
+    if (/^\s*bdd\s*=/m.test(_cargoToml) || _cargoToml.includes('cucumber')) {
+      runCheck('bdd', 'cargo', ['test', '--features', 'bdd'], { soft: graceActive });
+    } else {
+      console.log('[CHECK] bdd ... SKIP (no `bdd` feature / cucumber dep in Cargo.toml — see tests/example_bdd_test.rs)');
+      pushResult('bdd', 'SKIP', Date.now() - _rustBddStart);
+    }
+  }
+<% } else if(g.id === 'evidence-gate') { %>
+  // ─── L3/L4: Evidence gate (INV-33) ───────────────────────────────────────────
+  // Validates nightly evidence produced by evidence-collect.mjs.
+  // Warns when absent (first run); fails when present but obs_gate !== 'PASS'.
+  const _evidenceStart = Date.now();
+  let _evidenceStatus = 'PASS';
+  process.stdout.write('[CHECK] evidence gate (INV-33) ... ');
+  {
+    const _summaryPath = join(process.cwd(), '.evidence', 'SUMMARY.json');
+    if (!existsSync(_summaryPath)) {
+      console.log('WARN — .evidence/SUMMARY.json absent (run nightly pipeline first)');
+    } else {
+      try {
+        const _summary = JSON.parse(readFileSync(_summaryPath, 'utf-8'));
+        if (_summary.obs_gate === 'PASS') {
+          console.log('PASS');
+        } else {
+          console.log('FAIL (obs_gate=' + _summary.obs_gate + ')');
+          _evidenceStatus = 'FAIL';
+        }
+      } catch {
+        console.log('FAIL (could not parse .evidence/SUMMARY.json)');
+        _evidenceStatus = 'FAIL';
+      }
+    }
+  }
+  pushResult('evidence gate (INV-33)', _evidenceStatus, Date.now() - _evidenceStart);
+<% } %>
+<% } else { %>
+<% if (g.condition) { %>if (<%- g.condition %>) { <% } %>
+<% const _fn = g.kind === 'warn' ? 'runWarnCheck' : g.kind === 'tool' ? 'runToolCheck' : 'runCheck'; %>
+<%= _fn %>('<%= g.name %>', '<%= g.cmd[0] %>', [<% if (g.cmd.length > 1) { %>'<%- g.cmd.slice(1).join("', '") %>'<% } %>]<%= g.soft ? ', { soft: graceActive }' : '' %>);
+<% if (g.else) { %>} else {
+<%- g.else %>
+}<% } else if (g.condition) { %>}<% } %>
+<% } %>
+<%_ if (_skipCond.length) { _%>
+}
+<%_ } _%>
+<% } %>
+}
+
+// ─── Summary ─────────────────────────────────────────────────────────────────
+console.log('');
+console.log('=== Summary ===');
+console.log('');
+
+const _allResults = getResults();
+const _failedCount = getFailed();
+const nameWidth = Math.max(6, ..._allResults.map((r) => r.name.length));
+const header = `${'Check'.padEnd(nameWidth)}  Status  Elapsed`;
+const divider = '-'.repeat(header.length);
+console.log(header);
+console.log(divider);
+let totalElapsed = 0;
+for (const r of _allResults) {
+  totalElapsed += r.elapsed;
+  console.log(`${r.name.padEnd(nameWidth)}  ${r.status.padEnd(6)}  ${r.elapsed}ms`);
+}
+console.log(divider);
+console.log(`${'Total'.padEnd(nameWidth)}          ${totalElapsed}ms`);
+console.log('');
+
+// ─── Gate result JSON (arbiter-gate-v1) ──────────────────────────────────────
+// #2078: never write gate evidence from an inspection run (--dry-run / --gate) —
+// its `pass` would be a lie (all-SKIP for dry-run, a partial run for --gate).
+if (!_inspect) {
+  const _parityGates = _allResults
+    .map((r) => ({ name: r.name, pass: r.status === 'PASS' }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+  const _parityContentHash = createHash('sha256').update(JSON.stringify(_parityGates)).digest('hex');
+  const _contentHash = createHash('sha256').update(JSON.stringify(_parityGates)).digest('hex');
+  const _artifact = {
+    schema: 'arbiter-gate-v1',
+    node: process.version,
+    level,
+    gates: _allResults.map((r) => ({ name: r.name, pass: r.status === 'PASS', durationMs: r.elapsed })),
+    parityGates: _parityGates,
+    pass: _failedCount === 0,
+    parityContentHash: _parityContentHash,
+    contentHash: _contentHash,
+  };
+  const _outPath = (jsonPath !== null && jsonPath !== '') ? jsonPath : resolve(process.cwd(), '.arbiter/gate/local-result.json');
+  try {
+    mkdirSync(dirname(_outPath), { recursive: true });
+    writeFileSync(_outPath, JSON.stringify(_artifact, null, 2) + '\n');
+  } catch { /* non-fatal */ }
+}
+
+if (_failedCount === 0 && !_inspect) {
+  // #1441: stamp the task id so the Stop hook can reject a prior task's gate-pass (anti-replay).
+  const _taskId = (() => {
+    try {
+      const _sp = resolve(process.cwd(), '.claude/.task/status.json');
+      if (!existsSync(_sp)) return 'unknown';
+      const _s = JSON.parse(readFileSync(_sp, 'utf-8'));
+      return (typeof _s.taskId === 'string' && _s.taskId.length > 0) ? _s.taskId : 'unknown';
+    } catch { return 'unknown'; }
+  })();
+  // The marker binds tree content, checkout identity, toolchain identity, level
+  // and a TTL — not just head_sha + branch + a boolean. A fact that cannot be
+  // resolved yields no marker at all: a green gate with no marker is honest, a
+  // marker that cannot prove what it describes is not.
+  try {
+    // Loaded lazily so a project missing the verifier writes NO marker (fail
+    // closed) instead of crashing an otherwise-green gate at import time.
+    const { buildGateEvidence } = await import('./lib/gate-evidence.mjs');
+    // #2427: `_gateStart` is the identity captured before the first check ran; a
+    // marker is refused outright when it is missing, incomplete, or no longer
+    // matches. A green gate with no marker is honest; a marker naming a tree the
+    // gate did not measure end to end is not.
+    const _evidence = buildGateEvidence({ root: process.cwd(), level, taskId: _taskId, start: _gateStart });
+    if (_evidence === null) {
+      process.stderr.write(
+        'check-all: warning: gate marker NOT written — HEAD, checkout root or tree hash ' +
+          'could not be resolved, or the commit/tree moved while the gate was running, ' +
+          'so nothing can bind this gate result to this tree (#2427)\n',
+      );
+    } else {
+      const _markerPath = resolve(process.cwd(), '.arbiter/gate-pass.json');
+      mkdirSync(dirname(_markerPath), { recursive: true });
+      writeFileSync(_markerPath, JSON.stringify(_evidence, null, 2) + '\n');
+    }
+  } catch (_err) {
+    process.stderr.write(`check-all: warning: could not write gate marker: ${_err.message}\n`);
+  }
+}
+
+if (_failedCount > 0) {
+  const _failedResults = _allResults.filter((r) => r.status === 'FAIL' || r.status === 'TIMEOUT');
+  console.error(`=== FAILED: ${_failedCount} check(s) ===`);
+  console.error('Failed checks:');
+  for (const r of _failedResults) console.error(`- ${r.name} (${r.status})`);
+  console.error('');
+  process.exit(1);
+} else {
+  console.log('=== ALL PASSED ===\n');
+}