@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-cross-model-review.mjs.ejs

@@ -0,0 +1,458 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: validates task-scoped cross-model dispatch evidence, not the reviewer envelope corpus.
+// CATALOG: it cannot fold into check-agent-return.mjs because a missing external dispatch has no envelope for a corpus walk to discover.
+// CATALOG: it cannot fold into check-review-completion.mjs because that reconciles reviewer counts, not provider, degradation reason, or vendor provenance.
+// CATALOG: it cannot fold into check-agent-dispatch.mjs because that replays a static matrix and has no runtime artifact input; the src/ provider check is also outside the fail-open census, so this artifact is the compensating control.
+//
+// Exit codes (INV-53): 0 PASS/SKIP, 1 evidence or policy FAIL, 2 invocation/IO ERROR.
+// Usage: node scripts/check-cross-model-review.mjs [--root <dir>] [--task <id>] [--require-degraded]
+
+import {
+  constants as fsConstants,
+  closeSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { isAbsolute, join, relative, resolve } from 'node:path'
+import { randomBytes } from 'node:crypto'
+import { openRegularFileSync } from './lib/run-helpers.mjs'
+import { enforceCitations, validateSchema } from './lib/agent-return-validate.mjs'
+import { evidenceStaleness } from './lib/evidence-binding.mjs'
+
+const args = process.argv.slice(2)
+const requireFulfilled = args.includes('--require-fulfilled')
+const requireDegraded = args.includes('--require-degraded')
+function option(name) {
+  const index = args.indexOf(name)
+  return index >= 0 ? args[index + 1] : undefined
+}
+
+const root = resolve(option('--root') ?? process.cwd())
+
+function fail(message) {
+  process.stderr.write(`[check-cross-model-review] FAIL: ${message}\n`)
+  process.exit(1)
+}
+
+function error(message) {
+  process.stderr.write(`[check-cross-model-review] ERROR: ${message}\n`)
+  process.exit(2)
+}
+
+function descriptorPath(fd) {
+  return `${process.platform === 'linux' ? '/proc/self/fd' : '/dev/fd'}/${fd}`
+}
+
+function containedParts(relativePath) {
+  if (isAbsolute(relativePath)) throw new Error(`contained path must be relative: ${relativePath}`)
+  const parts = relativePath.split(/[\\/]+/)
+  if (parts.some((part) => part === '' || part === '.' || part === '..')) {
+    throw new Error(`contained path has invalid components: ${relativePath}`)
+  }
+  return parts
+}
+
+function openContainedDirectory(rootDir, directoryParts) {
+  if (process.platform === 'win32') {
+    error('descriptor-relative filesystem operations are unsupported on Windows')
+  }
+  const flags = fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW
+  let fd = -1
+  try {
+    fd = openSync('/', flags)
+    for (const part of [...resolve(rootDir).split('/').filter(Boolean), ...directoryParts]) {
+      const next = openSync(join(descriptorPath(fd), part), flags)
+      closeSync(fd)
+      fd = next
+    }
+    return fd
+  } catch (cause) {
+    if (fd !== -1) closeSync(fd)
+    throw cause
+  }
+}
+
+function openContainedFile(rootDir, relativePath) {
+  if (process.platform === 'win32') {
+    error('descriptor-relative filesystem operations are unsupported on Windows')
+  }
+  const parts = containedParts(relativePath)
+  const fileName = parts.pop()
+  const dirFd = openContainedDirectory(rootDir, parts)
+  try {
+    const fileFd = openRegularFileSync(join(descriptorPath(dirFd), fileName), true)
+    return { dirFd, fileFd }
+  } catch (cause) {
+    closeSync(dirFd)
+    throw cause
+  }
+}
+
+function closeContainedFile(handles) {
+  closeSync(handles.fileFd)
+  closeSync(handles.dirFd)
+}
+
+function readFileContained(rootDir, relativePath, label) {
+  let handles = null
+  try {
+    handles = openContainedFile(rootDir, relativePath)
+    return readFileSync(handles.fileFd, 'utf-8')
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause)
+    if (cause?.code === 'ENOENT' || cause?.code === 'ELOOP' || cause?.code === 'ENOTDIR') {
+      fail(`cannot read ${label} ${join(rootDir, relativePath)}: ${detail}`)
+    }
+    error(`cannot read ${label} ${join(rootDir, relativePath)}: ${detail}`)
+    throw cause
+  } finally {
+    if (handles !== null) closeContainedFile(handles)
+  }
+}
+
+function writeFileContained(rootDir, relativePath, data, label) {
+  let dirFd = -1
+  let tempFd = -1
+  let tempPath = null
+  try {
+    const parts = containedParts(relativePath)
+    const fileName = parts.pop()
+    dirFd = openContainedDirectory(rootDir, parts)
+    const dirPath = descriptorPath(dirFd)
+    tempPath = join(dirPath, `.arbiter-tmp-${randomBytes(4).toString('hex')}`)
+    tempFd = openSync(
+      tempPath,
+      fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW,
+      0o600,
+    )
+    writeFileSync(tempFd, data, 'utf-8')
+    closeSync(tempFd)
+    tempFd = -1
+    renameSync(tempPath, join(dirPath, fileName))
+    tempPath = null
+  } catch (cause) {
+    error(`cannot write ${label} ${join(rootDir, relativePath)}: ${cause instanceof Error ? cause.message : String(cause)}`)
+    throw cause
+  } finally {
+    if (tempFd !== -1) closeSync(tempFd)
+    if (tempPath !== null) {
+      try {
+        unlinkSync(tempPath)
+      // FAIL-OPEN-INTENT: cleanup failure must not replace the primary write error.
+      } catch {
+        // Preserve the primary write error.
+      }
+    }
+    if (dirFd !== -1) closeSync(dirFd)
+  }
+}
+
+function readContainedJson(rootDir, relativePath, label) {
+  try {
+    return JSON.parse(readFileContained(rootDir, relativePath, label))
+  } catch (cause) {
+    error(`cannot parse ${label} ${join(rootDir, relativePath)}: ${cause instanceof Error ? cause.message : String(cause)}`)
+    throw cause
+  }
+}
+
+function containedExists(rootDir, relativePath, label) {
+  let handles = null
+  try {
+    handles = openContainedFile(rootDir, relativePath)
+    return true
+  // FAIL-OPEN-INTENT: ENOENT means absent; every other filesystem error exits non-zero below.
+  } catch (cause) {
+    if (cause?.code === 'ENOENT') return false
+    const detail = cause instanceof Error ? cause.message : String(cause)
+    if (cause?.code === 'ELOOP' || cause?.code === 'ENOTDIR') {
+      fail(`cannot read ${label} ${join(rootDir, relativePath)}: ${detail}`)
+    }
+    error(`cannot read ${label} ${join(rootDir, relativePath)}: ${detail}`)
+    return false
+  } finally {
+    if (handles !== null) closeContainedFile(handles)
+  }
+}
+
+function isRecord(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function parseBooleanEnv(raw) {
+  if (raw === undefined) return undefined
+  const value = raw.trim().toLowerCase()
+  if (['true', '1', 'yes', 'on'].includes(value)) return true
+  if (['false', '0', 'no', 'off'].includes(value)) return false
+  return undefined
+}
+
+function isValidReviewerPanel(agents, count, collaborationMode) {
+  const expectedCount = collaborationMode === 'trunk-solo' ? 1 : 2
+  return (
+    Number.isInteger(count) &&
+    (count === expectedCount || count === 3) &&
+    Array.isArray(agents) &&
+    agents.length === count &&
+    agents.every((agent) => typeof agent === 'string' && agent.length > 0) &&
+    new Set(agents).size === agents.length &&
+    agents.filter((agent) => agent === 'codex-reviewer').length === 1
+  )
+}
+
+if (!containedExists(root, 'arbiter.json', 'configuration')) {
+  if (requireFulfilled) fail('cross-model review is not enabled')
+  process.stdout.write('[SKIP] [check-cross-model-review] skipped: crossModelReview not enabled\n')
+  process.exit(0)
+}
+
+const config = readContainedJson(root, 'arbiter.json', 'configuration')
+if (!isRecord(config)) error('arbiter.json must contain an object')
+const envOverride = parseBooleanEnv(process.env.ARBITER_CROSS_MODEL_REVIEW)
+const configuredCrossModel = config.crossModelReview
+let crossModel
+if (configuredCrossModel === undefined) {
+  if (envOverride !== true) {
+    if (requireFulfilled) fail('cross-model review is not enabled')
+    process.stdout.write('[SKIP] [check-cross-model-review] skipped: crossModelReview not enabled\n')
+    process.exit(0)
+  }
+  crossModel = { enabled: true, onUnavailable: 'degrade' }
+} else {
+  if (!isRecord(configuredCrossModel)) fail('crossModelReview must be an object when present')
+  crossModel = configuredCrossModel
+}
+if (crossModel.onUnavailable !== 'degrade' && crossModel.onUnavailable !== 'fail') {
+  fail('crossModelReview.onUnavailable must be degrade or fail')
+}
+const enabled = envOverride ?? crossModel.enabled
+if (enabled !== true) {
+  if (requireFulfilled) fail('cross-model review is not enabled')
+  if (envOverride === undefined && crossModel.enabled !== false) {
+    fail('crossModelReview.enabled must be boolean')
+  }
+  if (requireDegraded) {
+    process.stdout.write('[SKIP] [check-cross-model-review] skipped: crossModelReview not enabled\n')
+    process.exit(0)
+  }
+  const reason = envOverride === false ? 'disabled-by-env' : 'not enabled'
+  process.stdout.write(`[SKIP] [check-cross-model-review] skipped: crossModelReview ${reason}\n`)
+  process.exit(0)
+}
+
+const statusPath = join(root, '.claude', '.task', 'status.json')
+const status = option('--task')
+  ? { taskId: option('--task') }
+  : containedExists(root, '.claude/.task/status.json', 'task state')
+    ? readContainedJson(root, '.claude/.task/status.json', 'task state')
+    : null
+if (!isRecord(status) || typeof status.taskId !== 'string' || status.taskId.length === 0) {
+  fail(`enabled crossModelReview has no task id in ${statusPath}`)
+}
+
+const taskId = status.taskId
+const taskSegment = taskId.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64) || 'unknown'
+const evidenceRelativePath = join(
+  '.arbiter',
+  'evidence',
+  'cross-model',
+  taskSegment,
+  'dispatch.json',
+)
+const evidencePath = join(root, evidenceRelativePath)
+
+function gitValue(args, label) {
+  try {
+    return execFileSync('git', ['-C', root, ...args], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim()
+    // FAIL-OPEN-INTENT: an unreadable revision is an ERROR, never a pass without binding evidence to the current checkout.
+  } catch (cause) {
+    error(`cannot resolve current ${label}: ${cause instanceof Error ? cause.message : String(cause)}`)
+  }
+}
+
+const schemaPath = join(root, 'schemas', 'cross-model-dispatch.schema.json')
+let schema
+try {
+  if (!containedExists(root, 'schemas/cross-model-dispatch.schema.json', 'dispatch schema')) {
+    throw new Error(`schema not found: ${schemaPath}`)
+  }
+  schema = readContainedJson(root, 'schemas/cross-model-dispatch.schema.json', 'dispatch schema')
+  // FAIL-OPEN-INTENT: error() emits the failure and exits 2; the catch cannot return a pass.
+} catch (cause) {
+  error(`cannot load dispatch schema ${schemaPath}: ${cause instanceof Error ? cause.message : String(cause)}`)
+}
+const agentSchemaPath = join(root, 'schemas', 'agent-return.schema.json')
+let agentSchema
+try {
+  if (!containedExists(root, 'schemas/agent-return.schema.json', 'agent-return schema')) {
+    throw new Error(`schema not found: ${agentSchemaPath}`)
+  }
+  agentSchema = readContainedJson(root, 'schemas/agent-return.schema.json', 'agent-return schema')
+  // FAIL-OPEN-INTENT: error() emits the failure and exits 2; the catch cannot return a pass.
+} catch (cause) {
+  error(`cannot load agent-return schema ${agentSchemaPath}: ${cause instanceof Error ? cause.message : String(cause)}`)
+}
+const artifact = readContainedJson(root, evidenceRelativePath, 'dispatch evidence')
+let schemaErrors
+try {
+  schemaErrors = validateSchema(artifact, schema, schema, evidencePath)
+} catch (cause) {
+  error(`invalid dispatch schema: ${cause instanceof Error ? cause.message : String(cause)}`)
+}
+if (schemaErrors.length > 0) fail(schemaErrors.join('; '))
+if (artifact.taskId !== taskId) {
+  fail(`dispatch taskId ${JSON.stringify(artifact.taskId)} does not match active task ${JSON.stringify(taskId)}`)
+}
+
+const currentBranch = gitValue(['branch', '--show-current'], 'branch')
+const currentSha = gitValue(['rev-parse', 'HEAD'], 'HEAD SHA')
+if (artifact.branch !== currentBranch) {
+  fail(`dispatch branch ${JSON.stringify(artifact.branch)} does not match current branch ${JSON.stringify(currentBranch)}`)
+}
+// #2399: bound to SOURCE CONTENT, not to an exact HEAD — an evidence-only commit
+// must not invalidate the evidence it just recorded. The dirty-checkout guard
+// below still covers uncommitted source changes.
+const dispatchStaleness = evidenceStaleness(root, artifact.sha, { branch: artifact.branch })
+if (dispatchStaleness !== null) fail(`dispatch evidence ${dispatchStaleness}`)
+
+const changedPaths = [
+  gitValue(['diff', '--name-only'], 'working tree changes')
+    .split(/\r?\n/)
+    .filter(Boolean),
+  gitValue(['diff', '--cached', '--name-only'], 'index changes')
+    .split(/\r?\n/)
+    .filter(Boolean),
+  gitValue(['status', '--porcelain=v1', '--untracked-files=all'], 'checkout status')
+    .split(/\r?\n/)
+    .filter((line) => line.length > 2)
+    .map((line) => line.slice(3)),
+]
+  .flat()
+  .filter((path) => path.length > 0 && !path.startsWith('.arbiter/'))
+if (changedPaths.length > 0) {
+  fail('checkout has unreviewed changes after cross-model dispatch')
+}
+
+if (
+  artifact.requested.length > 1 ||
+  artifact.fulfilled.length > 1 ||
+  artifact.degraded.length > 1
+) {
+  fail('cross-model dispatch has one external seat; requested and outcome arrays must contain at most one entry')
+}
+
+if (artifact.requested.length === 0) {
+  if (artifact.fulfilled.length > 0 || artifact.degraded.length > 0) {
+    fail('dispatch has outcomes but no requested external slot')
+  }
+} else if (artifact.fulfilled.length === 0 && artifact.degraded.length === 0) {
+  fail('every requested external slot must have a fulfilled or degraded outcome')
+} else if (artifact.fulfilled.length + artifact.degraded.length !== artifact.requested.length) {
+  fail(`dispatch outcomes (${artifact.fulfilled.length + artifact.degraded.length}) do not match requested external slots (${artifact.requested.length})`)
+}
+
+if (
+  requireFulfilled &&
+  (artifact.requested.length !== 1 || artifact.fulfilled.length !== 1 || artifact.degraded.length !== 0)
+) {
+  fail('--require-fulfilled needs exactly one fulfilled Codex seat and no degradation')
+}
+if (
+  requireDegraded &&
+  (artifact.requested.length !== 1 || artifact.fulfilled.length !== 0 || artifact.degraded.length !== 1)
+) {
+  fail('--require-degraded needs exactly one degraded external seat and no fulfillment')
+}
+
+const agentReturnsRoot = resolve(root, '.arbiter', 'evidence', 'agent-returns', taskSegment)
+for (const [index, fulfilled] of artifact.fulfilled.entries()) {
+  const envelope = fulfilled.envelope
+  if (isAbsolute(envelope)) fail(`fulfilled[${index}].envelope must be repo-relative`)
+  const envelopePath = resolve(root, envelope)
+  const outside = relative(root, envelopePath)
+  if (outside.startsWith('..') || isAbsolute(outside)) {
+    fail(`fulfilled[${index}].envelope escapes the repository: ${envelope}`)
+  }
+  const outsideAgentReturns = relative(agentReturnsRoot, envelopePath)
+  if (outsideAgentReturns === '' || outsideAgentReturns.startsWith('..') || isAbsolute(outsideAgentReturns)) {
+    fail(`fulfilled[${index}].envelope must be under the active task's agent-return directory: ${envelope}`)
+  }
+  const envelopeName = relative(agentReturnsRoot, envelopePath)
+  if (!/^codex-reviewer(?:-\d+)?\.json$/.test(envelopeName)) {
+    fail(`fulfilled[${index}].envelope must use the canonical Codex reviewer filename: ${envelope}`)
+  }
+  const envelopeValue = readContainedJson(root, envelope, 'fulfilled envelope')
+  let envelopeSchemaErrors
+try {
+  envelopeSchemaErrors = validateSchema(envelopeValue, agentSchema, agentSchema, envelopePath)
+} catch (cause) {
+  error(`invalid agent-return schema: ${cause instanceof Error ? cause.message : String(cause)}`)
+}
+  if (envelopeSchemaErrors.length > 0) fail(envelopeSchemaErrors.join('; '))
+  if (envelopeValue.agent !== 'codex-reviewer' || envelopeValue.role !== 'reviewer') {
+    fail(`fulfilled[${index}].envelope must be the Codex reviewer envelope`)
+  }
+  if (!isRecord(envelopeValue) || envelopeValue.taskId !== taskId) {
+    fail(`fulfilled[${index}].envelope taskId must match active task ${JSON.stringify(taskId)}`)
+  }
+  if (envelopeValue.branch !== currentBranch) {
+    fail(`fulfilled[${index}].envelope branch ${JSON.stringify(envelopeValue.branch)} does not match current branch ${JSON.stringify(currentBranch)}`)
+  }
+  const envelopeStaleness = evidenceStaleness(root, envelopeValue.sha, { branch: envelopeValue.branch })
+  if (envelopeStaleness !== null) {
+    fail(`fulfilled[${index}].envelope ${envelopeStaleness}`)
+  }
+  const provenance = isRecord(envelopeValue.provenance) ? envelopeValue.provenance : null
+  if (
+    provenance?.vendor !== 'openai' ||
+    provenance.dispatch !== 'external-cli' ||
+    provenance.cli !== 'codex'
+  ) {
+    fail(`fulfilled[${index}].envelope must carry Codex provenance (vendor=openai, dispatch=external-cli, cli=codex)`)
+  }
+  const citationErrors = enforceCitations(envelopeValue, root, envelopePath)
+  if (citationErrors.length > 0) fail(citationErrors.join('; '))
+}
+
+if (crossModel.onUnavailable === 'fail' && artifact.degraded.length > 0) {
+  fail('crossModelReview.onUnavailable=fail with degraded dispatch evidence')
+}
+if (artifact.fulfilled.length > 0 && crossModel.diffEgressConsent !== true) {
+  fail('fulfilled cross-model evidence requires current diffEgressConsent=true')
+}
+
+const recordPanel = option('--record-panel')
+if (recordPanel !== undefined) {
+  if (!requireFulfilled) error('--record-panel requires --require-fulfilled')
+  const recordCount = Number(option('--record-count'))
+  let agents
+  try {
+    agents = JSON.parse(recordPanel)
+  } catch (cause) {
+    error(`cannot parse reviewer panel: ${cause instanceof Error ? cause.message : String(cause)}`)
+    throw cause
+  }
+  if (!isValidReviewerPanel(agents, recordCount, config.collaborationMode)) {
+    error('reviewer panel count does not match its agent list')
+  }
+  writeFileContained(
+    root,
+    '.arbiter/agents-dispatched.json',
+    `${JSON.stringify({ count: recordCount, agents, taskId, branch: currentBranch, sha: currentSha })}\n`,
+    'reviewer sidecar',
+  )
+}
+
+process.stdout.write(
+  `[check-cross-model-review] PASS — ${artifact.requested.length} requested, ` +
+    `${artifact.fulfilled.length} fulfilled, ${artifact.degraded.length} degraded\n`,
+)
+process.exit(0)

package/dist/templates/scripts/check-decision-registry.mjs.ejs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// <%= projectName %> — decision-registry gate (#2036, D-NN orphan check).
+// Reads DECISION_REGISTRY.md (or an adopted COSTITUZIONE.md carrying the
+// `arbiter:preserve` marker) and fails on ORPHAN decisions: a D-NN table row
+// with no Enforcement declaration and no `documentale` exemption.
+//
+// Grammar (documented in the scaffolded registry):
+//   | D-NN | decisione | razionale | decisore | data |
+//   Enforcement: <gate|test|documentale>     <- must directly follow the row
+//
+// Exit codes (INV-53): 0 = PASS/SKIP, 1 = FAIL (orphan decision), 2 = ERROR.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const CWD = process.cwd();
+const CANDIDATES = ['DECISION_REGISTRY.md', 'COSTITUZIONE.md'];
+const registryPath = CANDIDATES.map((c) => join(CWD, c)).find((p) => existsSync(p));
+
+if (!registryPath) {
+  // #2052: recognized marker so runCheck surfaces SKIP, not PASS.
+  process.stdout.write('[SKIP] no DECISION_REGISTRY.md (or adopted COSTITUZIONE.md) found\n');
+  process.exit(0);
+}
+
+const source = readFileSync(registryPath, 'utf-8');
+if (source.includes('arbiter:preserve')) {
+  process.stdout.write(
+    '[SKIP] registry carries `arbiter:preserve` — user-owned format, enforcement review is manual\n',
+  );
+  process.exit(0);
+}
+
+// ─── Parse: D-NN table rows + their Enforcement declaration ───────────────────
+// A row is `| D-NN | ... |`; its Enforcement line must directly follow (the next
+// non-blank line) before the next table row or heading.
+const ROW_RE = /^\|\s*(D-\d+)\s*\|/;
+// #2257: the scaffolded registry places the Enforcement line directly below the table
+// row with NO blank line in between (by design, so the gate can find it) — but that
+// makes it adjacent enough for a markdown table formatter (prettier) to fold it into
+// the table as a trailing `| Enforcement: ... |` row on a Day-1 `format --write`. Both
+// the plain and pipe-wrapped shapes are accepted so formatting the file never orphans
+// a decision that was actually declared.
+const ENFORCEMENT_RE = /^\s*\|?\s*Enforcement:\s*(.+?)\s*\|?\s*$/;
+const lines = source.split('\n');
+const orphans = [];
+const exempt = [];
+const enforced = [];
+for (let i = 0; i < lines.length; i++) {
+  const row = lines[i].match(ROW_RE);
+  if (!row) continue;
+  const id = row[1];
+  // Scan forward to the next table row / heading / blank-then-content boundary.
+  let enforcement = null;
+  for (let j = i + 1; j < lines.length; j++) {
+    const line = lines[j];
+    if (ROW_RE.test(line)) break;
+    if (/^#{1,6}\s/.test(line) || /^\|\s*---/.test(line)) break;
+    const decl = line.match(ENFORCEMENT_RE);
+    if (decl) {
+      enforcement = decl[1].trim();
+      break;
+    }
+    if (line.trim() === '' ) {
+      // blank line ends the declaration window unless the next line is Enforcement
+      const next = lines[j + 1];
+      const nxt = next !== undefined ? next.match(ENFORCEMENT_RE) : null;
+      if (!nxt) break;
+      enforcement = nxt[1].trim();
+      break;
+    }
+  }
+  if (!enforcement || enforcement === '—' || enforcement === '-' || enforcement === 'n/a') {
+    orphans.push(id);
+  } else if (enforcement.toLowerCase() === 'documentale') {
+    exempt.push(id);
+  } else {
+    enforced.push(id);
+  }
+}
+
+if (orphans.length > 0) {
+  process.stderr.write(
+    `check-decision-registry: FAIL — ${orphans.length} orphan decision(s) (no enforcement, no documentale exemption):\n`,
+  );
+  for (const id of orphans) process.stderr.write(`  - ${id}\n`);
+  process.stderr.write(
+    'Fix: add `Enforcement: <gate|test>` below the row, or `Enforcement: documentale` for an explicit exemption.\n',
+  );
+  process.exit(1);
+}
+
+if (exempt.length > 0) {
+  process.stdout.write(
+    `check-decision-registry: PASS — ${enforced.length} enforced, ${exempt.length} documentale-exempt (${exempt.join(', ')}), 0 orphan\n`,
+  );
+} else {
+  process.stdout.write(
+    `check-decision-registry: PASS — ${enforced.length} enforced, 0 orphan decisions\n`,
+  );
+}
+process.exit(0);

package/dist/templates/scripts/check-doc-freshness.mjs.ejs

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// scripts/check-doc-freshness.mjs — generated by arbiter (T4, gold-doc-tranches-t3-t5.md §2.3).
+// Per-doc freshness audit runner for this project. Delegates to `arbiter doc-set --freshness`
+// via the root-local CLI (no `yaml` dep — the engine runs inside arbiter's own environment
+// against this repo, same shape as check-doc-set.mjs.ejs).
+//
+// Usage: node scripts/check-doc-freshness.mjs [--json]
+//
+// Exit codes (INV-53): 0=all graded docs fresh, 1=>=1 stale doc, 2=ERROR. Binary — there is no
+// advisory mode inside the engine; softness (advisory/monthly/release-blocking) lives entirely in
+// where this runner is WIRED (starter/standard/industrial pipelineStyle band), never in the script.
+import { runLocalArbiter } from './lib/run-helpers.mjs'
+
+const args = process.argv.slice(2)
+
+process.exit(runLocalArbiter(['doc-set', '--freshness', ...args]))

package/dist/templates/scripts/check-doc-links.mjs.ejs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+// <%= projectName %> — doc-links gate
+// Gate: verify markdown links in docs/ resolve; follow CANONICAL_PATHS redirects.
+// Exits 0: all links resolve (possibly via redirect) or no docs found.
+// Exits 1: one or more broken links with no valid redirect.
+import { existsSync, readFileSync } from 'node:fs';
+import { join, dirname, resolve, relative } from 'node:path';
+import { walkRepo } from './lib/glob-walk.mjs';
+
+const CWD = process.cwd();
+const CANONICAL_PATHS_FILE = join(CWD, 'docs', 'METHOD', 'CANONICAL_PATHS.md');
+const IGNORE_FILE = join(CWD, '.docs-links-ignore');
+const DOCS_DIR = join(CWD, 'docs');
+
+const ignored = new Set();
+if (existsSync(IGNORE_FILE)) {
+  readFileSync(IGNORE_FILE, 'utf-8')
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean)
+    .forEach((p) => ignored.add(p));
+}
+
+function loadAliases() {
+  const aliases = new Map();
+  if (!existsSync(CANONICAL_PATHS_FILE)) return aliases;
+  const lines = readFileSync(CANONICAL_PATHS_FILE, 'utf-8').split('\n');
+  for (const line of lines) {
+    const m = line.match(/\|\s*`([^`]+)`\s*\|\s*`([^`]+)`/);
+    if (m) aliases.set(m[1], m[2]);
+  }
+  return aliases;
+}
+
+// Directory walking is delegated to the shared cycle-safe walkRepo (#1521/#1544): a single helper
+// owns tree traversal (symlink-cycle safe, vendor-tree pruning via SKIP_DIRS) instead of a
+// hand-rolled recursion. Returns absolute `.md` paths under `dir`.
+function findMarkdownFiles(dir) {
+  if (!existsSync(dir)) return [];
+  return walkRepo(dir)
+    .filter((rel) => rel.endsWith('.md'))
+    .map((rel) => join(dir, rel));
+}
+
+function isLocal(href) {
+  return (
+    !href.startsWith('http://') &&
+    !href.startsWith('https://') &&
+    !href.startsWith('#') &&
+    !href.startsWith('mailto:')
+  );
+}
+
+const aliases = loadAliases();
+const markdownFiles = findMarkdownFiles(DOCS_DIR);
+
+if (markdownFiles.length === 0) {
+  console.log('  check-doc-links: no docs found — skipping');
+  process.exit(0);
+}
+
+const LINK_PATTERN = /\[([^\]]*)\]\(([^)]+)\)/g;
+let broken = 0;
+
+for (const file of markdownFiles) {
+  const content = readFileSync(file, 'utf-8');
+  const fileDir = dirname(file);
+  for (const linkMatch of content.matchAll(LINK_PATTERN)) {
+    const href = linkMatch[2].split('#')[0];
+    if (!href || !isLocal(href)) continue;
+
+    const absTarget = resolve(fileDir, href);
+    const relTarget = relative(CWD, absTarget);
+
+    if (ignored.has(relTarget)) continue;
+    if (existsSync(absTarget)) continue;
+
+    const redirectTarget = aliases.get(relTarget);
+    if (redirectTarget) {
+      const absRedirect = join(CWD, redirectTarget);
+      if (existsSync(absRedirect)) continue;
+      const srcRel = relative(CWD, file);
+      console.log(`  broken: ${srcRel}: ${relTarget} → redirect ${redirectTarget} also missing`);
+    } else {
+      const srcRel = relative(CWD, file);
+      console.log(`  broken: ${srcRel}: ${relTarget}`);
+    }
+    broken++;
+  }
+}
+
+if (broken === 0) {
+  console.log(`  check-doc-links: all links resolve (${markdownFiles.length} files scanned)`);
+  process.exit(0);
+}
+
+console.log(`\n  check-doc-links: ${broken} broken link(s) found`);
+process.exit(1);