@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-doc-set.mjs.ejs

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// scripts/check-doc-set.mjs — generated by arbiter (#1428).
+// Doc-set presence audit runner for this project.
+// Delegates to the root-local `arbiter doc-set` CLI (no `yaml` dep —
+// the engine runs inside arbiter's own environment against this repo).
+//
+// Usage: node scripts/check-doc-set.mjs [--check] [--strict] [--json] [--generate] [--help]
+//
+// Exit codes (INV-53): 0=PASS/advisory, 1=FAIL (missing mandatory under --strict), 2=ERROR.
+// When invoked by check-all.mjs (advisory, L2) the exit code is informational; the
+// gate never hard-fails on the doc-set result alone. Plain --check runs the engine in its
+// default advisory mode and exits 0 (no day-1 redness); the strict hard guard is opt-in.
+import { runLocalArbiter } from './lib/run-helpers.mjs'
+
+const args = process.argv.slice(2)
+
+process.exit(runLocalArbiter(['doc-set', ...args]))

package/dist/templates/scripts/check-docs.mjs.ejs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+// <%= projectName %> — Docs gate: if src/ or __tests__/ changed since the merge-base with origin/main,
+// docs/ or README.md must also change.
+//
+// Rebased-aware: uses `git merge-base HEAD origin/main` so a rebased branch only sees its own
+// commits (not main commits replayed underneath). Falls back to `origin/main` then `main` if the
+// remote ref is missing locally.
+//
+// Bypass: any commit message in the diff range containing `[skip-docs]` causes the gate to PASS.
+// This mirrors the CI `docs-check` job so the gate fires identically pre-push.
+import { spawnSync } from 'node:child_process';
+
+const BYPASS_TOKEN = '[skip-docs]';
+const TRIGGER_PREFIXES = ['src/', '__tests__/'];
+const DOC_PREFIXES = ['docs/'];
+const DOC_FILES = new Set(['README.md']);
+
+function git(args) {
+  const r = spawnSync('git', args, { encoding: 'utf-8' });
+  return { status: r.status ?? 1, stdout: (r.stdout ?? '').trim(), stderr: (r.stderr ?? '').trim() };
+}
+
+function resolveBase() {
+  // Prefer the merge-base with origin/main (rebased-aware). Fall back to plain refs.
+  for (const ref of ['origin/main', 'main']) {
+    const verify = git(['rev-parse', '--verify', '--quiet', ref]);
+    if (verify.status === 0 && verify.stdout) {
+      const mb = git(['merge-base', 'HEAD', ref]);
+      if (mb.status === 0 && mb.stdout) return mb.stdout;
+      return ref;
+    }
+  }
+  // No base available — treat all of HEAD as the diff (single-branch repo).
+  return null;
+}
+
+const base = resolveBase();
+const diffRange = base ? `${base}..HEAD` : null;
+
+const diff = diffRange ? git(['diff', '--name-only', diffRange]) : { status: 0, stdout: '', stderr: '' };
+if (diff.status !== 0) {
+  console.error('git diff failed:', diff.stderr);
+  process.exit(1);
+}
+const staged = git(['diff', '--name-only', '--cached']);
+const changed = new Set(
+  [...diff.stdout.split('\n'), ...staged.stdout.split('\n')].map((s) => s.trim()).filter(Boolean),
+);
+
+const hasCode = [...changed].some((f) => TRIGGER_PREFIXES.some((p) => f.startsWith(p)));
+const hasDocs = [...changed].some(
+  (f) => DOC_PREFIXES.some((p) => f.startsWith(p)) || DOC_FILES.has(f),
+);
+
+// Bypass check: scan commit subjects+bodies in the diff range for BYPASS_TOKEN.
+let bypassed = false;
+if (diffRange) {
+  const log = git(['log', '--format=%B', diffRange]);
+  if (log.status === 0 && log.stdout.includes(BYPASS_TOKEN)) bypassed = true;
+}
+
+if (hasCode && !hasDocs && !bypassed) {
+  console.error('Code changed without documentation update.');
+  console.error('Files changed in src/ or __tests__/:');
+  for (const f of changed) {
+    if (TRIGGER_PREFIXES.some((p) => f.startsWith(p))) console.error('  ' + f);
+  }
+  console.error(`Update docs/ or README.md, or add "${BYPASS_TOKEN}" to a commit message to bypass.`);
+  process.exit(1);
+}
+console.log('Docs check passed.');

package/dist/templates/scripts/check-domain-api-surface.mjs.ejs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// <%= projectName %> — domain<->API surface-completeness gate (INV-125)
+// Generated by arbiter (src/templates/scripts/check-domain-api-surface.mjs.ejs)
+//
+// CATALOG: INV-125 enforcement. Reads domain-api-surface.json at repo root; fails when a
+// CATALOG:   persisted domain field is absent from both request and response schemas.
+// CATALOG:   SKIP when manifest absent (non-governed projects never false-fail).
+//
+// Exit codes per INV-53: 0=PASS/SKIP, 1=surface gap, 2=schema/parse error
+import { readFileSync, existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+
+const MANIFEST_FILENAME = 'domain-api-surface.json'
+const EXPECTED_SCHEMA = 'arbiter-domain-api-surface-v1'
+
+const repoRoot = process.env.REPO_ROOT ?? resolve('.')
+const manifestPath = join(repoRoot, MANIFEST_FILENAME)
+
+if (!existsSync(manifestPath)) {
+  console.log(`[domain-api-surface] SKIP — manifest absent (${MANIFEST_FILENAME} not found)`)
+  // #2052: recognized marker so runCheck surfaces SKIP, not PASS, in the gate summary.
+  console.log(`[SKIP] manifest absent (${MANIFEST_FILENAME} not found)`)
+  process.exit(0)
+}
+
+let manifest
+try {
+  manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+} catch (err) {
+  console.error(`[domain-api-surface] ERROR — cannot parse ${MANIFEST_FILENAME}: ${err.message}`)
+  process.exit(2)
+}
+
+if (manifest.schema !== EXPECTED_SCHEMA) {
+  console.error(
+    `[domain-api-surface] ERROR — unexpected schema ${JSON.stringify(manifest.schema)}, ` +
+      `expected "${EXPECTED_SCHEMA}"`,
+  )
+  process.exit(2)
+}
+
+if (!Array.isArray(manifest.resources)) {
+  console.error(`[domain-api-surface] ERROR — manifest.resources must be an array`)
+  process.exit(2)
+}
+
+const gaps = []
+
+for (const resource of manifest.resources) {
+  const resourceName = resource.resource ?? '(unnamed)'
+  if (!Array.isArray(resource.domainFields)) continue
+
+  for (const field of resource.domainFields) {
+    if (field.persisted === true && !field.inRequestSchema && !field.inResponseSchema) {
+      gaps.push({ resource: resourceName, field: field.name ?? '(unnamed)' })
+    }
+  }
+}
+
+if (gaps.length > 0) {
+  console.error(
+    `[domain-api-surface] FAIL — ${gaps.length} persisted field(s) unreachable through HTTP API:`,
+  )
+  for (const g of gaps) {
+    console.error(
+      `  ${g.resource}.${g.field}: persisted=true but absent from request AND response schemas`,
+    )
+  }
+  console.error(
+    'Fix: set inRequestSchema:true or inResponseSchema:true, or set persisted:false if intentionally hidden.',
+  )
+  process.exit(1)
+}
+
+const checked = manifest.resources.reduce((sum, r) => sum + (r.domainFields?.length ?? 0), 0)
+console.log(
+  `[domain-api-surface] PASS — ${checked} field(s) across ${manifest.resources.length} resource(s) all reachable`,
+)
+process.exit(0)

package/dist/templates/scripts/check-drift.mjs.ejs

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+// <%= projectName %> — generated content drift detector (INV-89)
+// Validates that committed generated files match what the generator would produce.
+// Uses a manifest of generated files with expected content hashes.
+// Exits 0 when no drift found; exits 1 when generated content has drifted.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+
+const args = process.argv.slice(2);
+
+// #2044 (AC-2044.5/6): live-SSOT binding — a commit that touches CODE must also
+// update every declared-live SSOT surface (matrix/ledger) in the SAME commit.
+// The obligation is LIMITED to the surfaces declared in .arbiter/live-ssot.json
+// (never every commit); the manifest absent => SKIP. The binding inspects the
+// LAST commit (HEAD vs HEAD^): CI runs the gate against the branch head.
+function runLiveSsotBinding() {
+  const LIVE_MANIFEST = join(CWD, '.arbiter', 'live-ssot.json');
+  if (!existsSync(LIVE_MANIFEST)) {
+    process.stdout.write('[SKIP] no .arbiter/live-ssot.json — no declared-live SSOT surfaces\n');
+    return true;
+  }
+  let declaration;
+  try {
+    declaration = JSON.parse(readFileSync(LIVE_MANIFEST, 'utf-8'));
+  } catch (err) {
+    process.stderr.write(`check-drift: FAIL — invalid JSON in ${LIVE_MANIFEST}: ${err.message}\n`);
+    return false;
+  }
+  const surfaces = Array.isArray(declaration?.surfaces) ? declaration.surfaces : [];
+  if (surfaces.length === 0) {
+    process.stderr.write(`check-drift: FAIL — ${LIVE_MANIFEST} declares no surfaces\n`);
+    return false;
+  }
+  const git = spawnSync('git', ['rev-parse', '--verify', 'HEAD^'], { cwd: CWD, encoding: 'utf-8' });
+  if (git.status !== 0) {
+    // Initial commit (no parent) — nothing to bind yet.
+    process.stdout.write('[SKIP] no parent commit — live-SSOT binding needs a commit range\n');
+    return true;
+  }
+  const changed = spawnSync('git', ['diff', '--name-only', 'HEAD^', 'HEAD'], {
+    cwd: CWD,
+    encoding: 'utf-8',
+  });
+  const changedFiles = (changed.stdout ?? '').split('\n').filter((l) => l.trim() !== '');
+  const surfacePaths = surfaces.map((s) => s?.path).filter((p) => typeof p === 'string');
+  const touchedSurfaces = changedFiles.filter((f) => surfacePaths.includes(f));
+  // Code = any changed path that is not a doc, not the drift/live manifests,
+  // not a declared surface, not a workflow/generated artifact.
+  const codeFiles = changedFiles.filter(
+    (f) =>
+      !f.startsWith('docs/') &&
+      !f.endsWith('.md') &&
+      !f.startsWith('.arbiter/') &&
+      !f.startsWith('.github/') &&
+      !surfacePaths.includes(f),
+  );
+  if (codeFiles.length === 0) {
+    process.stdout.write('check-drift: live-SSOT binding — no code files in the last commit\n');
+    return true;
+  }
+  if (touchedSurfaces.length === 0) {
+    process.stderr.write(
+      `check-drift: FAIL — live-SSOT binding: code changed without updating the declared-live surface(s):\n`,
+    );
+    for (const s of surfacePaths) process.stderr.write(`  - ${s}\n`);
+    process.stderr.write(
+      `  code files in commit: ${codeFiles.join(', ')}\n` +
+        '  Fix: update the live surface in the SAME commit (INV-63 SSOT atomic).\n',
+    );
+    return false;
+  }
+  process.stdout.write(
+    `check-drift: live-SSOT binding OK — ${touchedSurfaces.length} surface(s) updated in the commit\n`,
+  );
+  return true;
+}
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-drift.mjs [options]',
+    '',
+    'Validates that committed generated files match expected content hashes.',
+    'Exits 0 when no drift found; exits 1 when generated content has drifted.',
+    '',
+    'Manifest format: JSON array of { path, hash, generator } entries.',
+    '',
+    'Options:',
+    '  --manifest <path>   Path to drift manifest (default: .arbiter/drift-manifest.json)',
+    '  --dir <path>        Root directory (default: cwd)',
+    '  --help, -h          Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const manifestArg = args.indexOf('--manifest');
+const dirArg = args.indexOf('--dir');
+const CWD = dirArg >= 0 && args[dirArg + 1] ? resolve(args[dirArg + 1]) : process.cwd();
+const MANIFEST_PATH = manifestArg >= 0 && args[manifestArg + 1]
+  ? resolve(args[manifestArg + 1])
+  : join(CWD, '.arbiter', 'drift-manifest.json');
+
+// #2044: live-SSOT binding runs BEFORE the hash check (independent concern);
+// a binding violation exits 1 without touching the hash audit.
+if (!runLiveSsotBinding()) process.exit(1);
+
+if (!existsSync(MANIFEST_PATH)) {
+  process.stdout.write('check-drift: SKIP — no drift manifest found (.arbiter/drift-manifest.json)\n');
+  // #2052/#2012: recognized marker so runCheck surfaces SKIP, not PASS. Without it a
+  // manifest-less repo reports PASS on every gate run while verifying nothing.
+  process.stdout.write('[SKIP] no drift manifest found (.arbiter/drift-manifest.json)\n');
+  process.exit(0);
+}
+
+let manifest;
+try {
+  manifest = JSON.parse(readFileSync(MANIFEST_PATH, 'utf-8'));
+} catch (err) {
+  if (err instanceof SyntaxError) {
+    process.stderr.write(`check-drift: FAIL — invalid JSON in manifest: ${err.message}\n`);
+    process.exit(1);
+  }
+  throw err;
+}
+
+if (!Array.isArray(manifest)) {
+  process.stderr.write('check-drift: FAIL — drift manifest must be a JSON array\n');
+  process.exit(1);
+}
+
+let violations = 0;
+let checked = 0;
+
+for (const entry of manifest) {
+  if (!entry || typeof entry.path !== 'string' || typeof entry.hash !== 'string') {
+    process.stderr.write(`[FAIL] invalid manifest entry: ${JSON.stringify(entry)}\n`);
+    violations++;
+    continue;
+  }
+  const filePath = join(CWD, entry.path);
+  if (!existsSync(filePath)) {
+    process.stderr.write(`[FAIL] generated file missing: ${entry.path} (expected hash: ${entry.hash})\n`);
+    violations++;
+    continue;
+  }
+  checked++;
+  const content = readFileSync(filePath, 'utf-8');
+  const actual = createHash('sha256').update(content).digest('hex');
+  if (actual !== entry.hash) {
+    const generator = entry.generator ? ` (generator: ${entry.generator})` : '';
+    process.stderr.write(
+      `[FAIL] drift detected in ${entry.path}${generator}\n  expected: ${entry.hash}\n  actual:   ${actual}\n`,
+    );
+    violations++;
+  }
+}
+
+if (violations > 0) {
+  process.stderr.write(
+    `check-drift: FAIL — ${violations}/${manifest.length} generated file(s) have drifted (INV-89)\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write(`check-drift: OK — all ${checked} generated file(s) match manifest hashes (INV-89)\n`);
+process.exit(0);

package/dist/templates/scripts/check-duplication.mjs.ejs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+// check-duplication.mjs — generated by arbiter
+// CATALOG: fail-closed duplication gate — runs jscpd v5 with the fileset from
+// CATALOG: .jscpd.json#path and FAILS on config drift or a 0-source scan (which
+// CATALOG: jscpd v5 exits 0 on, silently neutering a bare `npx jscpd` gate).
+// CATALOG: rejected fold-in into debt-report.mjs because that is the ratchet leg
+// CATALOG: (baseline comparison); this is the absolute threshold leg.
+// Exits 1 on: unreadable config, missing/empty `path`, jscpd failure, missing
+// report, 0 sources, or threshold breach (jscpd exit 1).
+// Re-generate with: arbiter update
+import { jscpdScan } from './debt-lib.mjs';
+
+try {
+  const scan = jscpdScan(process.cwd());
+  if (scan.skipped) {
+    console.log('[duplication] FAIL: npx not available — cannot run jscpd');
+    process.exit(1);
+  }
+  if (scan.error) {
+    console.log(`[duplication] FAIL: ${scan.error}`);
+    process.exit(1);
+  }
+  if (scan.legacyNoReport) {
+    // jscpd v4 binary with zero clones (v5 always writes the report). Pass
+    // with a loud upgrade warning: brownfield projects keep their pinned v4
+    // devDep until the dependency is bumped by hand.
+    console.log(
+      '[duplication] WARN: jscpd v4 semantics detected (no report on exit 0, zero clones). ' +
+        'Upgrade the jscpd devDep to v5 to keep this gate fail-closed.',
+    );
+    process.exit(0);
+  }
+  if ((scan.status ?? 0) !== 0) {
+    console.log(
+      `[duplication] FAIL: jscpd exit ${scan.status} — duplication over threshold (${scan.percentage}% across ${scan.sources} files)`,
+    );
+    process.exit(1);
+  }
+  console.log(
+    `[duplication] OK: ${scan.percentage.toFixed(2)}% duplicated lines across ${scan.sources} files`,
+  );
+} catch (err) {
+  console.log(`[duplication] FAIL: ${err.message}`);
+  process.exit(1);
+}

package/dist/templates/scripts/check-e2e-escalation.mjs.ejs

@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: #2043 (AC-2043.5/6) enforcement. Reads the append-only e2e reliability
+// CATALOG:   ledger (.arbiter/e2e-ledger.jsonl, written by lib/e2e-reliability.mjs's
+// CATALOG:   appendLedger) and escalates when the TRAILING run of consecutive
+// CATALOG:   REGRESSION entries reaches the configured threshold — the cross-run
+// CATALOG:   counterpart to the ship tick prompt's within-run strike count (#2043
+// CATALOG:   AC-2043.4). Configured via arbiter.json's e2ePolicy.escalation
+// CATALOG:   (schema-validated, src/config/schema.ts); absent config falls back to the
+// CATALOG:   pre-#2043 hardcoded 2-strike default so existing/ungoverned projects keep
+// CATALOG:   their current behavior. SKIP when the ledger doesn't exist yet (no runs
+// CATALOG:   recorded) or is empty.
+// CATALOG: #2248 (AC-2248.2): escalation.strikes (e.g. [2, 3, 5]) drives a PER-RUNG
+// CATALOG:   ladder when present — the first rung crossed widens scope, the last rung
+// CATALOG:   crossed hard-stops to needs-human, any rung(s) in between force the full
+// CATALOG:   suite. escalation.maxStrikes alone (no strikes array) stays supported as
+// CATALOG:   the pre-#2248 single-rung scalar check (legacy).
+// Exit codes (INV-53): 0=PASS/SKIP, 1=escalation triggered
+// Usage: node scripts/check-e2e-escalation.mjs [--help]
+import { readFileSync, existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+
+const ROOT = resolve(process.cwd())
+const LEDGER_PATH = join(ROOT, '.arbiter', 'e2e-ledger.jsonl')
+const ARBITER_PATH = join(ROOT, 'arbiter.json')
+// Pre-#2043 hardcoded behavior (was the ship tick prompt's undeclared "2-strike" rule) —
+// the default when a project has not opted into e2ePolicy.escalation.
+const DEFAULT_MAX_STRIKES = 2
+
+const HELP = `Usage: node scripts/check-e2e-escalation.mjs [--help]
+
+Reads .arbiter/e2e-ledger.jsonl (append-only e2e reliability ledger) and escalates
+when the TRAILING run of consecutive REGRESSION entries reaches the configured
+threshold. When e2ePolicy.escalation.strikes (e.g. [2, 3, 5]) is declared, each
+rung crossed gets a distinct action: first rung widens scope, last rung hard-stops
+to needs-human, any rung(s) between force the full suite. Without a strikes array,
+falls back to the scalar e2ePolicy.escalation.maxStrikes (default ${DEFAULT_MAX_STRIKES}).
+
+SKIP:
+  When .arbiter/e2e-ledger.jsonl is absent or empty (no runs recorded yet).
+
+Exit codes:
+  0 — pass or SKIP (below threshold / no ledger)
+  1 — escalation triggered (consecutive REGRESSION count >= threshold)`
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  process.stdout.write(`${HELP}\n`)
+  process.exit(0)
+}
+
+// Reads+parses arbiter.json. Returns { strikes, maxStrikes } — strikes is the
+// per-rung ladder (sorted ascending) when e2ePolicy.escalation.strikes validates
+// as a non-empty array of positive integers, else null (legacy scalar path).
+// maxStrikes is the scalar threshold, defaulting when arbiter.json is absent,
+// unreadable, malformed, or doesn't declare e2ePolicy.escalation.maxStrikes —
+// this gate degrades gracefully rather than hard-failing on a config problem
+// another gate (check-smoke-journeys, schema validation) already owns reporting.
+function loadEscalationConfig() {
+  if (!existsSync(ARBITER_PATH)) return { strikes: null, maxStrikes: DEFAULT_MAX_STRIKES }
+
+  let raw
+  try {
+    raw = JSON.parse(readFileSync(ARBITER_PATH, 'utf-8'))
+    // FAIL-OPEN-INTENT: malformed arbiter.json defaults to DEFAULT_MAX_STRIKES; schema validation owns reporting.
+  } catch {
+    return { strikes: null, maxStrikes: DEFAULT_MAX_STRIKES }
+  }
+
+  const maxStrikesRaw = raw?.e2ePolicy?.escalation?.maxStrikes
+  const maxStrikes =
+    typeof maxStrikesRaw === 'number' && Number.isInteger(maxStrikesRaw) && maxStrikesRaw >= 2
+      ? maxStrikesRaw
+      : DEFAULT_MAX_STRIKES
+
+  const strikesRaw = raw?.e2ePolicy?.escalation?.strikes
+  const strikes =
+    Array.isArray(strikesRaw) &&
+    strikesRaw.length > 0 &&
+    strikesRaw.every((s) => typeof s === 'number' && Number.isInteger(s) && s >= 1)
+      ? [...strikesRaw].sort((a, b) => a - b)
+      : null
+
+  return { strikes, maxStrikes }
+}
+
+// #2248 (AC-2248.2): the rung (0-based index into `strikes`) the current
+// consecutive-REGRESSION count crosses, or -1 when it's below the first rung.
+// `strikes` is pre-sorted ascending — the highest rung whose threshold is <=
+// consecutive wins (a staircase: 4 consecutive against [2, 3, 5] is still
+// "rung 2 crossed", not "between rungs").
+function findCrossedRungIndex(strikes, consecutive) {
+  let idx = -1
+  for (let i = 0; i < strikes.length; i++) {
+    if (consecutive >= strikes[i]) idx = i
+  }
+  return idx
+}
+
+// #2248 (AC-2248.2): rung-specific action text. First rung crossed → widen
+// scope / root-cause; last rung crossed → hard stop + needs-human; any rung(s)
+// strictly between → force the full suite. A single-entry ladder is both
+// "first" and "last" — hard-stop wins (it's the only/final rung).
+function rungMessage(strikes, idx, consecutive) {
+  const rungNum = idx + 1
+  const total = strikes.length
+  const threshold = strikes[idx]
+  const action =
+    idx === total - 1
+      ? 'hard stop — escalate to needs-human'
+      : idx === 0
+        ? 'widen scope / root-cause the failure'
+        : 'force the full suite'
+  return (
+    `[check-e2e-escalation] FAIL — escalation triggered: ${consecutive} consecutive ` +
+    `REGRESSION ledger entries >= rung ${rungNum}/${total} threshold ${threshold} — ` +
+    `${action} per e2ePolicy.escalation.strikes\n`
+  )
+}
+
+// Loads the ledger as an array of parsed JSONL entries. Returns null when the ledger
+// file doesn't exist (SKIP path); malformed lines are dropped rather than fail-closed —
+// the ledger is an observability artifact, not a policy input, so a single corrupt
+// line should not itself block the run.
+function loadLedgerEntries() {
+  if (!existsSync(LEDGER_PATH)) return null
+  const raw = readFileSync(LEDGER_PATH, 'utf-8')
+  return raw
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      try {
+        return JSON.parse(line)
+        // FAIL-OPEN-INTENT: a corrupt ledger line is dropped, not fatal — observability data, not policy input.
+      } catch {
+        return null
+      }
+    })
+    .filter((entry) => entry !== null)
+}
+
+// Counts REGRESSION entries from the TAIL of the ledger, stopping at the first
+// non-REGRESSION (PASS/FLAKE/INFRA) entry — only a CONSECUTIVE run counts.
+function countTrailingRegressions(entries) {
+  let count = 0
+  for (let i = entries.length - 1; i >= 0; i--) {
+    if (entries[i]?.verdict !== 'REGRESSION') break
+    count++
+  }
+  return count
+}
+
+function main() {
+  const entries = loadLedgerEntries()
+  if (entries === null || entries.length === 0) {
+    process.stdout.write('[check-e2e-escalation] SKIP — no e2e ledger found\n')
+    process.exit(0)
+  }
+
+  const { strikes, maxStrikes } = loadEscalationConfig()
+  const consecutive = countTrailingRegressions(entries)
+
+  // #2248 (AC-2248.2): escalation.strikes present → per-rung ladder governs
+  // (maxStrikes is ignored here; it stays required by schema.ts alongside
+  // strikes but isn't consulted for the exit decision once a ladder exists).
+  if (strikes) {
+    const idx = findCrossedRungIndex(strikes, consecutive)
+    if (idx === -1) {
+      process.stdout.write(
+        `[check-e2e-escalation] OK — ${consecutive} consecutive REGRESSION entries below ` +
+          `rung 1 threshold ${strikes[0]}\n`,
+      )
+      process.exit(0)
+    }
+    process.stderr.write(rungMessage(strikes, idx, consecutive))
+    process.exit(1)
+  }
+
+  if (consecutive >= maxStrikes) {
+    process.stderr.write(
+      `[check-e2e-escalation] FAIL — escalation triggered: ${consecutive} consecutive ` +
+        `REGRESSION ledger entries >= threshold ${maxStrikes} — force the full suite / ` +
+        `escalate to needs-human per e2ePolicy.escalation\n`,
+    )
+    process.exit(1)
+  }
+
+  process.stdout.write(
+    `[check-e2e-escalation] OK — ${consecutive} consecutive REGRESSION entries below threshold ${maxStrikes}\n`,
+  )
+  process.exit(0)
+}
+
+try {
+  main()
+} catch (err) {
+  process.stderr.write(`[check-e2e-escalation] ERROR — unexpected: ${err.message}\n`)
+  process.exit(2)
+}

package/dist/templates/scripts/check-e2e-quarantine.mjs.ejs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// arbiter — E2E flaky-test quarantine hygiene gate (#1445, INV-130).
+//
+// The quarantine registry (.arbiter/e2e/quarantine.json) ANNOTATES known-unstable
+// tests but NEVER suppresses them: quarantined tests still run and still report, and
+// CI's exit code is unchanged by an entry's mere presence. What this gate enforces is
+// that the registry itself does not ROT — a quarantine must be a temporary, owned,
+// tracked exception, not a permanent silent mute. Every entry must carry the full
+// required-field set AND a FUTURE `expires` date; an expired, malformed, or
+// incomplete entry fails closed. Self-SKIPs (exit 0) when no registry is present.
+//
+// Exit codes (INV-53): 0 = clean / no registry · 1 = expired or malformed entry ·
+// 2 = unexpected error.
+import { readFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { validateQuarantine, QUARANTINE_REQUIRED_FIELDS } from './lib/e2e-reliability.mjs'
+
+function parseDir(argv) {
+  const i = argv.indexOf('--dir')
+  return i >= 0 && argv[i + 1] ? argv[i + 1] : process.cwd()
+}
+const ROOT = parseDir(process.argv.slice(2))
+const REGISTRY = join(ROOT, '.arbiter', 'e2e', 'quarantine.json')
+
+if (!existsSync(REGISTRY)) {
+  process.stdout.write(
+    'check-e2e-quarantine: OK — no quarantine registry (.arbiter/e2e/quarantine.json absent)\n',
+  )
+  process.exit(0)
+}
+
+let registry
+try {
+  registry = JSON.parse(readFileSync(REGISTRY, 'utf-8'))
+} catch (err) {
+  // A present-but-broken registry must not silently pass — fail closed.
+  process.stderr.write(
+    `check-e2e-quarantine: FAIL — ${REGISTRY} is not valid JSON: ${err.message}\n`,
+  )
+  process.exit(1)
+}
+
+let result
+try {
+  result = validateQuarantine(registry, new Date())
+} catch (err) {
+  process.stderr.write(`check-e2e-quarantine: error validating registry: ${err.message}\n`)
+  process.exit(2)
+}
+
+if (!result.ok) {
+  process.stderr.write(
+    `check-e2e-quarantine: FAIL — ${result.errors.length} quarantine issue(s):\n`,
+  )
+  for (const e of result.errors) process.stderr.write(`  [FAIL] ${e}\n`)
+  process.stderr.write(
+    `Each entry needs fields [${QUARANTINE_REQUIRED_FIELDS.join(', ')}] and a FUTURE 'expires' date. ` +
+      'A quarantine is a temporary owned exception, not a permanent mute.\n',
+  )
+  process.exit(1)
+}
+
+const count = Array.isArray(registry) ? registry.length : (registry.entries || []).length
+process.stdout.write(
+  `check-e2e-quarantine: OK — ${count} quarantine entry(ies), all complete and unexpired\n`,
+)
+process.exit(0)