@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-emission-parity.mjs.ejs

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+// CATALOG: emission parity (#2110) — every file Arbiter recorded as emitted is still on disk.
+// CATALOG: runs inside the governed project's OWN gate, so drift surfaces on every run and not
+// CATALOG: only when someone happens to run `arbiter update`.
+// CATALOG: Needs no Arbiter install: it reads the committed `.arbiter-generated-manifest.json`,
+// CATALOG: which carries the sha256 of Arbiter's last render per file. Arbiter is not a
+// CATALOG: dependency of the projects it governs, so a check that shelled out to its generators
+// CATALOG: would SKIP exactly where it matters — and a gate that skips is a green light with
+// CATALOG: nothing behind it.
+//
+// What FAILS: a recorded file that is GONE. "Never emitted" and "deleted after emission" are
+// indistinguishable at runtime without the manifest, and the second one silently removes
+// protection while the gate stays green.
+//
+// What does NOT fail: a recorded file whose content DIVERGED. Divergence is the normal, expected
+// state of a governed repo — the project customizes `check-all.mjs`, `AGENTS.md`, its rules — and
+// it is already governed at write time by the adopt policy and at read time by
+// `check-safety-adopt-ratchet.mjs`. Failing on it would red every real consumer on day one.
+// Divergence is reported, counted, and left to those gates.
+//
+// Exit codes (INV-53): 0 PASS, 1 FAIL (recorded file missing / no provenance record), 2 ERROR.
+import { existsSync, readFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { join } from 'node:path'
+
+const root = process.cwd()
+const manifestPath = join(root, '.arbiter-generated-manifest.json')
+
+try {
+  const files = readManifest(manifestPath)
+  const missing = []
+  let diverged = 0
+  for (const [key, recorded] of Object.entries(files)) {
+    const path = join(root, key)
+    if (!existsSync(path)) {
+      missing.push(key)
+      continue
+    }
+    if (sha256(path) !== recorded) diverged += 1
+  }
+  if (diverged > 0) {
+    process.stderr.write(
+      `[emission-parity] ${diverged} recorded file(s) diverged from Arbiter's last render — ` +
+        `expected in a customized project; run \`arbiter diff --withheld\` to review.\n`,
+    )
+  }
+  if (missing.length > 0) {
+    for (const key of missing.sort()) {
+      process.stderr.write(`[emission-parity] MISSING emitted file ${key}\n`)
+    }
+    process.stderr.write(
+      `[emission-parity] FAIL — ${missing.length} file(s) Arbiter emitted are gone. Restore them ` +
+        `(\`arbiter update\`) or, if the removal was deliberate, re-run \`arbiter update\` so the ` +
+        `manifest stops claiming them.\n`,
+    )
+    process.exit(1)
+  }
+  process.stdout.write(
+    `[emission-parity] PASS — ${Object.keys(files).length} emitted file(s) present ` +
+      `(${diverged} locally diverged)\n`,
+  )
+  process.exit(0)
+} catch (error) {
+  process.stderr.write(
+    `[emission-parity] ERROR — ${error instanceof Error ? error.message : String(error)}\n`,
+  )
+  process.exit(2)
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+// A missing manifest is NOT a pass. It means the repo carries no record of what Arbiter put
+// there, so nothing downstream can tell a deleted guard from one that never existed — the
+// silent-skip this gate exists to remove. `arbiter update` writes the record.
+function readManifest(path) {
+  if (!existsSync(path)) {
+    process.stderr.write(
+      `[emission-parity] FAIL — no .arbiter-generated-manifest.json: this repo has no record of ` +
+        `what Arbiter emitted, so a deleted guard is indistinguishable from one never emitted. ` +
+        `Run \`arbiter update\` to write the provenance record.\n`,
+    )
+    process.exit(1)
+  }
+  const parsed = JSON.parse(readFileSync(path, 'utf-8'))
+  if (parsed?.$schemaVersion !== 1 || typeof parsed.files !== 'object' || parsed.files === null) {
+    throw new Error('.arbiter-generated-manifest.json has an invalid shape')
+  }
+  return parsed.files
+}

package/dist/templates/scripts/check-exit-code-contract.mjs.ejs

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+// <%= projectName %> — exit code contract gate
+// Scans scripts and EJS templates for exit codes outside the 0=PASS/1=FAIL/2=ERROR contract.
+// Part of the anti-drift validator family (W6).
+// Usage: node scripts/check-exit-code-contract.mjs [dir...] [--help]
+// Exits 1 if any violations found.
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  process.stdout.write('Usage: node scripts/check-exit-code-contract.mjs [dir...] [--help]\nScans scripts for exit codes outside the 0=PASS/1=FAIL/2=ERROR contract.\n');
+  process.exit(0);
+}
+
+const VALID_EXITS = new Set([0, 1, 2]);
+
+// Match process.exit(N) only when not inside a string literal.
+// Heuristic: count unescaped quotes before the match; odd count = inside string.
+const PATTERNS = [
+  { re: /process\.exit\(\s*(-?\d+)\s*\)/, label: "process.exit(N)" },
+];
+
+function inStringLiteral(line, matchIndex) {
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < matchIndex; i++) {
+    const ch = line[i];
+    if (ch === "\\" && (inSingle || inDouble)) {
+      i++;
+      continue;
+    }
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+    }
+  }
+  return inSingle || inDouble;
+}
+
+const EXTENSIONS = new Set([".mjs", ".js", ".ejs"]);
+const SKIP_DIRS = new Set(["node_modules", "dist", ".git", ".arbiter"]);
+const SKIP_PATHS = new Set(["__tests__/fixtures"]);
+
+const args = process.argv.slice(2);
+const baseDir = process.cwd();
+let violations = 0;
+
+function scan(dir) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch (err) {
+    process.stderr.write(
+      `  [warn] could not read directory ${dir}: ${err.message}\n`,
+    );
+    return;
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry)) continue;
+    const full = join(dir, entry);
+    const rel = relative(baseDir, full);
+    if (SKIP_PATHS.has(rel) || rel.startsWith("__tests__/fixtures")) continue;
+    let stat;
+    try {
+      stat = statSync(full);
+    } catch (err) {
+      process.stderr.write(`  [warn] could not stat ${full}: ${err.message}\n`);
+      continue;
+    }
+    if (stat.isDirectory()) {
+      scan(full);
+    } else if (EXTENSIONS.has(full.slice(full.lastIndexOf(".")))) {
+      scanFile(full);
+    }
+  }
+}
+
+function scanFile(filePath) {
+  let content;
+  try {
+    content = readFileSync(filePath, "utf-8");
+  } catch (err) {
+    process.stderr.write(
+      `  [warn] could not read file ${filePath}: ${err.message}\n`,
+    );
+    return;
+  }
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const { re, label } of PATTERNS) {
+      const m = line.match(re);
+      if (m) {
+        const matchIdx = line.indexOf(m[0]);
+        if (inStringLiteral(line, matchIdx)) break;
+        const code = parseInt(m[1], 10);
+        if (!VALID_EXITS.has(code)) {
+          const rel = relative(baseDir, filePath);
+          console.log(
+            `  ${rel}:${i + 1}  [${label}]  exit(${code}) — must be 0, 1, or 2  ${line.trim()}`,
+          );
+          violations++;
+        }
+        break;
+      }
+    }
+  }
+}
+
+if (args.length > 0) {
+  const accessible = args.filter((p) => {
+    try {
+      statSync(p);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  if (accessible.length === 0) {
+    process.stderr.write(
+      "  [error] No valid scan paths — all provided paths are missing or inaccessible.\n",
+    );
+    process.exit(2);
+  }
+  for (const dir of accessible) scan(dir);
+} else {
+  scan(process.cwd());
+}
+
+if (violations > 0) {
+  console.log(
+    `\n  Found ${violations} violation(s). All scripts must exit 0=PASS / 1=FAIL / 2=ERROR.\n`,
+  );
+  process.exit(1);
+}

package/dist/templates/scripts/check-fail-closed-audit.mjs.ejs

@@ -0,0 +1,389 @@
+<%# #1720 (gap 5): guard was literal governanceLevel === 'L2' || === 'L3', silently
+    excluding L4 — the entire INV-96 fail-closed audit rendered EMPTY at L4 (a
+    fail-OPEN outcome for the very script whose job is enforcing fail-closed
+    doctrine). isL2Plus (levelAtLeast SSOT, #1516) keeps L4 a strict superset of L3. -%>
+<% if (isL2Plus) { -%>
+#!/usr/bin/env node
+// <%= projectName %> — fail-closed audit gate (INV-96)
+//
+// Doctrine: every gate, hook, check, and generator must default to BLOCK on
+// uncertainty, never SKIP. This script audits scripts/, .githooks/, and
+// .claude/hooks/ for fail-open anti-patterns and HARD-fails when a NEW
+// script (not listed in scripts/data/fail-closed-baseline.json) violates
+// the contract. See docs/SYSTEM/FAIL_CLOSED.md for the full doctrine.
+//
+// Usage:
+//   node scripts/check-fail-closed-audit.mjs                       # audit + baseline diff
+//   node scripts/check-fail-closed-audit.mjs --update-baseline     # rewrite baseline
+//   node scripts/check-fail-closed-audit.mjs --root <dir>          # alternate root
+//
+// Exit codes (INV-53): 0 PASS, 1 FAIL (new violation), 2 invocation/IO error.
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'
+import { join, relative, resolve } from 'node:path'
+
+const args = process.argv.slice(2)
+const rootArgIdx = args.indexOf('--root')
+const ROOT = rootArgIdx >= 0 ? resolve(args[rootArgIdx + 1] ?? '.') : process.cwd()
+const UPDATE = args.includes('--update-baseline')
+const BASELINE_PATH = resolve(ROOT, 'scripts/data/fail-closed-baseline.json')
+
+// `entryScript: true` dirs hold executable entry points that must carry top-level error
+// handling. `src/` holds library modules (imported, never run directly) — only the
+// swallowed-catch check runs there: a defaulting swallow in a governance path is exactly
+// what INV-96 forbids, but requiring each module to wrap a top-level try/catch is not.
+const SCAN_DIRS = [
+  { dir: 'scripts', recurse: true, entryScript: true },
+  { dir: '.githooks', recurse: true, entryScript: true },
+  { dir: '.claude/hooks', recurse: true, entryScript: true },
+  { dir: 'src', recurse: true, entryScript: false },
+]
+
+const SKIP_DIRS = new Set(['node_modules', 'dist', '.git', 'data'])
+const SKIP_FILES = new Set([
+  'scripts/lib/run-helpers.mjs',
+  'scripts/lib/parse-check-args.mjs',
+  'scripts/lib/glob-walk.mjs', // #1366: pure glob/tree-walk helper; consumers own the exit contract
+  // #2148 pure exact-SHA policy declarations/validation; the watcher and branch
+  // protection applicator own all I/O and convert validation errors fail-closed.
+  'scripts/lib/exact-sha-policy.mjs',
+  // #2399 pure content-binding semantics (staleness reason + foreign-sidecar predicate);
+  // no entry point — its consumers own the exit contract and fail closed on a non-null reason.
+  'scripts/lib/evidence-binding.mjs',
+])
+
+const BASH_SHEBANG = /^#!\s*\/(usr\/bin\/env\s+bash|bin\/bash|bin\/sh|usr\/bin\/env\s+sh)/
+const NODE_SHEBANG = /^#!\s*\/(usr\/bin\/env\s+node|usr\/local\/bin\/node)/
+const PIPEFAIL = /^\s*set\s+-[a-zA-Z]*o\s+pipefail|^\s*set\s+-euo\s+pipefail|^\s*set\s+-e[uo]?\s*$/
+const OR_TRUE = /\|\|\s*true\b/
+const FAIL_OPEN_MARK = /#\s*FAIL-OPEN-INTENT\s*:/i
+const FAIL_OPEN_MARK_JS = /\/\/\s*FAIL-OPEN-INTENT\s*:/i
+const HELPER_IMPORT = /from\s+['"][^'"]*scripts\/lib\/run-helpers(?:\.mjs)?['"]/
+const HELPER_USE = /\brun(Check|WarnCheck|ToolCheck)\s*\(/
+const TRY_CATCH_EXIT = /process\.exit\(\s*1\s*\)|throw\b/
+
+// `catch` opener — built from a string so this audit file does not self-match (maskCode
+// blanks string/comment/regex bodies before scanning).
+const CATCH_OPEN_RE = new RegExp('catch\\s*(?:\\([^)]*\\))?\\s*\\{', 'g')
+
+// A catch body is a fail-open SWALLOW unless it re-throws, exits non-zero, surfaces the
+// error (logs / stderr), or propagates. Subsumes the empty-brace, `return null/undefined`,
+// `continue`, `break`, and comment-only shapes — every pattern that disarms silently.
+const SURFACE_RE = new RegExp(
+  [
+    '\\bthrow\\b',
+    'process\\.exit\\(\\s*(?!0\\s*\\))',
+    'process\\.exitCode\\s*=\\s*(?!0)',
+    'console\\.(error|warn|log|info|debug)',
+    '\\bstderr\\b',
+    '\\bstdout\\b',
+    'log(Error|Warn|Info|Fatal)',
+    'core\\.setFailed',
+    '\\breject\\b',
+    'return\\s+Promise\\.reject',
+  ].join('|'),
+)
+
+function listFiles(absDir, recurse) {
+  const out = []
+  let entries
+  try {
+    entries = readdirSync(absDir)
+  } catch (err) {
+    if (err && err.code === 'ENOENT') return out
+    throw err
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry)) continue
+    const full = join(absDir, entry)
+    let st
+    try {
+      st = statSync(full)
+    } catch {
+      continue
+    }
+    if (st.isDirectory()) {
+      if (recurse) out.push(...listFiles(full, recurse))
+      continue
+    }
+    if (st.isFile()) out.push(full)
+  }
+  return out
+}
+
+function inferKind(relPath, content) {
+  const head = content.split('\n', 2)[0] ?? ''
+  if (BASH_SHEBANG.test(head)) return 'bash'
+  if (NODE_SHEBANG.test(head)) return 'node'
+  if (relPath.endsWith('.sh')) return 'bash'
+  if (/\.(m?js|cjs|ts)$/.test(relPath)) return 'node'
+  if (/^\.githooks\//.test(relPath)) return 'bash'
+  return null
+}
+
+// Return a same-length copy of `src` with the BODIES of strings and comments blanked to
+// spaces (newlines preserved). Lets the catch scanner reason about real code only — braces
+// or the word "catch" inside a string/comment disappear. Regex literals are intentionally
+// NOT masked: telling `/` (divide) from `/…/` (regex) needs a full lexer, and a wrong guess
+// desyncs the masker and blanks real code; a regex rarely holds an unescaped `catch {`.
+function maskCode(src) {
+  let out = ''
+  let state = 'code' // code | line | block | single | double | template
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i]
+    const c2 = src[i + 1]
+    if (state === 'code') {
+      if (c === '/' && c2 === '/') {
+        out += '  '
+        i++
+        state = 'line'
+      } else if (c === '/' && c2 === '*') {
+        out += '  '
+        i++
+        state = 'block'
+      } else if (c === "'") {
+        out += c
+        state = 'single'
+      } else if (c === '"') {
+        out += c
+        state = 'double'
+      } else if (c === '`') {
+        out += c
+        state = 'template'
+      } else {
+        out += c
+      }
+      continue
+    }
+    if (state === 'line') {
+      if (c === '\n') {
+        out += '\n'
+        state = 'code'
+      } else out += ' '
+      continue
+    }
+    if (state === 'block') {
+      if (c === '*' && c2 === '/') {
+        out += '  '
+        i++
+        state = 'code'
+      } else out += c === '\n' ? '\n' : ' '
+      continue
+    }
+    if (c === '\\') {
+      out += '  '
+      i++
+      continue
+    }
+    const closes =
+      (state === 'single' && c === "'") ||
+      (state === 'double' && c === '"') ||
+      (state === 'template' && c === '`')
+    if (closes) {
+      out += c
+      state = 'code'
+      continue
+    }
+    out += c === '\n' ? '\n' : ' '
+  }
+  return out
+}
+
+function readBraceBlock(masked, openIdx) {
+  let depth = 0
+  for (let i = openIdx; i < masked.length; i++) {
+    if (masked[i] === '{') depth++
+    else if (masked[i] === '}') {
+      depth--
+      if (depth === 0) return masked.slice(openIdx + 1, i)
+    }
+  }
+  return masked.slice(openIdx + 1)
+}
+
+// Find every fail-open swallowed `catch`. A catch is a swallow when its masked body carries
+// no surface/propagate token; suppressed when the previous non-blank ORIGINAL line is a
+// `// FAIL-OPEN-INTENT:` (or `# …`) marker.
+function findSwallowedCatches(content) {
+  const masked = maskCode(content)
+  const lines = content.split('\n')
+  const hits = []
+  CATCH_OPEN_RE.lastIndex = 0
+  let m
+  while ((m = CATCH_OPEN_RE.exec(masked)) !== null) {
+    const openIdx = m.index + m[0].length - 1
+    const body = readBraceBlock(masked, openIdx)
+    if (SURFACE_RE.test(body)) continue
+    const lineNo = masked.slice(0, m.index).split('\n').length
+    let allowlisted = false
+    for (let j = lineNo - 2; j >= 0; j--) {
+      const prev = (lines[j] ?? '').trim()
+      if (prev === '') continue
+      if (FAIL_OPEN_MARK_JS.test(prev) || FAIL_OPEN_MARK.test(prev)) allowlisted = true
+      break
+    }
+    if (!allowlisted) hits.push(lineNo)
+  }
+  return hits
+}
+
+function auditBash(content) {
+  const lines = content.split('\n')
+  const violations = []
+  let sawPipefail = false
+  let nonCommentScanned = 0
+  for (const line of lines) {
+    if (nonCommentScanned >= 20) break
+    const trimmed = line.trim()
+    if (trimmed === '' || trimmed.startsWith('#')) continue
+    nonCommentScanned++
+    if (PIPEFAIL.test(line)) {
+      sawPipefail = true
+      break
+    }
+  }
+  if (!sawPipefail) {
+    violations.push({ kind: 'bash-no-pipefail', detail: 'missing `set -euo pipefail` in head' })
+  }
+  for (let i = 0; i < lines.length; i++) {
+    if (!OR_TRUE.test(lines[i])) continue
+    const noStrings = lines[i].replace(/"[^"]*"|'[^']*'/g, '""')
+    const commentIdx = noStrings.indexOf('#')
+    const orIdx = noStrings.indexOf('|| true')
+    if (commentIdx >= 0 && orIdx > commentIdx) continue
+    let allowlisted = false
+    for (let j = i - 1; j >= 0; j--) {
+      const prev = lines[j].trim()
+      if (prev === '') continue
+      if (FAIL_OPEN_MARK.test(prev)) allowlisted = true
+      break
+    }
+    if (!allowlisted) {
+      violations.push({ kind: 'bash-or-true', detail: `unallowlisted \`|| true\` at line ${i + 1}` })
+    }
+  }
+  return violations
+}
+
+function auditNode(content, entryScript) {
+  const violations = []
+  // Entry-point contract: executable scripts must carry top-level error handling.
+  // Library modules under src/ are imported, never run directly — skip it there.
+  if (entryScript) {
+    const hasHelper = HELPER_IMPORT.test(content) && HELPER_USE.test(content)
+    const hasTryCatch =
+      /try\s*\{[\s\S]+?\}\s*catch\s*\([^)]*\)\s*\{[\s\S]*?\}/.test(content) &&
+      TRY_CATCH_EXIT.test(content)
+    if (!hasHelper && !hasTryCatch) {
+      violations.push({
+        kind: 'node-no-error-handling',
+        detail: 'no top-level try/catch with process.exit(1) and no run-helpers usage',
+      })
+    }
+  }
+  for (const lineNo of findSwallowedCatches(content)) {
+    violations.push({
+      kind: 'node-swallowed-catch',
+      detail: `catch swallows error without rethrow/exit/surface at line ${lineNo}`,
+    })
+  }
+  return violations
+}
+
+function loadBaseline() {
+  if (!existsSync(BASELINE_PATH)) {
+    return { schema: 'arbiter-fail-closed-baseline-v1', generated_at: null, files: [] }
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(BASELINE_PATH, 'utf-8'))
+    if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.files)) {
+      process.stderr.write(`[check-fail-closed-audit] ERROR: malformed baseline ${BASELINE_PATH}\n`)
+      process.exit(2)
+    }
+    return parsed
+  } catch (err) {
+    process.stderr.write(
+      `[check-fail-closed-audit] ERROR: cannot read baseline ${BASELINE_PATH}: ${err instanceof Error ? err.message : String(err)}\n`,
+    )
+    process.exit(2)
+  }
+}
+
+function writeBaseline(files) {
+  const out = {
+    schema: 'arbiter-fail-closed-baseline-v1',
+    generated_at: new Date().toISOString(),
+    files: [...files].sort(),
+  }
+  try {
+    writeFileSync(BASELINE_PATH, JSON.stringify(out, null, 2) + '\n')
+  } catch (err) {
+    process.stderr.write(
+      `[check-fail-closed-audit] ERROR: cannot write baseline ${BASELINE_PATH}: ${err instanceof Error ? err.message : String(err)}\n`,
+    )
+    process.exit(2)
+  }
+}
+
+function audit() {
+  const allViolations = []
+  for (const { dir, recurse, entryScript } of SCAN_DIRS) {
+    const abs = resolve(ROOT, dir)
+    for (const file of listFiles(abs, recurse)) {
+      const rel = relative(ROOT, file).replace(/\\/g, '/')
+      if (SKIP_FILES.has(rel)) continue
+      if (/\.(json|md|txt|yaml|yml|toml|ejs)$/i.test(rel)) continue
+      let content
+      try {
+        content = readFileSync(file, 'utf-8')
+      } catch (err) {
+        process.stderr.write(
+          `[check-fail-closed-audit] ERROR: cannot read ${rel}: ${err instanceof Error ? err.message : String(err)}\n`,
+        )
+        process.exit(2)
+      }
+      const kind = inferKind(rel, content)
+      if (!kind) continue
+      const violations = kind === 'bash' ? auditBash(content) : auditNode(content, entryScript)
+      if (violations.length > 0) allViolations.push({ file: rel, kind, violations })
+    }
+  }
+  return allViolations
+}
+
+const findings = audit()
+
+if (UPDATE) {
+  writeBaseline(findings.map((f) => f.file))
+  process.stdout.write(
+    `[check-fail-closed-audit] baseline updated — ${findings.length} grandfathered file(s)\n`,
+  )
+  process.exit(0)
+}
+
+const baseline = loadBaseline()
+const baselineSet = new Set(baseline.files)
+const newViolations = findings.filter((f) => !baselineSet.has(f.file))
+
+if (newViolations.length > 0) {
+  process.stdout.write(
+    `[check-fail-closed-audit] FAIL: ${newViolations.length} new file(s) violate fail-closed contract\n`,
+  )
+  for (const v of newViolations) {
+    process.stdout.write(`  ${v.file} (${v.kind}):\n`)
+    for (const item of v.violations) {
+      process.stdout.write(`    - [${item.kind}] ${item.detail}\n`)
+    }
+  }
+  process.stdout.write(
+    '\nFix the script (see docs/SYSTEM/FAIL_CLOSED.md) or, for a legitimate exception,\n' +
+      'mark the offending line with `# FAIL-OPEN-INTENT: <reason>` (bash) or\n' +
+      '`// FAIL-OPEN-INTENT: <reason>` (node).\n',
+  )
+  process.exit(1)
+}
+
+process.stdout.write(
+  `[check-fail-closed-audit] OK — ${findings.length} grandfathered, 0 new violations\n`,
+)
+process.exit(0)
+<% } -%>