@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-inline-suppressions.mjs.ejs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+// <%= projectName %> — inline suppression checker (INV-31)
+// Validates arbiter-suppress directives in source files.
+// Directive form: arbiter-suppress(INV-NN, until=YYYY-MM-DD, reason="...", owner=@user)
+// Part of the anti-drift validator family (W6).
+// Usage: node scripts/check-inline-suppressions.mjs [--help]
+
+import { readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { walkRepo } from './lib/glob-walk.mjs';
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  process.stdout.write('Usage: node scripts/check-inline-suppressions.mjs [--help]\nValidates arbiter-suppress directives in source files.\n');
+  process.exit(0);
+}
+
+const REASON_MIN_LEN = 10;
+const WARN_DAYS = 30;
+const DIRECTIVE_RE = /\/\/\s*arbiter-suppress\(([^)]+)\)/g;
+const SCANNED_EXTENSIONS = new Set([
+  '.ts', '.tsx', '.js', '.mjs', '.cjs', '.jsx',
+  '.java', '.kt', '.rs', '.py', '.rb', '.go',
+]);
+const IGNORED_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '__tests__']);
+const KNOWN_INV_IDS = new Set([
+  'INV-01','INV-02','INV-03','INV-04','INV-05','INV-06','INV-07',
+  'INV-08','INV-09','INV-10','INV-11','INV-12','INV-13','INV-14',
+  'INV-15','INV-16','INV-17','INV-18','INV-19','INV-20','INV-21',
+  'INV-22','INV-23','INV-24','INV-25','INV-26','INV-27','INV-28',
+  'INV-29','INV-30','INV-31','INV-32','INV-33','INV-34','INV-35',
+  'INV-36','INV-37','INV-38','INV-39',
+]);
+
+function checkExpiry(dateStr, label, file, counters) {
+  const expiry = new Date(dateStr);
+  if (isNaN(expiry.getTime())) {
+    process.stderr.write(`[FAIL] ${file}: ${label} — invalid until/expiresAt (not a date): ${dateStr}\n`);
+    counters.failed++;
+    return;
+  }
+  const now = new Date();
+  const diffMs = expiry.getTime() - now.getTime();
+  const diffDays = Math.ceil(diffMs / (1000 * 60 * 60 * 24));
+  if (diffMs < 0) {
+    process.stderr.write(`[FAIL] ${file}: ${label} — expired (until/expiresAt: ${dateStr})\n`);
+    counters.failed++;
+  } else if (diffDays <= WARN_DAYS) {
+    process.stderr.write(`[WARN] ${file}: ${label} expires in ${diffDays} day(s) (${dateStr})\n`);
+    counters.warnings++;
+  }
+}
+
+function validateEntry(entry, label, file, counters) {
+  const required = ['reason', 'owner', 'expiresAt'];
+  let valid = true;
+  for (const field of required) {
+    if (!entry[field]) {
+      process.stderr.write(`[FAIL] ${file}: ${label} — missing required field: ${field}\n`);
+      counters.failed++;
+      valid = false;
+    }
+  }
+  if (!valid) return;
+  if (entry.reason.length < REASON_MIN_LEN) {
+    process.stderr.write(`[FAIL] ${file}: ${label} — reason must be at least ${REASON_MIN_LEN} characters\n`);
+    counters.failed++;
+    return;
+  }
+  checkExpiry(entry.expiresAt, label, file, counters);
+}
+
+function parseArgs(argsStr) {
+  const parts = [];
+  let current = '';
+  let inQuote = false;
+  let quoteChar = '';
+  for (const ch of argsStr) {
+    if (!inQuote && (ch === '"' || ch === "'")) {
+      inQuote = true; quoteChar = ch; current += ch;
+    } else if (inQuote && ch === quoteChar) {
+      inQuote = false; quoteChar = ''; current += ch;
+    } else if (!inQuote && ch === ',') {
+      parts.push(current.trim()); current = '';
+    } else {
+      current += ch;
+    }
+  }
+  if (current.trim()) parts.push(current.trim());
+  return parts;
+}
+
+function parseDirective(argsStr) {
+  const parts = parseArgs(argsStr);
+  if (parts.length === 0) return null;
+  const result = {};
+  const firstPart = parts[0];
+  if (/^INV-\d+$/.test(firstPart) || !firstPart.includes('=')) result.invId = firstPart;
+  for (let i = 1; i < parts.length; i++) {
+    const eqIdx = parts[i].indexOf('=');
+    if (eqIdx === -1) continue;
+    const key = parts[i].slice(0, eqIdx).trim();
+    let val = parts[i].slice(eqIdx + 1).trim();
+    if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+      val = val.slice(1, -1);
+    }
+    result[key] = val;
+  }
+  return result;
+}
+
+function scanFile(filePath, counters) {
+  const content = readFileSync(filePath, 'utf-8');
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    DIRECTIVE_RE.lastIndex = 0;
+    const match = DIRECTIVE_RE.exec(lines[i]);
+    if (!match) continue;
+    const label = `${filePath}:${i + 1}`;
+    const parsed = parseDirective(match[1]);
+    if (!parsed || !parsed.invId) {
+      process.stderr.write(`[FAIL] ${label} — missing or malformed INV-NN identifier\n`);
+      counters.failed++;
+      continue;
+    }
+    if (!KNOWN_INV_IDS.has(parsed.invId)) {
+      process.stderr.write(`[FAIL] ${label} — unknown invariant ID: ${parsed.invId}\n`);
+      counters.failed++;
+      continue;
+    }
+    validateEntry({ reason: parsed.reason, owner: parsed.owner, expiresAt: parsed.until },
+      label, filePath, counters);
+  }
+}
+
+function walkDir(dir, counters) {
+  // Cycle-safe walk via the shared helper (#1521): walkRepo prunes vendor trees and never recurses
+  // into a symlinked directory. Re-apply this script's own IGNORED_DIRS as a path-segment filter so
+  // the visited set is identical, minus the symlink-cycle bug.
+  for (const rel of walkRepo(resolve(dir))) {
+    if (rel.split('/').some((seg) => IGNORED_DIRS.has(seg))) continue;
+    const name = rel.slice(rel.lastIndexOf('/') + 1);
+    const ext = name.slice(name.lastIndexOf('.'));
+    if (SCANNED_EXTENSIONS.has(ext)) scanFile(join(dir, rel), counters);
+  }
+}
+
+const targetDir = process.argv[2] ?? '.';
+const counters = { failed: 0, warnings: 0 };
+walkDir(targetDir, counters);
+if (counters.warnings > 0) {
+  process.stderr.write(`[WARN] ${counters.warnings} suppression(s) expiring within 30 days\n`);
+}
+process.exit(counters.failed > 0 ? 1 : 0);

package/dist/templates/scripts/check-iso9001.mjs.ejs

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * check-iso9001.mjs — ISO 9001 quality-process overlay gate (#1253)
+ *
+ * Fail-closed validation of three controlled documents:
+ *   1. docs/quality/REQUIREMENTS_TRACEABILITY.md — requirement→test RTM (status ladder)
+ *   2. docs/quality/DOCUMENT_CONTROL.md           — controlled-document register (doc_version + existence)
+ *   3. docs/quality/CAPA_LOG.md                   — corrective/preventive-action log (open→issue_ref)
+ *
+ * Reuses the FEATURE_MATRIX RTM machinery (sentinel-delimited table parse + ref
+ * existence) so the requirement→test chain is enforceable, not just prose.
+ *
+ * Exit codes (INV-53):
+ *   0 = PASS   1 = FAIL (drift / missing ref / broken ladder)   2 = ERROR (file/parse)
+ *
+ * Generated by arbiter — do not edit manually.
+ */
+import { existsSync, readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const ROOT = process.cwd()
+const RTM_PATH = resolve(ROOT, 'docs/quality/REQUIREMENTS_TRACEABILITY.md')
+const DOC_CONTROL_PATH = resolve(ROOT, 'docs/quality/DOCUMENT_CONTROL.md')
+const CAPA_PATH = resolve(ROOT, 'docs/quality/CAPA_LOG.md')
+
+/** Parse the pipe-table rows between two sentinel markers. Returns null if absent. */
+function parseSentinelRows(text, startMarker, endMarker) {
+  const start = text.indexOf(startMarker)
+  const end = text.indexOf(endMarker)
+  if (start === -1 || end === -1 || end <= start) return null
+  const block = text.slice(start + startMarker.length, end)
+  const rows = []
+  for (const line of block.split('\n')) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('|')) continue
+    const cells = trimmed
+      .split('|')
+      .slice(1, -1)
+      .map((c) => c.trim())
+    if (cells.length === 0) continue
+    // skip header + separator rows
+    if (/^-+$/.test(cells[0]) || cells[0].endsWith('_id')) continue
+    rows.push(cells)
+  }
+  return rows
+}
+
+function readOrError(path, label, failures) {
+  if (!existsSync(path)) {
+    process.stdout.write(`  check-iso9001: ERROR — ${label} not found at ${path}\n`)
+    process.exit(2)
+  }
+  try {
+    return readFileSync(path, 'utf-8')
+  } catch (err) {
+    process.stdout.write(
+      `  check-iso9001: ERROR — cannot read ${label}: ${err instanceof Error ? err.message : String(err)}\n`,
+    )
+    process.exit(2)
+  }
+}
+
+const failures = []
+
+// ─── 1. RTM: status ladder (fail-closed) ─────────────────────────────────────
+const rtmText = readOrError(RTM_PATH, 'RTM', failures)
+const rtmRows = parseSentinelRows(rtmText, '<!-- ISO9001_RTM_START -->', '<!-- ISO9001_RTM_END -->')
+if (rtmRows === null) {
+  process.stdout.write('  check-iso9001: ERROR — RTM sentinel markers not found\n')
+  process.exit(2)
+}
+if (rtmRows.length === 0) {
+  process.stdout.write('  check-iso9001: ERROR — RTM has no data rows\n')
+  process.exit(2)
+}
+for (const r of rtmRows) {
+  // requirement_id | requirement | code_ref | test_ref | status | issue_ref | note
+  const [id, , codeRef = '', testRef = '', status = '', issueRef = ''] = r
+  if (!['Missing', 'Partial', 'Done'].includes(status)) {
+    failures.push(`RTM ${id}: unknown status "${status}"`)
+    continue
+  }
+  if (status === 'Missing' && !/^#\d+$/.test(issueRef.trim())) {
+    failures.push(`RTM ${id}: Missing status requires issue_ref matching #NNN`)
+  }
+  if (status === 'Partial' && !codeRef.trim()) {
+    failures.push(`RTM ${id}: Partial status requires non-empty code_ref`)
+  }
+  if (status === 'Done') {
+    if (!codeRef.trim()) failures.push(`RTM ${id}: Done requires code_ref`)
+    if (!testRef.trim()) failures.push(`RTM ${id}: Done requires test_ref`)
+    for (const ref of testRef.split(',').map((s) => s.trim()).filter(Boolean)) {
+      if (!ref.includes('*') && !/^https?:/i.test(ref) && !existsSync(resolve(ROOT, ref))) {
+        failures.push(`RTM ${id}: Done test_ref file not found: ${ref}`)
+      }
+    }
+  }
+}
+
+// ─── 2. Document control: existence + doc_version ────────────────────────────
+const docText = readOrError(DOC_CONTROL_PATH, 'document-control register', failures)
+const docRows = parseSentinelRows(docText, '<!-- DOC_CONTROL_START -->', '<!-- DOC_CONTROL_END -->')
+if (docRows === null) {
+  process.stdout.write('  check-iso9001: ERROR — document-control sentinel markers not found\n')
+  process.exit(2)
+}
+for (const r of docRows) {
+  // doc_id | controlled_document | doc_version | owner | status | review_due
+  const [id, doc = '', version = ''] = r
+  if (doc.trim() && !existsSync(resolve(ROOT, doc.trim()))) {
+    failures.push(`DOC ${id}: controlled_document not found on disk: ${doc.trim()}`)
+  }
+  if (!/^\d+\.\d+\.\d+$/.test(version.trim())) {
+    failures.push(`DOC ${id}: doc_version must be semver (got "${version.trim()}")`)
+  }
+}
+
+// ─── 3. CAPA log: open CAPAs require an issue_ref ────────────────────────────
+const capaText = readOrError(CAPA_PATH, 'CAPA log', failures)
+const capaRows = parseSentinelRows(capaText, '<!-- CAPA_START -->', '<!-- CAPA_END -->')
+if (capaRows === null) {
+  process.stdout.write('  check-iso9001: ERROR — CAPA sentinel markers not found\n')
+  process.exit(2)
+}
+for (const r of capaRows) {
+  // capa_id | nonconformity | corrective_action | preventive_action | status | issue_ref
+  const [id, , , , status = '', issueRef = ''] = r
+  if (!['open', 'in_progress', 'closed'].includes(status.trim())) {
+    failures.push(`CAPA ${id}: unknown status "${status.trim()}"`)
+    continue
+  }
+  if ((status.trim() === 'open' || status.trim() === 'in_progress') && !/^#\d+$/.test(issueRef.trim())) {
+    failures.push(`CAPA ${id}: ${status.trim()} status requires a tracking issue_ref matching #NNN`)
+  }
+}
+
+// ─── Report ──────────────────────────────────────────────────────────────────
+if (failures.length === 0) {
+  process.stdout.write(
+    `  check-iso9001: OK — RTM (${rtmRows.length} rows), doc-control (${docRows.length}), CAPA (${capaRows.length}) all valid\n`,
+  )
+  process.exit(0)
+}
+for (const f of failures) process.stdout.write(`  check-iso9001: FAIL — ${f}\n`)
+process.exit(1)

package/dist/templates/scripts/check-knowledge-map.mjs.ejs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+// <%= projectName %> — knowledge-map gate (INV-49)
+// Gate: verify KNOWLEDGE_MAP.md line counts match actual docs within tolerance.
+// Exits 0: all populated entries within tolerance, or no KNOWLEDGE_MAP.md found.
+// Exits 1: one or more entries have drifted beyond tolerance.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const CWD = process.cwd();
+const KM_FILE = join(CWD, 'docs', 'METHOD', 'KNOWLEDGE_MAP.md');
+const TOLERANCE = 0.3;
+
+if (!existsSync(KM_FILE)) {
+  console.log('  check-knowledge-map: no KNOWLEDGE_MAP.md found — skipping');
+  process.exit(0);
+}
+
+const content = readFileSync(KM_FILE, 'utf-8');
+
+const ENTRY_PATTERN = /\*\*Location:\*\*\s+`([^`]+)`[^\n]*\n\*\*Lines:\*\*\s+(\d+)/g;
+
+const drifted = [];
+for (const match of content.matchAll(ENTRY_PATTERN)) {
+  const filePath = match[1];
+  const stored = parseInt(match[2], 10);
+
+  if (stored === 0) continue;
+
+  const abs = join(CWD, filePath);
+  if (!existsSync(abs)) continue;
+
+  const text = readFileSync(abs, 'utf-8');
+  const actual = text.split('\n').length - (text.endsWith('\n') ? 1 : 0);
+  const delta = Math.abs(actual - stored) / Math.max(stored, 1);
+  if (delta > TOLERANCE) {
+    drifted.push({ path: filePath, stored, actual });
+  }
+}
+
+if (drifted.length === 0) {
+  console.log('  check-knowledge-map: all line counts within tolerance');
+  process.exit(0);
+}
+
+console.log(`  check-knowledge-map: ${drifted.length} drift(s) detected in KNOWLEDGE_MAP.md:`);
+for (const { path, stored, actual } of drifted) {
+  console.log(`    drift: ${path} (stored ${stored}, actual ${actual})`);
+}
+process.exit(1);