@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-no-tracked-artifacts.mjs.ejs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// INV-129 enforcement (generated by arbiter for <%= projectName %>): no tracked
+// data/state files or compiled binaries in the git index. Mirrors the self-repo
+// gate (scripts/check-no-tracked-artifacts.mjs). A committed *.sqlite trips
+// neither gitleaks (no secret pattern) nor pii-scan (it skips binaries), so this
+// is the load-bearing retroactive catch for already-tracked data/binary files.
+//
+// Configurable: edit BANNED_PATTERNS / ALLOWLISTED_* below to match your project.
+// Exit codes per INV-53: 0=PASS, 1=FAIL, 2=ERROR.
+import { execFileSync } from 'node:child_process'
+import { openSync, readSync, closeSync } from 'node:fs'
+import { resolve, extname } from 'node:path'
+
+const GIT_CWD = process.env['ARBITER_HOOK_GIT_CWD'] ?? process.cwd()
+
+// Glob-matched banned artifacts: build outputs + data/state files.
+// Add project-specific artifact globs here (e.g. '*.jar', '*.wheel' if not in dist/).
+const BANNED_PATTERNS = [
+  '*.tgz',
+  '*.tar.gz',
+  '*.sqlite',
+  '*.sqlite3',
+  '*.db',
+  '*.db-shm',
+  '*.db-wal',
+]
+
+// Allowlist — intentional committed binaries this gate must NOT flag.
+const ALLOWLISTED_EXTS = new Set([
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.webp',
+  '.ico',
+  '.bmp',
+  '.woff',
+  '.woff2',
+  '.ttf',
+  '.otf',
+  '.eot',
+  '.wasm',
+  '.pdf',
+])
+const ALLOWLISTED_PATH_PREFIXES = ['__tests__/fixtures/', 'tests/fixtures/', 'fixtures/', 'testdata/']
+
+function isAllowlisted(file) {
+  const ext = extname(file).toLowerCase()
+  if (ALLOWLISTED_EXTS.has(ext)) return true
+  const norm = file.replace(/\\/g, '/')
+  return ALLOWLISTED_PATH_PREFIXES.some((p) => norm.startsWith(p) || norm.includes(`/${p}`))
+}
+
+// Magic-byte signatures (PRIMARY signal): ELF 7F454C46 | PE/MZ 4D5A |
+// Mach-O FEEDFACE/FEEDFACF/CEFAEDFE/CFFAEDFE/CAFEBABE.
+function readMagic(absPath) {
+  let fd
+  try {
+    fd = openSync(absPath, 'r')
+    const buf = Buffer.alloc(4)
+    const n = readSync(fd, buf, 0, 4, 0)
+    return buf.subarray(0, n)
+  } catch {
+    return Buffer.alloc(0)
+  } finally {
+    if (fd !== undefined) closeSync(fd)
+  }
+}
+
+function isCompiledBinary(absPath) {
+  const m = readMagic(absPath)
+  if (m.length < 2) return false
+  if (m[0] === 0x7f && m[1] === 0x45 && m[2] === 0x4c && m[3] === 0x46) return true
+  if (m[0] === 0x4d && m[1] === 0x5a) return true
+  if (m.length === 4) {
+    const u32 = m.readUInt32BE(0)
+    if (
+      u32 === 0xfeedface ||
+      u32 === 0xfeedfacf ||
+      u32 === 0xcefaedfe ||
+      u32 === 0xcffaedfe ||
+      u32 === 0xcafebabe ||
+      u32 === 0xbebafeca
+    ) {
+      return true
+    }
+  }
+  return false
+}
+
+function lsFiles(args) {
+  return execFileSync('git', ['ls-files', ...args], { cwd: GIT_CWD, encoding: 'utf-8' })
+    .trim()
+    .split('\n')
+    .filter(Boolean)
+}
+
+let failures = 0
+try {
+  // Fail-closed: a non-git CWD is ERROR (exit 2), never a silent NO-DATA PASS.
+  execFileSync('git', ['rev-parse', '--git-dir'], { cwd: GIT_CWD, stdio: 'pipe' })
+
+  for (const pattern of BANNED_PATTERNS) {
+    for (const f of lsFiles([pattern])) {
+      if (isAllowlisted(f)) continue
+      process.stderr.write(`check-no-tracked-artifacts: FAIL — tracked artifact: ${f}\n`)
+      failures++
+    }
+  }
+
+  const GLOB_EXTS = new Set(['.tgz', '.sqlite', '.sqlite3', '.db', '.db-shm', '.db-wal'])
+  for (const f of lsFiles([])) {
+    if (isAllowlisted(f)) continue
+    const ext = extname(f).toLowerCase()
+    if (GLOB_EXTS.has(ext) || f.endsWith('.tar.gz')) continue
+    const abs = resolve(GIT_CWD, f)
+    if (isCompiledBinary(abs)) {
+      process.stderr.write(`check-no-tracked-artifacts: FAIL — tracked compiled binary: ${f}\n`)
+      failures++
+    }
+  }
+} catch (err) {
+  process.stderr.write(
+    `check-no-tracked-artifacts: ERROR: ${err instanceof Error ? err.message : String(err)}\n`,
+  )
+  process.exit(2)
+}
+
+if (failures > 0) {
+  process.exit(1)
+}
+process.stdout.write('check-no-tracked-artifacts: OK\n')
+process.exit(0)

package/dist/templates/scripts/check-oracle-discrimination.mjs.ejs

@@ -0,0 +1,244 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// scripts/check-oracle-discrimination.mjs — generated by arbiter (anti-fake-green, #2160).
+//
+// Oracle-discrimination guard. An E2E wait written as `expect(list.or(empty).or(error)).toBeVisible()`
+// asserts only "the page arrived somewhere" — it passes identically whether the feature works or is
+// broken, because the error/empty state is folded into the alternative. This is how a green suite
+// stops verifying anything: a missing test is visible, this is not. Waiting on ANY terminal state is
+// fine — it is the right way to avoid a blind timeout — PROVIDED the code immediately after
+// discriminates WHICH state actually appeared and fails naming it.
+//
+// Port of a proven oracle-discrimination guard from a downstream consumer project (#2160),
+// generalized: the spec directory is discovered the same way check-skip-critical-e2e.mjs finds
+// e2e specs (any directory named e2e/playwright/cypress/integration-e2e), not a hardcoded project path.
+//
+// RATCHET, NOT A WALL: pre-existing non-discriminating oracles live in a baseline. The gate fails
+// only if the count GROWS or a new, unbaselined site appears. Fixing a site shrinks the baseline —
+// it can only improve. Regenerate with --update-baseline (explicit human intent, never automatic).
+// A MISSING baseline is fail-closed (exit 1) — this script never fabricates one at runtime; only an
+// explicit --update-baseline run writes it (INV-96).
+//
+// Exit codes (INV-53): 0=PASS (no regression), 1=FAIL (regression, or baseline missing), 2=ERROR.
+// Usage: node scripts/check-oracle-discrimination.mjs [--dir <path>] [--update-baseline] [--help]
+import { readFileSync, writeFileSync, readdirSync, statSync, existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+
+const args = process.argv.slice(2)
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write(
+    'Usage: node scripts/check-oracle-discrimination.mjs [--dir <path>] [--update-baseline]\n' +
+      '  Fails when an E2E wait accepts a failure/empty state as success without discriminating\n' +
+      '  which state appeared. Baseline-ratcheted: fails only on growth. A missing baseline is a\n' +
+      '  fail-closed error, not an auto-generated pass — run --update-baseline explicitly.\n',
+  )
+  process.exit(0)
+}
+const dirArgIdx = args.indexOf('--dir')
+const ROOT = dirArgIdx >= 0 && args[dirArgIdx + 1] ? resolve(args[dirArgIdx + 1]) : process.cwd()
+const UPDATE = args.includes('--update-baseline')
+const BASELINE = join(ROOT, 'oracle-discrimination-baseline.json')
+
+// Mirrors check-skip-critical-e2e.mjs's SKIP_DIRS/E2E_DIR_NAMES/SPEC_RE — same convention, same
+// project-agnostic e2e-directory discovery.
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  'coverage',
+  '.coverage',
+  '.venv',
+  'venv',
+  '__pycache__',
+])
+const E2E_DIR_NAMES = new Set(['e2e', 'playwright', 'cypress', 'integration-e2e'])
+const SPEC_RE = /\.(?:spec|test|e2e)\.(?:ts|tsx|js|jsx|mjs)$/
+
+/** Testid/name fragments that denote a failed or empty outcome. */
+const FAILURE_HINTS = [
+  'error-state',
+  'error-boundary',
+  'errorstate',
+  'empty-state',
+  'emptystate',
+  'not-found',
+  'notfound',
+  'error-message',
+  'errormessage',
+  'failure',
+]
+
+/** Signals that, after the wait, the state actually gets discriminated. */
+const DISCRIMINATORS = ['isVisible(', 'count(', 'innerText(', 'textContent(', 'throw ']
+
+/** How many lines after the wait a discrimination is still accepted. */
+const WINDOW = 30
+
+/** Collect spec files that live under an e2e-named directory (same walk as check-skip-critical-e2e). */
+function collectE2eSpecs(dir, acc, inE2eTree) {
+  let entries
+  try {
+    entries = readdirSync(dir)
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry)) continue
+    const full = join(dir, entry)
+    let st
+    try {
+      st = statSync(full)
+    } catch {
+      continue
+    }
+    if (st.isDirectory()) {
+      collectE2eSpecs(full, acc, inE2eTree || E2E_DIR_NAMES.has(entry))
+    } else if (inE2eTree && SPEC_RE.test(entry)) {
+      acc.push(full)
+    }
+  }
+}
+
+/** Identifiers mentioned in a chain, so a variable-named locator can be resolved. */
+function namesIn(text) {
+  return [...new Set(text.match(/[A-Za-z_$][\w$]*/g) ?? [])]
+}
+
+/**
+ * Map `const name = ...getByTestId('some-id')...` for the whole file. Without this a locator
+ * assigned to a neutrally-named variable (`errore`, `ko`, `alt`) would slip past the inline-testid
+ * scan — a demonstrated false negative from the source project, not a hypothetical one (spool N63).
+ */
+function locatorTestIds(src) {
+  const map = new Map()
+  const re =
+    /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=[^;\n]*?getByTestId\(\s*['"`]([^'"`]+)['"`]/g
+  let m
+  while ((m = re.exec(src)) !== null) map.set(m[1], m[2])
+  const raw = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=[^;\n]*?\[data-testid=["']([^"']+)["']\]/g
+  while ((m = raw.exec(src)) !== null) map.set(m[1], m[2])
+  return map
+}
+
+function findViolations(file) {
+  let src
+  try {
+    src = readFileSync(file, 'utf-8')
+  } catch {
+    return []
+  }
+  const lines = src.split('\n')
+  const rel = file.slice(ROOT.length + 1).replace(/\\/g, '/')
+  const testIdOf = locatorTestIds(src)
+  const hits = []
+
+  lines.forEach((line, i) => {
+    if (!line.includes('.or(')) return
+
+    // The chain may continue over several lines: collect up to the wait's close.
+    const chain = lines.slice(i, Math.min(i + 6, lines.length)).join(' ')
+    if (!/toBeVisible|toBeAttached|waitFor\b/.test(chain)) return
+
+    // The chain text PLUS the testids of any variable it cites — that is where the failure
+    // state hides when the locator has a neutral name.
+    const resolved = namesIn(chain)
+      .map((n) => testIdOf.get(n))
+      .filter(Boolean)
+      .join(' ')
+    const lower = `${chain} ${resolved}`.toLowerCase()
+    const hint = FAILURE_HINTS.find((h) => lower.includes(h))
+    if (!hint) return
+
+    const after = lines.slice(i + 1, Math.min(i + 1 + WINDOW, lines.length)).join('\n')
+    const chainNames = namesIn(chain)
+    const discriminated = DISCRIMINATORS.some(
+      (d) => after.includes(d) && (d === 'throw ' || chainNames.some((n) => after.includes(n))),
+    )
+    if (discriminated) return
+
+    hits.push({ file: rel, line: i + 1, hint, code: line.trim().slice(0, 110) })
+  })
+
+  return hits
+}
+
+function main() {
+  const specs = []
+  collectE2eSpecs(ROOT, specs, false)
+  const violations = specs.flatMap(findViolations)
+  const key = (v) => `${v.file}:${v.line}`
+
+  if (UPDATE) {
+    writeFileSync(
+      BASELINE,
+      JSON.stringify(
+        {
+          _comment:
+            'Pre-existing non-discriminating E2E oracles. The gate fails only if this count GROWS. ' +
+            'Fixing a site removes it from here — it can only improve.',
+          _generated: 'scripts/check-oracle-discrimination.mjs --update-baseline',
+          count: violations.length,
+          sites: violations.map(key).sort(),
+        },
+        null,
+        2,
+      ) + '\n',
+    )
+    process.stdout.write(`check-oracle-discrimination: baseline rewritten — ${violations.length} site(s).\n`)
+    return 0
+  }
+
+  if (!existsSync(BASELINE)) {
+    process.stderr.write(
+      `check-oracle-discrimination: ERROR — baseline missing (oracle-discrimination-baseline.json). ` +
+        `Generate it with --update-baseline.\n`,
+    )
+    return 1
+  }
+  let baseline = { count: 0, sites: [] }
+  try {
+    baseline = JSON.parse(readFileSync(BASELINE, 'utf-8'))
+  } catch (e) {
+    process.stderr.write(`check-oracle-discrimination: ERROR — baseline unparsable: ${e?.message ?? e}\n`)
+    return 1
+  }
+
+  const known = new Set(baseline.sites ?? [])
+  const fresh = violations.filter((v) => !known.has(key(v)))
+  const fixed = (baseline.sites ?? []).filter((s) => !violations.some((v) => key(v) === s))
+
+  process.stdout.write(
+    `check-oracle-discrimination: specs=${specs.length} nonDiscriminating=${violations.length} (baseline ${baseline.count ?? 0})\n`,
+  )
+
+  if (fresh.length > 0) {
+    process.stderr.write(
+      `\ncheck-oracle-discrimination: REGRESSION — ${fresh.length} new non-discriminating oracle(s):\n`,
+    )
+    for (const v of fresh) {
+      process.stderr.write(`  ${v.file}:${v.line}  (state "${v.hint}" in the alternative, never discriminated)\n`)
+      process.stderr.write(`      ${v.code}\n`)
+    }
+    process.stderr.write(
+      '\nWaiting on any terminal state is fine — right after, establish WHICH one appeared and fail naming it.\n',
+    )
+    return 1
+  }
+
+  if (fixed.length > 0) {
+    process.stdout.write(
+      `check-oracle-discrimination: OK — no regression. ${fixed.length} site(s) fixed: run --update-baseline to lock in the progress.\n`,
+    )
+  } else {
+    process.stdout.write('check-oracle-discrimination: OK — no regression.\n')
+  }
+  return 0
+}
+
+try {
+  process.exit(main())
+} catch (e) {
+  process.stderr.write(`check-oracle-discrimination: ERROR — ${e?.message ?? e}\n`)
+  process.exit(2)
+}

package/dist/templates/scripts/check-pii-scan.mjs.ejs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+// <%= projectName %> — PII scan patterns integrity checker (INV-89)
+// Validates that the PII patterns data file exists and is well-formed.
+// Distinct from pii-scan.mjs (which scans files); this validates the scanner config.
+// Exits 0 when patterns file is valid; exits 1 when missing or malformed.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-pii-scan.mjs [options]',
+    '',
+    'Validates that the PII patterns data file exists and is well-formed.',
+    'Exits 0 when patterns file is valid; exits 1 when missing or malformed.',
+    '',
+    'Options:',
+    '  --patterns <path>   Path to pii-patterns.txt (default: scripts/data/pii-patterns.txt)',
+    '  --help, -h          Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const patternsArg = args.indexOf('--patterns');
+const CWD = process.cwd();
+const PATTERNS_PATH = patternsArg >= 0 && args[patternsArg + 1]
+  ? resolve(args[patternsArg + 1])
+  : join(CWD, 'scripts', 'data', 'pii-patterns.txt');
+
+if (!existsSync(PATTERNS_PATH)) {
+  process.stderr.write(`check-pii-scan: FAIL — PII patterns file missing: ${PATTERNS_PATH} (INV-89)\n`);
+  process.exit(1);
+}
+
+let content;
+try {
+  content = readFileSync(PATTERNS_PATH, 'utf-8');
+} catch (err) {
+  process.stderr.write(`check-pii-scan: FAIL — cannot read ${PATTERNS_PATH}: ${String(err)}\n`);
+  process.exit(1);
+}
+
+const lines = content.split('\n').filter((l) => l.trim() && !l.trim().startsWith('#'));
+if (lines.length === 0) {
+  process.stderr.write(`check-pii-scan: FAIL — PII patterns file has no pattern entries: ${PATTERNS_PATH} (INV-89)\n`);
+  process.exit(1);
+}
+
+let violations = 0;
+for (const line of lines) {
+  try {
+    new RegExp(line.trim());
+  } catch (err) {
+    process.stderr.write(`[FAIL] invalid regex in ${PATTERNS_PATH}: "${line}" — ${String(err)}\n`);
+    violations++;
+  }
+}
+
+if (violations > 0) {
+  process.stderr.write(`check-pii-scan: FAIL — ${violations} invalid regex pattern(s) in ${PATTERNS_PATH} (INV-89)\n`);
+  process.exit(1);
+}
+
+process.stdout.write(`check-pii-scan: OK — PII patterns file valid: ${lines.length} pattern(s) in ${PATTERNS_PATH} (INV-89)\n`);
+process.exit(0);

package/dist/templates/scripts/check-pipe-tee-hazard.mjs.ejs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// Advisory scan: detects `| tee` without `set -o pipefail` or PIPESTATUS guard.
+// Unguarded pipe/tee masks exit-code failures (the tee command always exits 0).
+// Usage: node scripts/check-pipe-tee-hazard.mjs [dir...]
+// Always exits 0 (advisory — emits [WARN], does not block).
+import { readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { walkRepo } from "./lib/glob-walk.mjs";
+
+// Context window for guard detection (lines above and below the tee line).
+const CONTEXT_LINES = 20;
+
+const PIPE_TEE_RE = /\|\s*tee\b/;
+const PIPEFAIL_RE = /set\s+-[a-z]*o\s+pipefail|set\s+-[a-z]*o pipefail/;
+const PIPESTATUS_RE = /\$\{?PIPESTATUS\[/;
+
+// File suffixes scanned for unguarded pipe/tee. Shell scripts and the EJS
+// templates that emit shell: bare `.sh`, `.sh.ejs` / `.mjs.ejs` script
+// templates, and workflow templates (`.yml.ejs` / `.yaml.ejs`) whose `run:`
+// blocks are shell. Single source of truth for the walk filter below
+// (#1523: the old `.ejs`-wide set was dead and dropped `.yml.ejs` coverage).
+const SCAN_SUFFIXES = [".sh", ".sh.ejs", ".mjs.ejs", ".yml.ejs", ".yaml.ejs"];
+const SKIP_DIRS = new Set(["node_modules", "dist", ".git"]);
+
+const scanDirs =
+  process.argv.slice(2).length > 0 ? process.argv.slice(2) : [process.cwd()];
+const baseDir = process.cwd();
+let warnings = 0;
+
+function scan(dir) {
+  // Cycle-safe walk via the shared helper (#1521): walkRepo prunes vendor trees and never
+  // recurses into a symlinked directory. Re-apply this script's own SKIP_DIRS as a path-segment
+  // filter so the visited set is identical, minus the symlink-cycle bug. Unreadable dirs are
+  // skipped silently.
+  for (const rel of walkRepo(resolve(dir))) {
+    if (rel.split("/").some((seg) => SKIP_DIRS.has(seg))) continue;
+    const name = rel.slice(rel.lastIndexOf("/") + 1);
+    if (SCAN_SUFFIXES.some((suffix) => name.endsWith(suffix))) {
+      scanFile(join(dir, rel));
+    }
+  }
+}
+
+function hasGuard(lines, hitIndex) {
+  const start = Math.max(0, hitIndex - CONTEXT_LINES);
+  const end = Math.min(lines.length - 1, hitIndex + CONTEXT_LINES);
+  for (let i = start; i <= end; i++) {
+    if (PIPEFAIL_RE.test(lines[i]) || PIPESTATUS_RE.test(lines[i])) return true;
+  }
+  return false;
+}
+
+function scanFile(filePath) {
+  let content;
+  try {
+    content = readFileSync(filePath, "utf-8");
+  } catch (err) {
+    process.stderr.write(
+      `  [warn] could not read file ${filePath}: ${err.message}\n`,
+    );
+    return;
+  }
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (PIPE_TEE_RE.test(lines[i]) && !hasGuard(lines, i)) {
+      const rel = relative(baseDir, filePath);
+      console.log(
+        `  [WARN] ${rel}:${i + 1}  unguarded pipe/tee — add set -o pipefail or check PIPESTATUS[0]`,
+      );
+      warnings++;
+    }
+  }
+}
+
+for (const dir of scanDirs) {
+  scan(dir);
+}
+
+if (warnings > 0) {
+  console.log(
+    `\n  Found ${warnings} advisory warning(s). Consider adding pipefail guards.\n`,
+  );
+}
+// Always exit 0 — advisory only
+process.exit(0);

package/dist/templates/scripts/check-pr-size-gate.mjs.ejs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// <%= projectName %> — PR size gate drift checker (INV-89)
+// Validates that the PR size gate configuration is present and within bounds.
+// Exits 0 when PR size gate config is valid; exits 1 when config is missing or invalid.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-pr-size-gate.mjs [options]',
+    '',
+    'Validates that PR size gate configuration (pr-size-config.json or workflow) is present.',
+    'Exits 0 when config is valid; exits 1 when missing or invalid.',
+    '',
+    'Options:',
+    '  --help, -h      Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const CWD = process.cwd();
+const CONFIG_PATH = join(CWD, 'config', 'pr-size-config.json');
+const WORKFLOW_DIR = join(CWD, '.github', 'workflows');
+const MAX_WARNING_LINES = 1000;
+const MAX_ERROR_LINES = 5000;
+
+let violations = 0;
+
+if (existsSync(CONFIG_PATH)) {
+  let config;
+  try {
+    config = JSON.parse(readFileSync(CONFIG_PATH, 'utf-8'));
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      process.stderr.write(`[FAIL] ${CONFIG_PATH}: invalid JSON — ${err.message}\n`);
+      violations++;
+      process.exit(1);
+    }
+    throw err;
+  }
+  const warn = typeof config.warnLines === 'number' ? config.warnLines : null;
+  const error = typeof config.errorLines === 'number' ? config.errorLines : null;
+  if (warn !== null && warn > MAX_WARNING_LINES) {
+    process.stderr.write(`[FAIL] ${CONFIG_PATH}: warnLines=${warn} exceeds maximum ${MAX_WARNING_LINES} (INV-89)\n`);
+    violations++;
+  }
+  if (error !== null && error > MAX_ERROR_LINES) {
+    process.stderr.write(`[FAIL] ${CONFIG_PATH}: errorLines=${error} exceeds maximum ${MAX_ERROR_LINES} (INV-89)\n`);
+    violations++;
+  }
+  if (violations > 0) {
+    process.stderr.write('check-pr-size-gate: FAIL — PR size gate configuration out of bounds (INV-89)\n');
+    process.exit(1);
+  }
+  process.stdout.write('check-pr-size-gate: OK — PR size gate configuration valid (INV-89)\n');
+} else if (existsSync(WORKFLOW_DIR)) {
+  let found = false;
+  const entries = readdirSync(WORKFLOW_DIR, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    if (!entry.name.endsWith('.yml') && !entry.name.endsWith('.yaml')) continue;
+    try {
+      const content = readFileSync(join(WORKFLOW_DIR, entry.name), 'utf-8');
+      if (content.includes('pr-size') || content.includes('size-check')) {
+        found = true;
+        break;
+      }
+    } catch { /* ignore */ }
+  }
+  if (found) {
+    process.stdout.write('check-pr-size-gate: OK — PR size gate referenced in workflows (INV-89)\n');
+  } else {
+    process.stdout.write('check-pr-size-gate: SKIP — no PR size gate configuration found (optional) (INV-89)\n');
+    // #2052: recognized marker so runCheck surfaces SKIP, not PASS, in the gate summary.
+    process.stdout.write('[SKIP] no PR size gate configuration found (optional)\n');
+  }
+} else {
+  process.stdout.write('check-pr-size-gate: SKIP — no .github/workflows/ directory (INV-89)\n');
+  // #2052: recognized marker so runCheck surfaces SKIP, not PASS, in the gate summary.
+  process.stdout.write('[SKIP] no .github/workflows/ directory\n');
+}
+process.exit(0);