@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-refutation-verdicts.mjs.ejs

@@ -0,0 +1,256 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: E2 (#1943, M13) — refutation-by-majority gate. High-stakes findings are not
+// CATALOG: accepted from one agent: N independent skeptics are dispatched with a REFUTE mandate;
+// CATALOG: a finding survives only with a strict UPHELD majority. When the refutation skill
+// CATALOG: writes a marker (.arbiter/evidence/agent-returns/<task>/refutation-required.json), this
+// CATALOG: gate asserts every acted-on finding has >= N skeptic verdicts AND a strict UPHELD
+// CATALOG: majority — kills R4 (false structural alarms acted on) and R2 (rubber stamps).
+// CATALOG: SECOND AXIS (INV-145, CANON-24): the majority rule proves you did not act on a phantom;
+// CATALOG: the SEVERITY FLOOR proves you did not stop while a real one was still open. Any finding
+// CATALOG: the skeptics majority-UPHELD at critical/high/med must appear in the marker's acted-on
+// CATALOG: set. Both axes read the same envelopes, so the loop needs no new artifact — only the
+// CATALOG: obligation to keep hopping until nothing above `low` survives unaddressed.
+// CATALOG: Rejected fold-in into check-agent-return.mjs: that VALIDATES the envelope schema + M12
+// CATALOG: citations; this ADJUDICATES the refutation majority over a set of skeptic envelopes —
+// CATALOG: different axis (shape vs verdict semantics), different trigger (always vs marker-gated).
+//
+// Exit codes (INV-53): 0 PASS, 1 FAIL (insufficient skeptics / majority-refuted acted-on finding /
+//   a majority-upheld finding above `low` left unaddressed),
+// 2 ERROR. Vacuous pass when no marker exists (nothing to adjudicate — scope condition itself
+// checked, not a skip).
+//
+// Usage:
+//   node scripts/check-refutation-verdicts.mjs [--evidence-dir=<path>] [--repo-root=<dir>]
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { resolve, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { arg } from './lib/gate-args.mjs'
+
+const __dirname = fileURLToPath(new URL('.', import.meta.url))
+const repoDefault = resolve(__dirname, '..')
+
+const argv = process.argv.slice(2)
+const EVIDENCE_DIR = arg('evidence-dir', argv)
+  ? resolve(arg('evidence-dir', argv))
+  : join(repoDefault, '.arbiter', 'evidence', 'agent-returns')
+const MARKER_NAME = 'refutation-required.json'
+
+/**
+ * Find the refutation marker under the evidence dir (any task subdir).
+ * @param {string} evidenceDir
+ * @returns {{ path: string, body: Record<string, unknown> } | null}
+ */
+function findMarker(evidenceDir) {
+  if (!existsSync(evidenceDir)) return null
+  /** @type {string[]} */
+  const markers = []
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry)
+      let st
+      try {
+        st = statSync(full)
+        // FAIL-OPEN-INTENT: statSync ENOENT race on a dir entry — skip; rethrow would false-positive on a racing delete.
+      } catch {
+        continue
+      }
+      if (st.isDirectory()) walk(full)
+      else if (entry === MARKER_NAME) markers.push(full)
+    }
+  }
+  walk(evidenceDir)
+  if (markers.length === 0) return null
+  const path = markers[0]
+  try {
+    const body = JSON.parse(readFileSync(path, 'utf-8'))
+    return { path, body: /** @type {Record<string, unknown>} */ (body) }
+  } catch (err) {
+    throw new Error(
+      `cannot parse marker ${path}: ${err instanceof Error ? err.message : String(err)}`,
+    )
+  }
+}
+
+/**
+ * Load every skeptic envelope under the marker's task dir.
+ * @param {string} evidenceDir
+ * @param {string} taskDirName
+ * @returns {Record<string, unknown>[]}
+ */
+function loadSkepticEnvelopes(evidenceDir, taskDirName) {
+  const taskDir = join(evidenceDir, taskDirName)
+  if (!existsSync(taskDir)) return []
+  /** @type {Record<string, unknown>[]} */
+  const out = []
+  for (const entry of readdirSync(taskDir)) {
+    if (!entry.endsWith('.json') || entry === MARKER_NAME) continue
+    try {
+      const env = JSON.parse(readFileSync(join(taskDir, entry), 'utf-8'))
+      if (env && typeof env === 'object' && env['role'] === 'skeptic') {
+        out.push(/** @type {Record<string, unknown>} */ (env))
+      }
+      // FAIL-OPEN-INTENT: unparseable envelope is skipped here — E1 (check-agent-return.mjs) owns shape validation and fails closed on the same file.
+    } catch {
+      // unparseable envelope — skip here (E1 owns shape validation); fail-closed on marker parse.
+    }
+  }
+  return out
+}
+
+/** Severities that may never be left open when the loop closes (INV-145). `low`/`info` may. */
+export const ABOVE_FLOOR = new Set(['critical', 'high', 'med'])
+
+/**
+ * Findings the skeptics reported at a severity above the floor, which a strict UPHELD majority
+ * confirmed, and which the marker does NOT list as acted on. Severity is taken as the HIGHEST any
+ * skeptic assigned: when two disagree, the loop must clear the worse reading, not the kinder one.
+ *
+ * @param {Record<string, unknown>[]} skeptics skeptic envelopes
+ * @param {string[]} actedOn ids from the marker
+ * @param {number} n required skeptic count
+ * @returns {{id: string, severity: string}[]} sorted, worst first
+ */
+export function unaddressedAboveFloor(skeptics, actedOn, n) {
+  const RANK = { critical: 3, high: 2, med: 1 }
+  const worst = new Map()
+  for (const env of skeptics) {
+    const found = Array.isArray(env['findings']) ? env['findings'] : []
+    for (const f of found) {
+      const ff = /** @type {Record<string, unknown>} */ (f)
+      const id = typeof ff['id'] === 'string' ? ff['id'] : null
+      const sev = typeof ff['severity'] === 'string' ? ff['severity'] : null
+      if (id === null || sev === null || !ABOVE_FLOOR.has(sev)) continue
+      const prev = worst.get(id)
+      if (prev === undefined || (RANK[sev] ?? 0) > (RANK[prev] ?? 0)) worst.set(id, sev)
+    }
+  }
+  const out = []
+  for (const [id, severity] of worst) {
+    if (actedOn.includes(id)) continue
+    let upheld = 0
+    let refuted = 0
+    for (const env of skeptics) {
+      const refs = Array.isArray(env['refutations']) ? env['refutations'] : []
+      for (const r of refs) {
+        const rr = /** @type {Record<string, unknown>} */ (r)
+        if (rr['target'] !== id) continue
+        if (rr['verdict'] === 'UPHELD') upheld++
+        else if (rr['verdict'] === 'REFUTED') refuted++
+      }
+    }
+    // Only a finding the skeptics actually confirmed blocks the loop. One below quorum, or
+    // majority-refuted, is not a real finding and must not hold the wave hostage.
+    if (upheld + refuted >= n && upheld > refuted) out.push({ id, severity })
+  }
+  return out.sort(
+    (a, b) => (RANK[b.severity] ?? 0) - (RANK[a.severity] ?? 0) || a.id.localeCompare(b.id),
+  )
+}
+
+function main() {
+  let marker
+  try {
+    marker = findMarker(EVIDENCE_DIR)
+  } catch (err) {
+    process.stderr.write(
+      `[check-refutation-verdicts] ERROR: ${err instanceof Error ? err.message : String(err)}\n`,
+    )
+    return 2
+  }
+  if (!marker) {
+    process.stdout.write(
+      '[check-refutation-verdicts] OK — no refutation marker, nothing to adjudicate\n',
+    )
+    return 0
+  }
+  const N = Number(marker.body['skeptics'] ?? 0)
+  const findings = Array.isArray(marker.body['findings']) ? marker.body['findings'] : []
+  if (!Number.isInteger(N) || N < 1) {
+    process.stdout.write(
+      `[check-refutation-verdicts] FAIL: marker ${marker.path} has invalid skeptics count (${N})\n`,
+    )
+    return 1
+  }
+  // NOTE: no early return on an empty acted-on set. The majority axis has nothing to adjudicate
+  // there, but the SEVERITY FLOOR has everything: a wave that addressed nothing while the
+  // skeptics upheld a high finding is exactly the case INV-145 exists to catch, and returning
+  // early here made the floor unreachable for it — found by its own tests.
+  // task dir name = sanitized task id (the marker lives under <task>/)
+  const markerDir = marker.path.split('/').slice(0, -1).pop() ?? ''
+  const skeptics = loadSkepticEnvelopes(EVIDENCE_DIR, markerDir)
+  let violations = 0
+  for (const id of findings) {
+    /** @type {{ verdict: string }[]} */
+    const verdicts = []
+    for (const env of skeptics) {
+      const refs = Array.isArray(env['refutations']) ? env['refutations'] : []
+      for (const r of refs) {
+        const rr = /** @type {Record<string, unknown>} */ (r)
+        if (rr['target'] === id && (rr['verdict'] === 'UPHELD' || rr['verdict'] === 'REFUTED')) {
+          verdicts.push({ verdict: String(rr['verdict']) })
+        }
+      }
+    }
+    if (verdicts.length < N) {
+      process.stdout.write(
+        `[check-refutation-verdicts] FAIL: finding "${id}" has ${verdicts.length} skeptic verdict(s), need >= ${N}\n`,
+      )
+      violations++
+      continue
+    }
+    const upheld = verdicts.filter((v) => v.verdict === 'UPHELD').length
+    const refuted = verdicts.filter((v) => v.verdict === 'REFUTED').length
+    if (upheld <= refuted) {
+      process.stdout.write(
+        `[check-refutation-verdicts] FAIL: finding "${id}" acted on but majority-refuted (UPHELD ${upheld} <= REFUTED ${refuted})\n`,
+      )
+      violations++
+    }
+  }
+  // INV-145 severity floor. The loop is not closed while a REAL finding above `low` is still
+  // open, so a majority-upheld finding at critical/high/med must be in the acted-on set. Without
+  // this the majority rule is one-sided: it stops you acting on a phantom, and says nothing about
+  // stopping early on something true.
+  const unaddressed = unaddressedAboveFloor(skeptics, findings, N)
+  for (const f of unaddressed) {
+    process.stdout.write(
+      `[check-refutation-verdicts] FAIL: finding "${f.id}" (${f.severity}) is majority-upheld but ` +
+        `not in the acted-on set — the adversarial loop closes only when nothing above \`low\` ` +
+        `survives. Fix it and hop again, or lower it with evidence.\n`,
+    )
+    violations++
+  }
+  if (marker.body['degraded'] === true) {
+    // Recorded, never silently equated with an independent round. A hop that could not reach an
+    // independent skeptic (model unavailable, rate limit) is accepted but must SAY it was degraded,
+    // so the evidence never claims an independence it did not have.
+    process.stdout.write(
+      `[check-refutation-verdicts] DEGRADED — marker declares no independent skeptic was available; ` +
+        `verdicts are self-probed and this round does not count as independent\n`,
+    )
+  }
+  if (violations > 0) {
+    process.stdout.write(
+      `[check-refutation-verdicts] FAIL: ${violations} finding(s) failed refutation adjudication\n`,
+    )
+    return 1
+  }
+  process.stdout.write(
+    findings.length === 0
+      ? `[check-refutation-verdicts] OK — marker present, no finding acted on, and nothing above ` +
+          `\`low\` left unaddressed\n`
+      : `[check-refutation-verdicts] OK — ${findings.length} finding(s) survived refutation ` +
+          `(N=${N}), nothing above \`low\` left unaddressed\n`,
+  )
+  return 0
+}
+
+try {
+  process.exit(main())
+} catch (err) {
+  process.stderr.write(
+    `[check-refutation-verdicts] ERROR: ${err instanceof Error ? err.message : String(err)}\n`,
+  )
+  process.exit(2)
+}

package/dist/templates/scripts/check-regulated-overlay.mjs.ejs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+// <%= projectName %> — regulated / high-assurance overlay gate.
+// Fail-closed enforcement of the regulated bundle declared in
+// .arbiter/regulated/overlay.json. The manifest MAY be tightened above the
+// regulated floor; this gate FAILS if any pillar is weakened below the floor,
+// dropped, or the manifest is missing/unparseable. It is the machine-checkable
+// half of the regulated overlay — the bundle cannot be silently un-wired while a
+// project still claims to be "regulated".
+//
+// Exit codes: 0 = all pillars satisfy the regulated floor; 1 = a pillar violates
+// the floor; 2 = fail-closed error (manifest absent or unreadable).
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-regulated-overlay.mjs [options]',
+    '',
+    'Enforces the regulated / high-assurance overlay floor declared in',
+    '.arbiter/regulated/overlay.json (separation-of-duties, audit retention,',
+    'suppression-expiry, signing/SBOM attestation, mutation coverage).',
+    '',
+    'Options:',
+    '  --root <path>   Project root (default: cwd)',
+    '  --help, -h      Show this help and exit',
+    '',
+    'Exit: 0 = clean, 1 = floor violated, 2 = fail-closed error.',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const rootArg = args.indexOf('--root');
+const ROOT = rootArg >= 0 && args[rootArg + 1] ? resolve(args[rootArg + 1]) : process.cwd();
+const MANIFEST = join(ROOT, '.arbiter/regulated/overlay.json');
+
+// ── Regulated floor (the minimums that define "regulated"; tightening is allowed) ──
+const MIN_RETENTION_DAYS = 365;
+const MAX_SUPPRESSION_VALIDITY_DAYS = 365;
+
+function failClosed(msg) {
+  process.stderr.write(`[ERROR] check-regulated-overlay: ${msg}\n`);
+  process.exit(2);
+}
+
+if (!existsSync(MANIFEST)) {
+  failClosed(`policy manifest not found: .arbiter/regulated/overlay.json (regulated overlay requires it)`);
+}
+
+let manifest;
+try {
+  manifest = JSON.parse(readFileSync(MANIFEST, 'utf-8'));
+} catch (err) {
+  failClosed(`policy manifest is not valid JSON: ${err.message}`);
+}
+if (manifest === null || typeof manifest !== 'object' || Array.isArray(manifest)) {
+  failClosed('policy manifest must be a JSON object');
+}
+
+const failures = [];
+function require_(cond, pillar, detail) {
+  if (!cond) failures.push(`${pillar}: ${detail}`);
+}
+function isPosInt(v) {
+  return typeof v === 'number' && Number.isInteger(v) && v >= 1;
+}
+
+// 1. Separation of duties — an AI-authored PR needs an independent human approval.
+const sod = manifest.separationOfDuties;
+if (sod === null || typeof sod !== 'object' || Array.isArray(sod)) {
+  failures.push('separationOfDuties: pillar is missing — regulated requires human approval on AI-authored PRs');
+} else {
+  require_(
+    sod.requireHumanApprovalOnAiAuthoredPR === true,
+    'separationOfDuties',
+    'requireHumanApprovalOnAiAuthoredPR must be true (an AI-authored PR cannot self-approve)',
+  );
+  require_(
+    isPosInt(sod.minHumanApprovals),
+    'separationOfDuties',
+    'minHumanApprovals must be an integer >= 1',
+  );
+  require_(
+    Array.isArray(sod.aiAuthorMarkers) &&
+      sod.aiAuthorMarkers.length > 0 &&
+      sod.aiAuthorMarkers.every((m) => typeof m === 'string' && m.length > 0),
+    'separationOfDuties',
+    'aiAuthorMarkers must be a non-empty array of strings (how an AI-authored commit is recognised)',
+  );
+}
+
+// 2. Audit-trail retention — a minimum retention horizon.
+const audit = manifest.auditTrail;
+if (audit === null || typeof audit !== 'object' || Array.isArray(audit)) {
+  failures.push('auditTrail: pillar is missing — regulated requires a declared retention horizon');
+} else {
+  require_(
+    typeof audit.retentionDays === 'number' && audit.retentionDays >= MIN_RETENTION_DAYS,
+    'auditTrail',
+    `retentionDays must be a number >= ${MIN_RETENTION_DAYS}`,
+  );
+}
+
+// 3. Suppression expiry — every suppression carries a mandatory, bounded expiry.
+const supp = manifest.suppressionExpiry;
+if (supp === null || typeof supp !== 'object' || Array.isArray(supp)) {
+  failures.push('suppressionExpiry: pillar is missing — regulated requires mandatory, bounded suppression expiry');
+} else {
+  require_(supp.mandatory === true, 'suppressionExpiry', 'mandatory must be true');
+  require_(
+    typeof supp.maxValidityDays === 'number' &&
+      supp.maxValidityDays >= 1 &&
+      supp.maxValidityDays <= MAX_SUPPRESSION_VALIDITY_DAYS,
+    'suppressionExpiry',
+    `maxValidityDays must be a number in 1..${MAX_SUPPRESSION_VALIDITY_DAYS}`,
+  );
+}
+
+// 4. Signing + SBOM attestation — release artefacts are signed with an SBOM.
+const att = manifest.attestation;
+if (att === null || typeof att !== 'object' || Array.isArray(att)) {
+  failures.push('attestation: pillar is missing — regulated requires cosign + SBOM attestation');
+} else {
+  require_(att.cosign === true, 'attestation', 'cosign must be true');
+  require_(att.sbom === true, 'attestation', 'sbom must be true');
+}
+
+// 5. Mutation coverage — a minimum mutation score floor.
+const mut = manifest.mutationCoverage;
+if (mut === null || typeof mut !== 'object' || Array.isArray(mut)) {
+  failures.push('mutationCoverage: pillar is missing — regulated requires a mutation score floor');
+} else {
+  require_(
+    typeof mut.minScore === 'number' && mut.minScore >= 1,
+    'mutationCoverage',
+    'minScore must be a number >= 1',
+  );
+}
+
+// Bundle-wiring advisory: the suppression-expiry gate should be present when the
+// manifest mandates it. Advisory (WARN, not FAIL) — the floor above is the gate's
+// authority; this only nudges projects to wire the companion gate.
+if (supp && supp.mandatory === true && !existsSync(join(ROOT, 'scripts/check-suppressions.mjs'))) {
+  process.stderr.write(
+    '[WARN] suppressionExpiry.mandatory=true but scripts/check-suppressions.mjs is absent — ' +
+      'enable suppressions so expiry is actually enforced.\n',
+  );
+}
+
+if (failures.length > 0) {
+  process.stderr.write(`\n[FAIL] regulated overlay floor violated (${failures.length}):\n`);
+  for (const f of failures) process.stderr.write(`  - ${f}\n`);
+  process.exit(1);
+}
+
+process.stdout.write('check-regulated-overlay: OK — all regulated pillars satisfy the floor\n');
+process.exit(0);

package/dist/templates/scripts/check-render-smoke.mjs.ejs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: INV-127 enforcement. Frontend archetypes (or a `frontend` lane) MUST carry a
+// CATALOG:   render-smoke behavioural test: a headless-browser spec that boots the built
+// CATALOG:   SPA and asserts the app shell mounts without console errors. Fails-closed when
+// CATALOG:   a frontend project has zero render-smoke specs — catches a known failure mode from a prior internal project
+// CATALOG:   (token-purity passed while the screen rendered as broken empty boxes, #1366).
+// CATALOG:   SKIPs for non-frontend / ungoverned repos so they never false-fail.
+// CATALOG:   Boundary: file PRESENCE only — the spec is executed by the CI render-smoke lane.
+// Exit codes (INV-53): 0=PASS/SKIP, 1=policy violation, 2=schema error.
+// Usage: node scripts/check-render-smoke.mjs [--help]
+import { readFileSync, existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { globMatch, walkRepo } from './lib/glob-walk.mjs'
+
+const ROOT = resolve(process.cwd())
+const ARBITER_PATH = join(ROOT, 'arbiter.json')
+
+// Render-smoke spec naming conventions accepted by the gate (OR semantics).
+const RENDER_SMOKE_GLOBS = [
+  'tests/e2e/render-smoke.spec.ts',
+  'frontend/tests/e2e/render-smoke.spec.ts',
+  '**/render-smoke.spec.ts',
+  '**/*.render-smoke.spec.ts',
+  '**/*.render-smoke.test.ts',
+]
+
+const HELP = `Usage: node scripts/check-render-smoke.mjs [--help]
+
+Enforces that frontend archetypes carry a render-smoke behavioural test (INV-127).
+
+A render-smoke spec boots the built SPA in a headless browser and asserts the app
+shell + key screens mount without console errors. It catches the failure mode where
+a token-purity gate passes but the screen renders as broken empty boxes.
+
+Applicability:
+  Active when arbiter.json declares archetype "frontend-spa" OR a "frontend" lane.
+  Any other archetype / a missing arbiter.json → SKIP (exit 0).
+
+Accepted spec locations (any one satisfies the gate):
+${RENDER_SMOKE_GLOBS.map((g) => `  ${g}`).join('\n')}
+
+Exit codes:
+  0 — pass or SKIP (non-frontend / ungoverned repo)
+  1 — frontend project has no render-smoke spec
+  2 — schema error (unreadable / invalid arbiter.json)`
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  process.stdout.write(`${HELP}\n`)
+  process.exit(0)
+}
+
+function isFrontend(arbiter) {
+  if (arbiter.archetype === 'frontend-spa') return true
+  return Array.isArray(arbiter.lanes) && arbiter.lanes.includes('frontend')
+}
+
+function main() {
+  if (!existsSync(ARBITER_PATH)) {
+    process.stdout.write('[check-render-smoke] SKIP — arbiter.json not found\n')
+    // #2052: recognized marker so runCheck surfaces SKIP, not PASS, in the gate summary.
+    process.stdout.write('[SKIP] arbiter.json not found\n')
+    process.exit(0)
+  }
+
+  let arbiter
+  try {
+    arbiter = JSON.parse(readFileSync(ARBITER_PATH, 'utf-8'))
+  } catch (err) {
+    process.stderr.write(`[check-render-smoke] ERROR — invalid arbiter.json: ${err.message}\n`)
+    process.exit(2)
+  }
+
+  if (!isFrontend(arbiter)) {
+    process.stdout.write(
+      '[check-render-smoke] SKIP — not a frontend archetype and no frontend lane\n',
+    )
+    // #2052: recognized marker so runCheck surfaces SKIP, not PASS, in the gate summary.
+    process.stdout.write('[SKIP] not a frontend archetype and no frontend lane\n')
+    process.exit(0)
+  }
+
+  const allFiles = walkRepo(ROOT)
+  const found = RENDER_SMOKE_GLOBS.some((g) => allFiles.some((f) => globMatch(g, f)))
+
+  if (!found) {
+    process.stderr.write(
+      '[check-render-smoke] FAIL — frontend project has no render-smoke behavioural test. ' +
+        'A token-purity pass does not prove the screen renders. Scaffold one at ' +
+        'tests/e2e/render-smoke.spec.ts (arbiter init emits a starter), or run arbiter update. ' +
+        `Accepted: ${RENDER_SMOKE_GLOBS.join(', ')}\n`,
+    )
+    process.exit(1)
+  }
+
+  process.stdout.write('[check-render-smoke] OK — render-smoke behavioural test present\n')
+  process.exit(0)
+}
+
+main()

package/dist/templates/scripts/check-reuse-registry.mjs.ejs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// <%= projectName %> — reuse-registry gate (#2044, AC-2044.3).
+// Active only when the extended invariant set is on (wired in check-all.mjs
+// behind includeExtendedInvariants): the abstraction discipline (INV-69/70)
+// requires a documented search-before-build record. Fails when
+// docs/METHOD/REUSE_REGISTRY.md is absent or empty (no registered entries).
+// Exit codes (INV-53): 0 = PASS, 1 = FAIL, 2 = ERROR.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const CWD = process.cwd();
+const REGISTRY = join(CWD, 'docs', 'METHOD', 'REUSE_REGISTRY.md');
+
+if (!existsSync(REGISTRY)) {
+  process.stderr.write(
+    'check-reuse-registry: FAIL — docs/METHOD/REUSE_REGISTRY.md missing (extended set active, INV-69/70)\n',
+  );
+  process.exit(1);
+}
+
+const source = readFileSync(REGISTRY, 'utf-8');
+// An entry is a table row with a non-header, non-separator first cell.
+const ROW_RE = /^\|\s*[^|]+\s*\|/;
+const rows = source
+  .split('\n')
+  .filter((line) => ROW_RE.test(line))
+  .filter((line) => !/^\|\s*---/.test(line))
+  .filter((line) => !/^\|\s*Modulo\s*\|/.test(line))
+  .filter((line) => !/^\|\s*Data\s*\|/.test(line))
+  // the "nessun modulo registrato" placeholder is not a real entry
+  .filter((line) => !/nessun modulo ancora registrato/i.test(line))
+  .filter((line) => !/nessuna ricerca ancora registrata/i.test(line));
+
+if (rows.length === 0) {
+  process.stderr.write(
+    'check-reuse-registry: FAIL — docs/METHOD/REUSE_REGISTRY.md is empty (no registered reuse entries)\n',
+  );
+  process.exit(1);
+}
+
+process.stdout.write(
+  `check-reuse-registry: PASS — ${rows.length} reuse entr${rows.length === 1 ? 'y' : 'ies'} registered\n`,
+);
+process.exit(0);