@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-stack-conformity.mjs.ejs

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+// <%= projectName %> — stack-conformity gate (INV-121, generated by arbiter, #1312)
+// CATALOG: INV-121 enforcement. Fails when the repo-ROOT manifest contradicts the
+// CATALOG:   axes declared in arbiter.json (language AND databaseEngine). Self-safety
+// CATALOG:   lives HERE at runtime: absent `language` ⇒ exit 0 (PASS, undeclared never
+// CATALOG:   fails); absent/`none` `databaseEngine` ⇒ DB-conformity skipped. Independent
+// CATALOG:   escapes. Root-scope ONLY — reads ./go.mod, ./package.json, ./*.lock at the
+// CATALOG:   target root and NEVER recurses (auto-skips fixtures + node_modules).
+// CATALOG: Rejected fold-in into check-collab-mode-wired.mjs (collaborationMode axis,
+// CATALOG:   not manifest/lockfile conformity) and check-canonical-paths.mjs (path layout,
+// CATALOG:   not declared-vs-actual stack drift) — different axis, different failure mode.
+// Exit codes per INV-53: 0=PASS/SKIP, 1=FAIL (contradiction), 2=ERROR.
+// Usage: node scripts/check-stack-conformity.mjs [--config=<path>] [--help]
+
+import { readFileSync, existsSync, readdirSync } from 'node:fs'
+import { resolve, join } from 'node:path'
+
+const HELP = [
+  'Usage: node scripts/check-stack-conformity.mjs [options]',
+  '',
+  'Fails (exit 1) when the repo-root manifest contradicts arbiter.json axes',
+  '(language AND databaseEngine). Root-scope only — never recurses.',
+  '',
+  'Options:',
+  '  --config=<path>  Path to arbiter.json (default: ./arbiter.json)',
+  '  --help, -h       Show this help and exit',
+].join('\n')
+
+// Database drivers keyed by the engine they imply. A driver in the root manifest
+// for an engine OTHER than the declared one is a contradiction.
+const DB_DRIVERS = {
+  postgresql: ['pg', 'postgres', 'node-postgres', 'pg-promise', 'lib/pq', 'jackc/pgx', 'psycopg2', 'asyncpg', 'postgresql'],
+  mysql: ['mysql', 'mysql2', 'go-sql-driver/mysql', 'pymysql', 'mysqlclient'],
+  mongodb: ['mongodb', 'mongoose', 'go.mongodb.org/mongo-driver', 'pymongo', 'motor'],
+  sqlite: ['better-sqlite3', 'sqlite3', 'mattn/go-sqlite3', 'aiosqlite'],
+}
+
+function fail(msg) {
+  process.stderr.write(`[INV-121] ${msg}\n`)
+  process.exit(1)
+}
+
+try {
+  const args = process.argv.slice(2)
+  if (args.includes('--help') || args.includes('-h')) {
+    process.stdout.write(`${HELP}\n`)
+    process.exit(0)
+  }
+
+  const root = process.cwd()
+  const cfgFlag = args.find((a) => a.startsWith('--config='))
+  const configPath = cfgFlag ? resolve(cfgFlag.slice('--config='.length)) : resolve(root, 'arbiter.json')
+
+  if (!existsSync(configPath)) {
+    process.stdout.write('[INV-121] arbiter.json not found — not an arbiter project, skip.\n')
+    process.exit(0)
+  }
+
+  let config
+  try {
+    config = JSON.parse(readFileSync(configPath, 'utf8'))
+  } catch {
+    fail(`Failed to parse ${configPath}.`)
+  }
+
+  // SELF-SAFETY ESCAPE 1: absent `language` ⇒ PASS (undeclared never fails).
+  const language = config.language
+  if (language === undefined || language === null || language === '') {
+    process.stdout.write('[INV-121] language not declared — skip (PASS).\n')
+    process.exit(0)
+  }
+
+  // ─── Root-manifest snapshot (root-scope only, never recurse) ──────────────
+  const pkgPath = join(root, 'package.json')
+  const goModPath = join(root, 'go.mod')
+  const hasPkg = existsSync(pkgPath)
+  const hasGoMod = existsSync(goModPath)
+
+  const nodeDependencies = new Set()
+  if (hasPkg) {
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
+    for (const section of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+      if (pkg[section] && typeof pkg[section] === 'object' && !Array.isArray(pkg[section])) {
+        for (const name of Object.keys(pkg[section])) nodeDependencies.add(name)
+      }
+    }
+  }
+  let goModText = ''
+  if (hasGoMod) {
+    try {
+      goModText = readFileSync(goModPath, 'utf8')
+    } catch {
+      goModText = ''
+    }
+  }
+  // Root non-Node lock files (go.sum, poetry.lock, Cargo.lock, ...). Node lockfiles
+  // record transitive and optional peers, so only root package.json keys prove Node drivers.
+  let lockText = ''
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isFile()) continue
+    if (entry.name === 'package-lock.json' || entry.name === 'yarn.lock' || entry.name === 'bun.lock') continue
+    if (entry.name.endsWith('.lock') || entry.name === 'go.sum') {
+      try {
+        lockText += readFileSync(join(root, entry.name), 'utf8')
+      } catch {
+        // unreadable lock — ignore, manifest signal already collected
+      }
+    }
+  }
+  const nonNodeManifestText = `${goModText}\n${lockText}`
+
+  // ─── Language conformity ──────────────────────────────────────────────────
+  // go declared but the root is a Node/TS project (package.json, no go.mod).
+  if (language === 'go' && hasPkg && !hasGoMod) {
+    fail(
+      `declared language="go" but the repo-root manifest is a Node project ` +
+        `(package.json present, go.mod absent). Root manifest contradicts the declared axis.`,
+    )
+  }
+  // typescript/javascript declared but the root is a Go module (go.mod, no package.json).
+  if ((language === 'typescript' || language === 'javascript') && hasGoMod && !hasPkg) {
+    fail(
+      `declared language="${language}" but the repo-root manifest is a Go module ` +
+        `(go.mod present, package.json absent). Root manifest contradicts the declared axis.`,
+    )
+  }
+
+  // ─── Database conformity ──────────────────────────────────────────────────
+  // SELF-SAFETY ESCAPE 2: absent or 'none' databaseEngine ⇒ skip DB conformity.
+  const engine = config.databaseEngine == null ? 'none' : config.databaseEngine
+  if (engine !== 'none' && engine !== 'other') {
+    const declaredDrivers = new Set(DB_DRIVERS[engine] ?? [])
+    for (const [otherEngine, drivers] of Object.entries(DB_DRIVERS)) {
+      if (otherEngine === engine) continue
+      for (const driver of drivers) {
+        if (declaredDrivers.has(driver)) continue
+        // Word-ish boundary match: driver token quoted/pathed in a manifest.
+        const re = new RegExp(`(^|[^\\w/.-])${driver.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}([^\\w/.-]|$)`, 'm')
+        // Slash-bearing Go module paths are embedded in a larger module path
+        // (for example github.com/lib/pq); match whole path segments, not substrings.
+        const slashDriverRe = new RegExp(`(^|[^\\w.-])${driver.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}($|[^\\w.-])`, 'm')
+        const nonNodeDriverMatch = driver.includes('/')
+          ? slashDriverRe.test(nonNodeManifestText)
+          : re.test(nonNodeManifestText)
+        if (nodeDependencies.has(driver) || nonNodeDriverMatch) {
+          fail(
+            `declared databaseEngine="${engine}" but the repo-root manifest references the ` +
+              `"${driver}" driver (implies "${otherEngine}"). Database axis contradicted.`,
+          )
+        }
+      }
+    }
+  }
+
+  process.stdout.write(`[INV-121] stack conformity OK (language="${language}", databaseEngine="${engine}").\n`)
+  process.exit(0)
+} catch (err) {
+  process.stderr.write(`[INV-121] ERROR: ${err instanceof Error ? err.message : String(err)}\n`)
+  process.exit(2)
+}

package/dist/templates/scripts/check-stride-traceability.mjs.ejs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// <%= projectName %> — STRIDE/RACI traceability check (INV-90)
+// Scans HIGH/CRITICAL claims in governance docs and verifies each has a
+// @Security:<id> or @RACI:<id> annotation in the codebase.
+// Usage: node scripts/check-stride-traceability.mjs (must be run from project root)
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join, extname } from 'node:path';
+
+let failed = 0;
+
+// ─── File walker ──────────────────────────────────────────────────────────────
+
+const SCAN_EXTS = new Set(['.ts', '.js', '.mjs', '.java', '.go', '.py', '.rs', '.kt']);
+const EXCLUDE_DIRS = new Set(['node_modules', '.git', 'dist', 'target', 'build', '.cache', 'coverage', '.evidence', '.nyc_output', 'vendor']);
+
+function walkFiles(dir) {
+  const results = [];
+  let entries;
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return results; }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (!EXCLUDE_DIRS.has(entry.name)) results.push(...walkFiles(join(dir, entry.name)));
+    } else if (SCAN_EXTS.has(extname(entry.name))) {
+      results.push(join(dir, entry.name));
+    }
+  }
+  return results;
+}
+
+// ─── Threat/claim parser ──────────────────────────────────────────────────────
+
+/**
+ * Parse a markdown table in filePath for rows where the column at severityCol
+ * (0-indexed, after splitting by |) is HIGH or CRITICAL.
+ * Returns { id, severity, line } objects.
+ */
+function parseClaims(filePath, idCol, severityCol) {
+  if (!existsSync(filePath)) return [];
+  const lines = readFileSync(filePath, 'utf-8').split('\n');
+  const claims = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
+    if (!line.startsWith('|') || !line.endsWith('|')) continue;
+    // Split "| a | b | c |" → ['', 'a', 'b', 'c', '']
+    const cols = line.split('|').map(c => c.trim());
+    // cols[0] and cols[last] are empty; real values start at index 1
+    const id = cols[idCol + 1];
+    const sev = (cols[severityCol + 1] ?? '').toUpperCase();
+    if (!id || id.startsWith('-') || id === 'ID') continue;
+    if (sev === 'HIGH' || sev === 'CRITICAL') {
+      claims.push({ id, severity: sev, line: i + 1, file: filePath });
+    }
+  }
+  return claims;
+}
+
+// ─── Tag lookup ───────────────────────────────────────────────────────────────
+
+function buildTagIndex(sourceFiles) {
+  const tags = new Set();
+  for (const file of sourceFiles) {
+    let content;
+    try { content = readFileSync(file, 'utf-8'); } catch { continue; }
+    const matches = content.matchAll(/@(Security|RACI):([A-Za-z0-9_-]+)/g);
+    for (const m of matches) tags.add(`${m[1]}:${m[2]}`);
+  }
+  return tags;
+}
+
+// ─── Main ────────────────────────────────────────────────────────────────────
+
+const sourceFiles = walkFiles('.');
+const tagIndex = buildTagIndex(sourceFiles);
+
+// STRIDE: | ID | Threat | Category | Severity(3) | Mitigation | Status |
+const strideClaims = parseClaims('docs/SECURITY/STRIDE.md', 0, 3);
+// RACI:   | ID | Responsibility | Accountable | Responsible | Consulted | Informed | Priority(6) |
+const raciClaims = parseClaims('docs/GOVERNANCE/RACI.md', 0, 6);
+
+for (const claim of strideClaims) {
+  const tag = `Security:${claim.id}`;
+  if (!tagIndex.has(tag)) {
+    process.stderr.write(`[FAIL] ${claim.file}:${claim.line} — ${claim.severity} threat "${claim.id}" has no @Security:${claim.id} tagged test\n`);
+    failed++;
+  }
+}
+
+for (const claim of raciClaims) {
+  const tag = `RACI:${claim.id}`;
+  if (!tagIndex.has(tag)) {
+    process.stderr.write(`[FAIL] ${claim.file}:${claim.line} — ${claim.severity} responsibility "${claim.id}" has no @RACI:${claim.id} tagged test\n`);
+    failed++;
+  }
+}
+
+if (failed > 0) {
+  process.stderr.write(`\n[SUMMARY] ${failed} HIGH/CRITICAL claim(s) lack verified tests\n`);
+  process.exit(1);
+} else {
+  process.stdout.write('[SUMMARY] All HIGH/CRITICAL claims verified\n');
+}

package/dist/templates/scripts/check-suppression-expiry.mjs.ejs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+// <%= projectName %> — suppression expiry window check (INV-89)
+// Validates that no suppression entries have excessively far expiry dates (> 365 days).
+// Complements check-suppressions.mjs (checks expired) by catching over-extended suppressions.
+// Exits 0 when all expiries are within the window; exits 1 when window exceeded.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-suppression-expiry.mjs [options]',
+    '',
+    'Validates that no suppression entries have excessively far expiry dates.',
+    'Exits 0 when all expiries are within the max window; exits 1 when exceeded.',
+    '',
+    'Options:',
+    '  --max-days <N>  Maximum allowed days from now to expiry (default: 365)',
+    '  --help, -h      Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const maxDaysArg = args.indexOf('--max-days');
+const MAX_DAYS = maxDaysArg >= 0 && args[maxDaysArg + 1] ? parseInt(args[maxDaysArg + 1], 10) : 365;
+const CWD = process.cwd();
+const SUPPRESSIONS_DIR = join(CWD, 'suppressions');
+let violations = 0;
+let checked = 0;
+
+function checkJsonFile(filePath) {
+  if (!existsSync(filePath)) return;
+  let data;
+  try {
+    data = JSON.parse(readFileSync(filePath, 'utf-8'));
+  } catch {
+    return;
+  }
+  if (!Array.isArray(data)) return;
+  const now = new Date();
+  for (const entry of data) {
+    const expiresAt = entry.expiresAt ?? entry.until;
+    if (!expiresAt) continue;
+    checked++;
+    const expiry = new Date(expiresAt);
+    if (isNaN(expiry.getTime())) continue;
+    const diffDays = Math.ceil((expiry.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+    if (diffDays > MAX_DAYS) {
+      process.stderr.write(
+        `[FAIL] ${filePath}: entry expires in ${diffDays} day(s) (>${MAX_DAYS} max): ${expiresAt}\n`,
+      );
+      violations++;
+    }
+  }
+}
+
+if (!existsSync(SUPPRESSIONS_DIR)) {
+  process.stdout.write('check-suppression-expiry: SKIP — no suppressions/ directory\n');
+  // #2052: recognized marker so runCheck surfaces SKIP, not PASS, in the gate summary.
+  process.stdout.write('[SKIP] no suppressions/ directory\n');
+  process.exit(0);
+}
+
+checkJsonFile(join(SUPPRESSIONS_DIR, 'pii-allowlist.json'));
+checkJsonFile(join(SUPPRESSIONS_DIR, 'inline-suppressions.json'));
+checkJsonFile(join(SUPPRESSIONS_DIR, 'consumer-audit-allowlist.json'));
+
+if (violations > 0) {
+  process.stderr.write(
+    `check-suppression-expiry: FAIL — ${violations}/${checked} suppression(s) exceed ${MAX_DAYS}-day expiry window (INV-89)\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write(
+  `check-suppression-expiry: OK — all ${checked} suppression(s) within ${MAX_DAYS}-day expiry window (INV-89)\n`,
+);
+process.exit(0);

package/dist/templates/scripts/check-suppression-rationale.mjs.ejs

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+// <%= projectName %> — suppression rationale quality check (INV-89)
+// Validates that all suppression entries have meaningful rationale (reason field).
+// Exits 0 when all rationales are meaningful; exits 1 when thin rationales found.
+// Part of the anti-drift validator family (W6).
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-suppression-rationale.mjs [options]',
+    '',
+    'Validates that all suppression entries have meaningful rationale (reason field >= 20 chars).',
+    'Exits 0 when all rationales are meaningful; exits 1 when thin rationales found.',
+    '',
+    'Options:',
+    '  --help, -h      Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const CWD = process.cwd();
+const SUPPRESSIONS_DIR = join(CWD, 'suppressions');
+const REASON_MIN_LEN = 20;
+let violations = 0;
+let checked = 0;
+
+function checkJsonFile(filePath) {
+  if (!existsSync(filePath)) return;
+  let data;
+  try {
+    data = JSON.parse(readFileSync(filePath, 'utf-8'));
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      process.stderr.write(`[FAIL] ${filePath}: invalid JSON — ${err.message}\n`);
+      violations++;
+      return;
+    }
+    return;
+  }
+  if (!Array.isArray(data)) return;
+  for (const entry of data) {
+    checked++;
+    const reason = typeof entry.reason === 'string' ? entry.reason : '';
+    if (reason.trim().length < REASON_MIN_LEN) {
+      process.stderr.write(
+        `[FAIL] ${filePath}: entry "${JSON.stringify(entry).slice(0, 60)}..." has thin reason: "${reason}" (min ${REASON_MIN_LEN} chars)\n`,
+      );
+      violations++;
+    }
+  }
+}
+
+if (!existsSync(SUPPRESSIONS_DIR)) {
+  process.stdout.write('check-suppression-rationale: SKIP — no suppressions/ directory\n');
+  // #2052: recognized marker so runCheck surfaces SKIP, not PASS, in the gate summary.
+  process.stdout.write('[SKIP] no suppressions/ directory\n');
+  process.exit(0);
+}
+
+checkJsonFile(join(SUPPRESSIONS_DIR, 'pii-allowlist.json'));
+checkJsonFile(join(SUPPRESSIONS_DIR, 'inline-suppressions.json'));
+checkJsonFile(join(SUPPRESSIONS_DIR, 'consumer-audit-allowlist.json'));
+
+if (violations > 0) {
+  process.stderr.write(
+    `check-suppression-rationale: FAIL — ${violations}/${checked} suppression(s) have thin rationale (INV-89)\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write(
+  `check-suppression-rationale: OK — all ${checked} suppression(s) have adequate rationale (INV-89)\n`,
+);
+process.exit(0);

package/dist/templates/scripts/check-suppressions.mjs.ejs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+// <%= projectName %> — suppression expiry check (INV-31)
+// Validates that all suppression entries have mandatory metadata and a future expiresAt.
+// Part of the anti-drift validator family (W6).
+// Usage: node scripts/check-suppressions.mjs [--help]
+import { readFileSync, existsSync } from 'node:fs';
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  process.stdout.write('Usage: node scripts/check-suppressions.mjs [--help]\nValidates suppression entries for mandatory metadata and future expiresAt.\n');
+  process.exit(0);
+}
+
+const REQUIRED_FIELDS = ['reason', 'owner', 'expiresAt', 'scope'];
+const REASON_MIN_LEN = 10;
+const WARN_DAYS = 30;
+let failed = 0;
+let warnings = 0;
+
+function checkExpiry(expiresAt, label, file) {
+  const expiry = new Date(expiresAt);
+  if (isNaN(expiry.getTime())) {
+    process.stderr.write(`[FAIL] ${file}: ${label} — invalid expiresAt (not a date): ${expiresAt}\n`);
+    failed++;
+    return;
+  }
+  const now = new Date();
+  const diffMs = expiry.getTime() - now.getTime();
+  const diffDays = Math.ceil(diffMs / (1000 * 60 * 60 * 24));
+  if (diffMs < 0) {
+    process.stderr.write(`[EXPIRED] ${file}: ${label} — expiresAt: ${expiresAt}\n`);
+    failed++;
+  } else if (diffDays <= WARN_DAYS) {
+    process.stderr.write(`[WARN] ${file}: ${label} expires in ${diffDays} day(s) (${expiresAt})\n`);
+    warnings++;
+  }
+}
+
+function validateEntry(entry, label, file) {
+  let valid = true;
+  for (const field of REQUIRED_FIELDS) {
+    if (!entry[field]) {
+      process.stderr.write(`[FAIL] ${file}: ${label} — missing required field: ${field}\n`);
+      failed++;
+      valid = false;
+    }
+  }
+  if (valid && entry.reason.length < REASON_MIN_LEN) {
+    process.stderr.write(`[FAIL] ${file}: ${label} — reason must be at least ${REASON_MIN_LEN} characters\n`);
+    failed++;
+    valid = false;
+  }
+  if (valid) {
+    checkExpiry(entry.expiresAt, label, file);
+  }
+}
+
+function parseMetaComment(commentText) {
+  const result = {};
+  for (const field of REQUIRED_FIELDS) {
+    const match = commentText.match(new RegExp(`${field}:\\s*([^|\\n]+)`));
+    if (match) result[field] = match[1].trim();
+  }
+  return result;
+}
+
+function checkJsonFile(filePath) {
+  if (!existsSync(filePath)) return;
+  const raw = readFileSync(filePath, 'utf-8').trim();
+  if (!raw || raw === '[]') return;
+  let entries;
+  try {
+    entries = JSON.parse(raw);
+  } catch (e) {
+    process.stderr.write(`[FAIL] ${filePath}: could not parse JSON — ${e.message}\n`);
+    failed++;
+    return;
+  }
+  if (!Array.isArray(entries)) {
+    process.stderr.write(`[FAIL] ${filePath}: expected a JSON array, got ${typeof entries}\n`);
+    failed++;
+    return;
+  }
+  if (entries.length === 0) return;
+  for (let i = 0; i < entries.length; i++) {
+    validateEntry(entries[i], `entry[${i}]`, filePath);
+  }
+}
+
+// .trivyignore entries are single lines (no preceding metadata comment, unlike the XML
+// suppress-block format): `<CVE-ID> exp:<YYYY-MM-DD> # reason=<text> owner=@<handle>`.
+// Blank lines and full-line `#` comments (the file's own header/policy block) are skipped.
+const TRIVYIGNORE_ENTRY_RE = /^(\S+)\s+exp:(\d{4}-\d{2}-\d{2})(?:\s*#\s*reason=(.*?)\s+owner=(@\S+))?\s*$/;
+
+function parseTrivyignoreLine(line) {
+  const match = TRIVYIGNORE_ENTRY_RE.exec(line);
+  if (!match) return { scope: line.split(/\s+/)[0] };
+  const [, scope, expiresAt, reason, owner] = match;
+  return { scope, expiresAt, reason, owner };
+}
+
+function checkTrivyignoreFile(filePath) {
+  if (!existsSync(filePath)) return;
+  const lines = readFileSync(filePath, 'utf-8').split('\n');
+  let idx = 0;
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (line === '' || line.startsWith('#')) continue;
+    const entry = parseTrivyignoreLine(line);
+    validateEntry(entry, `entry[${idx}] (${entry.scope})`, filePath);
+    idx++;
+  }
+}
+
+function checkGitleaksFile(filePath) {
+  if (!existsSync(filePath)) return;
+  const lines = readFileSync(filePath, 'utf-8').split('\n');
+  let lastComment = null;
+  let idx = 0;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === '') {
+      // blank lines do not reset lastComment
+    } else if (trimmed.startsWith('#')) {
+      lastComment = trimmed.slice(1).trim();
+    } else {
+      // Non-comment, non-blank line is a suppression entry
+      const meta = lastComment ? parseMetaComment(lastComment) : {};
+      validateEntry(meta, `entry[${idx}] (${trimmed.slice(0, 40)})`, filePath);
+      idx++;
+      lastComment = null;
+    }
+  }
+}
+
+checkJsonFile('suppressions/pii-allowlist.json');
+<% if (language === 'java' || language === 'kotlin' || language === 'multi') { %>
+checkJsonFile('suppressions/archunit-baseline.json');
+<% } %>
+checkJsonFile('suppressions/consumer-audit-allowlist.json');
+checkTrivyignoreFile('.trivyignore');
+checkGitleaksFile('suppressions/.gitleaksignore');
+
+if (failed > 0) {
+  process.stderr.write(`\n[SUMMARY] ${failed} suppression(s) failed expiry/field check\n`);
+  process.exit(1);
+} else if (warnings > 0) {
+  process.stderr.write(`\n[SUMMARY] All suppressions valid — ${warnings} expiring soon\n`);
+} else {
+  process.stdout.write('[SUMMARY] All suppressions valid\n');
+}