@bendyline/gilde 0.1.17 → 0.1.19

package/data/craftbook-templates/pu/pull-request-review/manifest.json

@@ -4,9 +4,13 @@
   "id": "pull-request-review",
   "role": "maintenance-review",
   "name": "Pull Request Review",
-  "description": "Staff-engineer-style PR review. Loads PR context, walks a per-file diff, applies a safety/quality checklist, and posts a structured summary. Requires a GitHub-connected project on a feature branch.",
+  "description": "Staff-engineer-style PR review. Defaults to the open pull request for the project's checked-out branch, walks its per-file diff, applies a safety/quality checklist, and posts a structured summary. Requires a GitHub-connected project on a feature branch.",
   "tags": [
     "review",
+    "pull-request",
+    "pr-review",
+    "code-review",
+    "github",
     "recommended"
   ],
   "maintainer": {

package/data/craftbook-templates/pu/pull-request-review/versions/1.2.0/craftbook.json

@@ -0,0 +1,159 @@
+{
+  "id": "pull-request-review",
+  "name": "Pull Request Review",
+  "description": "Review the open GitHub pull request for the project's checked-out branch and deliver a gated, evidence-based report. This is the PR-aware companion to Code Review: it resolves the current branch's PR by default, reads PR metadata, comments, files, and diff through the GitHub toolset, and writes `pr-review.md` without modifying source or posting back to GitHub. Three steps:\n\n1. **Scope the PR** — select an explicit PR number or the unique current-branch match and record the review surface\n2. **Review and report** — walk every changed file, cite concrete `path:line` evidence, and write a severity-ranked report\n3. **Deliver the verdict** — summarize approve vs request-changes in task notes\n\nIf the current branch has no unique open PR, the reviewer asks instead of silently choosing another branch's PR.",
+  "basedOn": {
+    "name": "Gezel Code Review",
+    "url": "https://github.com/bendyline/gezel"
+  },
+  "entryStepId": "scope",
+  "triggers": [
+    "review this pr",
+    "review the current pr",
+    "review this pull request",
+    "pr review",
+    "review the github pull request"
+  ],
+  "requirements": [
+    {
+      "kind": "github"
+    },
+    {
+      "kind": "non-main-branch"
+    }
+  ],
+  "toolsets": [
+    {
+      "toolsetId": "github",
+      "optional": true,
+      "autoAllow": true,
+      "reason": "read pull-request metadata, comments, changed files, and the unified diff"
+    }
+  ],
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "number": {
+        "type": "number",
+        "title": "Pull request number",
+        "description": "Optional PR number. Leave blank to use the open PR whose head matches the project's checked-out branch."
+      },
+      "focus": {
+        "type": "string",
+        "title": "Review focus",
+        "description": "Optional area to emphasize, e.g. security, performance, or tests."
+      },
+      "intensity": {
+        "type": "string",
+        "title": "Intensity",
+        "enum": [
+          "low",
+          "medium",
+          "high"
+        ],
+        "default": "medium",
+        "squisq": {
+          "control": "segmented"
+        },
+        "description": "How deep to go on the diff walk."
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "scope",
+      "name": "Scope the pull request",
+      "description": "Resolve an explicit PR or the unique open PR for the checked-out branch, then record its metadata, changed files, existing review context, and review themes.",
+      "prompt": "**You are reviewing a pull request, not authoring it. Never modify project source in this craftbook.**\n\n**Your first tool call this turn:** `github_pr_list({})`. It lists open PRs for this project, puts PRs whose head matches the checked-out branch first, and marks a unique one `Current branch match — default`.\n\nSelect the PR with this precedence:\n\n1. If the invocation parameters or user message supply a PR number, use it.\n2. Otherwise use the unique `Current branch match — default`.\n3. If multiple PRs match the current branch, or no PR matches and more than one PR is open, call `ask_user_question` with the concrete choices. Never take an unrelated first result.\n4. If no PR is open, write a task note explaining that and stop.\n\nFor the selected number, call `github_pr_view`, `github_pr_files`, and `github_pr_comments`. Read the title/body, head and base branches, file list, additions/deletions, and any feedback already raised so you do not duplicate it. Then write ONE task note beginning `## Scope — PR #<number>` and include: title, URL, head → base, draft state, changed-file list, existing-review themes, and 3–6 review themes weighted by the requested focus and intensity. End by calling `advance_task_step`.",
+      "suggestedRole": "reviewer",
+      "gate": {
+        "at": "completion",
+        "scripts": [
+          {
+            "name": "checkTaskNoteContains",
+            "scope": "standard",
+            "inputs": {
+              "pattern": "##\\s*Scope\\s*[—-]\\s*PR\\s*#\\d+"
+            }
+          }
+        ],
+        "onReject": "scope",
+        "maxAttempts": 3
+      },
+      "next": "report"
+    },
+    {
+      "id": "report",
+      "name": "Review and write the report",
+      "description": "Walk the full PR diff and every changed file, then write a gated report with concrete citations and a verdict. The report is local; this recipe never posts to GitHub automatically.",
+      "prompt": "Use the PR number selected in the Scope note. Call `github_pr_diff` for the complete unified diff and `github_pr_files` for the per-file patches. Walk every changed file and review for correctness, security, data-loss risk, error handling, concurrency, compatibility, tests, and clarity — weighted by the requested focus and intensity. Use `read_file` only when you need surrounding workspace context. Do not repeat an existing PR comment unless the issue still needs action and you explicitly say it was already raised.\n\nCite every finding as `path:line` using a changed path and a line from the new side of the diff. Do not invent files, behavior, or line numbers. Any critical or major finding requires `request-changes`; otherwise use `approve`.\n\nWrite `pr-review.md` in ONE `write_file` call using exactly this skeleton:\n\n```\n# Pull Request Review — PR #<number>: <title>\n\n## Summary\n<2–6 sentences: what changes, overall risk, and whether existing comments cover any issue. Say \"No findings.\" when there are none.>\n\n## Findings\n| # | Severity | File | Line | Finding | Recommendation |\n|---|----------|------|------|---------|----------------|\n<one row per finding; severities: critical, major, minor, nit. Keep the header when there are no findings.>\n\n## Verdict\nVerdict: approve\n<or> Verdict: request-changes\n<one sentence of rationale>\n```\n\nDo not modify source and do not call `github_pr_comment`; the user asked for a review report, not an automatic public side effect. If the gate rejects, fix exactly the named gap and rewrite the whole report. Then call `advance_task_step`.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "pr-review.md",
+        "minBytes": 500
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "pr-review.md",
+            "bytes": 500
+          },
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "#\\s+Pull Request Review\\s+[—-]\\s+PR\\s+#\\d+",
+            "label": "PR-numbered title"
+          },
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "##\\s+Summary",
+            "label": "Summary section"
+          },
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "##\\s+Findings",
+            "label": "Findings section"
+          },
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "\\|\\s*Severity\\s*\\|",
+            "label": "findings table header"
+          },
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "Verdict:\\s*(approve|request-changes)",
+            "label": "verdict line"
+          },
+          {
+            "kind": "tableShape",
+            "file": "pr-review.md",
+            "requiredColumns": [
+              "Severity",
+              "File",
+              "Finding"
+            ]
+          }
+        ],
+        "onReject": "report",
+        "maxAttempts": 4
+      },
+      "next": "done"
+    },
+    {
+      "id": "done",
+      "name": "Deliver the verdict",
+      "description": "The report passed its gates. Summarize the verdict and point the user to the local report.",
+      "prompt": "Read `pr-review.md`, then write one final task note with `write_task_note`: `PR #<number> — Verdict: <approve|request-changes> — N findings (a critical, b major, c minor, d nit)` plus a one-paragraph summary. Tell the user the full local review is at `pr-review.md` and was not posted to GitHub. Then call `advance_task_step` to complete the task.",
+      "suggestedRole": "reviewer",
+      "terminal": true
+    }
+  ],
+  "version": "1.2.0",
+  "releasedAt": "2026-08-10T00:00:00Z"
+}

package/data/craftbook-templates/pu/pull-request-review/versions/1.2.0/test.json

@@ -0,0 +1,172 @@
+{
+  "schemaVersion": 1,
+  "title": "Current-branch pull request review",
+  "objective": "Verify that Pull Request Review selects the PR marked as the checked-out branch default, inspects its GitHub metadata and diff through a deterministic MCP fixture, and writes a cited request-changes report without posting to GitHub.",
+  "tags": [
+    "external",
+    "mcp",
+    "pull-request"
+  ],
+  "prompt": "Run the Pull Request Review craftbook for the current checked-out branch. The fake GitHub toolset is local and deterministic; do not use real network or credentials. Review the PR marked as the current-branch default, not unrelated PR #41. Write the complete local review to pr-review.md and do not post a GitHub comment.",
+  "setup": {
+    "projectName": "Current Branch PR Review Eval",
+    "about": "A local fixture project whose checked-out branch is codex/pr-review. GitHub operations are supplied by the fake github MCP toolset.",
+    "missionObjectives": "Review the open PR for codex/pr-review, cite concrete changed-file lines, identify the insecure fallback credential, and deliver pr-review.md without public side effects.",
+    "files": [
+      {
+        "path": "src/auth.ts",
+        "content": "export function isAdmin(token: string): boolean {\n  const expected = process.env.ADMIN_API_KEY || 'dev-admin-key';\n  return token === expected;\n}\n"
+      },
+      {
+        "path": "source/eval-context.md",
+        "content": "# Eval context\n\nThe checked-out branch is `codex/pr-review`. PR #52 is the only open pull request whose head matches that branch. PR #41 is unrelated and must not be reviewed.\n"
+      }
+    ],
+    "worker": {
+      "name": "Rina",
+      "role": "Reviewer",
+      "description": "A careful code reviewer who grounds findings in changed lines."
+    }
+  },
+  "mocks": [
+    {
+      "kind": "mcp",
+      "id": "github",
+      "toolsetId": "github",
+      "description": "Fake GitHub PR tools with two open PRs; PR #52 is the unique current-branch match and PR #41 is unrelated.",
+      "tools": [
+        {
+          "name": "github_pr_list",
+          "description": "List open PRs, prioritizing and marking the checked-out branch match.",
+          "resultTemplate": "#52 — Add admin API-key authentication (alex, codex/pr-review → main)\n  https://github.example.test/acme/widget/pull/52\n  Current branch match — default: codex/pr-review\n\n#41 — Refactor invoice export (sam, feature/invoice-export → main)\n  https://github.example.test/acme/widget/pull/41"
+        },
+        {
+          "name": "github_pr_view",
+          "description": "Fetch PR metadata for a selected number.",
+          "resultTemplate": "#52 — Add admin API-key authentication\nAuthor: alex\nBranches: codex/pr-review → main\nState: OPEN\nChanges: +4 −0 across 1 file(s)\nURL: https://github.example.test/acme/widget/pull/52\n\nAdds an API-key check for admin routes."
+        },
+        {
+          "name": "github_pr_files",
+          "description": "List changed files and patches for a selected PR.",
+          "resultTemplate": "src/auth.ts — added (+4 −0)\n```diff\n@@ -0,0 +1,4 @@\n+export function isAdmin(token: string): boolean {\n+  const expected = process.env.ADMIN_API_KEY || 'dev-admin-key';\n+  return token === expected;\n+}\n```"
+        },
+        {
+          "name": "github_pr_diff",
+          "description": "Fetch the full unified diff for a selected PR.",
+          "resultTemplate": "diff --git a/src/auth.ts b/src/auth.ts\nnew file mode 100644\n--- /dev/null\n+++ b/src/auth.ts\n@@ -0,0 +1,4 @@\n+export function isAdmin(token: string): boolean {\n+  const expected = process.env.ADMIN_API_KEY || 'dev-admin-key';\n+  return token === expected;\n+}\n"
+        },
+        {
+          "name": "github_pr_comments",
+          "description": "List existing PR comments.",
+          "resultTemplate": "No comments on this PR."
+        },
+        {
+          "name": "github_pr_comment",
+          "description": "Post a PR comment. Present only so the eval can prove the review recipe does not call it.",
+          "resultTemplate": {
+            "id": 9001,
+            "url": "https://github.example.test/acme/widget/pull/52#comment-9001"
+          }
+        }
+      ]
+    }
+  ],
+  "success": {
+    "summary": "pr-review.md reviews PR #52 (the unique current-branch match), cites src/auth.ts, flags the hard-coded fallback credential, requests changes, and never calls the GitHub comment tool.",
+    "deliverables": [
+      {
+        "path": "pr-review.md",
+        "kind": "markdown-report",
+        "minBytes": 500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "#\\s+Pull Request Review\\s+[—-]\\s+PR\\s+#52",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "src/auth\\.ts(?::|\\s*\\|\\s*)[23]",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "dev-admin-key|fallback credential|hard-coded credential|hardcoded credential",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "pr-review.md",
+            "pattern": "Verdict:\\s*request-changes",
+            "flags": "i"
+          },
+          {
+            "kind": "notContains",
+            "file": "pr-review.md",
+            "pattern": "PR\\s*#41|invoice export",
+            "flags": "i"
+          }
+        ]
+      }
+    ],
+    "mocks": [
+      {
+        "service": "github",
+        "requiredTools": [
+          "github_pr_list",
+          "github_pr_view",
+          "github_pr_files",
+          "github_pr_diff"
+        ],
+        "toolCalls": {
+          "github_pr_comment": {
+            "minCalls": 0,
+            "maxCalls": 0
+          }
+        }
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "pr-review.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "selection",
+        "description": "The report is explicitly about PR #52, the current-branch default, and contains no analysis of unrelated PR #41."
+      },
+      {
+        "name": "grounding",
+        "description": "Every finding is grounded in the supplied diff with a concrete src/auth.ts line citation."
+      },
+      {
+        "name": "severity",
+        "description": "The insecure fallback credential receives a proportionate severity and forces request-changes."
+      },
+      {
+        "name": "side-effects",
+        "description": "The review remains local and does not post a GitHub comment."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "current-branch PR selection",
+    "diff-grounded findings",
+    "safe local-only delivery"
+  ],
+  "extensions": {
+    "legacySimulators": [
+      {
+        "id": "pull-request-review-github-mcp",
+        "kind": "mcp",
+        "status": "implemented",
+        "description": "Deterministic fake GitHub PR toolset with a unique current-branch match, an unrelated open PR, changed-file patches, and a forbidden comment side effect."
+      }
+    ]
+  }
+}

package/data/craftbook-templates/re/release-artifact-sanity-check/art.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "promptVersion": "workshop-mark-1910-v2",
+  "periodCue": "circa-1910-subtle",
+  "family": "inspect-verify",
+  "accents": [
+    "ochre",
+    "sage",
+    "muted indigo"
+  ],
+  "sourceSummary": "Inspect release parcels, ledgers, seals, and package contents for integrity and provenance.",
+  "styleReference": "release-readiness-review-1910"
+}

package/data/craftbook-templates/re/release-artifact-sanity-check/manifest.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": 1,
+  "kind": "craftbook-template",
+  "id": "release-artifact-sanity-check",
+  "role": "maintenance-review",
+  "name": "Release Artifact Sanity Check",
+  "description": "Sanity-check a folder of release artifacts without executing them: inventory every package, verify hashes and signatures against trusted evidence, safely inspect every file inside archives and application bundles, scan for suspicious or secret-bearing content, and produce an evidence-backed ship or no-ship report. Use this for release artifact verification, installer signing checks, package integrity audits, supply-chain inspection, or a pre-publish binary review.",
+  "tags": [
+    "gallery",
+    "release",
+    "artifacts",
+    "integrity",
+    "signing",
+    "security",
+    "supply-chain"
+  ],
+  "maintainer": {
+    "name": "Gezel"
+  },
+  "logo": "logo.webp",
+  "license": "MIT",
+  "yankedVersions": [],
+  "workflow": "build-loop"
+}

package/data/craftbook-templates/re/release-artifact-sanity-check/versions/1.0.0/craftbook.json

@@ -0,0 +1,202 @@
+{
+  "id": "release-artifact-sanity-check",
+  "name": "Release Artifact Sanity Check",
+  "description": "Sanity-check a folder of release artifacts without executing them: inventory every package, verify hashes and signatures against trusted evidence, safely inspect every file inside archives and application bundles, scan for suspicious or secret-bearing content, and produce an evidence-backed ship or no-ship report.\n\nThis craftbook treats release artifacts as hostile input. It never executes an installer, application, script, postinstall hook, or extracted binary. It stages any extraction under a disposable workspace directory, rejects path traversal and escaping symlinks, bounds recursive expansion, and reports any item it could not inspect as NOT VERIFIED rather than silently passing it. The result is a file-level inventory plus a go/no-go report whose claims are tied to commands, hashes, signer identities, and exact paths.",
+  "entryStepId": "inventory",
+  "triggers": [
+    "sanity check release artifacts",
+    "audit release packages",
+    "verify installer signatures",
+    "inspect app bundles",
+    "check release artifact integrity",
+    "scan a release folder"
+  ],
+  "toolsets": [
+    {
+      "toolsetId": "builtin.security-intel",
+      "autoAllow": true,
+      "reason": "reuse local secret, dependency, malware, and vulnerability scanner evidence when available"
+    },
+    {
+      "toolsetId": "builtin.code-intel",
+      "autoAllow": true,
+      "reason": "search safely extracted text and package manifests without executing bundled code"
+    }
+  ],
+  "steps": [
+    {
+      "id": "inventory",
+      "name": "Inventory the release set",
+      "description": "identify every release record, artifact, checksum, signature, and package boundary",
+      "prompt": "Treat the entire input folder as hostile and do not execute anything in it. Locate the requested release folder; if it came from the GitHub Releases connector, use the release Markdown records, frontmatter, asset tables, and sibling `attachments/` directories to associate bytes with releases. Enumerate every top-level artifact, checksum manifest, detached signature, certificate/provenance file, and release-notes record. Record exact relative path, byte size, file type identified from magic bytes (not extension alone), release/tag association, and the expected digest/signature evidence available. Define the inspection boundary and a safe staging directory outside the source corpus. Before extraction, list archive entries and flag absolute paths, `..` traversal, device files, escaping links, duplicate paths, case collisions, excessive nesting, or expansion bombs. Never follow a symlink outside the staging root. Write the complete inventory, counts, tool availability, inspection limits, and acceptance checklist to `notes/release-artifact-inventory.md` and task notes. Any artifact omitted by a configured size/name filter must be listed as NOT PRESENT and prevents a full-set pass.",
+      "suggestedRole": "developer",
+      "advanceWhen": {
+        "file": "notes/release-artifact-inventory.md",
+        "minBytes": 1,
+        "sniff": "nonempty"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "notes/release-artifact-inventory.md",
+            "bytes": 500
+          },
+          {
+            "kind": "sniff",
+            "file": "notes/release-artifact-inventory.md",
+            "sniff": "nonempty"
+          }
+        ],
+        "onReject": "inventory",
+        "maxAttempts": 3
+      },
+      "next": "verify"
+    },
+    {
+      "id": "verify",
+      "name": "Verify integrity and signing",
+      "description": "hash every artifact and validate signatures against a trusted identity",
+      "prompt": "Without executing any artifact, compute SHA-256 for every top-level asset and compare it independently against: GitHub's supplied `sha256:` digest when present, checked-in checksum manifests, detached signature payloads, and any release provenance/attestation. A hash written beside the same untrusted artifact is evidence of consistency, not authenticity; name the trust root. Verify signatures with the platform-appropriate verifier when installed (for example `codesign`/`spctl`/`pkgutil` on macOS, `Get-AuthenticodeSignature` or `signtool` on Windows, and `gpgv`, `cosign verify-blob`, `rpm --checksig`, or package-native verification on Linux). Capture the exact command, exit status, signer subject/team/key identity, timestamp/notarization status, certificate chain or trusted key source, and whether the signed object covers the bytes being shipped. Do not call an artifact signed merely because a signature file exists. Use PASS / FAIL / NOT VERIFIED for every artifact and evidence type. A mismatch, invalid signature, unsigned required executable, untrusted key, unavailable verifier, or missing expected artifact is not a pass. Write results to `notes/release-artifact-verification.md` and task notes.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "notes/release-artifact-verification.md",
+        "minBytes": 1,
+        "sniff": "nonempty"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "notes/release-artifact-verification.md",
+            "bytes": 600
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkContains",
+            "scope": "standard",
+            "inputs": {
+              "file": "notes/release-artifact-verification.md",
+              "pattern": "PASS|FAIL|NOT VERIFIED",
+              "flags": "i"
+            }
+          }
+        ],
+        "onReject": "verify",
+        "maxAttempts": 3
+      },
+      "next": "inspect"
+    },
+    {
+      "id": "inspect",
+      "name": "Inspect every package member",
+      "description": "safely unpack app packages and scan every contained file",
+      "prompt": "Work only in the disposable staging directory; never mutate the source corpus and never execute package contents. Safely expand each supported container recursively, including ZIP/TAR archives, DMG/PKG and `.app` bundles where host tooling permits, MSI/EXE packages where a non-executing extractor is available, AppImage/deb/rpm packages, and nested archives. Inventory EVERY regular file and symlink with relative path, magic-byte type, size, SHA-256, executable bit, signing coverage, and parent package. Inspect manifests, entitlements, permissions, dynamic libraries, launch agents/services, updater helpers, install scripts as text, bundled runtimes/dependencies, debug symbols, universal architectures, and unexpected executables. Scan extracted text and metadata for secrets, private keys, credentials, unsafe URLs, suspicious persistence, world-writable paths, and provenance drift; reuse `security_scan`/local malware scanners when available, recording tool name/version/result. Never run an installer, binary, macro, or script and disable postinstall hooks. If a format/tool/limit prevents inspecting even one member, name the exact gap and mark the package coverage INCOMPLETE / NOT VERIFIED. Write the file-count reconciliation, findings, and evidence to `notes/release-package-inspection.md` and task notes.",
+      "suggestedRole": "developer",
+      "advanceWhen": {
+        "file": "notes/release-package-inspection.md",
+        "minBytes": 1,
+        "sniff": "nonempty"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "notes/release-package-inspection.md",
+            "bytes": 700
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkContains",
+            "scope": "standard",
+            "inputs": {
+              "file": "notes/release-package-inspection.md",
+              "pattern": "file|path|SHA-256|coverage",
+              "flags": "i"
+            }
+          }
+        ],
+        "onReject": "inspect",
+        "maxAttempts": 3
+      },
+      "next": "report"
+    },
+    {
+      "id": "report",
+      "name": "Write the artifact sanity report",
+      "description": "state a ship decision with complete evidence and blockers",
+      "prompt": "Write `release-artifact-sanity-report.md`. Put one decision at the top: PASS / NO-GO / PASS-WITH-CONDITIONS, with the deciding evidence. Include: scope and release/tag; coverage summary with top-level and contained-file counts reconciled; an artifact matrix with expected/computed digest, integrity result, signature result, signer/trust root, package-inspection coverage, and evidence path/command; findings ranked by severity with exact package/member paths; unsupported or uninspected items; and blockers with concrete remediation/rebuild/re-sign/re-upload actions. Distinguish verified authenticity from checksum consistency and signature presence. A digest mismatch, invalid/untrusted/required-but-missing signature, escaping archive member, secret-bearing shipped file, uninspected package member, or unavailable mandatory verifier prevents an unconditional PASS. Do not minimize an issue because another platform's package passed. Include enough detail for another reviewer to reproduce each claim without running the artifacts. Record the report path, decision, artifact count, contained-file count, and blocker count in task notes.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "release-artifact-sanity-report.md",
+        "minBytes": 1,
+        "sniff": "nonempty"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "release-artifact-sanity-report.md",
+            "bytes": 2000
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkContains",
+            "scope": "standard",
+            "inputs": {
+              "file": "release-artifact-sanity-report.md",
+              "pattern": "PASS|NO-GO|PASS-WITH-CONDITIONS",
+              "flags": "i"
+            }
+          },
+          {
+            "name": "checkContains",
+            "scope": "standard",
+            "inputs": {
+              "file": "release-artifact-sanity-report.md",
+              "pattern": "integrity|digest|SHA-256",
+              "flags": "i"
+            }
+          },
+          {
+            "name": "checkContains",
+            "scope": "standard",
+            "inputs": {
+              "file": "release-artifact-sanity-report.md",
+              "pattern": "signature|signer|notar",
+              "flags": "i"
+            }
+          }
+        ],
+        "onReject": "report",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "grade coverage and evidence; pass only when every acceptance criterion is met",
+      "prompt": "Open `release-artifact-sanity-report.md` and the three evidence notes. Grade EACH criterion PASS/FAIL with one-line evidence: (1) every top-level release artifact is inventoried and its SHA-256 computed; (2) expected digests are compared and mismatches are blockers; (3) every required signature is cryptographically verified against a named trusted identity, with presence-only and unavailable checks marked NOT VERIFIED; (4) every supported package is safely expanded without executing content; (5) contained-file counts reconcile and every member has a path/type/hash/security disposition; (6) traversal, escaping links, expansion limits, secrets, persistence, entitlements, permissions, libraries, and nested executables are addressed; (7) all inspection gaps are explicit and prevent an unconditional pass; (8) the final decision follows from the evidence. Then route explicitly: if every criterion passes, call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`. If any criterion fails, write the exact gap to task notes and call `advance_task_step({ ref, stepId: \"evaluate\", next: \"report\" })`. Never route to finish with a silent omission or unsupported package. After three unproductive loops, stop with DONE_WITH_CONCERNS for user review.",
+      "suggestedRole": "reviewer",
+      "next": "report"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "stamp the decision and hand off the evidence-backed report",
+      "prompt": "All acceptance criteria passed. Write a concise DONE summary to task notes: the release/tag and folder reviewed, report path, decision, top-level artifact count, contained-file count, blocker count, and any conditions or NOT VERIFIED items. Remind the user that the audit did not execute any artifact. Then report DONE.",
+      "suggestedRole": "reviewer",
+      "terminal": true
+    }
+  ],
+  "version": "1.0.0",
+  "releasedAt": "2026-08-09T00:00:00Z"
+}