@bendyline/gilde 0.1.17 → 0.1.19

package/data/craftbook-templates/re/release-artifact-sanity-check/versions/1.0.0/test.json

@@ -0,0 +1,138 @@
+{
+  "schemaVersion": 1,
+  "title": "Release Artifact Sanity Check evidence-fixture eval",
+  "objective": "Verify that the craftbook reconciles release integrity, signing, and package-member evidence into a conservative go/no-go report without live services or executable artifacts.",
+  "tags": [
+    "corpus",
+    "release",
+    "security"
+  ],
+  "prompt": "Use the Release Artifact Sanity Check craftbook on the captured dry-run evidence in `source/release-artifacts/`. These fixtures describe artifacts and package contents but are deliberately non-executable; do not use the network or invent new verification results. Write the final report to `release-artifact-sanity-report.md`.",
+  "setup": {
+    "projectName": "Release Artifact Sanity Check Eval",
+    "about": "A self-contained release-artifact audit. The source folder contains captured hashes, signature-tool results, and safe package listings for Boreal Desk v2.4.0.",
+    "missionObjectives": "Use the Release Artifact Sanity Check craftbook, reconcile every supplied item, treat missing trust or coverage as NOT VERIFIED, and produce an evidence-backed release-artifact-sanity-report.md without network calls or executing package contents.",
+    "files": [
+      {
+        "path": "source/release-artifacts/release-v2.4.0.md",
+        "content": "# Boreal Desk v2.4.0\n\nTag: v2.4.0\nRelease URL: https://example.invalid/boreal/releases/v2.4.0\nTop-level uploaded artifacts: 3\n\n| Artifact | GitHub sha256 digest | Bytes |\n| --- | --- | ---: |\n| BorealDesk-2.4.0-macos.zip | aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa | 4100 |\n| BorealDeskSetup-2.4.0.msi | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 5200 |\n| BorealDesk-2.4.0.AppImage | dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd | 6300 |\n"
+      },
+      {
+        "path": "source/release-artifacts/SHA256SUMS",
+        "content": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  BorealDesk-2.4.0-macos.zip\nbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb  BorealDeskSetup-2.4.0.msi\ndddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd  BorealDesk-2.4.0.AppImage\n"
+      },
+      {
+        "path": "source/release-artifacts/computed-hashes.txt",
+        "content": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  BorealDesk-2.4.0-macos.zip\ncccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc  BorealDeskSetup-2.4.0.msi\ndddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd  BorealDesk-2.4.0.AppImage\n"
+      },
+      {
+        "path": "source/release-artifacts/signature-evidence.md",
+        "content": "# Captured signature verifier output\n\n- `BorealDesk-2.4.0-macos.zip` expanded app: `codesign --verify --deep --strict` exit 0; Developer ID Application signer Team ID BDESK12345; `spctl` accepted and reported notarized. Trusted Apple root chain captured.\n- `BorealDeskSetup-2.4.0.msi`: `Get-AuthenticodeSignature` Status = NotSigned.\n- `BorealDesk-2.4.0.AppImage`: detached signature produced `GOODSIG build@boreal.example`, but the fixture contains no trusted fingerprint or key-source record. Treat signer trust as NOT VERIFIED.\n"
+      },
+      {
+        "path": "source/release-artifacts/package-inventory.txt",
+        "content": "SAFE LISTING ONLY — DO NOT EXECUTE\nDeclared contained regular files: 12\n\nmacos/Boreal Desk.app/Contents/MacOS/BorealDesk | Mach-O arm64+x86_64 | executable | signature covered\nmacos/Boreal Desk.app/Contents/Frameworks/Electron Framework.framework/Electron Framework | Mach-O | signature covered\nmacos/Boreal Desk.app/Contents/Resources/app.asar | ASAR | data\nmacos/Boreal Desk.app/Contents/Resources/current -> ../../outside | symlink escapes package root\nwindows/BorealDesk.exe | PE32+ | executable | Authenticode NotSigned\nwindows/updater.exe | PE32+ | executable | Authenticode NotSigned\nwindows/config/defaults.env | text | contains API_TOKEN=demo-hardcoded-token\nwindows/LICENSE.txt | text\nlinux/BorealDesk | ELF x86_64 | executable | covered only by untrusted outer GOODSIG\nlinux/usr/lib/libcrypto.so.3 | ELF shared library\nlinux/resources/app.asar | ASAR | data\nlinux/updater | ELF x86_64 | executable | no inner signature evidence\n\nArchive preflight: no absolute or `..` entry names; one escaping symlink is listed above. Expansion ratio stayed below the supplied limit. Local malware scanner was unavailable in the captured environment.\n"
+      }
+    ],
+    "worker": {
+      "name": "Ada",
+      "role": "Release Security Reviewer"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "The report reconciles all three artifacts and 12 package members, reaches NO-GO from the supplied integrity/signing/package blockers, and does not invent live verification.",
+    "deliverables": [
+      {
+        "path": "release-artifact-sanity-report.md",
+        "kind": "markdown-report",
+        "minBytes": 2000,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "NO-GO|NO GO",
+            "flags": "i",
+            "label": "derive a no-go decision from hard blockers"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "BorealDeskSetup-2\\.4\\.0\\.msi[\\s\\S]{0,500}(?:mismatch|cccc|FAIL)|(?:mismatch|cccc|FAIL)[\\s\\S]{0,500}BorealDeskSetup-2\\.4\\.0\\.msi",
+            "flags": "i",
+            "label": "catch the Windows installer digest mismatch"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "NotSigned|not signed|unsigned",
+            "flags": "i",
+            "label": "report missing Authenticode signing"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "GOODSIG[\\s\\S]{0,300}(?:NOT VERIFIED|untrusted|trust)|(?:NOT VERIFIED|untrusted|trust)[\\s\\S]{0,300}GOODSIG",
+            "flags": "i",
+            "label": "distinguish signature presence from trusted identity"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "Resources/current|escaping symlink|symlink escapes",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "API_TOKEN|hardcoded-token|credential",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "3\\s+(?:top-level\\s+)?artifacts|12\\s+(?:contained\\s+)?(?:regular\\s+)?files",
+            "flags": "i",
+            "label": "reconcile top-level and contained-file counts"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "release-artifact-sanity-report.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "coverage",
+        "description": "Every top-level artifact and all 12 supplied package members are reconciled."
+      },
+      {
+        "name": "integrity",
+        "description": "Digest comparisons are explicit and the Windows mismatch drives the decision."
+      },
+      {
+        "name": "authenticity",
+        "description": "Signature presence, cryptographic validity, and trusted signer identity are kept distinct."
+      },
+      {
+        "name": "package safety",
+        "description": "The escaping symlink, unsigned executables, hardcoded token, and unavailable scanner are handled conservatively."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "complete artifact and package-member reconciliation",
+    "trust-aware signature verification",
+    "evidence-backed no-go decision",
+    "non-executing hostile-input inspection"
+  ]
+}

package/data/craftbook-templates/ro/root-cause-investigation/versions/2.0.0/craftbook.json

@@ -0,0 +1,348 @@
+{
+  "id": "root-cause-investigation",
+  "name": "Root-Cause Investigation",
+  "description": "Debug systematically: reproduce the failure and find the true root cause before changing any code, then fix and verify. Enforces a no-fix-without-diagnosis discipline.",
+  "basedOn": {
+    "name": "gstack",
+    "url": "https://github.com/garrytan/gstack"
+  },
+  "plan": "Reproduce first, diagnose second, change code only after the evidence identifies a root cause. Keep an explicit hypothesis ledger so plausible stories cannot silently become facts. Prefer the smallest experiment that separates competing explanations. The final report must connect symptom, causal mechanism, fix, and regression proof with inspectable paths and command results.",
+  "entryStepId": "reproduce",
+  "triggers": [
+    "debug this",
+    "fix this bug",
+    "why is this broken",
+    "root cause analysis",
+    "investigate this error"
+  ],
+  "command": "root-cause-investigation",
+  "steps": [
+    {
+      "id": "reproduce",
+      "name": "Reproduce and bound the failure",
+      "description": "Establish a stable failing case, expected behavior, environment, and blast radius.",
+      "prompt": "Read the request, relevant code, existing tests, logs, and configuration. Reproduce the problem with the smallest safe case you can run. Record exact inputs, expected and actual results, environment details, frequency, and whether the failure is deterministic. If it cannot be reproduced, document the attempts and the missing observation needed; do not invent a cause or edit production code.\n\nObservable handoff: write the completed result to `investigations/reproduction.md` in the workspace. Do not merely describe what the file would contain. Re-read it before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "debugging engineer",
+      "advanceWhen": {
+        "file": "investigations/reproduction.md",
+        "minBytes": 700,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "goto": "diagnose"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "investigations/reproduction.md",
+            "bytes": 700
+          },
+          {
+            "kind": "sniff",
+            "file": "investigations/reproduction.md",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/reproduction.md",
+            "pattern": "^##\\s+Symptom",
+            "flags": "im",
+            "label": "Symptom section"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/reproduction.md",
+            "pattern": "^##\\s+Minimal reproduction",
+            "flags": "im",
+            "label": "Minimal reproduction section"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/reproduction.md",
+            "pattern": "^##\\s+Expected",
+            "flags": "im",
+            "label": "Expected behavior section"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/reproduction.md",
+            "pattern": "^##\\s+Actual",
+            "flags": "im",
+            "label": "Actual behavior section"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/reproduction.md",
+            "pattern": "^##\\s+Evidence",
+            "flags": "im",
+            "label": "Evidence section"
+          }
+        ],
+        "onReject": "reproduce",
+        "maxAttempts": 3
+      },
+      "next": "diagnose"
+    },
+    {
+      "id": "diagnose",
+      "name": "Prove the root cause",
+      "description": "Test competing hypotheses and identify the causal mechanism before modifying code.",
+      "prompt": "Use `investigations/reproduction.md` to form at least two plausible hypotheses. Trace the relevant execution and data paths with workspace search and file-reading tools. For each hypothesis, run a discriminating experiment and record its predicted versus observed outcome. Name the first bad state or decision, explain how it produces the symptom, and check for sibling cases. Do not change source code in this phase.\n\nObservable handoff: write the completed result to `investigations/root-cause-analysis.md` in the workspace. Do not merely describe what the file would contain. Re-read it before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "root-cause analyst",
+      "advanceWhen": {
+        "file": "investigations/root-cause-analysis.md",
+        "minBytes": 1000,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "goto": "fix-and-verify"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "investigations/root-cause-analysis.md",
+            "bytes": 1000
+          },
+          {
+            "kind": "sniff",
+            "file": "investigations/root-cause-analysis.md",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/root-cause-analysis.md",
+            "pattern": "^##\\s+Hypotheses",
+            "flags": "im",
+            "label": "Hypotheses section"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/root-cause-analysis.md",
+            "pattern": "^##\\s+Experiments",
+            "flags": "im",
+            "label": "Experiments section"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/root-cause-analysis.md",
+            "pattern": "^##\\s+Root cause",
+            "flags": "im",
+            "label": "Root cause section"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/root-cause-analysis.md",
+            "pattern": "^##\\s+Causal chain",
+            "flags": "im",
+            "label": "Causal chain section"
+          },
+          {
+            "kind": "contains",
+            "file": "investigations/root-cause-analysis.md",
+            "pattern": "^##\\s+Blast radius",
+            "flags": "im",
+            "label": "Blast radius section"
+          }
+        ],
+        "onReject": "diagnose",
+        "maxAttempts": 3
+      },
+      "next": "fix-and-verify"
+    },
+    {
+      "id": "fix-and-verify",
+      "name": "Implement the smallest fix and verify it",
+      "description": "Correct the proven mechanism and demonstrate both regression coverage and non-regression.",
+      "prompt": "Read both investigation files. Implement the smallest maintainable change that breaks the documented causal chain. Add or strengthen a regression test that fails on the old behavior and passes with the fix. Run the focused test, relevant neighboring tests, and any proportionate static checks. Record exact changed paths and exact verification commands with exit results. If the environment prevents a check, label it unverified and explain what is needed to run it.\n\nObservable handoff: write the completed result to `reports/root-cause-investigation.md` in the workspace. Do not merely describe what the file would contain. Re-read it before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "software engineer",
+      "advanceWhen": {
+        "file": "reports/root-cause-investigation.md",
+        "minBytes": 1200,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "goto": "evaluate"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "reports/root-cause-investigation.md",
+            "bytes": 1200
+          },
+          {
+            "kind": "sniff",
+            "file": "reports/root-cause-investigation.md",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Root cause",
+            "flags": "im",
+            "label": "Root cause section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Fix",
+            "flags": "im",
+            "label": "Fix section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Changed files",
+            "flags": "im",
+            "label": "Changed files section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Regression coverage",
+            "flags": "im",
+            "label": "Regression coverage section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Verification",
+            "flags": "im",
+            "label": "Verification section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Rollback",
+            "flags": "im",
+            "label": "Rollback section"
+          }
+        ],
+        "onReject": "fix-and-verify",
+        "maxAttempts": 3
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate the deliverable",
+      "description": "Independently grade the observable deliverable and route it to finish, repair, or user escalation.",
+      "prompt": "Review `reports/root-cause-investigation.md`, `investigations/reproduction.md`, `investigations/root-cause-analysis.md` against every criterion below. Inspect the underlying evidence files named by the workflow; do not grade from the author's summary alone.\n\n1. The failure is reproducible or the report explicitly stops without claiming an unproven diagnosis.\n2. Competing hypotheses were separated by recorded experiments rather than intuition.\n3. The stated root cause includes a causal chain from first bad state to observed symptom.\n4. The change is limited to that causal mechanism and covers identified sibling cases.\n5. A regression test and neighboring checks have concrete, credible results with no fabricated execution evidence.\n6. The report identifies changed files, residual risk, and a viable rollback.\n\nWrite an evidence-backed review to `reviews/root-cause-investigation-review.md`. Give each criterion a PASS or FAIL with a concrete path, excerpt, measurement, or observed behavior. End with exactly `Verdict: PASS` or `Verdict: REVISE`. Then use `advance_task_step` for the active task: PASS routes to `finish`; REVISE routes to `repair` for review rounds 1 through 2, and the 3th REVISE routes to `needs-user`. Never route to finish while a criterion is unmet.",
+      "suggestedRole": "debugging reviewer",
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "reviews/root-cause-investigation-review.md",
+            "bytes": 400
+          },
+          {
+            "kind": "contains",
+            "file": "reviews/root-cause-investigation-review.md",
+            "pattern": "Verdict:\\s*(?:PASS|REVISE)",
+            "flags": "i",
+            "label": "explicit PASS or REVISE verdict"
+          }
+        ],
+        "onReject": "evaluate",
+        "maxAttempts": 3
+      },
+      "next": "repair"
+    },
+    {
+      "id": "repair",
+      "name": "Repair the deliverable",
+      "description": "Fix only the concrete gaps from the latest independent review.",
+      "prompt": "Read `reviews/root-cause-investigation-review.md` and repair every failed criterion in `reports/root-cause-investigation.md`, `investigations/reproduction.md`, `investigations/root-cause-analysis.md`. Make the changes in the actual workspace files, not just in task notes or a reply. Preserve evidence that already passed. Re-run or re-check anything the reviewer found unproven. Ensure `reports/root-cause-investigation.md` is genuinely updated this turn so the repair is observable, then hand it back for independent evaluation.",
+      "suggestedRole": "software engineer",
+      "advanceWhen": {
+        "file": "reports/root-cause-investigation.md",
+        "minBytes": 1200,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "goto": "evaluate"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "reports/root-cause-investigation.md",
+            "bytes": 1200
+          },
+          {
+            "kind": "sniff",
+            "file": "reports/root-cause-investigation.md",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Root cause",
+            "flags": "im",
+            "label": "Root cause section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Fix",
+            "flags": "im",
+            "label": "Fix section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Changed files",
+            "flags": "im",
+            "label": "Changed files section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Regression coverage",
+            "flags": "im",
+            "label": "Regression coverage section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Verification",
+            "flags": "im",
+            "label": "Verification section"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^##\\s+Rollback",
+            "flags": "im",
+            "label": "Rollback section"
+          }
+        ],
+        "onReject": "repair",
+        "maxAttempts": 3
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All deterministic and reviewer criteria passed.",
+      "prompt": "The independent review passed. Read `reviews/root-cause-investigation-review.md`, then use `write_task_note` to record a concise DONE summary with the final deliverable paths (`reports/root-cause-investigation.md`, `investigations/reproduction.md`, `investigations/root-cause-analysis.md`) and the evidence that each acceptance criterion passed. Report DONE without starting new work.",
+      "suggestedRole": "project lead",
+      "terminal": true
+    },
+    {
+      "id": "needs-user",
+      "name": "Escalate unresolved concerns",
+      "description": "The bounded repair loop ended without a defensible pass.",
+      "prompt": "The deliverable did not pass after 3 review rounds. Do not claim success. Read `reviews/root-cause-investigation-review.md`, then use `write_task_note` to record DONE_WITH_CONCERNS: the unmet criteria, what was attempted, the affected paths, and the smallest user decision or missing input needed to continue.",
+      "suggestedRole": "project lead",
+      "terminal": true
+    }
+  ],
+  "version": "2.0.0",
+  "releasedAt": "2026-08-09T00:00:00Z"
+}

package/data/craftbook-templates/ro/root-cause-investigation/versions/2.0.0/test.json

@@ -0,0 +1,153 @@
+{
+  "schemaVersion": 1,
+  "title": "Root-Cause Investigation — decimal cart total regression",
+  "objective": "Require the Root-Cause Investigation craftbook to reproduce a deterministic failure, identify the causal mechanism before editing, implement the smallest fix, and prove the regression test passes.",
+  "tags": [
+    "workflow",
+    "debugging",
+    "code-with-tests",
+    "node"
+  ],
+  "prompt": "Use the Root-Cause Investigation craftbook to diagnose the failing decimal cart-total behavior in this workspace. First reproduce it with the existing dependency-free test and preserve concrete evidence; do not edit until a causal hypothesis has been tested. Then make the smallest correct source change, keep the regression coverage, and write the craftbook's artifacts, including `reports/root-cause-investigation.md`. The final report must cite the files inspected, distinguish root cause from symptom, include the exact verification command and result, and describe a safe rollback.",
+  "setup": {
+    "projectName": "Decimal cart total regression",
+    "about": "A tiny dependency-free Node project with one reproducible arithmetic defect. The initial test is expected to fail.",
+    "missionObjectives": "Restore exact cent-based addition for decimal prices without broad refactoring and leave a passing regression test plus an evidence-backed investigation report.",
+    "files": [
+      {
+        "path": "package.json",
+        "content": "{\n  \"name\": \"cart-total-fixture\",\n  \"private\": true,\n  \"type\": \"module\"\n}\n"
+      },
+      {
+        "path": "src/cart-total.js",
+        "content": "/** Sum display-price strings and return a two-decimal total. */\nexport function cartTotal(prices) {\n  const cents = prices.reduce((sum, price) => sum + parseInt(price, 10) * 100, 0);\n  return (cents / 100).toFixed(2);\n}\n"
+      },
+      {
+        "path": "tests/cart-total.test.mjs",
+        "content": "import test from 'node:test';\nimport assert from 'node:assert/strict';\nimport { cartTotal } from '../src/cart-total.js';\n\ntest('keeps cents when totaling decimal display prices', () => {\n  assert.equal(cartTotal(['19.99', '5.50']), '25.49');\n});\n\ntest('handles a single whole-dollar price', () => {\n  assert.equal(cartTotal(['7.00']), '7.00');\n});\n"
+      },
+      {
+        "path": "source/incident.md",
+        "content": "# Incident note\n\nCheckout preview showed **$24.00** for line items **$19.99** and **$5.50**. The expected total is **$25.49**. The defect appeared after price inputs changed from integer-dollar strings to two-decimal display strings. No production data migration is in scope.\n"
+      },
+      {
+        "path": "tests/verify-cart-total.mjs",
+        "content": "import assert from 'node:assert/strict';\nimport { cartTotal } from '../src/cart-total.js';\n\nconst cases = [\n  [['19.99', '5.50'], '25.49'],\n  [['0.10', '0.20'], '0.30'],\n  [['12.34', '0.66'], '13.00'],\n  [['7.00'], '7.00'],\n  [['1.01', '2.02', '3.03'], '6.06'],\n];\nfor (const [prices, expected] of cases) assert.equal(cartTotal(prices), expected, prices.join(' + '));\nconsole.log('CART_TOTAL_ORACLE_OK 5/5');\n",
+        "surface": "harness"
+      }
+    ]
+  },
+  "mocks": [],
+  "success": {
+    "summary": "The decimal regression is fixed by a diagnosed causal change, the existing test passes, and the craftbook report preserves reproducible evidence.",
+    "deliverables": [
+      {
+        "path": "reports/root-cause-investigation.md",
+        "kind": "markdown-report",
+        "minBytes": 1200,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "^#{1,3}\\s+Root cause\\b[\\s\\S]*^#{1,3}\\s+(Fix|Changed files)\\b[\\s\\S]*^#{1,3}\\s+(Regression coverage|Verification)\\b[\\s\\S]*^#{1,3}\\s+Rollback\\b",
+            "flags": "im",
+            "label": "root cause through rollback sections"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "parseInt|truncat(?:e|ed|ion)|discard(?:s|ed)?\\s+(?:the\\s+)?(?:decimal|fractional|cent)",
+            "flags": "i",
+            "label": "causal mechanism"
+          },
+          {
+            "kind": "contains",
+            "file": "reports/root-cause-investigation.md",
+            "pattern": "node\\s+--test\\s+tests/cart-total\\.test\\.mjs[\\s\\S]*(pass|2\\s+tests?|exit(?:ed)?\\s+0)",
+            "flags": "i",
+            "label": "verification command and result"
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "reports/root-cause-investigation.md",
+            "minCitations": 2
+          }
+        ]
+      }
+    ],
+    "checks": [
+      {
+        "kind": "notContains",
+        "file": "src/cart-total.js",
+        "pattern": "\\bparseInt\\s*\\(",
+        "label": "lossy integer parsing removed"
+      },
+      {
+        "kind": "sourceParses",
+        "file": "src/cart-total.js"
+      },
+      {
+        "kind": "nodeRuns",
+        "file": "tests/cart-total.test.mjs",
+        "timeoutMs": 20000
+      },
+      {
+        "kind": "nodeScriptPasses",
+        "script": "tests/verify-cart-total.mjs",
+        "requiredOutput": [
+          {
+            "pattern": "CART_TOTAL_ORACLE_OK 5/5",
+            "label": "hidden multi-case regression oracle"
+          }
+        ]
+      }
+    ],
+    "taskNotes": {
+      "minBytes": 180,
+      "checks": [
+        {
+          "kind": "contains",
+          "file": "task-notes.md",
+          "pattern": "\\bDONE\\b[\\s\\S]*(node\\s+--test|tests/cart-total\\.test\\.mjs)[\\s\\S]*reports/root-cause-investigation\\.md",
+          "flags": "i",
+          "label": "terminal note records proof and report"
+        }
+      ],
+      "requireCraftbookTask": true
+    },
+    "taskGraph": {
+      "requireCraftbookTask": true,
+      "requireTerminalStep": true
+    },
+    "unchangedFixtures": [
+      "package.json",
+      "tests/cart-total.test.mjs",
+      "source/incident.md"
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "reports/root-cause-investigation.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "Causal rigor",
+        "description": "The report explains why the observed inputs fail in this implementation and distinguishes causal evidence from guesses."
+      },
+      {
+        "name": "Fix discipline",
+        "description": "The source change is minimal, directly addresses the diagnosed mechanism, and avoids unrelated refactoring."
+      },
+      {
+        "name": "Verification quality",
+        "description": "Reproduction, regression coverage, final command result, blast radius, and rollback are concrete and auditable."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "Diagnosis precedes source edits",
+    "The fix preserves decimal cents and passes the dependency-free test",
+    "The final report cites real workspace files and includes rollback"
+  ]
+}