@bendyline/gilde 0.1.24 → 0.1.26

package/data/craftbook-templates/se/security-architecture-review/versions/2.0.2/test.json

@@ -0,0 +1,154 @@
+{
+  "schemaVersion": 1,
+  "title": "Security Architecture Review — admin export surface",
+  "objective": "Exercise the Security Architecture Review craftbook against a self-contained service slice and require a prioritized, evidence-linked report that includes both confirmed vulnerabilities and working controls.",
+  "tags": [
+    "workflow",
+    "security",
+    "architecture-review",
+    "typescript"
+  ],
+  "prompt": "Use the Security Architecture Review craftbook to review the seeded service slice. This is report-only: do not modify source files. Model assets, actors, trust boundaries, and data flows; audit authorization, command/SQL construction, secrets handling, and relevant common vulnerability classes. Produce the scope and findings register, then write `security/security-architecture-review.md`. Every confirmed finding must name severity, confidence, concrete workspace evidence, exploit preconditions, impact, and a specific remediation plus verification. Include working controls and rejected hypotheses. Do not invent CVEs, dependency versions, scans, or tests you did not run, and do not reproduce the example secret value in the report.",
+  "setup": {
+    "projectName": "Admin export security review",
+    "about": "A hermetic source-review fixture. No network or dependency lookup is needed or authorized; conclusions must come from seeded files.",
+    "missionObjectives": "Deliver an actionable risk posture that distinguishes confirmed source defects, positive controls, and unverified areas without changing implementation.",
+    "managedWorkspaceWritePolicy": "deny",
+    "files": [
+      {
+        "path": "docs/architecture.md",
+        "content": "# Service slice\n\nAn authenticated HTTP handler receives an export name and email filter from a browser operated by support staff. The handler calls local process and database adapters. `requireUser` is the shared authentication boundary. Only administrators should reach backup export; ordinary authenticated users may search their own customer records. Deployment injects `SESSION_SECRET` from environment configuration.\n"
+      },
+      {
+        "path": "src/auth.ts",
+        "content": "export interface User { id: string; role: 'member' | 'admin' }\n\nexport function requireUser(value: User | undefined): User {\n  if (!value) throw new Error('unauthorized');\n  return value;\n}\n\nexport function requireAdmin(user: User): void {\n  if (user.role !== 'admin') throw new Error('forbidden');\n}\n"
+      },
+      {
+        "path": "src/admin-export.ts",
+        "content": "import { exec } from 'node:child_process';\nimport type { User } from './auth.js';\nimport { requireAdmin, requireUser } from './auth.js';\n\nexport function exportBackup(currentUser: User | undefined, requestedName: string): void {\n  const user = requireUser(currentUser);\n  requireAdmin(user);\n  exec(`tar -czf backups/${requestedName}.tgz data/`);\n}\n"
+      },
+      {
+        "path": "src/customer-search.ts",
+        "content": "export interface Db { query(sql: string): Promise<unknown[]> }\n\nexport function findCustomerByEmail(db: Db, email: string): Promise<unknown[]> {\n  return db.query(`SELECT id, email FROM customers WHERE email = '${email}'`);\n}\n"
+      },
+      {
+        "path": "src/safe-audit-log.ts",
+        "content": "export interface AuditSink { write(event: { actorId: string; action: string; target: string }): void }\n\nexport function recordExport(sink: AuditSink, actorId: string, target: string): void {\n  sink.write({ actorId, action: 'backup.exported', target });\n}\n"
+      },
+      {
+        "path": "config/example.env",
+        "content": "# Example only; deployment replaces this value\nSESSION_SECRET=local-dev-only-not-a-real-secret\n"
+      }
+    ]
+  },
+  "mocks": [],
+  "success": {
+    "summary": "The named craftbook produces a source-grounded risk posture with prioritized findings, positive controls, remediation, verification, and terminal task evidence.",
+    "deliverables": [
+      {
+        "path": "security/security-architecture-review.md",
+        "kind": "security-report",
+        "artifact": true,
+        "minBytes": 1700,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "security/security-architecture-review.md",
+            "pattern": "^#{1,3}\\s+Executive risk posture\\b[\\s\\S]*^#{1,3}\\s+What is working\\b[\\s\\S]*^#{1,3}\\s+Prioritized findings\\b[\\s\\S]*^#{1,3}\\s+Remediation plan\\b[\\s\\S]*^#{1,3}\\s+Verification\\b[\\s\\S]*^#{1,3}\\s+Unverified areas\\b",
+            "flags": "im",
+            "label": "complete security-review structure"
+          },
+          {
+            "kind": "contains",
+            "file": "security/security-architecture-review.md",
+            "pattern": "(command injection|shell injection)[\\s\\S]{0,500}src/admin-export\\.ts[\\s\\S]*(severity)[\\s\\S]*(confidence)",
+            "flags": "is",
+            "label": "command-injection finding with evidence metadata"
+          },
+          {
+            "kind": "contains",
+            "file": "security/security-architecture-review.md",
+            "pattern": "(SQL injection|parameteri[sz]ed quer)[\\s\\S]{0,500}src/customer-search\\.ts",
+            "flags": "is",
+            "label": "SQL-injection finding and remediation"
+          },
+          {
+            "kind": "contains",
+            "file": "security/security-architecture-review.md",
+            "pattern": "(requireUser|requireAdmin)[\\s\\S]{0,300}(working|control|authorization|authentication)[\\s\\S]*(safe-audit-log|audit)",
+            "flags": "is",
+            "label": "positive auth and audit controls"
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "security/security-architecture-review.md",
+            "minCitations": 4
+          },
+          {
+            "kind": "notContains",
+            "file": "security/security-architecture-review.md",
+            "pattern": "CVE-\\d{4}-\\d+",
+            "label": "no invented CVEs"
+          },
+          {
+            "kind": "notContains",
+            "file": "security/security-architecture-review.md",
+            "pattern": "local-dev-only-not-a-real-secret",
+            "label": "example secret value is not reproduced"
+          }
+        ]
+      }
+    ],
+    "taskNotes": {
+      "minBytes": 180,
+      "checks": [
+        {
+          "kind": "contains",
+          "file": "task-notes.md",
+          "pattern": "\\bDONE\\b[\\s\\S]*security/security-architecture-review\\.md[\\s\\S]*(command|SQL)",
+          "flags": "i",
+          "label": "terminal note records report and principal risks"
+        }
+      ],
+      "requireCraftbookTask": true
+    },
+    "taskGraph": {
+      "requireCraftbookTask": true,
+      "requireTerminalStep": true
+    },
+    "unchangedFixtures": [
+      "docs/architecture.md",
+      "src/auth.ts",
+      "src/admin-export.ts",
+      "src/customer-search.ts",
+      "src/safe-audit-log.ts",
+      "config/example.env"
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "security/security-architecture-review.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "Threat-model coverage",
+        "description": "The report connects assets, actors, trust boundaries, privileges, and data flows to the reviewed attack surface."
+      },
+      {
+        "name": "Finding rigor",
+        "description": "Confirmed findings cite exact source evidence, state preconditions and impact, and calibrate severity and confidence without overclaiming."
+      },
+      {
+        "name": "Remediation utility",
+        "description": "Recommendations are prioritized, source-specific, verifiable, and preserve or strengthen the controls that already work."
+      }
+    ],
+    "contextNote": "No live dependency or dynamic scan is part of this hermetic source-review scenario; the report should say so."
+  },
+  "qualityFocus": [
+    "Both injection paths are found and tied to exact source",
+    "Working authentication, authorization, and audit controls are recognized",
+    "Unverified areas and evidence limits are explicit"
+  ]
+}

package/data/craftbook-templates/sp/spec-authoring/versions/2.0.1/craftbook.json

@@ -0,0 +1,391 @@
+{
+  "id": "spec-authoring",
+  "name": "Spec Authoring",
+  "description": "Turn a rough intent into a backlog-ready spec: interrogate scope and requirements against the real code, then file a well-formed, unambiguous issue.",
+  "basedOn": {
+    "name": "gstack",
+    "url": "https://github.com/garrytan/gstack"
+  },
+  "plan": "Turn an already-approved intent into an implementation-ready workspace specification. Inspect the real project before asking questions, resolve one consequential decision at a time, and leave no hidden architecture choice to the implementer. Acceptance criteria must be pass/fail, references must use real paths, and risky changes need verification and rollback. The canonical deliverable stays in the workspace; publishing it elsewhere is a separate user-authorized action.",
+  "entryStepId": "inspect",
+  "triggers": [
+    "spec this out",
+    "file an issue",
+    "write up a ticket",
+    "turn this into an issue",
+    "make this a github issue",
+    "turn this into a backlog item"
+  ],
+  "command": "spec-authoring",
+  "steps": [
+    {
+      "id": "inspect",
+      "name": "Inspect the current system",
+      "description": "Map present behavior, relevant code, conventions, dependencies, tests, and constraints.",
+      "prompt": "Read the approved intent and inspect the relevant workspace before asking the user anything. Trace current behavior through entry points, interfaces, data models, dependencies, tests, and adjacent patterns. Record exact paths and what each proves. Identify root cause for bugs, compatibility boundaries, security or migration risks, and unknowns that cannot be answered from the project. Do not design the change yet.\n\nObservable handoff: write the completed result to `specs/source-audit.md` in the workspace. Do not merely describe what the file would contain. Re-read it before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "principal engineer",
+      "advanceWhen": {
+        "file": "specs/source-audit.md",
+        "minBytes": 1000,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "goto": "resolve-decisions"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "specs/source-audit.md",
+            "bytes": 1000
+          },
+          {
+            "kind": "sniff",
+            "file": "specs/source-audit.md",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/source-audit.md",
+            "pattern": "^##\\s+Current behavior",
+            "flags": "im",
+            "label": "Current behavior section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/source-audit.md",
+            "pattern": "^##\\s+Source map",
+            "flags": "im",
+            "label": "Source map section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/source-audit.md",
+            "pattern": "^##\\s+Conventions",
+            "flags": "im",
+            "label": "Conventions section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/source-audit.md",
+            "pattern": "^##\\s+Constraints",
+            "flags": "im",
+            "label": "Constraints section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/source-audit.md",
+            "pattern": "^##\\s+Unknowns",
+            "flags": "im",
+            "label": "Unknowns section"
+          }
+        ],
+        "onReject": "inspect",
+        "maxAttempts": 3
+      },
+      "next": "resolve-decisions"
+    },
+    {
+      "id": "resolve-decisions",
+      "name": "Resolve scope and design decisions",
+      "description": "Close consequential ambiguities and record alternatives, rationale, and boundaries.",
+      "prompt": "Use `specs/source-audit.md` to enumerate only decisions the workspace cannot settle. Ask the user one consequential question at a time with `ask_user_question`, supplying a recommendation and trade-offs. In unattended mode, make only reversible assumptions and label them. Record the selected architecture, data and interface shapes, compatibility choices, dependency order, out-of-scope items, alternatives rejected, and decisions still blocked.\n\nObservable handoff: write the completed result to `specs/decision-log.md` in the workspace. Do not merely describe what the file would contain. Re-read it before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "solution architect",
+      "advanceWhen": {
+        "file": "specs/decision-log.md",
+        "minBytes": 900,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "goto": "write-spec"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "specs/decision-log.md",
+            "bytes": 900
+          },
+          {
+            "kind": "sniff",
+            "file": "specs/decision-log.md",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/decision-log.md",
+            "pattern": "^##\\s+Scope",
+            "flags": "im",
+            "label": "Scope section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/decision-log.md",
+            "pattern": "^##\\s+Decisions",
+            "flags": "im",
+            "label": "Decisions section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/decision-log.md",
+            "pattern": "^##\\s+Alternatives",
+            "flags": "im",
+            "label": "Alternatives section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/decision-log.md",
+            "pattern": "^##\\s+Out of scope",
+            "flags": "im",
+            "label": "Out of scope section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/decision-log.md",
+            "pattern": "^##\\s+Open blockers",
+            "flags": "im",
+            "label": "Open blockers section"
+          }
+        ],
+        "onReject": "resolve-decisions",
+        "maxAttempts": 3
+      },
+      "next": "write-spec"
+    },
+    {
+      "id": "write-spec",
+      "name": "Write the implementation specification",
+      "description": "Produce a backlog-ready spec with concrete interfaces, sequencing, tests, and rollback.",
+      "prompt": "Synthesize the source audit and decision log into a self-contained implementation specification. Include current versus proposed behavior, precise file changes, actual schema or API shapes where relevant, dependency-ordered work, measurable acceptance criteria, a testing pyramid, observability, rollout and rollback, effort by component, and explicit exclusions. Split work that cannot be completed safely as one bounded change. Use real workspace paths; never manufacture line numbers or execution results.\n\nObservable handoff: write the completed result to `specs/implementation-spec.md` in the workspace. Do not merely describe what the file would contain. Re-read it before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "specification writer",
+      "advanceWhen": {
+        "file": "specs/implementation-spec.md",
+        "minBytes": 1800,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "goto": "evaluate"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "specs/implementation-spec.md",
+            "bytes": 1800
+          },
+          {
+            "kind": "sniff",
+            "file": "specs/implementation-spec.md",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Context",
+            "flags": "im",
+            "label": "Context section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Current state",
+            "flags": "im",
+            "label": "Current state section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Proposed change",
+            "flags": "im",
+            "label": "Proposed change section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Implementation details",
+            "flags": "im",
+            "label": "Implementation details section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Acceptance criteria",
+            "flags": "im",
+            "label": "Acceptance criteria section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Testing plan",
+            "flags": "im",
+            "label": "Testing plan section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Rollback plan",
+            "flags": "im",
+            "label": "Rollback plan section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Out of scope",
+            "flags": "im",
+            "label": "Out of scope section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+File reference",
+            "flags": "im",
+            "label": "File reference section"
+          }
+        ],
+        "onReject": "write-spec",
+        "maxAttempts": 3
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate the deliverable",
+      "description": "Independently grade the observable deliverable and route it to finish, repair, or user escalation.",
+      "prompt": "Review `specs/implementation-spec.md`, `specs/source-audit.md`, `specs/decision-log.md` against every criterion below. Inspect the underlying evidence files named by the workflow; do not grade from the author's summary alone.\n\n1. Every material current-state claim and file reference traces to inspected workspace evidence.\n2. The proposed architecture, interfaces, data shapes, and sequencing leave no hidden design decision to the implementer.\n3. Acceptance criteria are individually observable and pass/fail rather than subjective.\n4. The testing plan covers unit, integration, and end-to-end layers in proportion to risk.\n5. Migration, compatibility, observability, rollout, and rollback are addressed when relevant.\n6. Scope is bounded, exclusions are explicit, and unresolved blockers are not disguised as assumptions.\n\nWrite an evidence-backed review to `reviews/spec-authoring-review.md`. Give each criterion a PASS or FAIL with a concrete path, excerpt, measurement, or observed behavior. End with exactly `Verdict: PASS` or `Verdict: REVISE`. Then use `advance_task_step` for the active task: PASS routes to `finish`; REVISE routes to `repair` for review rounds 1 through 2, and the 3th REVISE routes to `needs-user`. Never route to finish while a criterion is unmet.",
+      "suggestedRole": "engineering reviewer",
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "reviews/spec-authoring-review.md",
+            "bytes": 400
+          },
+          {
+            "kind": "contains",
+            "file": "reviews/spec-authoring-review.md",
+            "pattern": "Verdict:\\s*(?:PASS|REVISE)",
+            "flags": "i",
+            "label": "explicit PASS or REVISE verdict"
+          }
+        ],
+        "onReject": "evaluate",
+        "maxAttempts": 3
+      },
+      "next": "repair"
+    },
+    {
+      "id": "repair",
+      "name": "Repair the deliverable",
+      "description": "Fix only the concrete gaps from the latest independent review.",
+      "prompt": "Read `reviews/spec-authoring-review.md` and repair every failed criterion in `specs/implementation-spec.md`, `specs/source-audit.md`, `specs/decision-log.md`. Make the changes in the actual workspace files, not just in task notes or a reply. Preserve evidence that already passed. Re-run or re-check anything the reviewer found unproven. Ensure `specs/implementation-spec.md` is genuinely updated this turn so the repair is observable, then hand it back for independent evaluation.",
+      "suggestedRole": "specification writer",
+      "advanceWhen": {
+        "file": "specs/implementation-spec.md",
+        "minBytes": 1800,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "goto": "evaluate"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "specs/implementation-spec.md",
+            "bytes": 1800
+          },
+          {
+            "kind": "sniff",
+            "file": "specs/implementation-spec.md",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Context",
+            "flags": "im",
+            "label": "Context section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Current state",
+            "flags": "im",
+            "label": "Current state section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Proposed change",
+            "flags": "im",
+            "label": "Proposed change section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Implementation details",
+            "flags": "im",
+            "label": "Implementation details section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Acceptance criteria",
+            "flags": "im",
+            "label": "Acceptance criteria section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Testing plan",
+            "flags": "im",
+            "label": "Testing plan section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Rollback plan",
+            "flags": "im",
+            "label": "Rollback plan section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+Out of scope",
+            "flags": "im",
+            "label": "Out of scope section"
+          },
+          {
+            "kind": "contains",
+            "file": "specs/implementation-spec.md",
+            "pattern": "^##\\s+File reference",
+            "flags": "im",
+            "label": "File reference section"
+          }
+        ],
+        "onReject": "repair",
+        "maxAttempts": 3
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All deterministic and reviewer criteria passed.",
+      "prompt": "The independent review passed. Read `reviews/spec-authoring-review.md`, then use `write_task_note` to record a concise DONE summary with the final deliverable paths (`specs/implementation-spec.md`, `specs/source-audit.md`, `specs/decision-log.md`) and the evidence that each acceptance criterion passed. Report DONE without starting new work.",
+      "suggestedRole": "project lead",
+      "terminal": true
+    },
+    {
+      "id": "needs-user",
+      "name": "Escalate unresolved concerns",
+      "description": "The bounded repair loop ended without a defensible pass.",
+      "prompt": "The deliverable did not pass after 3 review rounds. Do not claim success. Read `reviews/spec-authoring-review.md`, then use `write_task_note` to record DONE_WITH_CONCERNS: the unmet criteria, what was attempted, the affected paths, and the smallest user decision or missing input needed to continue.",
+      "suggestedRole": "project lead",
+      "terminal": true
+    }
+  ],
+  "version": "2.0.1",
+  "releasedAt": "2026-08-13T00:00:00Z"
+}