@bendyline/gilde 0.1.38 → 0.1.39

package/data/craftbook-templates/au/audiobook-master-pack/versions/1.0.4/test.json

@@ -0,0 +1,224 @@
+{
+  "schemaVersion": 1,
+  "title": "Master the Audiobook smoke eval",
+  "objective": "Task-specific eval for the Master the Audiobook craftbook: six rendered chapters with run logs are swept against the table of contents, described in a verified manifest, concatenated through the fake mastering pipeline, and packaged with listener copy.",
+  "tags": [
+    "external"
+  ],
+  "prompt": "all six chapters are rendered — can you master the audiobok and get the metadata sorted? theres a fake concat pipeline wired up",
+  "setup": {
+    "projectName": "Audiobook Studio — Mastering Eval",
+    "about": "Self-contained eval project for audiobook-master-pack. The table of contents is manuscript/toc.md; the six rendered chapters sit under audio/ as chapter-XX.wav with a chapter-XX-log.json run log each (durations in durationSeconds). The manifest goes to master/manifest.json; the fake mastering pipeline is the ready-made mock-probe project script (writes master/book.m4b plus master/assembly-log.json, and cross-checks manifest durations against the chapter logs). The listener description and release notes go to master/release-notes.md.",
+    "missionObjectives": "Use the Master the Audiobook craftbook/template, sweep the chapters against the table of contents, build master/manifest.json with file, duration, and order per chapter taken from the run logs, assemble through the provided mock-probe script, and write master/release-notes.md. No real audio tools or services — only the wired fake pipeline.",
+    "files": [
+      {
+        "path": "manuscript/toc.md",
+        "content": "# A Field Guide to Vanishing - table of contents\n\n1. The Door in the Sea Wall\n2. The Ferry at Dusk\n3. The Handwriting House\n4. What the Buoy Knew\n5. The Smallest Lantern\n6. Come Anyway\n"
+      },
+      {
+        "path": "audio/chapter-01.wav",
+        "content": "MOCKWAV chapter-01 rendered audio stub (The Door in the Sea Wall)\n0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
+      },
+      {
+        "path": "audio/chapter-01-log.json",
+        "content": "{\n  \"status\": \"ok\",\n  \"engine\": \"mock-tts\",\n  \"chapter\": \"The Door in the Sea Wall\",\n  \"file\": \"audio/chapter-01.wav\",\n  \"durationSeconds\": 1712.4,\n  \"wordCount\": 4310\n}\n"
+      },
+      {
+        "path": "audio/chapter-02.wav",
+        "content": "MOCKWAV chapter-02 rendered audio stub (The Ferry at Dusk)\n0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
+      },
+      {
+        "path": "audio/chapter-02-log.json",
+        "content": "{\n  \"status\": \"ok\",\n  \"engine\": \"mock-tts\",\n  \"chapter\": \"The Ferry at Dusk\",\n  \"file\": \"audio/chapter-02.wav\",\n  \"durationSeconds\": 1544.8,\n  \"wordCount\": 3890\n}\n"
+      },
+      {
+        "path": "audio/chapter-03.wav",
+        "content": "MOCKWAV chapter-03 rendered audio stub (The Handwriting House)\n0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
+      },
+      {
+        "path": "audio/chapter-03-log.json",
+        "content": "{\n  \"status\": \"ok\",\n  \"engine\": \"mock-tts\",\n  \"chapter\": \"The Handwriting House\",\n  \"file\": \"audio/chapter-03.wav\",\n  \"durationSeconds\": 1836.2,\n  \"wordCount\": 4620\n}\n"
+      },
+      {
+        "path": "audio/chapter-04.wav",
+        "content": "MOCKWAV chapter-04 rendered audio stub (What the Buoy Knew)\n0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
+      },
+      {
+        "path": "audio/chapter-04-log.json",
+        "content": "{\n  \"status\": \"ok\",\n  \"engine\": \"mock-tts\",\n  \"chapter\": \"What the Buoy Knew\",\n  \"file\": \"audio/chapter-04.wav\",\n  \"durationSeconds\": 1490.5,\n  \"wordCount\": 3750\n}\n"
+      },
+      {
+        "path": "audio/chapter-05.wav",
+        "content": "MOCKWAV chapter-05 rendered audio stub (The Smallest Lantern)\n0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
+      },
+      {
+        "path": "audio/chapter-05-log.json",
+        "content": "{\n  \"status\": \"ok\",\n  \"engine\": \"mock-tts\",\n  \"chapter\": \"The Smallest Lantern\",\n  \"file\": \"audio/chapter-05.wav\",\n  \"durationSeconds\": 1671.9,\n  \"wordCount\": 4205\n}\n"
+      },
+      {
+        "path": "audio/chapter-06.wav",
+        "content": "MOCKWAV chapter-06 rendered audio stub (Come Anyway)\n0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\n"
+      },
+      {
+        "path": "audio/chapter-06-log.json",
+        "content": "{\n  \"status\": \"ok\",\n  \"engine\": \"mock-tts\",\n  \"chapter\": \"Come Anyway\",\n  \"file\": \"audio/chapter-06.wav\",\n  \"durationSeconds\": 1922.7,\n  \"wordCount\": 4840\n}\n"
+      }
+    ],
+    "worker": {
+      "name": "Ruben",
+      "role": "Producer"
+    },
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [
+    {
+      "kind": "cli",
+      "id": "probe",
+      "description": "Provenance-trusted project script `mock-probe` that runs the fake mastering pipeline: verifies master/manifest.json against the audio files and their run logs, then writes the stub master and its run log.",
+      "shim": {
+        "path": "scripts/mock-probe.ts",
+        "content": "import { defineScript, gezel } from '@bendyline/gezel-sdk';\n\nexport const meta = defineScript({\n  name: 'mock-probe',\n  description:\n    'Fake mastering pipeline for this eval: reads master/manifest.json, verifies every referenced audio file exists with a sane duration and order, cross-checks durations against the per-chapter run logs, then writes the stub master to master/book.m4b and its run log to master/assembly-log.json.',\n  inputs: {},\n  outputs: {\n    log: { type: 'string', description: 'The mastering run log JSON written to master/assembly-log.json.' },\n  },\n  requires: ['workspace.read', 'workspace.write'],\n});\n\nconst manifest = JSON.parse(await gezel.fs.read('master/manifest.json'));\nif (!Array.isArray(manifest) || manifest.length === 0) {\n  throw new Error('master/manifest.json must be a non-empty JSON array');\n}\nconst entries = await gezel.fs.list('audio');\nconst present = new Set(entries.filter((entry) => !entry.isDirectory).map((entry) => entry.name));\nlet total = 0;\nconst orders = new Set();\nfor (const row of manifest) {\n  const base = String(row.file ?? '').split('/').pop();\n  if (!base || !present.has(base)) {\n    throw new Error(`manifest references a missing audio file: ${row.file}`);\n  }\n  if (typeof row.duration !== 'number' || row.duration <= 0) {\n    throw new Error(`bad duration for chapter ${row.chapter}: ${row.duration}`);\n  }\n  if (typeof row.order !== 'number' || orders.has(row.order)) {\n    throw new Error(`bad or duplicate order for chapter ${row.chapter}: ${row.order}`);\n  }\n  orders.add(row.order);\n  const logName = base.replace(/\\.wav$/, '-log.json');\n  if (present.has(logName)) {\n    const chapterLog = JSON.parse(await gezel.fs.read(`audio/${logName}`));\n    if (\n      typeof chapterLog.durationSeconds === 'number' &&\n      Math.abs(chapterLog.durationSeconds - row.duration) > 0.01\n    ) {\n      throw new Error(`manifest duration for chapter ${row.chapter} does not match its run log`);\n    }\n  }\n  total += row.duration;\n}\nconst log = {\n  status: 'ok',\n  engine: 'mock-concat',\n  chapters: manifest.length,\n  totalDurationSeconds: Math.round(total * 100) / 100,\n};\nawait gezel.fs.write('master/book.m4b', `MOCKM4B audiobook master stub\\n${'0'.repeat(2048)}\\n`);\nawait gezel.fs.write('master/assembly-log.json', `${JSON.stringify(log, null, 2)}\\n`);\ngezel.output({ log: JSON.stringify(log) });\n"
+      }
+    }
+  ],
+  "success": {
+    "summary": "master/manifest.json describes all six chapters exactly once with log-true durations, the fake pipeline produced the master and a status-ok log counting six chapters, and the release notes carry the total running time plus listener copy.",
+    "deliverables": [
+      {
+        "path": "master/manifest.json",
+        "kind": "json",
+        "checks": [
+          {
+            "kind": "recordSchema",
+            "file": "master/manifest.json",
+            "fields": [
+              {
+                "name": "chapter",
+                "type": "nonempty"
+              },
+              {
+                "name": "file",
+                "type": "nonempty"
+              },
+              {
+                "name": "duration"
+              },
+              {
+                "name": "order"
+              }
+            ],
+            "minRows": 6,
+            "uniqueBy": "chapter"
+          },
+          {
+            "kind": "valuesSubsetOf",
+            "file": "master/manifest.json",
+            "sourceFiles": [
+              "audio/chapter-01-log.json",
+              "audio/chapter-02-log.json",
+              "audio/chapter-03-log.json",
+              "audio/chapter-04-log.json",
+              "audio/chapter-05-log.json",
+              "audio/chapter-06-log.json"
+            ],
+            "pattern": "\"file\"\\s*:\\s*\"([^\"]+)\"",
+            "label": "every manifest file reference matches a rendered chapter from the run logs"
+          }
+        ]
+      },
+      {
+        "path": "master/book.m4b",
+        "kind": "generic-file",
+        "minBytes": 200
+      },
+      {
+        "path": "master/assembly-log.json",
+        "kind": "json",
+        "checks": [
+          {
+            "kind": "jsonPathEquals",
+            "file": "master/assembly-log.json",
+            "path": "status",
+            "value": "ok",
+            "label": "the mastering log reports status ok"
+          },
+          {
+            "kind": "jsonPathEquals",
+            "file": "master/assembly-log.json",
+            "path": "chapters",
+            "value": 6,
+            "label": "all six chapters were assembled"
+          }
+        ]
+      },
+      {
+        "path": "master/release-notes.md",
+        "kind": "markdown-report",
+        "minBytes": 500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "master/release-notes.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "master/release-notes.md",
+            "pattern": "duration|running time",
+            "flags": "i",
+            "label": "the total running time is stated"
+          },
+          {
+            "kind": "contains",
+            "file": "master/release-notes.md",
+            "pattern": "chapter",
+            "flags": "i",
+            "label": "the chapter list is present"
+          },
+          {
+            "kind": "judge",
+            "file": "master/release-notes.md",
+            "rubric": "The listener-facing description reads like store copy for the book (warm, no spoilers, aimed at a browsing listener), and the stated total running time matches the mastering log rather than being invented.",
+            "sourceFiles": [
+              "master/assembly-log.json",
+              "manuscript/toc.md"
+            ],
+            "label": "store-copy quality and log-true numbers"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "master/release-notes.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "completeness",
+        "description": "All six chapters swept, present, and in manuscript order — no holes."
+      },
+      {
+        "name": "metadata-quality",
+        "description": "Manifest durations and orders come from the run logs, never estimated."
+      },
+      {
+        "name": "listener-copy",
+        "description": "The description sells the book to a browsing listener without spoiling it."
+      },
+      {
+        "name": "release-readiness",
+        "description": "The notes confirm the master's numbers match the manifest."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "completeness sweep",
+    "log-true metadata",
+    "listener-facing copy"
+  ]
+}

package/data/craftbook-templates/au/auth-flow/versions/1.0.2/craftbook.json

@@ -0,0 +1,160 @@
+{
+  "id": "auth-flow",
+  "name": "Auth / Session Implementation",
+  "description": "Implement an authentication and session flow — login, session/token issuance, verification, and logout — with the security fundamentals baked in. Threat-models FIRST to lock the security requirements — credential hashing, token/session strategy, expiry, CSRF/XSS posture, and the attacks in scope — then implements registration/login/verify/logout to those requirements, then a security-minded reviewer audits for the classic auth pitfalls. Covers password hashing (bcrypt/argon2), session vs JWT, token expiry/refresh, secure cookie flags, timing-safe comparison, CSRF protection, and brute-force throttling.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Threat scope (planner) — lock the security requirements and threats in scope → gated on artifact `{{workPath}}/threat-scope.md` (markdown-notes)\n2. Build the auth flow (developer) — implement register/login/verify/logout securely → gated on `src/auth.js` (code-module)\n3. Security review (reviewer) — audit for the classic auth pitfalls → gated on artifact `{{workPath}}/review.md` (markdown-notes)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n",
+  "entryStepId": "threat-scope",
+  "triggers": [
+    "implement login",
+    "build an auth flow",
+    "session handling",
+    "add authentication",
+    "jwt or session auth"
+  ],
+  "steps": [
+    {
+      "id": "threat-scope",
+      "name": "Threat scope",
+      "description": "lock the security requirements and threats in scope",
+      "prompt": "Lock the security requirements before implementing auth — auth done casually is a vulnerability. Step 1: Decide the session strategy: server sessions vs JWT, where the token lives (httpOnly cookie vs header), and expiry/refresh. Step 2: Lock credential handling: passwords hashed with a strong adaptive function (bcrypt/argon2) and never stored or logged in plaintext, with timing-safe verification. Step 3: Enumerate the threats in scope and the mitigations: brute force (throttling/lockout), CSRF (token or SameSite cookie), XSS (httpOnly), session fixation (rotate on login), and enumeration (uniform error messages). Step 4: Write a numbered acceptance-criteria checklist of 6-9 items (e.g. 'passwords are hashed, never plaintext', 'wrong password and unknown user return the same error', 'sessions expire and rotate on login', 'logout invalidates the session', 'cookies are httpOnly/secure/SameSite'). `write_task_note` the requirements + threat list + checklist and write the same to the produces path.\n\nThe deliverable `{{workPath}}/threat-scope.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "planner",
+      "advanceWhen": {
+        "file": "{{workPath}}/threat-scope.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/threat-scope.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/threat-scope.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "threat-scope",
+        "maxAttempts": 3
+      },
+      "next": "build"
+    },
+    {
+      "id": "build",
+      "name": "Build the auth flow",
+      "description": "implement register/login/verify/logout securely",
+      "prompt": "Implement the auth flow to the security requirements. Step 1: Registration — hash passwords with the chosen adaptive function and a per-user salt; never store/log plaintext. Step 2: Login — look up the user and verify with a timing-safe comparison; on success issue the session/token with expiry and set the cookie with httpOnly/secure/SameSite (rotate the session id to prevent fixation). Step 3: Use a UNIFORM error for both unknown-user and wrong-password to avoid enumeration; add basic brute-force throttling. Step 4: Verify — middleware/function that validates the session/token and rejects expired/invalid ones. Step 5: Logout — invalidate the session server-side and clear the cookie. Add CSRF protection for state-changing routes. Write the implementation to the produces path. On a loop-back, fix only the flagged issue. `write_task_note` the file path and which criteria now pass.",
+      "suggestedRole": "developer",
+      "advanceWhen": {
+        "file": "src/auth.js",
+        "minBytes": 1,
+        "sniff": "nonempty"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "src/auth.js",
+            "bytes": 200
+          },
+          {
+            "kind": "sniff",
+            "file": "src/auth.js",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "esmImports",
+            "file": "src/auth.js"
+          },
+          {
+            "kind": "sourceParses",
+            "file": "src/auth.js"
+          }
+        ],
+        "onReject": "build",
+        "maxAttempts": 3
+      },
+      "next": "review"
+    },
+    {
+      "id": "review",
+      "name": "Security review",
+      "description": "audit for the classic auth pitfalls",
+      "prompt": "Audit the auth implementation against the threat scope and the classic pitfalls. Step 1: Confirm passwords are hashed with a strong adaptive function (not MD5/SHA-1/plaintext) and never logged. Step 2: Confirm login uses timing-safe comparison and that unknown-user vs wrong-password are indistinguishable (no enumeration). Step 3: Confirm sessions/tokens expire, rotate on login, and are invalidated on logout, and that cookies carry httpOnly/secure/SameSite. Step 4: Confirm CSRF protection on state-changing routes and that brute force is throttled. Step 5: Look for secrets hardcoded in source. Write an audit note listing each threat and PASS/FAIL with the specific finding to the produces path.\n\nThe deliverable `{{workPath}}/review.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "{{workPath}}/review.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "src/auth.js",
+            "bytes": 200
+          },
+          {
+            "kind": "sniff",
+            "file": "src/auth.js",
+            "sniff": "nonempty"
+          },
+          {
+            "kind": "esmImports",
+            "file": "src/auth.js"
+          },
+          {
+            "kind": "sourceParses",
+            "file": "src/auth.js"
+          }
+        ],
+        "onReject": "review",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Exercise the auth flow and audit the code. For EACH acceptance criterion: confirm passwords are hashed (never plaintext/logged), confirm unknown-user and wrong-password return identical errors, confirm sessions expire/rotate and logout invalidates, confirm cookies are httpOnly/secure/SameSite, and confirm CSRF + brute-force protections exist. Write PASS/FAIL per criterion; plaintext passwords or user enumeration is an automatic FAIL.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"build\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "src/auth.js"
+        }
+      ],
+      "next": "build"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "terminal": true
+    }
+  ],
+  "version": "1.0.2",
+  "releasedAt": "2026-08-21T00:00:00Z",
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "minGezelVersion": "1.26233"
+}

package/data/craftbook-templates/au/auth-flow/versions/1.0.2/test.json

@@ -0,0 +1,143 @@
+{
+  "schemaVersion": 1,
+  "title": "Secure auth-flow module",
+  "objective": "Measure whether the auth-flow craftbook scopes threats before writing a password/session flow with basic security controls.",
+  "tags": [
+    "code"
+  ],
+  "prompt": "In the `Auth Flow Eval` project, write `src/auth.js`: a small dependency-free ESM module for a session-based email/password login flow. Include registration, login, logout, session creation/validation, password hashing with Node crypto pbkdf2 or scrypt, CSRF token generation/validation, rate-limit bookkeeping, and safe error messages. Also write `tasks/eval/review.md` with a concise security review that covers password storage, session expiry, CSRF, rate limiting, and what is intentionally out of scope. Do not use live network services or real credentials.",
+  "setup": {
+    "projectName": "Auth Flow Eval",
+    "about": "Self-contained eval project for auth-flow. Deliverables are workspace/src/auth.js and workspace/notes/review.md.",
+    "missionObjectives": "Build a small local auth module and a threat/security review covering storage, sessions, CSRF, and rate limiting.",
+    "files": [],
+    "worker": {
+      "name": "Sander",
+      "role": "Developer"
+    },
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "src/auth.js implements a local auth module and tasks/eval/review.md covers the required security controls.",
+    "deliverables": [
+      {
+        "path": "src/auth.js",
+        "kind": "code-module",
+        "minBytes": 1800,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "pbkdf2|scrypt|crypto",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "register",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "login",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "logout",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "session",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "csrf",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "src/auth.js",
+            "pattern": "rate|attempt",
+            "flags": "i"
+          }
+        ]
+      },
+      {
+        "path": "tasks/eval/review.md",
+        "kind": "markdown-notes",
+        "minBytes": 350,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "password|hash",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "session|expiry|expiration",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "csrf",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "rate limit|rate-limit|attempt",
+            "flags": "i"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "src/auth.js",
+      "kind": "typescript"
+    },
+    "axes": [
+      {
+        "name": "correctness",
+        "description": "The module does what the requirements ask, with sensible edge handling."
+      },
+      {
+        "name": "verification",
+        "description": "Self-tests exercise real behavior, not trivial truths."
+      },
+      {
+        "name": "clarity",
+        "description": "Exports, naming, and structure make the module usable without reading every line."
+      },
+      {
+        "name": "robustness",
+        "description": "Invalid input and boundary cases fail loudly rather than silently."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "security scoping",
+    "session flow",
+    "review notes"
+  ]
+}