@bendyline/gilde 0.1.38 → 0.1.39

package/data/craftbook-templates/pr/pr-security-review/versions/1.0.2/craftbook.json

@@ -0,0 +1,153 @@
+{
+  "id": "pr-security-review",
+  "name": "Security Review of a Diff",
+  "description": "Perform a focused security review of a code change or diff and produce a vulnerability report mapped to a threat checklist. First scopes the change's attack surface and locks a security checklist (injection, authn/authz, secrets, deserialization, SSRF, crypto misuse, input validation, dependency risk), then audits the diff against each class while tracing tainted data from untrusted sources to dangerous sinks, then writes a findings report rating each issue by severity and likelihood with a concrete remediation. Use this for a security review, secure code review, vulnerability assessment of a diff, an AppSec pass, or checking a change for injection/auth/secret-leak risks before merge — it surfaces exploitable flaws tied to specific lines rather than generic security platitudes.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Scope the attack surface (reviewer) — map trust boundaries, lock a security checklist → gated on artifact `{{workPath}}/scope.md` (markdown-notes)\n2. Audit for vulnerabilities (reviewer) — trace tainted data to sinks, check each threat class → gated on artifact `{{workPath}}/audit.md` (markdown-notes)\n3. Write the security report (reviewer) — findings with severity, exploit, remediation → gated on artifact `{{workPath}}/security-review.md` (markdown-report)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n",
+  "entryStepId": "scope",
+  "triggers": [
+    "security review",
+    "is this change secure",
+    "check this diff for vulnerabilities",
+    "secure code review",
+    "appsec review",
+    "review for injection"
+  ],
+  "steps": [
+    {
+      "id": "scope",
+      "name": "Scope the attack surface",
+      "description": "map trust boundaries, lock a security checklist",
+      "prompt": "Step 1: Read the diff and identify the attack surface it touches: new/changed endpoints, inputs from untrusted sources (HTTP params, headers, files, env, third-party data), data sinks (SQL, shell, filesystem, eval, HTML render, outbound requests), and any auth/permission logic. Step 2: Map the trust boundaries — where does untrusted data enter and where could it reach a dangerous operation. Step 3: Write a security acceptance-criteria checklist tuned to this change, drawn from: injection (SQL/command/template/XSS), broken authn/authz (missing checks, IDOR), secrets handling (no hardcoded keys, no secrets logged), unsafe deserialization, SSRF/path traversal, crypto misuse (weak algo, static IV, no salt), missing input validation, and risky new dependencies. Step 4: For each item, state what 'safe' looks like for THIS diff (e.g. 'all SQL uses parameterized queries', 'the user-supplied filename is canonicalized and confined to the upload dir'). Step 5: Record assumptions and out-of-scope areas. Write the surface map + checklist to `write_task_note` AND `{{workPath}}/scope.md`. No findings yet.\n\nThe deliverable `{{workPath}}/scope.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "{{workPath}}/scope.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/scope.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/scope.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "scope",
+        "maxAttempts": 3
+      },
+      "next": "audit"
+    },
+    {
+      "id": "audit",
+      "name": "Audit for vulnerabilities",
+      "description": "trace tainted data to sinks, check each threat class",
+      "prompt": "Step 1: For each untrusted input identified in scope, trace it through the code to every sink it can reach — flag any path where it hits a sink without validation/escaping/parameterization (that is the vulnerability). Step 2: Walk EACH checklist threat class against the diff and the code it calls, looking for concrete violations, not theoretical ones. Step 3: For every finding capture: file:line, the vulnerability class, an exploit sketch (how an attacker triggers it), severity (critical/high/medium/low) and likelihood, and a concrete remediation (parameterize this query, add this authz check, move this secret to env). Step 4: Verify the negatives too — confirm the dangerous-looking spots that are actually safe and note WHY (so the report is trustworthy). Step 5: Note anything requiring dynamic testing you could not perform statically. Good looks like: a finding with a real taint path from source to sink, not 'consider validating inputs'. Stage findings to `write_task_note`. Do not write the report yet.\n\nThe deliverable `{{workPath}}/audit.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "{{workPath}}/audit.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/audit.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/audit.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "audit",
+        "maxAttempts": 3
+      },
+      "next": "report"
+    },
+    {
+      "id": "report",
+      "name": "Write the security report",
+      "description": "findings with severity, exploit, remediation",
+      "prompt": "Step 1: Open `{{workPath}}/security-review.md` and write a top-line verdict: Safe-to-merge / Merge-after-fixes / Block, with the count of findings by severity. Step 2: Add a '## Findings' section; for each, write `### [SEVERITY] class — file:line` with the exploit sketch, the impact, the likelihood, and the concrete remediation. Order by severity then likelihood. Step 3: Add a '## Verified safe' section noting the threat classes you checked and found clean (so the review's coverage is auditable). Step 4: Add a '## Not statically verifiable' section for anything needing a pentest/runtime check. Every finding must have a concrete taint path or rule violation and a specific fix — no generic advice. On a loop-back, fix only the named gaps without dropping real findings. `write_task_note` the report path and the severity counts.\n\nThe deliverable `{{workPath}}/security-review.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "{{workPath}}/security-review.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/security-review.md",
+            "bytes": 1500,
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/security-review.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i",
+            "label": "at least one markdown heading",
+            "artifact": true
+          }
+        ],
+        "onReject": "report",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Open `{{workPath}}/security-review.md` and grade it against the scope checklist. Check EACH criterion and write PASS/FAIL with a one-line reason: (1) every threat class in the checklist was assessed (found-and-reported or verified-safe); (2) each finding is pinned to file:line with an exploit sketch; (3) each finding has a severity and a concrete remediation; (4) tainted-data paths from untrusted source to sink are traced where applicable; (5) a Verified-safe section makes coverage auditable; (6) the verdict matches the findings (no 'Safe-to-merge' with an open critical). If any criterion fails, name the exact gap and loop back.\n\nThe deliverable lives in the project's artifacts drawer — open `{{workPath}}/security-review.md` with `read_artifact`, not `read_file`.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"report\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/security-review.md",
+          "artifact": true
+        }
+      ],
+      "next": "report"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "terminal": true
+    }
+  ],
+  "version": "1.0.2",
+  "releasedAt": "2026-08-21T00:00:00Z",
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "minGezelVersion": "1.26233"
+}

package/data/craftbook-templates/pr/pr-security-review/versions/1.0.2/test.json

@@ -0,0 +1,113 @@
+{
+  "schemaVersion": 1,
+  "title": "Security Review of a Diff smoke eval",
+  "objective": "Self-contained smoke eval for the Security Review of a Diff craftbook using the corpus generic harness.",
+  "tags": [
+    "corpus"
+  ],
+  "prompt": "We need a security review of a diff for the returns-desk work. The backgound info is in source/brief.md — have a look and write it up in report.md.",
+  "setup": {
+    "projectName": "Security Review of a Diff Eval",
+    "about": "Self-contained eval project for pr-security-review. Seeded inputs are under workspace/source or workspace/fixtures; final deliverable is workspace/report.md.",
+    "missionObjectives": "Use the Security Review of a Diff craftbook/template, read the seeded local fixtures, and write report.md without network calls, real credentials, or live services.",
+    "files": [
+      {
+        "path": "source/brief.md",
+        "content": "# Security Review of a Diff Eval Brief\n\nClient: Boreal Desk, a home-office accessories company.\nAudience: operations leads who need an artifact they can use this week.\n\nFixed source facts for grounding:\n- The returns desk pilot covered 18 SKUs.\n- Median first response improved from 18 hours to 6 hours.\n- Preventable refund leakage fell from 14.2% to 8.9%.\n- The top unresolved complaint is status silence after photo submission.\n- Required next actions are automated status emails, barcode-exception training, and a weekly Finance exception export.\n\nUse these facts when the task asks for prose, analysis, copy, UI content, or test data. Do not use live web services, real credentials, or current outside data.\n\nCraftbook under test: pr-security-review - Security Review of a Diff.\n"
+      }
+    ],
+    "worker": {
+      "name": "Jules",
+      "role": "Writer"
+    },
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "report.md is a source-grounded markdown artifact with required facts and actions.",
+    "deliverables": [
+      {
+        "path": "report.md",
+        "kind": "markdown-report",
+        "minBytes": 1000,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "report.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "report.md",
+            "pattern": "source/brief\\.md|Brief",
+            "flags": "i",
+            "label": "cite or name the seeded source"
+          },
+          {
+            "kind": "contains",
+            "file": "report.md",
+            "pattern": "18\\b[\\s\\S]{0,30}\\bSKUs",
+            "flags": "i",
+            "label": "include the 18-SKU pilot scope"
+          },
+          {
+            "kind": "contains",
+            "file": "report.md",
+            "pattern": "18\\s*hours|6\\s*hours",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "report.md",
+            "pattern": "14\\.2%|8\\.9%",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "report.md",
+            "pattern": "status silence|photo submission",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "report.md",
+            "pattern": "automated status emails|barcode|Finance",
+            "flags": "i"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "report.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "grounding",
+        "description": "Seeded facts appear faithfully and the source is cited."
+      },
+      {
+        "name": "structure",
+        "description": "Sections progress logically for the artifact class."
+      },
+      {
+        "name": "completeness",
+        "description": "Required elements (risks, next actions, scope) are all present."
+      },
+      {
+        "name": "tone",
+        "description": "The register fits the audience and artifact class."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "source-grounded prose",
+    "section structure",
+    "next-action clarity"
+  ]
+}

package/data/craftbook-templates/pr/practice-exam/versions/1.0.2/craftbook.json

@@ -0,0 +1,171 @@
+{
+  "id": "practice-exam",
+  "name": "Practice Exam",
+  "description": "Take the exam before the exam: a timed, self-scoring practice paper blueprinted from the deck — weighted toward what the review record says is weak — with an answer key that explains, not just grades. Locks the blueprint FIRST — topic coverage, weak-spot weighting from the deck's boxes and miss counts, timing, honest scoring — then builds the interactive exam page, then writes the key. Use for practice exams, mock tests, 'test me before the test', timed practice papers, and exam-week dress rehearsals.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Blueprint the exam (studiemaat) — deck picture, weak-spot weighting, timing and scoring rules → gated on artifact `{{workPath}}/scope.md` (markdown-notes)\n2. Build the exam page (developer) — timed, self-scoring exam.html built from the deck → gated on `exam.html` (html-page)\n3. Write the answer key (copywriter) — per-question explanations that teach, not just grade → gated on artifact `{{workPath}}/answer-key.md` (markdown-notes)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n",
+  "entryStepId": "scope",
+  "triggers": [
+    "build me a practice exam",
+    "practice test from the deck",
+    "mock exam before the test",
+    "timed practice paper",
+    "test me before the exam"
+  ],
+  "steps": [
+    {
+      "id": "scope",
+      "name": "Blueprint the exam",
+      "description": "deck picture, weak-spot weighting, timing and scoring rules",
+      "prompt": "Blueprint the exam before writing a single question. Step 1: read deck.json from the workspace — every card with its front, back, box, and got-it/missed stats — and note the exam date or occasion from the owner's ask. Step 2: name the deck's topics (group the cards by theme) and the weak spots with numbers as evidence: cards sitting in box 1, and cards missed as often as they were got. Step 3: lock the blueprint — how many questions, coverage across every topic, weak material weighted roughly double, the time limit, and the scoring rule (points per question, what score means ready). Step 4: write an acceptance-criteria checklist ('every topic represented', 'weak cards get the extra weight the blueprint promises', 'every question comes from a deck card — nothing invented', 'the timer and scoring actually work', 'the key explains every answer'). Call write_task_note with the topic list + weak-spot count + checklist and write {{workPath}}/scope.md.\n\nThe deliverable `{{workPath}}/scope.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "studiemaat",
+      "advanceWhen": {
+        "file": "{{workPath}}/scope.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/scope.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/scope.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "scope",
+        "maxAttempts": 3
+      },
+      "next": "author"
+    },
+    {
+      "id": "author",
+      "name": "Build the exam page",
+      "description": "timed, self-scoring exam.html built from the deck",
+      "prompt": "Build the exam as one self-contained page at exam.html. Step 1: write the questions from the blueprint — every question grounded in a deck card (the card's fact, come at from a testing angle), weak cards weighted as the blueprint says, order shuffled so topics interleave. Step 2: make it takeable — a visible countdown timer from the blueprint's limit, one clear control per question, and a submit control that ends the attempt. Step 3: make the scoring honest — on submit, grade against the built-in key, show the score and which questions were missed, and never inflate; an exam that always says full marks is broken. Step 4: keep it one file — inline styles and script, no external requests — and check the script actually parses before completing. Call write_task_note with the question count per topic and the time limit.",
+      "suggestedRole": "developer",
+      "advanceWhen": {
+        "file": "exam.html",
+        "minBytes": 1,
+        "sniff": "html-complete"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "exam.html",
+            "bytes": 2500
+          },
+          {
+            "kind": "htmlLint",
+            "file": "exam.html"
+          },
+          {
+            "kind": "cssMinBytes",
+            "bytes": 650,
+            "file": "exam.html"
+          },
+          {
+            "kind": "jsParses",
+            "file": "exam.html"
+          },
+          {
+            "kind": "contains",
+            "file": "exam.html",
+            "pattern": "score|submit",
+            "flags": "i",
+            "label": "self-scoring controls"
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkHtmlComplete",
+            "scope": "standard",
+            "inputs": {
+              "file": "exam.html"
+            }
+          }
+        ],
+        "onReject": "author",
+        "maxAttempts": 3
+      },
+      "next": "key"
+    },
+    {
+      "id": "key",
+      "name": "Write the answer key",
+      "description": "per-question explanations that teach, not just grade",
+      "prompt": "Write the answer key at {{workPath}}/answer-key.md. Step 1: one entry per exam question — the right answer, then a plain-words explanation of WHY it is right, sized for someone reviewing the night before. Step 2: name which deck card each question leans on, so a missed question points straight back to the card to re-study. Step 3: for the weak-spot questions, add the one memory hook or contrast that makes the fact stick. Step 4: keep the tone encouraging — the key exists to close gaps, not to scold. Call write_task_note with the entry count and the key path.\n\nThe deliverable `{{workPath}}/answer-key.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "copywriter",
+      "advanceWhen": {
+        "file": "{{workPath}}/answer-key.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/answer-key.md",
+            "bytes": 800,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/answer-key.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "key",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Open exam.html, {{workPath}}/answer-key.md, and deck.json and verify every criterion from {{workPath}}/scope.md: count the questions per topic against the blueprint — every topic covered and the weak material actually carrying the promised extra weight; spot-check three questions against the deck — each must trace to a real card, an invented fact is the classic failure; walk the page's logic — the timer counts down from the blueprint's limit and submit grades honestly against the key; and confirm the key explains every answer and points back to its card. Write PASS/FAIL per criterion; on any failure, name the question or topic and loop back to author.\n\nThe deliverable lives in the project's artifacts drawer — open `{{workPath}}/answer-key.md` with `read_artifact`, not `read_file`.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"author\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/answer-key.md",
+          "artifact": true
+        }
+      ],
+      "next": "author"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "terminal": true
+    }
+  ],
+  "version": "1.0.2",
+  "releasedAt": "2026-08-21T00:00:00Z",
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "minGezelVersion": "1.26233"
+}

package/data/craftbook-templates/pr/practice-exam/versions/1.0.2/test.json

@@ -0,0 +1,120 @@
+{
+  "schemaVersion": 1,
+  "title": "Practice Exam — timed, self-scoring, weighted to the weak spots",
+  "objective": "Measure whether the practice-exam craftbook turns the deck's review record into a takeable, honestly-scoring exam page — every question grounded in a real card, the record's weak topics carrying extra weight — plus an answer key that explains.",
+  "tags": [
+    "html-page"
+  ],
+  "prompt": "exam is in two weeks — can you build me a practise exam from the deck? somthing i can actually take and score",
+  "setup": {
+    "projectName": "Spanish Flashcards",
+    "about": "Study Buddy project for Spanish vocabulary. The deck and its review record live at workspace/deck.json — each card carries its Leitner box and got-it/missed stats. The practice exam goes to workspace/exam.html with its key at workspace/notes/answer-key.md.",
+    "missionObjectives": "The exam must come from the deck's own record — questions grounded in real cards, weak material (box 1, missed-heavy) weighted up, timing and scoring honest. No live services, no real credentials.",
+    "files": [
+      {
+        "path": "deck.json",
+        "content": "{\n  \"version\": 1,\n  \"subject\": \"Spanish vocabulary\",\n  \"cards\": [\n    {\n      \"id\": \"card-1\",\n      \"front\": \"the apple\",\n      \"back\": \"la manzana\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 6,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-2\",\n      \"front\": \"the cheese\",\n      \"back\": \"el queso\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 6,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-3\",\n      \"front\": \"the bread\",\n      \"back\": \"el pan\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 6,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-4\",\n      \"front\": \"the fish (to eat)\",\n      \"back\": \"el pescado\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 6,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-5\",\n      \"front\": \"the market\",\n      \"back\": \"el mercado\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 6,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-6\",\n      \"front\": \"how much does it cost?\",\n      \"back\": \"cuánto cuesta\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 6,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-7\",\n      \"front\": \"the platform (train)\",\n      \"back\": \"el andén\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 1,\n        \"missed\": 6\n      }\n    },\n    {\n      \"id\": \"card-8\",\n      \"front\": \"the luggage\",\n      \"back\": \"el equipaje\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 1,\n        \"missed\": 6\n      }\n    },\n    {\n      \"id\": \"card-9\",\n      \"front\": \"the ticket\",\n      \"back\": \"el billete\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 1,\n        \"missed\": 6\n      }\n    },\n    {\n      \"id\": \"card-10\",\n      \"front\": \"the station\",\n      \"back\": \"la estación\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 1,\n        \"missed\": 6\n      }\n    },\n    {\n      \"id\": \"card-11\",\n      \"front\": \"the delay\",\n      \"back\": \"el retraso\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 1,\n        \"missed\": 6\n      }\n    },\n    {\n      \"id\": \"card-12\",\n      \"front\": \"the return trip\",\n      \"back\": \"la vuelta\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 1,\n        \"missed\": 6\n      }\n    },\n    {\n      \"id\": \"card-13\",\n      \"front\": \"I bring (traer)\",\n      \"back\": \"traigo\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 2,\n        \"missed\": 5\n      }\n    },\n    {\n      \"id\": \"card-14\",\n      \"front\": \"I hear (oír)\",\n      \"back\": \"oigo\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 2,\n        \"missed\": 5\n      }\n    },\n    {\n      \"id\": \"card-15\",\n      \"front\": \"I follow (seguir)\",\n      \"back\": \"sigo\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 2,\n        \"missed\": 5\n      }\n    },\n    {\n      \"id\": \"card-16\",\n      \"front\": \"they ask for (pedir)\",\n      \"back\": \"piden\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 2,\n        \"missed\": 5\n      }\n    },\n    {\n      \"id\": \"card-17\",\n      \"front\": \"we sleep (dormir)\",\n      \"back\": \"dormimos\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 2,\n        \"missed\": 5\n      }\n    },\n    {\n      \"id\": \"card-18\",\n      \"front\": \"I fit (caber)\",\n      \"back\": \"quepo\",\n      \"box\": 1,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 2,\n        \"missed\": 5\n      }\n    },\n    {\n      \"id\": \"card-19\",\n      \"front\": \"half past two\",\n      \"back\": \"las dos y media\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 5,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-20\",\n      \"front\": \"quarter to five\",\n      \"back\": \"las cinco menos cuarto\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 5,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-21\",\n      \"front\": \"seven hundred\",\n      \"back\": \"setecientos\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 5,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-22\",\n      \"front\": \"the day after tomorrow\",\n      \"back\": \"pasado mañana\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 5,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-23\",\n      \"front\": \"last night\",\n      \"back\": \"anoche\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 5,\n        \"missed\": 1\n      }\n    },\n    {\n      \"id\": \"card-24\",\n      \"front\": \"ninety\",\n      \"back\": \"noventa\",\n      \"box\": 3,\n      \"lastReviewedAt\": \"2026-07-15T18:00:00.000Z\",\n      \"createdAt\": \"2026-06-20T09:00:00.000Z\",\n      \"stats\": {\n        \"gotIt\": 5,\n        \"missed\": 1\n      }\n    }\n  ],\n  \"dueCardIds\": [],\n  \"updatedAt\": \"2026-07-18T08:00:00.000Z\"\n}\n"
+      }
+    ],
+    "worker": {
+      "name": "Milan",
+      "role": "Developer"
+    },
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "exam.html is a timed, self-scoring exam built from the deck with the record's weak topics weighted up; tasks/eval/answer-key.md explains every answer.",
+    "deliverables": [
+      {
+        "path": "exam.html",
+        "kind": "html-page",
+        "minBytes": 3000,
+        "checks": [
+          {
+            "kind": "cssMinBytes",
+            "bytes": 650,
+            "file": "exam.html"
+          },
+          {
+            "kind": "jsParses",
+            "file": "exam.html"
+          },
+          {
+            "kind": "contains",
+            "file": "exam.html",
+            "pattern": "score|submit",
+            "flags": "i",
+            "label": "self-scoring controls"
+          },
+          {
+            "kind": "contains",
+            "file": "exam.html",
+            "pattern": "timer|time left|remaining|countdown|minute",
+            "flags": "i",
+            "label": "the exam is timed"
+          },
+          {
+            "kind": "contains",
+            "file": "exam.html",
+            "pattern": "andén|equipaje|billete|estación|retraso",
+            "flags": "i",
+            "label": "weak travel material made the paper"
+          },
+          {
+            "kind": "contains",
+            "file": "exam.html",
+            "pattern": "traigo|oigo|sigo|piden|dormimos|quepo",
+            "flags": "i",
+            "label": "weak verb material made the paper"
+          }
+        ]
+      },
+      {
+        "path": "tasks/eval/answer-key.md",
+        "kind": "markdown-notes",
+        "minBytes": 800,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/answer-key.md",
+            "pattern": "card|deck",
+            "flags": "i",
+            "label": "key points back to the deck"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "exam.html",
+      "kind": "html"
+    },
+    "axes": [
+      {
+        "name": "coverage",
+        "description": "Every deck topic is represented and the record's weak topics visibly carry extra weight — the blueprint is honored, not a uniform sample."
+      },
+      {
+        "name": "question quality",
+        "description": "Questions test the card's idea from a real testing angle — no invented facts, no copy-pasted card fronts."
+      },
+      {
+        "name": "interactivity",
+        "description": "The timer counts down, answers can be entered, and submit ends the attempt — the page is genuinely takeable."
+      },
+      {
+        "name": "scoring honesty",
+        "description": "Submit grades against a real key and reports misses truthfully — an exam that flatters is broken."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "deck-grounded questions",
+    "weak-spot weighting",
+    "honest self-scoring"
+  ]
+}