@bendyline/gilde 0.1.38 → 0.1.40

package/data/craftbook-templates/co/comprehensive-codebase-review/versions/1.0.0/craftbook.json

@@ -0,0 +1,337 @@
+{
+  "id": "comprehensive-codebase-review",
+  "name": "Comprehensive Codebase Review",
+  "description": "The definitive deep, consultant-level review of an entire codebase and its architecture. Before any review turn runs, the runtime brings the project's static index and AI index as up to date as they can get and publishes an honest coverage snapshot the report must cite. The review then harvests every indexed finding (per-file AI reviews, Boekwachter issues, security findings, dependency advisories), assesses the architecture and module boundaries, sweeps for duplicated code and logic, dead code, hygiene problems, embarrassments, and lightweight security issues — verifying every lead in real source — and clusters it all into systemic themes. The deliverable is a prioritized consultant report with a per-dimension scorecard, file-and-line-cited findings, quick wins vs strategic recommendations, and a machine-readable findings file, gated so no fabricated citation survives.\n\nWhat makes this the deep review rather than a long one: it starts from evidence the runtime prepared. On entering the first step, an `ensureIndexFresh` hook re-scans the static index, drives the AI tiers (embeddings, summaries, per-file reviews) with a bounded wait, and lands `review/index-readiness.json` in the task's working folder — including what could NOT be made fresh (no Boekwachter on the crew, indexing paused or disabled), so a quiet issue list is never mistaken for a clean codebase. Every phase gates on an artifact, the final report is checked structurally AND against fabrication (every cited file must exist in the workspace), and an evaluate loop repairs named gaps before the task can finish.\n\nDeliverables land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source, and the review never modifies the codebase.\n\nPhases:\n\n1. Survey the system (reviewer) — index freshness snapshot + whole-system map → gated on artifact `{{workPath}}/review/system-map.md`\n2. Harvest indexed findings (reviewer) — every existing AI-review, security, and dependency lead in one place → gated on artifact `{{workPath}}/review/indexed-findings.md`\n3. Assess the architecture (reviewer) — boundaries, coupling, pattern consistency, duplicated logic, verified in source → gated on artifact `{{workPath}}/review/architecture.md`\n4. Sweep quality and hygiene (reviewer) — duplication, dead code, embarrassments, lightweight security, verified in source → gated on artifact `{{workPath}}/review/hygiene.md`\n5. Synthesize themes (reviewer) — root-cause clusters ranked by blast radius; quick wins vs strategic work → gated on artifact `{{workPath}}/review/themes.md`\n6. Write the consultant report (reviewer) — scorecard, cited findings, recommendations + machine-readable findings JSON → gated on artifact `{{workPath}}/codebase-review.md` including an anti-fabrication check\n\nThe gates never advance with an unmet criterion, and loop back to the owning phase to fix named gaps. For a dedicated deep dive on one dimension afterwards, the report points at the specialist books: Deep Security Review, Codebase Refactoring Review, Reliability & Resilience Review, Documentation Drift Review.\n",
+  "entryStepId": "survey",
+  "triggers": [
+    "comprehensive codebase review",
+    "deep codebase review",
+    "review my whole codebase",
+    "consultant level code review",
+    "deep dive on code quality and architecture",
+    "full audit of the codebase",
+    "what is wrong with this codebase"
+  ],
+  "toolsets": [
+    {
+      "toolsetId": "builtin.code-intel",
+      "autoAllow": true,
+      "reason": "map the repo, rank indexed file-health leads, and verify every finding in real symbols"
+    },
+    {
+      "toolsetId": "builtin.security-intel",
+      "autoAllow": true,
+      "reason": "harvest static security findings, attack surface, and dependency advisories for the lightweight security pass"
+    },
+    {
+      "toolsetId": "builtin.git",
+      "autoAllow": true,
+      "reason": "read-only churn and fix-frequency evidence for prioritizing findings"
+    }
+  ],
+  "runModes": {
+    "nightShift": "recommended",
+    "scheduled": "supported"
+  },
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      },
+      "focus": {
+        "type": "string",
+        "title": "Review focus",
+        "default": "overall code health, architecture, and maintainability",
+        "description": "Optional area to emphasize, e.g. architecture, duplication, security, tests, or a specific subsystem."
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "survey",
+      "name": "Survey the system",
+      "description": "read the runtime's index-freshness snapshot and map the whole system before judging any of it",
+      "prompt": "You are opening a comprehensive, consultant-level review of this entire codebase, weighted toward `{{focus}}`. You never modify project source in this craftbook — every deliverable is an artifact.\n\n**The runtime already ran the index-freshness pass.** On entering this step it re-scanned the static index, drove the AI index tiers with a bounded wait, and published the honest result to the artifact `{{workPath}}/review/index-readiness.json`. Step 1: call `read_artifact` on that file. Record its static state, search readiness, AI-tier coverage (summaries and per-file reviews: reviewed vs eligible), and EVERY entry in its `notes` array — those caveats (no Boekwachter on the crew, indexing paused or disabled, catch-up still running) are coverage limits your final report must state. If the file does not exist, say plainly that index freshness could not be verified and derive coverage from `map_repo` instead — never invent numbers.\n\nStep 2: map the system. Call `map_repo` and record languages, top areas, file counts, indexed health rollup, and worst files. Read the top-level manifests and docs (`read_file` on the package/build manifests and README) to state what the system IS: its purpose, runtime shape, entry points, external dependencies, and how it is built and tested. Step 3: if git history is available, use read-only `run_git` queries (log, shortlog, churn on the worst areas) for change-frequency evidence; missing history is not a failure. Step 4: name the 4-8 areas the deep phases will cover and anything deliberately out of scope.\n\nWrite the artifact `{{workPath}}/review/system-map.md` with `write_artifact`: the system's purpose and shape, the area inventory, churn hot spots, your review plan — and a section headed exactly `## Index coverage` quoting the readiness numbers and caveats. No findings yet; this phase orients the review.",
+      "suggestedRole": "reviewer",
+      "onEnter": [
+        {
+          "name": "ensureIndexFresh",
+          "scope": "standard",
+          "inputs": {
+            "outFile": "{{workPath}}/review/index-readiness.json",
+            "waitBudgetSeconds": 180
+          }
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/system-map.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/system-map.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/review/system-map.md",
+            "pattern": "(?:^|\\n)#{1,4}\\s+Index coverage",
+            "flags": "i",
+            "label": "an '## Index coverage' section quoting the readiness snapshot",
+            "artifact": true
+          }
+        ],
+        "onReject": "survey",
+        "maxAttempts": 3
+      },
+      "next": "harvest"
+    },
+    {
+      "id": "harvest",
+      "name": "Harvest indexed findings",
+      "description": "pull every existing AI-review, security, and dependency lead into one evidence base",
+      "prompt": "Collect everything gezel's indexes already know about this codebase before forming your own opinions. Step 1: call `list_file_issues` across the repo and record the totals by severity and category, the reviewed-vs-eligible coverage it reports, and the worst files; call `file_review` on the 5-10 lowest-health files for the indexed rationale. Step 2: call `security_scan` once to refresh the dependency inventory and run any installed scanners, then `security_overview` for the posture and candidate systemic themes, `scan_findings` for the static security leads by severity, and `list_dependencies` for advisory-bearing packages. Step 3: cross-reference with the churn hot spots from the system map — a low-health, high-churn file outranks a low-health frozen one.\n\nWrite the artifact `{{workPath}}/review/indexed-findings.md` with `write_artifact`: the counts and coverage per source, then the top leads grouped by dimension (architecture, duplication, hygiene, security, tests), each with its file path and one line of indexed rationale. Label everything here a LEAD, not a finding — nothing is a finding until a later phase verifies it in real source. Note which sources were empty and why (the readiness snapshot's caveats say whether an empty issue list means a clean codebase or an unstaffed AI tier).\n\nBefore working, open the artifact input `{{workPath}}/review/system-map.md` with `read_artifact`; do not look for it in the workspace.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/system-map.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/indexed-findings.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/indexed-findings.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/review/indexed-findings.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "harvest",
+        "maxAttempts": 3
+      },
+      "next": "architecture"
+    },
+    {
+      "id": "architecture",
+      "name": "Assess the architecture",
+      "description": "boundaries, coupling, dependency direction, pattern consistency, and duplicated logic — verified in source",
+      "prompt": "Judge the architecture the way a consultant would: by how the pieces actually depend on each other, not by the directory names. Step 1: from the system map, identify the intended layers/modules and their boundaries. Step 2: verify them — use `outline_file` before reading any large file, `read_symbol` for the load-bearing units, and `find_references` to see real dependency direction; flag boundary leaks (a lower layer importing upward, UI reaching into storage, cross-module reach-ins). Step 3: assess pattern consistency with `search_code`: how many different ways does this codebase do error handling, data access, configuration, validation? Each extra way is a finding. Step 4: hunt duplicated LOGIC across modules (the same responsibility implemented twice), oversized orchestration files, god objects, and unclear ownership — start from the worst-health files in the indexed leads and confirm or explicitly reject each. Step 5: for every CONFIRMED problem record file:line evidence, why it hurts (change amplification, blast radius, onboarding cost), a bounded remediation seam, and effort/risk. Note what you checked and found SOUND — that list is half the report's credibility.\n\nWrite the evidence to the artifact `{{workPath}}/review/architecture.md` with `write_artifact`. Do not modify source.\n\nBefore working, open the artifact inputs `{{workPath}}/review/system-map.md` and `{{workPath}}/review/indexed-findings.md` with `read_artifact`; do not look for them in the workspace.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/system-map.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/review/indexed-findings.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/architecture.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/architecture.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/review/architecture.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "architecture",
+        "maxAttempts": 3
+      },
+      "next": "hygiene"
+    },
+    {
+      "id": "hygiene",
+      "name": "Sweep quality and hygiene",
+      "description": "duplicated code, dead code, embarrassments, and lightweight security problems — verified in source",
+      "prompt": "Sweep for the problems that make a codebase embarrassing to hand to a new engineer. Step 1: copy-paste duplication — use `search_code` and `grep_files` for distinctive repeated fragments and near-identical functions; confirm each pair by reading both sides. Step 2: dead weight — exports with no references (`find_references`), unreachable branches, leftover scratch/experiment files, and committed junk (`find_files` for logs, editor droppings, build outputs, `.env`-style files that should not be in the tree). Step 3: embarrassments — clusters of TODO/FIXME/HACK/XXX, commented-out code blocks, debug prints left in production paths, misspellings in public names, wildly inconsistent naming. Cluster them; five scattered TODOs are noise, thirty in one module are a finding. Step 4: lightweight security — verify the harvested leads and grep for hardcoded secrets/tokens, ad-hoc environment reads, string-built queries or shell commands reaching user input, and debug/permissive flags left on. Confirm in source; severity honestly (a hardcoded token is high; a TODO is info). This is the LIGHTWEIGHT pass — recommend the Deep Security Review craftbook in the report for anything that needs a real audit. Step 5: test posture — where are the tests thin relative to the risk you have seen? For every confirmed finding: file:line, why it matters, the concrete fix. Record what came out CLEAN too.\n\nWrite the evidence to the artifact `{{workPath}}/review/hygiene.md` with `write_artifact`. Do not modify source.\n\nBefore working, open the artifact input `{{workPath}}/review/indexed-findings.md` with `read_artifact`; do not look for it in the workspace.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/indexed-findings.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/hygiene.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/hygiene.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/review/hygiene.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "hygiene",
+        "maxAttempts": 3
+      },
+      "next": "synthesize"
+    },
+    {
+      "id": "synthesize",
+      "name": "Synthesize themes",
+      "description": "cluster every confirmed finding into root-cause themes; rank; split quick wins from strategic work",
+      "prompt": "Step back from individual findings and produce the analysis only a whole-codebase review can: the systemic picture. Step 1: re-read your evidence artifacts (`{{workPath}}/review/architecture.md`, `{{workPath}}/review/hygiene.md`, `{{workPath}}/review/indexed-findings.md`) with `read_artifact`. Step 2: cluster every CONFIRMED finding by ROOT CAUSE, not by file — e.g. 'there is no shared validation layer so each route re-implements it', 'module boundaries are undocumented so logic duplicates across areas'. For each theme state the root cause, the blast radius (how much of the system it touches and how many findings it explains), and the single change that would prevent the whole class. Step 3: rank themes by blast radius × severity, weighted toward `{{focus}}`. Step 4: split the remediation into QUICK WINS (safe, bounded, this-week fixes: delete the dead files, remove the debug prints, extract one duplicated helper) and STRATEGIC WORK (sequenced refactors with migration boundaries and the tests that must protect behavior). Step 5: assign each confirmed finding a severity (critical, high, medium, low, info) and the theme it belongs to — this taxonomy feeds the final report and its machine-readable findings file. A healthy codebase with few material findings should say so plainly rather than inventing themes.\n\nWrite the artifact `{{workPath}}/review/themes.md` with `write_artifact`.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/architecture.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/review/hygiene.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/themes.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/themes.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/review/themes.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "synthesize",
+        "maxAttempts": 3
+      },
+      "next": "report"
+    },
+    {
+      "id": "report",
+      "name": "Write the consultant report",
+      "description": "the definitive deliverable: scorecard, cited findings, recommendations, and a machine-readable findings file",
+      "prompt": "Write the final deliverable as TWO artifacts, in this order.\n\nStep 1: write `{{workPath}}/codebase-review-findings.json` with `write_artifact` — a JSON array where each confirmed finding is an object with: `file` (a REAL workspace path — the gate verifies every one exists), `line` (a number; REQUIRED for critical and high findings), `severity` (one of critical, high, medium, low, info), `dimension` (architecture, duplication, hygiene, security, tests, or docs), `title`, `remediation` (a concrete fix), and `theme` (the systemic theme it belongs to). No fabricated paths, no vague remediations.\n\nStep 2: write `{{workPath}}/codebase-review.md` with `write_artifact`, using these exact section headings:\n\n`## Executive summary` — 3-6 sentences an owner reads first: overall judgment, the finding counts by severity, the top systemic themes, and the single most valuable next action. The tone must match the open severity — never 'excellent health' over an open critical/high.\n`## Scorecard` — a markdown table with columns `Dimension`, `Grade`, `Evidence` grading at least five dimensions (architecture, code quality & duplication, hygiene, security posture, tests) A-F, each grade justified by one line of evidence from your phases.\n`## Index coverage and method` — the readiness snapshot's numbers and caveats, what each phase examined, and the limits of this review.\n`## Systemic themes` — each theme with its root cause and blast radius, ranked. This is the heart of the review.\n`## Findings` — each finding as `### [SEVERITY] title — file:line` with the evidence, the consequence, and the remediation, ordered by severity then blast radius.\n`## Quick wins` — the safe, bounded fixes worth doing this week.\n`## Strategic recommendations` — the sequenced larger work: seams, migration order, and the behavior-preserving tests required first.\n`## Verified sound` — what you checked and found solid, so coverage is auditable.\n`## Not assessed` — what this review did not cover (runtime performance, deployment, anything the index caveats excluded).\n`## Suggested deeper reviews` — which specialist craftbooks to run next (Deep Security Review, Codebase Refactoring Review, Reliability & Resilience Review, Documentation Drift Review) and why, based on what you found.\n\nThe gate re-reads both artifacts: it verifies every cited file exists, every finding is complete, the scorecard table is real, and the themes analyze root cause and blast radius. On a loop-back, fix ONLY the gaps it names without dropping findings that already passed.\n\nBefore working, open the artifact input `{{workPath}}/review/themes.md` with `read_artifact`; do not look for it in the workspace.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/themes.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/codebase-review.md",
+        "minBytes": 500,
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/codebase-review.md",
+            "bytes": 2500,
+            "artifact": true
+          },
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/codebase-review-findings.json",
+            "bytes": 2,
+            "artifact": true
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkCodebaseReviewReport",
+            "scope": "standard",
+            "inputs": {
+              "file": "{{workPath}}/codebase-review.md",
+              "findings": "{{workPath}}/codebase-review-findings.json"
+            }
+          }
+        ],
+        "onReject": "report",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Grade `{{workPath}}/codebase-review.md` against the standard a paying client would hold a consultant to. Check EACH criterion and write PASS/FAIL with a one-line reason: (1) the executive summary gives a real judgment an owner can act on, consistent with the open severity; (2) the scorecard grades are grounded in the report's own evidence, not vibes; (3) index coverage and its caveats are stated, and 'Not assessed' is honest — a quiet report is never passed off as a clean codebase; (4) every finding was verified in source and cites a real file (critical/high pinned to a line); (5) systemic themes are root-cause clusters with blast radius, not a re-grouped file list; (6) quick wins are genuinely safe and bounded, and strategic recommendations name seams, sequence, and behavior-preserving tests; (7) severities are calibrated — no inflation to look thorough, no deflation to look kind; (8) the suggested deeper reviews follow from what was actually found; (9) no project source was modified. \n\nThe deliverable lives in the project's artifacts drawer — open `{{workPath}}/codebase-review.md` with `read_artifact`, not `read_file`.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"report\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually read like a definitive review). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/codebase-review.md",
+          "artifact": true
+        }
+      ],
+      "next": "report"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: the overall judgment, the finding counts by severity, the top systemic themes, and the deliverable paths (`{{workPath}}/codebase-review.md`, `{{workPath}}/codebase-review-findings.json`, with the phase evidence under `{{workPath}}/review/`). Note that nothing in the workspace was modified. Then report DONE.",
+      "suggestedRole": "reviewer",
+      "terminal": true
+    }
+  ],
+  "version": "1.0.0",
+  "releasedAt": "2026-08-23T00:00:00Z",
+  "minGezelVersion": "1.26235"
+}

package/data/craftbook-templates/co/comprehensive-codebase-review/versions/1.0.0/test.json

@@ -0,0 +1,160 @@
+{
+  "schemaVersion": 1,
+  "title": "Comprehensive Codebase Review multi-dimension eval",
+  "objective": "Measure whether the review verifies planted architecture, duplication, hygiene, and lightweight-security problems in real source, states its index coverage honestly, and delivers a consultant report with a grounded scorecard, systemic themes, and a machine-readable findings file.",
+  "tags": [
+    "corpus"
+  ],
+  "prompt": "Use the Comprehensive Codebase Review craftbook to do a deep, consultant-level review of this codebase and its architecture. Write the report to tasks/eval/codebase-review.md. Do not change source.",
+  "setup": {
+    "projectName": "Comprehensive Review Eval",
+    "about": "A small web service with deliberate problems in several dimensions: duplicated parsing logic, a hardcoded token, debug prints, dead code, and a leaky module boundary.",
+    "missionObjectives": "Verify problems in source across architecture, duplication, hygiene, and security; grade each dimension; separate quick wins from strategic work.",
+    "files": [
+      {
+        "path": "src/routes/orders.ts",
+        "content": "import { db } from '../storage/db';\nexport async function postOrder(req, res) {\n  // TODO: validate\n  // TODO: auth\n  // TODO: rate limit\n  const items = String(req.body.items || '');\n  const parsed = items.split(',').map(s => { const [sku, qty] = s.split(':'); return { sku: sku.trim(), qty: Number(qty || 1) }; });\n  console.log('DEBUG order', parsed);\n  const rows = await db.query(\"INSERT INTO orders (items) VALUES ('\" + items + \"')\");\n  res.json({ ok: true, rows });\n}\n"
+      },
+      {
+        "path": "src/routes/quotes.ts",
+        "content": "export async function postQuote(req, res) {\n  const items = String(req.body.items || '');\n  const parsed = items.split(',').map(s => { const [sku, qty] = s.split(':'); return { sku: sku.trim(), qty: Number(qty || 1) }; });\n  res.json({ quote: parsed.length * 10 });\n}\n"
+      },
+      {
+        "path": "src/storage/db.ts",
+        "content": "import { postOrder } from '../routes/orders';\nexport const API_TOKEN = 'sk-live-9f2a71c04d8e';\nexport const db = { query: async (sql) => { return [{ sql }]; } };\nexport function legacyMigrate() { /* unused since v2 */ return null; }\n"
+      },
+      {
+        "path": "test/quotes.test.ts",
+        "content": "test('quotes', async () => {\n  expect(1 + 1).toBe(2);\n});\n"
+      },
+      {
+        "path": "README.md",
+        "content": "# Order service\nA tiny order and quote service.\n"
+      }
+    ],
+    "worker": {
+      "name": "Rae",
+      "role": "Reviewer"
+    },
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "tasks/eval/codebase-review.md verifies the planted problems with real file citations, grades at least five dimensions, clusters findings into root-cause themes, and ships a machine-readable findings JSON beside it.",
+    "deliverables": [
+      {
+        "path": "tasks/eval/codebase-review.md",
+        "kind": "markdown-report",
+        "artifact": true,
+        "minBytes": 2500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "##\\s+Executive summary[\\s\\S]*##\\s+Scorecard[\\s\\S]*##\\s+Systemic themes[\\s\\S]*##\\s+Findings[\\s\\S]*##\\s+Quick wins",
+            "flags": "i",
+            "label": "consultant report sections",
+            "artifact": true
+          },
+          {
+            "kind": "tableShape",
+            "file": "tasks/eval/codebase-review.md",
+            "requiredColumns": [
+              "Dimension",
+              "Grade"
+            ],
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "src/routes/(orders|quotes)\\.ts",
+            "flags": "i",
+            "label": "duplication evidence cites a real route file",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "API_TOKEN|hard-?coded (secret|token|credential)",
+            "flags": "i",
+            "label": "the planted hardcoded token is found",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "console\\.log|debug (print|logging|output)",
+            "flags": "i",
+            "label": "the planted debug print is found",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "root[\\s-]?cause",
+            "flags": "i",
+            "label": "themes analyze root cause",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "Index coverage",
+            "flags": "i",
+            "label": "index coverage is stated",
+            "artifact": true
+          }
+        ]
+      },
+      {
+        "path": "tasks/eval/codebase-review-findings.json",
+        "kind": "json",
+        "artifact": true,
+        "minBytes": 100,
+        "checks": [
+          {
+            "kind": "sniff",
+            "file": "tasks/eval/codebase-review-findings.json",
+            "sniff": "json-valid",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review-findings.json",
+            "pattern": "\"severity\"[\\s\\S]*\"remediation\"",
+            "label": "structured findings with severity and remediation",
+            "artifact": true
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "tasks/eval/codebase-review.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "verification",
+        "description": "Findings cite real files and lines; the duplicated parser, SQL string-building, hardcoded token, debug print, dead export, and storage-imports-routes boundary leak are found rather than invented."
+      },
+      {
+        "name": "synthesis",
+        "description": "Findings cluster into root-cause themes with blast radius; the scorecard grades follow the evidence."
+      },
+      {
+        "name": "actionability",
+        "description": "Quick wins are safe and bounded; strategic recommendations name seams, sequence, and behavior-preserving tests; deeper specialist reviews are suggested where warranted."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "verified findings across dimensions",
+    "honest coverage statement",
+    "consultant-grade prioritization"
+  ]
+}

package/data/craftbook-templates/co/config-scaffold/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "config-scaffold",
   "role": "project-starter",
+  "category": "code-build",
   "name": "Project Config Scaffold",
   "description": "Bootstrap a project's configuration — the tooling, linter, formatter, tsconfig/compiler, scripts, and ignore files — into a coherent, conflict-free baseline that actually works together. Scopes the config surface FIRST — every tool, its config file, the settings, and how they must agree (formatter vs linter, strict compiler) — then writes the config files and scripts, then verifies the toolchain runs clean with no conflicts. Covers linter/formatter config, compiler/tsconfig, package scripts, editorconfig, gitignore, and ensuring tools do not fight each other.",
   "tags": [

package/data/craftbook-templates/co/config-scaffold/versions/1.0.2/craftbook.json

@@ -0,0 +1,117 @@
+{
+  "id": "config-scaffold",
+  "name": "Project Config Scaffold",
+  "description": "Bootstrap a project's configuration — the tooling, linter, formatter, tsconfig/compiler, scripts, and ignore files — into a coherent, conflict-free baseline that actually works together. Scopes the config surface FIRST — every tool, its config file, the settings, and how they must agree (formatter vs linter, strict compiler) — then writes the config files and scripts, then verifies the toolchain runs clean with no conflicts. Covers linter/formatter config, compiler/tsconfig, package scripts, editorconfig, gitignore, and ensuring tools do not fight each other.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Scope the config (planner) — lock the tools, files, settings, and agreements → gated on artifact `{{workPath}}/scope.md` (markdown-notes)\n2. Write the config (developer) — create the config files + scripts to the plan → gated on `package.json` (json)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n",
+  "entryStepId": "scope",
+  "triggers": [
+    "scaffold project config",
+    "set up linting and formatting",
+    "bootstrap a project",
+    "create config files",
+    "tooling setup"
+  ],
+  "steps": [
+    {
+      "id": "scope",
+      "name": "Scope the config",
+      "description": "lock the tools, files, settings, and agreements",
+      "prompt": "Scope the configuration before writing files. Step 1: List the tools the project needs (formatter, linter, compiler/type-checker, test runner, etc.) and the config file each one reads. Step 2: For each, decide the key settings (e.g. strict compiler, line width, rule set). Step 3: Crucially, decide how the tools must AGREE so they do not fight — e.g. the linter defers formatting to the formatter, the compiler target matches the runtime. Step 4: Decide the package scripts (lint, format, typecheck, test, build) and the ignore files (.gitignore, tool ignores, .editorconfig). Step 5: Write a numbered acceptance-criteria checklist of 5-9 items (e.g. 'every script runs without error', 'formatter and linter do not conflict', 'the type-checker passes on the scaffold', 'ignore files exclude build output and deps'). `write_task_note` the config plan + checklist and write the same to the produces path.\n\nThe deliverable `{{workPath}}/scope.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "planner",
+      "advanceWhen": {
+        "file": "{{workPath}}/scope.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/scope.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/scope.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "scope",
+        "maxAttempts": 3
+      },
+      "next": "build"
+    },
+    {
+      "id": "build",
+      "name": "Write the config",
+      "description": "create the config files + scripts to the plan",
+      "prompt": "Create the configuration files to the plan. Step 1: Write each tool's config file with the scoped settings, and the package manifest's scripts (lint/format/typecheck/test/build) wired to real commands. Step 2: Configure the linter and formatter to defer to each other so they do not conflict, and align the compiler target with the runtime. Step 3: Write the ignore files (.gitignore, tool-specific ignores, .editorconfig) excluding deps and build output. Step 4: Run each script (lint, format --check, typecheck) on the scaffold and confirm they pass without errors or conflicting complaints. Write the primary manifest/config to the produces path. On a loop-back, fix only the named conflict/gap. `write_task_note` the file paths and which criteria now pass.",
+      "suggestedRole": "developer",
+      "advanceWhen": {
+        "file": "package.json",
+        "minBytes": 1,
+        "sniff": "json-valid"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "package.json",
+            "bytes": 2
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkJsonValid",
+            "scope": "standard",
+            "inputs": {
+              "file": "package.json"
+            }
+          }
+        ],
+        "onReject": "build",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Run each configured script on the scaffold. For EACH acceptance criterion: confirm lint, format-check, typecheck, and build/test scripts run without error, confirm the formatter and linter do NOT fight each other (no rule both formats and lints in conflict), confirm the type-checker passes, and confirm ignore files exclude deps/build output. Write PASS/FAIL per criterion; a formatter-vs-linter conflict is a FAIL.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"build\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "package.json"
+        }
+      ],
+      "next": "build"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "terminal": true
+    }
+  ],
+  "version": "1.0.2",
+  "releasedAt": "2026-08-21T00:00:00Z",
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "minGezelVersion": "1.26233"
+}