@bendyline/gilde 0.1.39 → 0.1.41

package/data/craftbook-templates/co/comprehensive-codebase-review/versions/1.0.0/craftbook.json

@@ -0,0 +1,337 @@
+{
+  "id": "comprehensive-codebase-review",
+  "name": "Comprehensive Codebase Review",
+  "description": "The definitive deep, consultant-level review of an entire codebase and its architecture. Before any review turn runs, the runtime brings the project's static index and AI index as up to date as they can get and publishes an honest coverage snapshot the report must cite. The review then harvests every indexed finding (per-file AI reviews, Boekwachter issues, security findings, dependency advisories), assesses the architecture and module boundaries, sweeps for duplicated code and logic, dead code, hygiene problems, embarrassments, and lightweight security issues — verifying every lead in real source — and clusters it all into systemic themes. The deliverable is a prioritized consultant report with a per-dimension scorecard, file-and-line-cited findings, quick wins vs strategic recommendations, and a machine-readable findings file, gated so no fabricated citation survives.\n\nWhat makes this the deep review rather than a long one: it starts from evidence the runtime prepared. On entering the first step, an `ensureIndexFresh` hook re-scans the static index, drives the AI tiers (embeddings, summaries, per-file reviews) with a bounded wait, and lands `review/index-readiness.json` in the task's working folder — including what could NOT be made fresh (no Boekwachter on the crew, indexing paused or disabled), so a quiet issue list is never mistaken for a clean codebase. Every phase gates on an artifact, the final report is checked structurally AND against fabrication (every cited file must exist in the workspace), and an evaluate loop repairs named gaps before the task can finish.\n\nDeliverables land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source, and the review never modifies the codebase.\n\nPhases:\n\n1. Survey the system (reviewer) — index freshness snapshot + whole-system map → gated on artifact `{{workPath}}/review/system-map.md`\n2. Harvest indexed findings (reviewer) — every existing AI-review, security, and dependency lead in one place → gated on artifact `{{workPath}}/review/indexed-findings.md`\n3. Assess the architecture (reviewer) — boundaries, coupling, pattern consistency, duplicated logic, verified in source → gated on artifact `{{workPath}}/review/architecture.md`\n4. Sweep quality and hygiene (reviewer) — duplication, dead code, embarrassments, lightweight security, verified in source → gated on artifact `{{workPath}}/review/hygiene.md`\n5. Synthesize themes (reviewer) — root-cause clusters ranked by blast radius; quick wins vs strategic work → gated on artifact `{{workPath}}/review/themes.md`\n6. Write the consultant report (reviewer) — scorecard, cited findings, recommendations + machine-readable findings JSON → gated on artifact `{{workPath}}/codebase-review.md` including an anti-fabrication check\n\nThe gates never advance with an unmet criterion, and loop back to the owning phase to fix named gaps. For a dedicated deep dive on one dimension afterwards, the report points at the specialist books: Deep Security Review, Codebase Refactoring Review, Reliability & Resilience Review, Documentation Drift Review.\n",
+  "entryStepId": "survey",
+  "triggers": [
+    "comprehensive codebase review",
+    "deep codebase review",
+    "review my whole codebase",
+    "consultant level code review",
+    "deep dive on code quality and architecture",
+    "full audit of the codebase",
+    "what is wrong with this codebase"
+  ],
+  "toolsets": [
+    {
+      "toolsetId": "builtin.code-intel",
+      "autoAllow": true,
+      "reason": "map the repo, rank indexed file-health leads, and verify every finding in real symbols"
+    },
+    {
+      "toolsetId": "builtin.security-intel",
+      "autoAllow": true,
+      "reason": "harvest static security findings, attack surface, and dependency advisories for the lightweight security pass"
+    },
+    {
+      "toolsetId": "builtin.git",
+      "autoAllow": true,
+      "reason": "read-only churn and fix-frequency evidence for prioritizing findings"
+    }
+  ],
+  "runModes": {
+    "nightShift": "recommended",
+    "scheduled": "supported"
+  },
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      },
+      "focus": {
+        "type": "string",
+        "title": "Review focus",
+        "default": "overall code health, architecture, and maintainability",
+        "description": "Optional area to emphasize, e.g. architecture, duplication, security, tests, or a specific subsystem."
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "survey",
+      "name": "Survey the system",
+      "description": "read the runtime's index-freshness snapshot and map the whole system before judging any of it",
+      "prompt": "You are opening a comprehensive, consultant-level review of this entire codebase, weighted toward `{{focus}}`. You never modify project source in this craftbook — every deliverable is an artifact.\n\n**The runtime already ran the index-freshness pass.** On entering this step it re-scanned the static index, drove the AI index tiers with a bounded wait, and published the honest result to the artifact `{{workPath}}/review/index-readiness.json`. Step 1: call `read_artifact` on that file. Record its static state, search readiness, AI-tier coverage (summaries and per-file reviews: reviewed vs eligible), and EVERY entry in its `notes` array — those caveats (no Boekwachter on the crew, indexing paused or disabled, catch-up still running) are coverage limits your final report must state. If the file does not exist, say plainly that index freshness could not be verified and derive coverage from `map_repo` instead — never invent numbers.\n\nStep 2: map the system. Call `map_repo` and record languages, top areas, file counts, indexed health rollup, and worst files. Read the top-level manifests and docs (`read_file` on the package/build manifests and README) to state what the system IS: its purpose, runtime shape, entry points, external dependencies, and how it is built and tested. Step 3: if git history is available, use read-only `run_git` queries (log, shortlog, churn on the worst areas) for change-frequency evidence; missing history is not a failure. Step 4: name the 4-8 areas the deep phases will cover and anything deliberately out of scope.\n\nWrite the artifact `{{workPath}}/review/system-map.md` with `write_artifact`: the system's purpose and shape, the area inventory, churn hot spots, your review plan — and a section headed exactly `## Index coverage` quoting the readiness numbers and caveats. No findings yet; this phase orients the review.",
+      "suggestedRole": "reviewer",
+      "onEnter": [
+        {
+          "name": "ensureIndexFresh",
+          "scope": "standard",
+          "inputs": {
+            "outFile": "{{workPath}}/review/index-readiness.json",
+            "waitBudgetSeconds": 180
+          }
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/system-map.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/system-map.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/review/system-map.md",
+            "pattern": "(?:^|\\n)#{1,4}\\s+Index coverage",
+            "flags": "i",
+            "label": "an '## Index coverage' section quoting the readiness snapshot",
+            "artifact": true
+          }
+        ],
+        "onReject": "survey",
+        "maxAttempts": 3
+      },
+      "next": "harvest"
+    },
+    {
+      "id": "harvest",
+      "name": "Harvest indexed findings",
+      "description": "pull every existing AI-review, security, and dependency lead into one evidence base",
+      "prompt": "Collect everything gezel's indexes already know about this codebase before forming your own opinions. Step 1: call `list_file_issues` across the repo and record the totals by severity and category, the reviewed-vs-eligible coverage it reports, and the worst files; call `file_review` on the 5-10 lowest-health files for the indexed rationale. Step 2: call `security_scan` once to refresh the dependency inventory and run any installed scanners, then `security_overview` for the posture and candidate systemic themes, `scan_findings` for the static security leads by severity, and `list_dependencies` for advisory-bearing packages. Step 3: cross-reference with the churn hot spots from the system map — a low-health, high-churn file outranks a low-health frozen one.\n\nWrite the artifact `{{workPath}}/review/indexed-findings.md` with `write_artifact`: the counts and coverage per source, then the top leads grouped by dimension (architecture, duplication, hygiene, security, tests), each with its file path and one line of indexed rationale. Label everything here a LEAD, not a finding — nothing is a finding until a later phase verifies it in real source. Note which sources were empty and why (the readiness snapshot's caveats say whether an empty issue list means a clean codebase or an unstaffed AI tier).\n\nBefore working, open the artifact input `{{workPath}}/review/system-map.md` with `read_artifact`; do not look for it in the workspace.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/system-map.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/indexed-findings.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/indexed-findings.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/review/indexed-findings.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "harvest",
+        "maxAttempts": 3
+      },
+      "next": "architecture"
+    },
+    {
+      "id": "architecture",
+      "name": "Assess the architecture",
+      "description": "boundaries, coupling, dependency direction, pattern consistency, and duplicated logic — verified in source",
+      "prompt": "Judge the architecture the way a consultant would: by how the pieces actually depend on each other, not by the directory names. Step 1: from the system map, identify the intended layers/modules and their boundaries. Step 2: verify them — use `outline_file` before reading any large file, `read_symbol` for the load-bearing units, and `find_references` to see real dependency direction; flag boundary leaks (a lower layer importing upward, UI reaching into storage, cross-module reach-ins). Step 3: assess pattern consistency with `search_code`: how many different ways does this codebase do error handling, data access, configuration, validation? Each extra way is a finding. Step 4: hunt duplicated LOGIC across modules (the same responsibility implemented twice), oversized orchestration files, god objects, and unclear ownership — start from the worst-health files in the indexed leads and confirm or explicitly reject each. Step 5: for every CONFIRMED problem record file:line evidence, why it hurts (change amplification, blast radius, onboarding cost), a bounded remediation seam, and effort/risk. Note what you checked and found SOUND — that list is half the report's credibility.\n\nWrite the evidence to the artifact `{{workPath}}/review/architecture.md` with `write_artifact`. Do not modify source.\n\nBefore working, open the artifact inputs `{{workPath}}/review/system-map.md` and `{{workPath}}/review/indexed-findings.md` with `read_artifact`; do not look for them in the workspace.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/system-map.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/review/indexed-findings.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/architecture.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/architecture.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/review/architecture.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "architecture",
+        "maxAttempts": 3
+      },
+      "next": "hygiene"
+    },
+    {
+      "id": "hygiene",
+      "name": "Sweep quality and hygiene",
+      "description": "duplicated code, dead code, embarrassments, and lightweight security problems — verified in source",
+      "prompt": "Sweep for the problems that make a codebase embarrassing to hand to a new engineer. Step 1: copy-paste duplication — use `search_code` and `grep_files` for distinctive repeated fragments and near-identical functions; confirm each pair by reading both sides. Step 2: dead weight — exports with no references (`find_references`), unreachable branches, leftover scratch/experiment files, and committed junk (`find_files` for logs, editor droppings, build outputs, `.env`-style files that should not be in the tree). Step 3: embarrassments — clusters of TODO/FIXME/HACK/XXX, commented-out code blocks, debug prints left in production paths, misspellings in public names, wildly inconsistent naming. Cluster them; five scattered TODOs are noise, thirty in one module are a finding. Step 4: lightweight security — verify the harvested leads and grep for hardcoded secrets/tokens, ad-hoc environment reads, string-built queries or shell commands reaching user input, and debug/permissive flags left on. Confirm in source; severity honestly (a hardcoded token is high; a TODO is info). This is the LIGHTWEIGHT pass — recommend the Deep Security Review craftbook in the report for anything that needs a real audit. Step 5: test posture — where are the tests thin relative to the risk you have seen? For every confirmed finding: file:line, why it matters, the concrete fix. Record what came out CLEAN too.\n\nWrite the evidence to the artifact `{{workPath}}/review/hygiene.md` with `write_artifact`. Do not modify source.\n\nBefore working, open the artifact input `{{workPath}}/review/indexed-findings.md` with `read_artifact`; do not look for it in the workspace.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/indexed-findings.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/hygiene.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/hygiene.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/review/hygiene.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "hygiene",
+        "maxAttempts": 3
+      },
+      "next": "synthesize"
+    },
+    {
+      "id": "synthesize",
+      "name": "Synthesize themes",
+      "description": "cluster every confirmed finding into root-cause themes; rank; split quick wins from strategic work",
+      "prompt": "Step back from individual findings and produce the analysis only a whole-codebase review can: the systemic picture. Step 1: re-read your evidence artifacts (`{{workPath}}/review/architecture.md`, `{{workPath}}/review/hygiene.md`, `{{workPath}}/review/indexed-findings.md`) with `read_artifact`. Step 2: cluster every CONFIRMED finding by ROOT CAUSE, not by file — e.g. 'there is no shared validation layer so each route re-implements it', 'module boundaries are undocumented so logic duplicates across areas'. For each theme state the root cause, the blast radius (how much of the system it touches and how many findings it explains), and the single change that would prevent the whole class. Step 3: rank themes by blast radius × severity, weighted toward `{{focus}}`. Step 4: split the remediation into QUICK WINS (safe, bounded, this-week fixes: delete the dead files, remove the debug prints, extract one duplicated helper) and STRATEGIC WORK (sequenced refactors with migration boundaries and the tests that must protect behavior). Step 5: assign each confirmed finding a severity (critical, high, medium, low, info) and the theme it belongs to — this taxonomy feeds the final report and its machine-readable findings file. A healthy codebase with few material findings should say so plainly rather than inventing themes.\n\nWrite the artifact `{{workPath}}/review/themes.md` with `write_artifact`.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/architecture.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/review/hygiene.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review/themes.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review/themes.md",
+            "bytes": 150,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/review/themes.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "synthesize",
+        "maxAttempts": 3
+      },
+      "next": "report"
+    },
+    {
+      "id": "report",
+      "name": "Write the consultant report",
+      "description": "the definitive deliverable: scorecard, cited findings, recommendations, and a machine-readable findings file",
+      "prompt": "Write the final deliverable as TWO artifacts, in this order.\n\nStep 1: write `{{workPath}}/codebase-review-findings.json` with `write_artifact` — a JSON array where each confirmed finding is an object with: `file` (a REAL workspace path — the gate verifies every one exists), `line` (a number; REQUIRED for critical and high findings), `severity` (one of critical, high, medium, low, info), `dimension` (architecture, duplication, hygiene, security, tests, or docs), `title`, `remediation` (a concrete fix), and `theme` (the systemic theme it belongs to). No fabricated paths, no vague remediations.\n\nStep 2: write `{{workPath}}/codebase-review.md` with `write_artifact`, using these exact section headings:\n\n`## Executive summary` — 3-6 sentences an owner reads first: overall judgment, the finding counts by severity, the top systemic themes, and the single most valuable next action. The tone must match the open severity — never 'excellent health' over an open critical/high.\n`## Scorecard` — a markdown table with columns `Dimension`, `Grade`, `Evidence` grading at least five dimensions (architecture, code quality & duplication, hygiene, security posture, tests) A-F, each grade justified by one line of evidence from your phases.\n`## Index coverage and method` — the readiness snapshot's numbers and caveats, what each phase examined, and the limits of this review.\n`## Systemic themes` — each theme with its root cause and blast radius, ranked. This is the heart of the review.\n`## Findings` — each finding as `### [SEVERITY] title — file:line` with the evidence, the consequence, and the remediation, ordered by severity then blast radius.\n`## Quick wins` — the safe, bounded fixes worth doing this week.\n`## Strategic recommendations` — the sequenced larger work: seams, migration order, and the behavior-preserving tests required first.\n`## Verified sound` — what you checked and found solid, so coverage is auditable.\n`## Not assessed` — what this review did not cover (runtime performance, deployment, anything the index caveats excluded).\n`## Suggested deeper reviews` — which specialist craftbooks to run next (Deep Security Review, Codebase Refactoring Review, Reliability & Resilience Review, Documentation Drift Review) and why, based on what you found.\n\nThe gate re-reads both artifacts: it verifies every cited file exists, every finding is complete, the scorecard table is real, and the themes analyze root cause and blast radius. On a loop-back, fix ONLY the gaps it names without dropping findings that already passed.\n\nBefore working, open the artifact input `{{workPath}}/review/themes.md` with `read_artifact`; do not look for it in the workspace.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review/themes.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/codebase-review.md",
+        "minBytes": 500,
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/codebase-review.md",
+            "bytes": 2500,
+            "artifact": true
+          },
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/codebase-review-findings.json",
+            "bytes": 2,
+            "artifact": true
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkCodebaseReviewReport",
+            "scope": "standard",
+            "inputs": {
+              "file": "{{workPath}}/codebase-review.md",
+              "findings": "{{workPath}}/codebase-review-findings.json"
+            }
+          }
+        ],
+        "onReject": "report",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Grade `{{workPath}}/codebase-review.md` against the standard a paying client would hold a consultant to. Check EACH criterion and write PASS/FAIL with a one-line reason: (1) the executive summary gives a real judgment an owner can act on, consistent with the open severity; (2) the scorecard grades are grounded in the report's own evidence, not vibes; (3) index coverage and its caveats are stated, and 'Not assessed' is honest — a quiet report is never passed off as a clean codebase; (4) every finding was verified in source and cites a real file (critical/high pinned to a line); (5) systemic themes are root-cause clusters with blast radius, not a re-grouped file list; (6) quick wins are genuinely safe and bounded, and strategic recommendations name seams, sequence, and behavior-preserving tests; (7) severities are calibrated — no inflation to look thorough, no deflation to look kind; (8) the suggested deeper reviews follow from what was actually found; (9) no project source was modified. \n\nThe deliverable lives in the project's artifacts drawer — open `{{workPath}}/codebase-review.md` with `read_artifact`, not `read_file`.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"report\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually read like a definitive review). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/codebase-review.md",
+          "artifact": true
+        }
+      ],
+      "next": "report"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: the overall judgment, the finding counts by severity, the top systemic themes, and the deliverable paths (`{{workPath}}/codebase-review.md`, `{{workPath}}/codebase-review-findings.json`, with the phase evidence under `{{workPath}}/review/`). Note that nothing in the workspace was modified. Then report DONE.",
+      "suggestedRole": "reviewer",
+      "terminal": true
+    }
+  ],
+  "version": "1.0.0",
+  "releasedAt": "2026-08-23T00:00:00Z",
+  "minGezelVersion": "1.26235"
+}

package/data/craftbook-templates/co/comprehensive-codebase-review/versions/1.0.0/test.json

@@ -0,0 +1,160 @@
+{
+  "schemaVersion": 1,
+  "title": "Comprehensive Codebase Review multi-dimension eval",
+  "objective": "Measure whether the review verifies planted architecture, duplication, hygiene, and lightweight-security problems in real source, states its index coverage honestly, and delivers a consultant report with a grounded scorecard, systemic themes, and a machine-readable findings file.",
+  "tags": [
+    "corpus"
+  ],
+  "prompt": "Use the Comprehensive Codebase Review craftbook to do a deep, consultant-level review of this codebase and its architecture. Write the report to tasks/eval/codebase-review.md. Do not change source.",
+  "setup": {
+    "projectName": "Comprehensive Review Eval",
+    "about": "A small web service with deliberate problems in several dimensions: duplicated parsing logic, a hardcoded token, debug prints, dead code, and a leaky module boundary.",
+    "missionObjectives": "Verify problems in source across architecture, duplication, hygiene, and security; grade each dimension; separate quick wins from strategic work.",
+    "files": [
+      {
+        "path": "src/routes/orders.ts",
+        "content": "import { db } from '../storage/db';\nexport async function postOrder(req, res) {\n  // TODO: validate\n  // TODO: auth\n  // TODO: rate limit\n  const items = String(req.body.items || '');\n  const parsed = items.split(',').map(s => { const [sku, qty] = s.split(':'); return { sku: sku.trim(), qty: Number(qty || 1) }; });\n  console.log('DEBUG order', parsed);\n  const rows = await db.query(\"INSERT INTO orders (items) VALUES ('\" + items + \"')\");\n  res.json({ ok: true, rows });\n}\n"
+      },
+      {
+        "path": "src/routes/quotes.ts",
+        "content": "export async function postQuote(req, res) {\n  const items = String(req.body.items || '');\n  const parsed = items.split(',').map(s => { const [sku, qty] = s.split(':'); return { sku: sku.trim(), qty: Number(qty || 1) }; });\n  res.json({ quote: parsed.length * 10 });\n}\n"
+      },
+      {
+        "path": "src/storage/db.ts",
+        "content": "import { postOrder } from '../routes/orders';\nexport const API_TOKEN = 'sk-live-9f2a71c04d8e';\nexport const db = { query: async (sql) => { return [{ sql }]; } };\nexport function legacyMigrate() { /* unused since v2 */ return null; }\n"
+      },
+      {
+        "path": "test/quotes.test.ts",
+        "content": "test('quotes', async () => {\n  expect(1 + 1).toBe(2);\n});\n"
+      },
+      {
+        "path": "README.md",
+        "content": "# Order service\nA tiny order and quote service.\n"
+      }
+    ],
+    "worker": {
+      "name": "Rae",
+      "role": "Reviewer"
+    },
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "tasks/eval/codebase-review.md verifies the planted problems with real file citations, grades at least five dimensions, clusters findings into root-cause themes, and ships a machine-readable findings JSON beside it.",
+    "deliverables": [
+      {
+        "path": "tasks/eval/codebase-review.md",
+        "kind": "markdown-report",
+        "artifact": true,
+        "minBytes": 2500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "##\\s+Executive summary[\\s\\S]*##\\s+Scorecard[\\s\\S]*##\\s+Systemic themes[\\s\\S]*##\\s+Findings[\\s\\S]*##\\s+Quick wins",
+            "flags": "i",
+            "label": "consultant report sections",
+            "artifact": true
+          },
+          {
+            "kind": "tableShape",
+            "file": "tasks/eval/codebase-review.md",
+            "requiredColumns": [
+              "Dimension",
+              "Grade"
+            ],
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "src/routes/(orders|quotes)\\.ts",
+            "flags": "i",
+            "label": "duplication evidence cites a real route file",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "API_TOKEN|hard-?coded (secret|token|credential)",
+            "flags": "i",
+            "label": "the planted hardcoded token is found",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "console\\.log|debug (print|logging|output)",
+            "flags": "i",
+            "label": "the planted debug print is found",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "root[\\s-]?cause",
+            "flags": "i",
+            "label": "themes analyze root cause",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review.md",
+            "pattern": "Index coverage",
+            "flags": "i",
+            "label": "index coverage is stated",
+            "artifact": true
+          }
+        ]
+      },
+      {
+        "path": "tasks/eval/codebase-review-findings.json",
+        "kind": "json",
+        "artifact": true,
+        "minBytes": 100,
+        "checks": [
+          {
+            "kind": "sniff",
+            "file": "tasks/eval/codebase-review-findings.json",
+            "sniff": "json-valid",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/codebase-review-findings.json",
+            "pattern": "\"severity\"[\\s\\S]*\"remediation\"",
+            "label": "structured findings with severity and remediation",
+            "artifact": true
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "tasks/eval/codebase-review.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "verification",
+        "description": "Findings cite real files and lines; the duplicated parser, SQL string-building, hardcoded token, debug print, dead export, and storage-imports-routes boundary leak are found rather than invented."
+      },
+      {
+        "name": "synthesis",
+        "description": "Findings cluster into root-cause themes with blast radius; the scorecard grades follow the evidence."
+      },
+      {
+        "name": "actionability",
+        "description": "Quick wins are safe and bounded; strategic recommendations name seams, sequence, and behavior-preserving tests; deeper specialist reviews are suggested where warranted."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "verified findings across dimensions",
+    "honest coverage statement",
+    "consultant-grade prioritization"
+  ]
+}

package/data/craftbook-templates/co/config-scaffold/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "config-scaffold",
   "role": "project-starter",
+  "category": "code-build",
   "name": "Project Config Scaffold",
   "description": "Bootstrap a project's configuration — the tooling, linter, formatter, tsconfig/compiler, scripts, and ignore files — into a coherent, conflict-free baseline that actually works together. Scopes the config surface FIRST — every tool, its config file, the settings, and how they must agree (formatter vs linter, strict compiler) — then writes the config files and scripts, then verifies the toolchain runs clean with no conflicts. Covers linter/formatter config, compiler/tsconfig, package scripts, editorconfig, gitignore, and ensuring tools do not fight each other.",
   "tags": [

package/data/craftbook-templates/co/content-accuracy-review/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "content-accuracy-review",
   "role": "maintenance-review",
+  "category": "research",
   "name": "Content Accuracy Review",
   "description": "Fact-check a piece of content for accuracy and produce a claim-by-claim verification report. First scopes the content and extracts every checkable claim (statistics, dates, quotes, attributions, causal and factual statements) and locks a verification standard, then verifies each claim against authoritative sources rating it true/false/misleading/unverifiable with the supporting evidence, then writes a report flagging every inaccuracy with the correction and source plus an overall trust rating. Use this for a fact-check, accuracy review, content verification, checking claims and statistics, source-checking an article, or vetting content before publishing — it returns a claim-level verdict backed by cited sources rather than a vague 'seems accurate'.",
   "tags": [

package/data/craftbook-templates/co/content-deck/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "content-deck",
   "role": "general",
+  "category": "design",
   "name": "Slide Deck from Content",
   "description": "Turn a body of source content into a presentation deck. Outlines the narrative first, designs a consistent slide look, then builds the deck (HTML slides), evaluating for narrative flow and visual consistency.",
   "tags": [

package/data/craftbook-templates/co/contract-template/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "contract-template",
   "role": "general",
+  "category": "business",
   "name": "Contract Template (Non-Legal-Advice)",
   "description": "Draft a reusable, plain-language agreement template — service agreement, NDA, freelance contract, or terms — with clearly marked fill-in fields, structured numbered clauses, and a prominent non-legal-advice disclaimer. Scopes the parties, obligations, and risk allocation FIRST, drafts clear enforceable-style clauses with placeholders for the variable terms, then has a reviewer check completeness and flag anything that genuinely needs a lawyer. NOT legal advice — every output must say so. Use for templated agreements you will adapt and have counsel review.",
   "tags": [

package/data/craftbook-templates/co/cookbook-layout/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "cookbook-layout",
   "role": "general",
+  "category": "personal",
   "name": "Lay Out the Cookbook",
   "description": "Assemble the heirloom: every tested recipe in its chapter, the provenance kept beside the food — whose recipe it was, what table it came from — chapter intros in the family's voice, print-ready pages. The book that exists because someone finally sat down and made it. Locks the inclusion rule FIRST — tested recipes in, untested listed for the next round, never silently dropped — then lays out the chapters, then proofs every eligible recipe made it in with its story intact. Use for laying out the family cookbook, the heirloom recipe book, 'print the cookbook', and a recipe book for the grandchildren.",
   "tags": [

package/data/craftbook-templates/co/copy-review/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "copy-review",
   "role": "maintenance-review",
+  "category": "writing",
   "name": "Editorial & Tone Review",
   "description": "Run an editorial review on a piece of content for clarity, correctness, and brand voice, then produce a line-edit report and a clean revised version. First scopes the audience, purpose, and voice/style rules and locks an editorial checklist (grammar and spelling, clarity and concision, consistent terminology, active voice, reading level, tone match, scannability, and CTA strength), then reviews the copy line-by-line against those rules marking every issue with a suggested rewrite, then writes a report of categorized edits plus a clean revised draft. Use this for a copy review, editorial pass, proofreading, line edit, tone/voice review, or tightening writing — it returns specific tracked edits with rewrites and a polished final draft rather than 'tighten this up'.",
   "tags": [

package/data/craftbook-templates/co/corpus-email-digest/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "corpus-email-digest",
   "role": "general",
+  "category": "business",
   "name": "Daily Email Digest from a Corpus",
   "description": "Produce an email-ready digest that summarizes a corpus of content (docs, feeds, notes) for a recurring send. Scopes what matters and the format first, drafts the digest in a consistent voice, then builds the email-ready output and evaluates for accuracy and scannability.",
   "tags": [

package/data/craftbook-templates/co/corpus-synthesis/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "corpus-synthesis",
   "role": "general",
+  "category": "research",
   "name": "Corpus Synthesis",
   "description": "Read a provided corpus of documents and synthesize it into a single coherent overview: a planner sets the synthesis question and the extraction schema, a researcher reads every document and extracts structured notes keyed back to each source, and a copywriter synthesizes the extracts into a unified narrative organized by idea rather than by document. The ordering matters because synthesizing before reading everything privileges the first few documents, and a write-up keyed to documents instead of ideas just summarizes each file; locking a synthesis question and per-document extraction first guarantees full coverage and a real cross-document synthesis. Use this for synthesizing a folder of docs/notes/papers, 'pull together everything we know about X', cross-document summaries, knowledge consolidation, and meeting/research-note synthesis.",
   "tags": [

package/data/craftbook-templates/co/cover-letter/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "cover-letter",
   "role": "general",
+  "category": "business",
   "name": "Tailored Cover Letter",
   "description": "Write a tailored, one-page cover letter that maps a candidate's real background to a specific job's requirements: it first scopes the role's key requirements, the company hook, and the 3-4 strongest matching proof points from the applicant's experience, then drafts a focused letter with a specific opening, evidence-backed body paragraphs, and a confident close. Covers cover letter, job application letter, motivation letter, application writing, and personalized cover letter. Scoping the role-to-experience mapping before writing is the point: a small model that picks the strongest evidence for THIS job avoids the generic, one-size-fits-all letter that could be sent anywhere and lists duties instead of proving fit.",
   "tags": [

package/data/craftbook-templates/cr/crm-update-batch/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "crm-update-batch",
   "role": "general",
+  "category": "business",
   "name": "Bulk CRM Update from Notes",
   "description": "Turn unstructured notes (call logs, meeting recaps, email threads) into a batch of structured CRM updates: per-contact field changes, activity logs, and next-step tasks as a validated import file. Scopes the CRM field schema and extraction rules FIRST (which objects/fields, allowed picklist values, the match-or-create key, required fields), then a developer extracts and maps every note into rows against that schema, then a reviewer validates the batch for schema-conformance and that no update mutates a field without evidence in the source. Scoping the schema before extraction is what makes the import load cleanly and prevents fabricated field values. Use for CRM data entry, bulk contact updates, importing notes into Salesforce/HubSpot, activity logging, and turning call notes into pipeline updates.",
   "tags": [

package/data/craftbook-templates/cr/cron-job/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "cron-job",
   "role": "project-starter",
+  "category": "code-ops",
   "name": "Scheduled Batch Job",
   "description": "Build a scheduled batch job that runs on a cadence, processes a unit of work, is safe to re-run, and reports its outcome. Scopes the job FIRST — trigger cadence, the work it does, batch/chunk size, idempotency, failure/partial-failure handling, and observable output — then implements the runnable job, then tests a clean run, an empty run, a partial-failure run, and re-run safety. Covers cron scheduling semantics, batch processing, idempotent reruns, chunking, structured logging, exit codes, and graceful partial-failure handling.",
   "tags": [

package/data/craftbook-templates/cr/crossword-forge/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "crossword-forge",
   "role": "general",
+  "category": "design",
   "name": "Forge a Crossword",
   "description": "Construct a personalized crossword and prove it works before anyone's pencil touches it: the grid actually interlocks, every entry sits in the grid exactly where its number says, every clue is tuned to the solver — and the whole thing ships as a printable page with the solution kept decently out of sight. Locks the theme and the word list FIRST, then constructs the mechanically-verified grid, then renders the printable puzzle. Use for making a crossword, a personalized puzzle for the family, 'a crossword with the grandkids' names in it', and printable puzzle gifts.",
   "tags": [

package/data/craftbook-templates/cs/csv-transformer/manifest.json

@@ -3,6 +3,7 @@
   "kind": "craftbook-template",
   "id": "csv-transformer",
   "role": "general",
+  "category": "code-data",
   "name": "CSV / Tabular Transformer",
   "description": "Reshape and convert tabular data from one schema to another: rename and reorder columns, split or merge fields, derive new columns, pivot/unpivot, change format (CSV<->JSON<->TSV), and filter rows. Locks the input and target schema and the field-by-field mapping FIRST (so the transform is a contract, not guesswork), then builds the transform and emits the output, then verifies row counts and a sample mapping. Use this for reshaping a CSV, converting data formats, remapping columns, flattening JSON to a table, or reformatting an export for another tool.",
   "tags": [