@bendyline/gilde 0.1.40 → 0.1.41

package/data/craftbook-templates/ci/ci-pipeline/versions/2.0.0/craftbook.json

@@ -0,0 +1,423 @@
+{
+  "id": "ci-pipeline",
+  "name": "CI Pipeline from Scratch",
+  "description": "Set up continuous integration the way it survives contact with a real repo: every stage grounded in a command that actually exists, and no claim that local reading cannot back. First INVENTORY: read package.json and the repo layout, record the scripts that genuinely exist with their exact lines quoted, and decide the stages — install, lint, typecheck, test, build, whichever subset is real here — plus caching keyed to the lockfile and the triggers the work calls for. The cardinal sin this book exists to prevent is the invented command: a `run:` line calling a script the repo does not have turns the whole pipeline red on its first push, so nothing enters the plan without a quoted manifest line behind it. A release or publish stage is planned only when the repo shows one — publish config, a release script, a tag convention — and when present it is gated behind the green test/build stages and the tag trigger so publishing can never run before the checks pass. Then AUTHOR the real workflow file(s) at the conventional location for the detected host (`.github/workflows/ci.yml` for GitHub Actions by default): minimal, cached, actions pinned to major versions, gating merges on green, with no fabricated secrets or inputs. Then VERIFY by reading the workflow back and matching EVERY command it invokes to the quoted manifest line that provides it — and by being plain that CI cannot be executed locally, so the notes must say what reading verified and what only a live run on the host can prove. Finally an independent reviewer checks the same ground truth — commands exist, stages ordered, triggers match, nothing invented — and a REVISE verdict routes the work back automatically with concrete findings. Works identically whether the run edits the project directly or drafts a change proposal for the user to apply.",
+  "plan": "Inventory the repo's real commands and decide the stages -> author the workflow at the conventional location, cached and merge-gating -> verify every invoked command against the manifests, honest about what only a live CI run can prove -> enforced independent review.",
+  "entryStepId": "inventory",
+  "triggers": [
+    "set up ci",
+    "create a ci pipeline",
+    "github actions workflow",
+    "build a ci/cd pipeline",
+    "add automated testing on push",
+    "set up a release pipeline",
+    "ci/cd for releases",
+    "publish on tag workflow",
+    "github actions release",
+    "automate the release"
+  ],
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "inventory",
+      "name": "Inventory the repo",
+      "description": "Read the real scripts and layout, then plan stages, caching, and triggers — never a command that does not exist.",
+      "prompt": "Learn what this repo actually needs before writing a line of YAML. Read `package.json` (and any workspace manifests) with `read_file` and record the scripts that genuinely exist — their exact names and the exact lines. Read the repo layout with `list_dir`: the lockfile (which package manager), the language, build outputs, and any existing workflow files. NEVER invent a command: a stage enters your plan only when a matching script or standard invocation exists in the repo — install, lint, typecheck, test, build, in whatever subset is real here, and nothing for tools the repo does not use. Decide caching from the lockfile and package manager, and the triggers the task calls for (typically pushes to the default branch and pull requests). Plan a release or publish stage ONLY when the repo shows one — a publish configuration, a release script, an existing tag convention; when nothing shows one, say so and leave it out. Note the CI host the repo points at (existing workflow files, hosting hints); default to GitHub Actions when nothing says otherwise.\n\nWrite `{{workPath}}/ci-plan.md` with exactly these sections: `## Detected commands` (each script name with the exact line quoted from `package.json`), `## Pipeline stages` (the stages in order and why each exists here), `## Caching` (what is cached and what it is keyed on), `## Triggers` (the events and why). Cite the real files with backtick paths.\n\nObservable handoff: write the completed result to `{{workPath}}/ci-plan.md` in the project's artifacts drawer with `write_artifact`. Do not merely describe what the file would contain. Re-read it with `read_artifact` before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "devops engineer",
+      "capabilityFloor": "small",
+      "advanceWhen": {
+        "file": "{{workPath}}/ci-plan.md",
+        "minBytes": 500,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "artifact": true,
+        "goto": "author"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/ci-plan.md",
+            "bytes": 500,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/ci-plan.md",
+            "sniff": "nonempty",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/ci-plan.md",
+            "pattern": "^##\\s+Detected commands",
+            "flags": "im",
+            "label": "Detected commands section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/ci-plan.md",
+            "pattern": "^##\\s+Pipeline stages",
+            "flags": "im",
+            "label": "Pipeline stages section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/ci-plan.md",
+            "pattern": "^##\\s+Caching",
+            "flags": "im",
+            "label": "Caching section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/ci-plan.md",
+            "pattern": "^##\\s+Triggers",
+            "flags": "im",
+            "label": "Triggers section",
+            "artifact": true
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "{{workPath}}/ci-plan.md",
+            "minCitations": 2,
+            "artifact": true
+          }
+        ],
+        "onReject": "inventory",
+        "maxAttempts": 4
+      },
+      "next": "author"
+    },
+    {
+      "id": "author",
+      "name": "Author the workflow",
+      "description": "Write the real workflow file(s) at the conventional location — minimal, cached, pinned, gating merges on green.",
+      "prompt": "Read `{{workPath}}/ci-plan.md` and write the REAL workflow file(s) with `write_file` at the conventional location for the detected host — for GitHub Actions, `.github/workflows/ci.yml` unless the repo already has its own convention. Keep it minimal and fast: the planned stages in order, dependency caching wired to the lockfile, and the workflow triggering on the planned pushes and pull requests so merges gate on green. Pin every action to a major version (for example `actions/checkout@v4`); do not invent action names, inputs, or secrets. Every `run:` line must invoke a command the plan detected — nothing else. Add a release or publish job ONLY if ci-plan.md called for one, and gate it behind the green build/test stages and the tag trigger so a publish can never run before the checks pass; if the plan named no release stage, do not add one.\n\nThen write `{{workPath}}/ci-notes.md` with exactly these sections: `## Files written` (the real path of every workflow file, backtick path per line), `## Stages` (each job and step, and the detected command it runs), `## Choices explained` (caching, triggers, pinning, and anything you deliberately left out — including a release job when the repo showed no evidence for one). Before working, open `{{workPath}}/ci-plan.md` with `read_artifact`.\n\nObservable handoff: write the completed result to `{{workPath}}/ci-notes.md` in the project's artifacts drawer with `write_artifact`. Do not merely describe what the file would contain. Re-read it with `read_artifact` before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "devops engineer",
+      "capabilityFloor": "small",
+      "consumes": [
+        {
+          "file": "{{workPath}}/ci-plan.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/ci-notes.md",
+        "minBytes": 500,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "artifact": true,
+        "goto": "verify"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/ci-notes.md",
+            "bytes": 500,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/ci-notes.md",
+            "sniff": "nonempty",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/ci-notes.md",
+            "pattern": "^##\\s+Files written",
+            "flags": "im",
+            "label": "Files written section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/ci-notes.md",
+            "pattern": "^##\\s+Stages",
+            "flags": "im",
+            "label": "Stages section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/ci-notes.md",
+            "pattern": "^##\\s+Choices explained",
+            "flags": "im",
+            "label": "Choices explained section",
+            "artifact": true
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "{{workPath}}/ci-notes.md",
+            "minCitations": 2,
+            "artifact": true
+          }
+        ],
+        "onReject": "author",
+        "maxAttempts": 4
+      },
+      "next": "verify"
+    },
+    {
+      "id": "verify",
+      "name": "Verify against the manifests",
+      "description": "Read the workflow back and match every invoked command to the manifest line that provides it; honest about what only a live run proves.",
+      "prompt": "Verify the workflow the only honest way available without a CI run: read it back and check every claim against the repo. Open each workflow file named in `{{workPath}}/ci-notes.md` with `read_file`, and for EVERY command it invokes, find and quote the `package.json` line (or manifest entry) that provides it — a `run:` line with no matching script is a defect: fix it now at the workflow's real site, not in prose. Confirm the triggers match `{{workPath}}/ci-plan.md`. Confirm every action reference is pinned to a major version, and every secret the workflow references is a standard one (`GITHUB_TOKEN`) or one the user explicitly named — an invented secret is a defect. Be plain about the limit of this verification: CI cannot be executed locally, so state what reading verified and what only a real run on the host can prove — never claim the pipeline ran.\n\nWrite `{{workPath}}/verification.md` with exactly these sections: `## Workflow files` (each file checked, backtick paths), `## Commands verified against package.json` (each workflow command with the quoted manifest line that provides it), `## Result` (what reading verified, what only a live CI run can prove, and any defects found and fixed). Before working, open `{{workPath}}/ci-plan.md`, `{{workPath}}/ci-notes.md` with `read_artifact`.\n\nObservable handoff: write the completed result to `{{workPath}}/verification.md` in the project's artifacts drawer with `write_artifact`. Do not merely describe what the file would contain. Re-read it with `read_artifact` before finishing this phase and repair any incomplete sections.",
+      "suggestedRole": "devops engineer",
+      "capabilityFloor": "small",
+      "consumes": [
+        {
+          "file": "{{workPath}}/ci-plan.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/ci-notes.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/verification.md",
+        "minBytes": 500,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "artifact": true,
+        "goto": "evaluate"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/verification.md",
+            "bytes": 500,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/verification.md",
+            "sniff": "nonempty",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/verification.md",
+            "pattern": "^##\\s+Workflow files",
+            "flags": "im",
+            "label": "Workflow files section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/verification.md",
+            "pattern": "^##\\s+Commands verified against package\\.json",
+            "flags": "im",
+            "label": "Commands verified section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/verification.md",
+            "pattern": "^##\\s+Result",
+            "flags": "im",
+            "label": "Result section",
+            "artifact": true
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "{{workPath}}/verification.md",
+            "minCitations": 2,
+            "artifact": true
+          }
+        ],
+        "onReject": "verify",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate the deliverable",
+      "description": "Independently grade the observable deliverable and route it to finish, repair, or user escalation.",
+      "prompt": "Review `{{workPath}}/verification.md`, `{{workPath}}/ci-plan.md`, `{{workPath}}/ci-notes.md` against every criterion below. Inspect the underlying evidence files named by the workflow; do not grade from the author's summary alone.\n\n1. Every command the workflow invokes exists in the repo — open package.json (and any other manifests) and check each run: line yourself; a script the repo does not have fails this criterion.\n2. The stages are ordered sensibly (dependencies installed before lint/test/build) and dependency caching is wired to the real lockfile.\n3. The triggers match ci-plan.md, and a release or publish job exists only where the plan showed repo evidence for one — gated behind the green stages and the tag trigger when present.\n4. Nothing is invented: every action is pinned to a major version, no fabricated action inputs, and no secrets beyond standard ones or those the user explicitly named.\n5. verification.md is honest about the limit of local verification — what reading proved versus what only a live CI run can prove — and the accounts reconcile across ci-plan.md, ci-notes.md, and verification.md.\n\nOpen `{{workPath}}/verification.md`, `{{workPath}}/ci-plan.md`, `{{workPath}}/ci-notes.md` with `read_artifact`. Write the evidence-backed review to `{{workPath}}/review.md` in the artifacts drawer with `write_artifact`.\n\nList the findings as a markdown table with columns `| Severity | File | Line | Problem | Fix |` (severities: critical/major/minor/nit; empty table only on PASS). Give each criterion a PASS or FAIL with a concrete path, excerpt, measurement, or observed behavior. End with exactly `Verdict: PASS` or `Verdict: REVISE`. The gate ENFORCES the verdict: a well-formed REVISE is rejected and routed back to `repair` automatically, carrying your findings — so list every finding in the table with a concrete fix. On PASS, `advance_task_step` to `finish`. Never write PASS while a criterion is unmet.",
+      "suggestedRole": "devops reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/verification.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/ci-plan.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/ci-notes.md",
+          "artifact": true
+        }
+      ],
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review.md",
+            "bytes": 400,
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/review.md",
+            "pattern": "Verdict:\\s*(?:PASS|REVISE)",
+            "flags": "i",
+            "label": "explicit PASS or REVISE verdict",
+            "artifact": true
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkFixReview",
+            "scope": "standard",
+            "inputs": {
+              "reviewPath": "{{workPath}}/review.md",
+              "fixStepId": "repair"
+            }
+          }
+        ],
+        "onReject": "evaluate",
+        "maxAttempts": 4
+      },
+      "next": "finish"
+    },
+    {
+      "id": "repair",
+      "name": "Repair the deliverable",
+      "description": "Fix only the concrete gaps from the latest independent review.",
+      "prompt": "Read `{{workPath}}/review.md` with `read_artifact` and repair every failed criterion in `{{workPath}}/verification.md`, `{{workPath}}/ci-plan.md`, `{{workPath}}/ci-notes.md`. Make changes on each file's declared surface (`write_artifact` for artifact inputs, `write_file` for workspace inputs), not in task notes or a reply. Preserve evidence that already passed. Re-run or re-check anything the reviewer found unproven. Ensure `{{workPath}}/verification.md` is genuinely updated this turn so the repair is observable, then hand it back for independent evaluation.",
+      "suggestedRole": "devops engineer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/verification.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/ci-plan.md",
+          "artifact": true
+        },
+        {
+          "file": "{{workPath}}/ci-notes.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/verification.md",
+        "minBytes": 500,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "artifact": true,
+        "goto": "evaluate"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/verification.md",
+            "bytes": 500,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/verification.md",
+            "sniff": "nonempty",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/verification.md",
+            "pattern": "^##\\s+Workflow files",
+            "flags": "im",
+            "label": "Workflow files section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/verification.md",
+            "pattern": "^##\\s+Commands verified against package\\.json",
+            "flags": "im",
+            "label": "Commands verified section",
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/verification.md",
+            "pattern": "^##\\s+Result",
+            "flags": "im",
+            "label": "Result section",
+            "artifact": true
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "{{workPath}}/verification.md",
+            "minCitations": 2,
+            "artifact": true
+          }
+        ],
+        "onReject": "repair",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All deterministic and reviewer criteria passed.",
+      "prompt": "The independent review passed. Read `{{workPath}}/review.md` with `read_artifact`, then use `write_task_note` to record a concise DONE summary with the final deliverable paths (`{{workPath}}/verification.md`, `{{workPath}}/ci-plan.md`, `{{workPath}}/ci-notes.md`) and the evidence that each acceptance criterion passed. Report DONE without starting new work.",
+      "suggestedRole": "project lead",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review.md",
+          "artifact": true
+        }
+      ],
+      "terminal": true
+    },
+    {
+      "id": "needs-user",
+      "name": "Escalate unresolved concerns",
+      "description": "The bounded repair loop ended without a defensible pass.",
+      "prompt": "The deliverable did not pass after 3 review rounds. Do not claim success. Read `{{workPath}}/review.md` with `read_artifact`, then use `write_task_note` to record DONE_WITH_CONCERNS: the unmet criteria, what was attempted, the affected paths, and the smallest user decision or missing input needed to continue.",
+      "suggestedRole": "project lead",
+      "consumes": [
+        {
+          "file": "{{workPath}}/review.md",
+          "artifact": true
+        }
+      ],
+      "terminal": true
+    }
+  ],
+  "diffpackCapable": true,
+  "capabilityFloor": "small",
+  "version": "2.0.0",
+  "releasedAt": "2026-08-24T00:00:00.000Z",
+  "minGezelVersion": "1.26236"
+}

package/data/craftbook-templates/ci/ci-pipeline/versions/2.0.0/test.json

@@ -0,0 +1,228 @@
+{
+  "schemaVersion": 1,
+  "title": "CI pipeline grounded in real scripts",
+  "objective": "The craftbook authors a CI workflow for a repo that has exactly two scripts (test and lint) and no typecheck. The oracle verifies a real workflow exists under .github/workflows/, runs both real scripts with checkout and node setup pinned to major versions, triggers on push and pull_request, and invents nothing — no typecheck stage, no publish job, no fabricated secrets.",
+  "tags": [
+    "code",
+    "ci",
+    "devops",
+    "tactical-fleet"
+  ],
+  "prompt": "Use the CI Pipeline from Scratch craftbook: this repo has no CI at all. Set up a pipeline that runs on every push and pull request using what the repo already has — do not add stages for tools the repo does not use. Standard GitHub Actions layout.",
+  "setup": {
+    "projectName": "Relay Notes",
+    "about": "A small Node library with two package scripts: `npm run test` (node --test) and `npm run lint` (a repo-local lint script). No typecheck, no build step, no publish configuration.",
+    "files": [
+      {
+        "path": "package.json",
+        "content": "{\n  \"name\": \"relay-notes\",\n  \"private\": true,\n  \"version\": \"1.0.0\",\n  \"type\": \"module\",\n  \"scripts\": {\n    \"test\": \"node --test\",\n    \"lint\": \"node tools/lint.mjs\"\n  }\n}\n"
+      },
+      {
+        "path": "package-lock.json",
+        "content": "{\n  \"name\": \"relay-notes\",\n  \"version\": \"1.0.0\",\n  \"lockfileVersion\": 3,\n  \"requires\": true,\n  \"packages\": {\n    \"\": {\n      \"name\": \"relay-notes\",\n      \"version\": \"1.0.0\"\n    }\n  }\n}\n"
+      },
+      {
+        "path": "src/greet.js",
+        "content": "export function greet(name) {\n  const label = String(name ?? '').trim();\n  if (label === '') return 'Hello there!';\n  return `Hello, ${label}!`;\n}\n"
+      },
+      {
+        "path": "tools/lint.mjs",
+        "content": "import { readFileSync, readdirSync } from 'node:fs';\n\nlet problems = 0;\nfor (const file of readdirSync('src')) {\n  if (!file.endsWith('.js')) continue;\n  const text = readFileSync(`src/${file}`, 'utf8');\n  if (/\\t/.test(text)) {\n    console.error(`lint: tab indentation in src/${file}`);\n    problems++;\n  }\n}\nif (problems > 0) process.exit(1);\nconsole.log('lint ok');\n"
+      },
+      {
+        "path": "tests/greet.test.mjs",
+        "content": "import assert from 'node:assert/strict';\nimport { test } from 'node:test';\nimport { greet } from '../src/greet.js';\n\ntest('greets a trimmed name', () => {\n  assert.equal(greet('  Mira '), 'Hello, Mira!');\n});\n\ntest('falls back for an empty name', () => {\n  assert.equal(greet(''), 'Hello there!');\n});\n"
+      },
+      {
+        "path": "tests/verify-ci.mjs",
+        "content": "import assert from 'node:assert/strict';\nimport { readFileSync, readdirSync } from 'node:fs';\nimport { join } from 'node:path';\n\nconst dir = '.github/workflows';\nlet names = [];\ntry {\n  names = readdirSync(dir).filter((f) => /\\.ya?ml$/i.test(f));\n} catch {}\nassert.ok(names.length >= 1, 'no workflow file exists under .github/workflows/');\nconst raw = names.map((f) => readFileSync(join(dir, f), 'utf8')).join('\\n---\\n');\n// Judge only active YAML: a comment honestly noting \"no typecheck script\"\n// must never trip the anti-invention assertions below.\nconst all = raw.replace(/#[^\\n]*/g, '');\nconsole.log('CIPIPE_ORACLE workflow found');\n\n// Checkout and Node setup, pinned to major versions.\nassert.ok(/actions\\/checkout@v\\d+/.test(all), 'uses actions/checkout pinned to a major version');\nassert.ok(/actions\\/setup-node@v\\d+/.test(all), 'uses actions/setup-node pinned to a major version');\nconsole.log('CIPIPE_ORACLE actions ok');\n\n// Runs both real scripts.\nassert.ok(/\\bnpm\\s+(?:run\\s+)?test\\b/.test(all), 'the workflow runs the test script');\nassert.ok(/\\bnpm\\s+run\\s+lint\\b/.test(all), 'the workflow runs the lint script');\nconsole.log('CIPIPE_ORACLE scripts ok');\n\n// Invokes nothing the repo does not have.\nassert.ok(!/typecheck/i.test(all), 'no invented typecheck stage - the repo has no such script');\nconst pkg = JSON.parse(readFileSync('package.json', 'utf8'));\nfor (const m of all.matchAll(/npm\\s+run\\s+([A-Za-z0-9:_-]+)/g)) {\n  if (m[1].startsWith('-')) continue;\n  assert.ok(pkg.scripts && pkg.scripts[m[1]], `workflow invokes \"npm run ${m[1]}\" but package.json has no such script`);\n}\nconsole.log('CIPIPE_ORACLE no invented commands');\n\n// Triggers on push and pull_request.\nassert.ok(/\\bpush\\b/.test(all), 'triggers on push');\nassert.ok(/\\bpull_request\\b/.test(all), 'triggers on pull_request');\nconsole.log('CIPIPE_ORACLE triggers ok');\n\n// No invented secrets, and no publish job in a repo with no release evidence.\nfor (const m of all.matchAll(/secrets\\.([A-Za-z0-9_]+)/g)) {\n  assert.equal(m[1], 'GITHUB_TOKEN', `workflow references invented secret \"${m[1]}\"`);\n}\nassert.ok(!/npm\\s+publish/.test(all), 'no publish step - the repo shows no release configuration');\nconsole.log('CIPIPE_ORACLE nothing invented');\nconsole.log('CIPIPE_ORACLE done');\n",
+        "surface": "harness"
+      }
+    ],
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "A real GitHub Actions workflow exists at the conventional location, runs exactly the repo's two scripts on push and pull_request with pinned actions, invents no command, secret, or publish job — and every fleet artifact exists with the workflow commands verified against quoted package.json lines.",
+    "deliverables": [
+      {
+        "path": "tasks/eval/ci-plan.md",
+        "kind": "markdown-notes",
+        "artifact": true,
+        "minBytes": 500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/ci-plan.md",
+            "pattern": "^##\\s+Detected commands[\\s\\S]*^##\\s+Pipeline stages[\\s\\S]*^##\\s+Caching[\\s\\S]*^##\\s+Triggers",
+            "flags": "im",
+            "label": "ci-plan sections in order"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/ci-plan.md",
+            "pattern": "package\\.json",
+            "label": "the plan reads the real manifest"
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "tasks/eval/ci-plan.md",
+            "minCitations": 2,
+            "artifact": true
+          }
+        ]
+      },
+      {
+        "path": "tasks/eval/ci-notes.md",
+        "kind": "markdown-notes",
+        "artifact": true,
+        "minBytes": 500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/ci-notes.md",
+            "pattern": "^##\\s+Files written[\\s\\S]*^##\\s+Stages[\\s\\S]*^##\\s+Choices explained",
+            "flags": "im",
+            "label": "ci-notes sections in order"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/ci-notes.md",
+            "pattern": "\\.github/workflows/",
+            "label": "names the conventional workflow location"
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "tasks/eval/ci-notes.md",
+            "minCitations": 2,
+            "artifact": true
+          }
+        ]
+      },
+      {
+        "path": "tasks/eval/verification.md",
+        "kind": "markdown-notes",
+        "artifact": true,
+        "minBytes": 500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/verification.md",
+            "pattern": "^##\\s+Workflow files[\\s\\S]*^##\\s+Commands verified against package\\.json[\\s\\S]*^##\\s+Result",
+            "flags": "im",
+            "label": "verification sections in order"
+          }
+        ]
+      },
+      {
+        "path": "tasks/eval/review.md",
+        "kind": "markdown-report",
+        "artifact": true,
+        "minBytes": 400,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/review.md",
+            "pattern": "Verdict:\\s*(?:PASS|REVISE)",
+            "flags": "i",
+            "label": "explicit reviewer verdict"
+          }
+        ]
+      }
+    ],
+    "checks": [
+      {
+        "kind": "nodeRuns",
+        "file": "tests/greet.test.mjs"
+      },
+      {
+        "kind": "nodeScriptPasses",
+        "script": "tools/lint.mjs",
+        "timeoutMs": 30000,
+        "requiredOutput": [
+          {
+            "pattern": "lint ok",
+            "label": "the repo lint still passes"
+          }
+        ]
+      },
+      {
+        "kind": "nodeScriptPasses",
+        "script": "tests/verify-ci.mjs",
+        "timeoutMs": 60000,
+        "requiredOutput": [
+          {
+            "pattern": "CIPIPE_ORACLE workflow found",
+            "label": "a workflow exists at the conventional location"
+          },
+          {
+            "pattern": "CIPIPE_ORACLE scripts ok",
+            "label": "both real scripts run in CI"
+          },
+          {
+            "pattern": "CIPIPE_ORACLE no invented commands",
+            "label": "no command invented beyond package.json"
+          },
+          {
+            "pattern": "CIPIPE_ORACLE triggers ok",
+            "label": "triggers on push and pull_request"
+          },
+          {
+            "pattern": "CIPIPE_ORACLE nothing invented",
+            "label": "no fabricated secrets or publish job"
+          }
+        ]
+      }
+    ],
+    "taskNotes": {
+      "minBytes": 120,
+      "checks": [
+        {
+          "kind": "contains",
+          "file": "task-notes.md",
+          "pattern": "\\bDONE\\b[\\s\\S]*(workflows|ci\\.yml|verification\\.md)",
+          "flags": "i",
+          "label": "DONE note names the workflow deliverable"
+        }
+      ]
+    },
+    "taskGraph": {
+      "requireCraftbookTask": true,
+      "requireTerminalStep": true
+    },
+    "unchangedFixtures": [
+      "package.json",
+      "package-lock.json",
+      "src/greet.js",
+      "tools/lint.mjs",
+      "tests/greet.test.mjs"
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "tasks/eval/ci-notes.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "Grounded inventory",
+        "description": "Every planned stage maps to a script that exists in package.json, quoted verbatim; no typecheck, build, or publish stage was invented for this repo."
+      },
+      {
+        "name": "Workflow quality",
+        "description": "The workflow sits at the conventional location, pins actions to major versions, orders install before lint and test, wires dependency caching, and triggers on push and pull_request."
+      },
+      {
+        "name": "Verification honesty",
+        "description": "The verify pass matched each workflow command to a quoted manifest line and is plain about what only a live CI run on the host can prove."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "no invented commands or secrets",
+    "manifest-quoted verification",
+    "enforced review loop"
+  ]
+}