@bendyline/gilde 0.1.50 → 0.1.52

package/data/craftbook-templates/se/security-architecture-review/versions/2.0.5/test.json

@@ -0,0 +1,157 @@
+{
+  "schemaVersion": 1,
+  "title": "Security Architecture Review — admin export surface",
+  "objective": "Exercise the Security Architecture Review craftbook against a self-contained service slice and require a prioritized, evidence-linked report that includes both confirmed vulnerabilities and working controls.",
+  "tags": [
+    "workflow",
+    "security",
+    "architecture-review",
+    "typescript"
+  ],
+  "prompt": "Use the Security Architecture Review craftbook to review the seeded service slice. This is report-only: do not modify source files. Model assets, actors, trust boundaries, and data flows; audit authorization, command/SQL construction, secrets handling, and relevant common vulnerability classes. Produce the scope and findings register, then write `tasks/eval/security/security-architecture-review.md`. Every confirmed finding must name severity, confidence, concrete workspace evidence, exploit preconditions, impact, and a specific remediation plus verification. Include working controls and rejected hypotheses. Do not invent CVEs, dependency versions, scans, or tests you did not run, and do not reproduce the example secret value in the report.",
+  "setup": {
+    "projectName": "Admin export security review",
+    "about": "A hermetic source-review fixture. No network or dependency lookup is needed or authorized; conclusions must come from seeded files.",
+    "missionObjectives": "Deliver an actionable risk posture that distinguishes confirmed source defects, positive controls, and unverified areas without changing implementation.",
+    "managedWorkspaceWritePolicy": "deny",
+    "files": [
+      {
+        "path": "docs/architecture.md",
+        "content": "# Service slice\n\nAn authenticated HTTP handler receives an export name and email filter from a browser operated by support staff. The handler calls local process and database adapters. `requireUser` is the shared authentication boundary. Only administrators should reach backup export; ordinary authenticated users may search their own customer records. Deployment injects `SESSION_SECRET` from environment configuration.\n"
+      },
+      {
+        "path": "src/auth.ts",
+        "content": "export interface User { id: string; role: 'member' | 'admin' }\n\nexport function requireUser(value: User | undefined): User {\n  if (!value) throw new Error('unauthorized');\n  return value;\n}\n\nexport function requireAdmin(user: User): void {\n  if (user.role !== 'admin') throw new Error('forbidden');\n}\n"
+      },
+      {
+        "path": "src/admin-export.ts",
+        "content": "import { exec } from 'node:child_process';\nimport type { User } from './auth.js';\nimport { requireAdmin, requireUser } from './auth.js';\n\nexport function exportBackup(currentUser: User | undefined, requestedName: string): void {\n  const user = requireUser(currentUser);\n  requireAdmin(user);\n  exec(`tar -czf backups/${requestedName}.tgz data/`);\n}\n"
+      },
+      {
+        "path": "src/customer-search.ts",
+        "content": "export interface Db { query(sql: string): Promise<unknown[]> }\n\nexport function findCustomerByEmail(db: Db, email: string): Promise<unknown[]> {\n  return db.query(`SELECT id, email FROM customers WHERE email = '${email}'`);\n}\n"
+      },
+      {
+        "path": "src/safe-audit-log.ts",
+        "content": "export interface AuditSink { write(event: { actorId: string; action: string; target: string }): void }\n\nexport function recordExport(sink: AuditSink, actorId: string, target: string): void {\n  sink.write({ actorId, action: 'backup.exported', target });\n}\n"
+      },
+      {
+        "path": "config/example.env",
+        "content": "# Example only; deployment replaces this value\nSESSION_SECRET=local-dev-only-not-a-real-secret\n"
+      }
+    ],
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "The named craftbook produces a source-grounded risk posture with prioritized findings, positive controls, remediation, verification, and terminal task evidence.",
+    "deliverables": [
+      {
+        "path": "tasks/eval/security/security-architecture-review.md",
+        "kind": "security-report",
+        "artifact": true,
+        "minBytes": 1700,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "^#{1,3}\\s+Executive risk posture\\b[\\s\\S]*^#{1,3}\\s+What is working\\b[\\s\\S]*^#{1,3}\\s+Prioritized findings\\b[\\s\\S]*^#{1,3}\\s+Remediation plan\\b[\\s\\S]*^#{1,3}\\s+Verification\\b[\\s\\S]*^#{1,3}\\s+Unverified areas\\b",
+            "flags": "im",
+            "label": "complete security-review structure"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "(command injection|shell injection)[\\s\\S]{0,500}src/admin-export\\.ts[\\s\\S]*(severity)[\\s\\S]*(confidence)",
+            "flags": "is",
+            "label": "command-injection finding with evidence metadata"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "(SQL injection|parameteri[sz]ed quer)[\\s\\S]{0,500}src/customer-search\\.ts",
+            "flags": "is",
+            "label": "SQL-injection finding and remediation"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "(requireUser|requireAdmin)[\\s\\S]{0,300}(working|control|authorization|authentication)[\\s\\S]*(safe-audit-log|audit)",
+            "flags": "is",
+            "label": "positive auth and audit controls"
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "minCitations": 4
+          },
+          {
+            "kind": "notContains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "CVE-\\d{4}-\\d+",
+            "label": "no invented CVEs"
+          },
+          {
+            "kind": "notContains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "local-dev-only-not-a-real-secret",
+            "label": "example secret value is not reproduced"
+          }
+        ]
+      }
+    ],
+    "taskNotes": {
+      "minBytes": 180,
+      "checks": [
+        {
+          "kind": "contains",
+          "file": "task-notes.md",
+          "pattern": "\\bDONE\\b[\\s\\S]*tasks/eval/security/security-architecture-review\\.md[\\s\\S]*(command|SQL)",
+          "flags": "i",
+          "label": "terminal note records report and principal risks"
+        }
+      ],
+      "requireCraftbookTask": true
+    },
+    "taskGraph": {
+      "requireCraftbookTask": true,
+      "requireTerminalStep": true
+    },
+    "unchangedFixtures": [
+      "docs/architecture.md",
+      "src/auth.ts",
+      "src/admin-export.ts",
+      "src/customer-search.ts",
+      "src/safe-audit-log.ts",
+      "config/example.env"
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "tasks/eval/security/security-architecture-review.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "Threat-model coverage",
+        "description": "The report connects assets, actors, trust boundaries, privileges, and data flows to the reviewed attack surface."
+      },
+      {
+        "name": "Finding rigor",
+        "description": "Confirmed findings cite exact source evidence, state preconditions and impact, and calibrate severity and confidence without overclaiming."
+      },
+      {
+        "name": "Remediation utility",
+        "description": "Recommendations are prioritized, source-specific, verifiable, and preserve or strengthen the controls that already work."
+      }
+    ],
+    "contextNote": "No live dependency or dynamic scan is part of this hermetic source-review scenario; the report should say so."
+  },
+  "qualityFocus": [
+    "Both injection paths are found and tied to exact source",
+    "Working authentication, authorization, and audit controls are recognized",
+    "Unverified areas and evidence limits are explicit"
+  ]
+}

package/data/craftbook-templates/se/seo-meta-pack/versions/1.0.2/test.json

@@ -23,9 +23,6 @@
     "worker": {
       "name": "Jules",
       "role": "Developer"
-    },
-    "craftbookParams": {
-      "workPath": "tasks/eval"
     }
   },
   "mocks": [],

package/data/craftbook-templates/se/seo-meta-pack/versions/1.0.3/craftbook.json

@@ -0,0 +1,213 @@
+{
+  "id": "seo-meta-pack",
+  "name": "SEO Metadata Pack",
+  "description": "Generate a complete on-page SEO metadata pack for a set of pages: it first scopes each page's primary keyword and search intent and the length/format rules (title tag, meta description, Open Graph, Twitter card, slug), then writes optimized, unique metadata for every page that respects pixel/character limits and front-loads the keyword, producing a structured JSON file ready to drop into a CMS or templating layer. Covers SEO metadata, meta tags, title tags, meta descriptions, Open Graph tags, social cards, and on-page SEO. Scoping the keyword and limits per page before writing is the point: a small model that fixes the rules first produces unique, limit-respecting tags across the whole set, instead of duplicate titles and descriptions that get truncated in the SERP.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Metadata scope (planner) — lock per-page keyword/intent and the metadata field rules → gated on artifact `{{workPath}}/scope.md` (markdown-notes)\n2. Write the metadata (copywriter) — write unique, limit-respecting metadata for every page → gated on `seo-meta.json` (json)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n",
+  "entryStepId": "scope",
+  "triggers": [
+    "write seo meta tags",
+    "generate meta descriptions",
+    "title tags for pages",
+    "open graph tags",
+    "seo metadata pack"
+  ],
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "scope",
+      "name": "Metadata scope",
+      "description": "lock per-page keyword/intent and the metadata field rules",
+      "prompt": "1) List the pages in scope; for EACH, identify its primary keyword/phrase and search intent in one line. 2) Lock the field schema and limits: title tag (50-60 chars, keyword near front, brand suffix policy), meta description (140-155 chars, includes keyword + a soft CTA), URL slug (lowercase, hyphenated, keyword-based), Open Graph (og:title, og:description, og:type), and Twitter card (card type, title, description). 3) Set the duplicate policy: every title and description must be UNIQUE across pages. Write an acceptance-criteria checklist (e.g. 'every page has all fields'; 'titles 50-60 chars, descriptions 140-155 chars'; 'primary keyword present and front-loaded in title'; 'no duplicate titles or descriptions across pages'; 'slugs are valid kebab-case'; 'OG/Twitter fields populated'). Use write_task_note for the per-page keyword map + field rules + checklist, and write the same to the produces path. No metadata yet.\n\nThe deliverable `{{workPath}}/scope.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "planner",
+      "advanceWhen": {
+        "file": "{{workPath}}/scope.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/scope.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/scope.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "scope",
+        "maxAttempts": 3
+      },
+      "next": "build",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      }
+    },
+    {
+      "id": "build",
+      "name": "Write the metadata",
+      "description": "write unique, limit-respecting metadata for every page",
+      "prompt": "Write the metadata for EVERY page in scope to the locked schema. 1) For each page: a title tag (50-60 chars, primary keyword front-loaded, brand suffix per policy), a meta description (140-155 chars with the keyword and a soft CTA), a kebab-case slug, and the Open Graph + Twitter card fields. 2) Count characters for title and description and stay within range — do not exceed limits or they truncate in the SERP. 3) Ensure NO title and NO description is duplicated across pages. 4) Make each compelling and accurate to the page, not keyword-stuffed. 5) Output a single valid JSON array, one object per page: {\"page\", \"title\", \"titleChars\", \"metaDescription\", \"descChars\", \"slug\", \"og\": {\"title\",\"description\",\"type\"}, \"twitter\": {\"card\",\"title\",\"description\"}}. Save to the produces path and note the page count.",
+      "suggestedRole": "copywriter",
+      "advanceWhen": {
+        "file": "seo-meta.json",
+        "minBytes": 1,
+        "sniff": "json-valid"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "seo-meta.json",
+            "bytes": 2
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkJsonValid",
+            "scope": "standard",
+            "inputs": {
+              "file": "seo-meta.json"
+            }
+          }
+        ],
+        "onReject": "build",
+        "maxAttempts": 4
+      },
+      "next": "evaluate",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web"
+        ],
+        "outputMedium": "workspace"
+      }
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Parse seo-meta.json (must be valid JSON) and grade against the checklist. Check EACH criterion and write PASS/FAIL: (a) every page in scope has an object with all fields populated; (b) titles are 50-60 chars and descriptions 140-155 chars (verify the char counts); (c) the primary keyword is present and front-loaded in each title; (d) no duplicate titles or descriptions across pages; (e) slugs are valid lowercase kebab-case; (f) OG and Twitter fields are populated. A pack with truncated, duplicate, or missing metadata FAILS — loop back to build and name the offending pages.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"build\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "seo-meta.json"
+        }
+      ],
+      "next": "build",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      }
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "terminal": true,
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      }
+    }
+  ],
+  "version": "1.0.3",
+  "releasedAt": "2026-09-01T20:00:00Z",
+  "minGezelVersion": "1.26233"
+}

package/data/craftbook-templates/se/seo-meta-pack/versions/1.0.3/test.json

@@ -0,0 +1,97 @@
+{
+  "schemaVersion": 1,
+  "title": "SEO Metadata Pack smoke eval",
+  "objective": "Self-contained smoke eval for the SEO Metadata Pack craftbook using the html-page generic harness.",
+  "tags": [
+    "html-page"
+  ],
+  "prompt": "Can you biuld us a little page for this? The content notes are in source/page-content.md. Save it as index.html — one file, nothing fancy needed on our end.",
+  "setup": {
+    "projectName": "SEO Metadata Pack Eval",
+    "about": "Self-contained eval project for seo-meta-pack. Seeded inputs are under workspace/source or workspace/fixtures; final deliverable is workspace/index.html.",
+    "missionObjectives": "Use the SEO Metadata Pack craftbook/template, read the seeded local fixtures, and write index.html without network calls, real credentials, or live services.",
+    "files": [
+      {
+        "path": "source/brief.md",
+        "content": "# SEO Metadata Pack Eval Brief\n\nClient: Boreal Desk, a home-office accessories company.\nAudience: operations leads who need an artifact they can use this week.\n\nFixed source facts for grounding:\n- The returns desk pilot covered 18 SKUs.\n- Median first response improved from 18 hours to 6 hours.\n- Preventable refund leakage fell from 14.2% to 8.9%.\n- The top unresolved complaint is status silence after photo submission.\n- Required next actions are automated status emails, barcode-exception training, and a weekly Finance exception export.\n\nUse these facts when the task asks for prose, analysis, copy, UI content, or test data. Do not use live web services, real credentials, or current outside data.\n\nCraftbook under test: seo-meta-pack - SEO Metadata Pack.\n"
+      },
+      {
+        "path": "source/page-content.md",
+        "content": "# Boreal Desk Support Board\n\nBuild content around a support operations board. Required labels: Open issues, Status silence, Response time, Refund leakage, Next action. Required metric text: 18 hours to 6 hours and 14.2% to 8.9%.\n"
+      }
+    ],
+    "worker": {
+      "name": "Jules",
+      "role": "Developer"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "index.html is a source-grounded self-contained HTML page/tool.",
+    "deliverables": [
+      {
+        "path": "index.html",
+        "kind": "html-page",
+        "minBytes": 3000,
+        "checks": [
+          {
+            "kind": "cssMinBytes",
+            "bytes": 650,
+            "file": "index.html"
+          },
+          {
+            "kind": "jsParses",
+            "file": "index.html"
+          },
+          {
+            "kind": "contains",
+            "file": "index.html",
+            "pattern": "Boreal|Support Board|returns",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "index.html",
+            "pattern": "18\\s*hours|6\\s*hours|14\\.2%|8\\.9%",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "index.html",
+            "pattern": "button|input|filter|tab|card|section|nav",
+            "flags": "i"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "index.html",
+      "kind": "html"
+    },
+    "axes": [
+      {
+        "name": "structure",
+        "description": "Layout and hierarchy fit the content; sections are scannable and coherent."
+      },
+      {
+        "name": "grounding",
+        "description": "Seeded source content is used faithfully — no invented facts or dropped requirements."
+      },
+      {
+        "name": "interactivity",
+        "description": "Controls and states the page claims to offer actually work."
+      },
+      {
+        "name": "polish",
+        "description": "Styling is intentional and responsive rather than unstyled or broken."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "self-contained UI",
+    "source grounding",
+    "responsive structure"
+  ]
+}