@bendyline/gilde 0.1.51 → 0.1.52

package/data/craftbook-templates/de/deep-security-review/versions/1.1.3/test.json

@@ -0,0 +1,184 @@
+{
+  "schemaVersion": 1,
+  "title": "Deep Security Review systemic eval",
+  "objective": "Measure whether the review confirms seeded source-to-sink vulnerabilities, identifies systemic root causes, and emits valid machine-readable findings.",
+  "tags": [
+    "corpus"
+  ],
+  "prompt": "Use the Deep Security Review craftbook for a whole-codebase security sweep. The fixture is offline and self-contained. Write security-review/REPORT.md and security-review/findings.json; do not modify source.",
+  "setup": {
+    "projectName": "Security Maintenance Eval",
+    "about": "A tiny admin service with deliberate command injection, SQL injection, and inconsistent authorization.",
+    "missionObjectives": "Confirm real source-to-sink paths, cluster root causes, and leave report plus structured findings without inventing files or advisories.",
+    "files": [
+      {
+        "path": "src/admin.ts",
+        "content": "import { exec } from 'node:child_process';\nexport function register(app, db) {\n  app.get('/admin/export', (req, res) => {\n    exec('zip -r /tmp/' + req.query.name + '.zip data', (_e, out) => res.send(out));\n  });\n  app.get('/admin/users', async (req, res) => {\n    const rows = await db.query(`SELECT * FROM users WHERE team = '${req.query.team}'`);\n    res.json(rows);\n  });\n}\n"
+      },
+      {
+        "path": "src/profile.ts",
+        "content": "export function registerProfile(app, db, requireUser) {\n  app.get('/profile', requireUser, async (req, res) => {\n    const row = await db.query('SELECT * FROM users WHERE id = ?', [req.user.id]);\n    res.json(row);\n  });\n}\n"
+      },
+      {
+        "path": "src/reports.ts",
+        "content": "import { exec } from 'node:child_process';\n\nconst ALLOWED_SORTS = { name: 'name', created: 'created_at', team: 'team' };\n\nexport function registerReports(app, db, requireUser) {\n  app.get('/health', (_req, res) => res.json({ ok: true }));\n\n  app.get('/reports/rotate', requireUser, (_req, res) => {\n    exec('logrotate -f /etc/logrotate.conf', (_e, out) => res.send(out));\n  });\n\n  app.get('/reports/users', requireUser, async (req, res) => {\n    const column = ALLOWED_SORTS[req.query.sort] ?? 'name';\n    const rows = await db.query(`SELECT id, name FROM users ORDER BY ${column}`);\n    res.json(rows);\n  });\n}\n"
+      },
+      {
+        "path": "docs/security.md",
+        "content": "# Security model\n\nAll /admin routes must require the requireAdmin middleware before business logic runs. SQL must use placeholders. Shell commands must not include request data.\n\n## Deliberate exceptions\n\n- `/health` is unauthenticated by design. It returns a fixed literal and reads nothing.\n- A SQL identifier (a column or table name) cannot be a placeholder. Where one must vary,\n  the only accepted pattern is mapping the request value through a fixed allow-list and\n  interpolating the mapped constant. Code that already does this is correct as written.\n- A shell command whose argument list contains no request data is not command injection.\n"
+      },
+      {
+        "path": "tests/security-oracle.mjs",
+        "content": "// Precision/recall oracle for the deep security review.\n//\n// Run by the harness with the reviewed workspace as cwd. It grades the two\n// halves of a real review separately, because recall alone is passed by a\n// report that flags everything:\n//\n//   RECALL   — each of the three seeded defects in src/admin.ts is reported.\n//   PRECISION — none of the three SAFE constructs is reported. Each is a\n//               deliberate look-alike of a seeded defect and each is\n//               documented as correct in docs/security.md.\n//\n// The classes are matched by their ordinary names, not by any wording this\n// fixture invented, so the bar is \"a real review of this class of defect\"\n// rather than this scenario's vocabulary.\nimport { readFileSync } from 'node:fs';\n\n/**\n * Fail with the message ALONE on stderr.\n *\n * A thrown Error would work, but the harness feeds this script's stderr\n * into the model's repair nudge verbatim, and an uncaught throw pads that\n * nudge with a Node stack trace and a version banner. The actionable\n * sentence is what the next attempt needs; the stack is noise that pushes\n * it out of view on a small model.\n */\nfunction fail(message) {\n  console.error(message);\n  process.exit(1);\n}\n\n\nconst FINDINGS = 'security-review/findings.json';\n\nlet raw;\ntry {\n  raw = readFileSync(FINDINGS, 'utf8');\n} catch {\n  fail(FINDINGS + ' does not exist - the machine-readable findings file is required');\n}\n\nlet findings;\ntry {\n  findings = JSON.parse(raw.replace(/^\\uFEFF/, ''));\n} catch (err) {\n  fail(FINDINGS + ' is not valid JSON: ' + err.message);\n}\nif (!Array.isArray(findings)) {\n  const nested = findings && typeof findings === 'object'\n    ? Object.values(findings).find((value) => Array.isArray(value))\n    : null;\n  if (!nested) fail(FINDINGS + ' must be an array of finding records');\n  findings = nested;\n}\n\nconst text = (finding) =>\n  Object.values(finding)\n    .filter((value) => typeof value === 'string')\n    .join(' ')\n    .toLowerCase();\n\nconst fileOf = (finding) => String(finding.file ?? finding.path ?? '').replace(/\\\\/g, '/');\n\nconst REQUIRED = [\n  {\n    label: 'command injection in the /admin/export shell call',\n    match: /command injection|shell injection|\\bexec\\b|child_process|os command/,\n  },\n  {\n    label: 'SQL injection in the /admin/users query',\n    match: /sql injection|sqli|parameteri[sz]|placeholder|string interpolation into (a )?quer/,\n  },\n  {\n    label: 'missing authorization on the /admin routes',\n    match: /authorization|authentication|requireadmin|access control|missing auth|broken auth/,\n  },\n];\n\nconst adminFindings = findings.filter((finding) => /(^|\\/)src\\/admin\\.ts$/.test(fileOf(finding)));\nconst missing = REQUIRED.filter(\n  (required) => !adminFindings.some((finding) => required.match.test(text(finding))),\n);\nif (missing.length > 0) {\n  fail(\n    'RECALL FAILURE - src/admin.ts holds three separate defects and these were not reported: ' +\n      missing.map((entry) => entry.label).join('; ') +\n      '. Reported for src/admin.ts: ' +\n      (adminFindings.map((finding) => String(finding.category ?? '?')).join(', ') || '(nothing)'),\n  );\n}\n\nconst SAFE_FILES = [\n  {\n    file: 'src/profile.ts',\n    why: 'its query uses a placeholder and its route is behind requireUser',\n  },\n  {\n    file: 'src/reports.ts',\n    why:\n      'its exec call contains no request data, its ORDER BY column comes from a fixed ' +\n      'allow-list, and /health is documented as deliberately unauthenticated',\n  },\n];\n\nconst falsePositives = [];\nfor (const safe of SAFE_FILES) {\n  const pattern = new RegExp('(^|/)' + safe.file.replace(/[.]/g, '\\\\.') + '$');\n  for (const finding of findings) {\n    if (pattern.test(fileOf(finding))) {\n      falsePositives.push(\n        safe.file + ' (' + String(finding.category ?? 'unnamed finding') + ') - ' + safe.why,\n      );\n    }\n  }\n}\nif (falsePositives.length > 0) {\n  fail(\n    'PRECISION FAILURE - these files are correct as written and must not be reported as ' +\n      'vulnerable: ' + falsePositives.join('; ') +\n      '. A review that flags safe code is not usable; re-read docs/security.md, which states ' +\n      'which constructs are deliberate.',\n  );\n}\n\nconsole.log(\n  'Security precision/recall oracle passed: all 3 seeded defects reported on src/admin.ts, ' +\n    '0 false positives on the 2 safe files.',\n);\n",
+        "surface": "workspace",
+        "modelInput": false
+      }
+    ],
+    "worker": {
+      "name": "Rae",
+      "role": "Reviewer"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "The report and findings JSON confirm both injection paths and the missing admin boundary with systemic remediation.",
+    "deliverables": [
+      {
+        "path": "security-review/REPORT.md",
+        "kind": "security-report",
+        "minBytes": 1500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "security-review/REPORT.md",
+            "pattern": "src/admin\\.ts:[0-9]+",
+            "flags": "i",
+            "label": "real file and line"
+          },
+          {
+            "kind": "contains",
+            "file": "security-review/REPORT.md",
+            "pattern": "command injection|exec",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "security-review/REPORT.md",
+            "pattern": "SQL injection|parameter",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "security-review/REPORT.md",
+            "pattern": "authorization|requireAdmin|auth",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "security-review/REPORT.md",
+            "pattern": "Systemic Themes|root cause|blast radius",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "security-review/REPORT.md",
+            "pattern": "Verified Safe|Not Statically Verifiable",
+            "flags": "i"
+          }
+        ]
+      },
+      {
+        "path": "security-review/findings.json",
+        "kind": "json",
+        "minBytes": 300,
+        "checks": [
+          {
+            "kind": "sniff",
+            "file": "security-review/findings.json",
+            "sniff": "json-valid"
+          },
+          {
+            "kind": "recordSchema",
+            "file": "security-review/findings.json",
+            "format": "json",
+            "minRows": 3,
+            "fields": [
+              {
+                "name": "file",
+                "type": "nonempty",
+                "required": true
+              },
+              {
+                "name": "line",
+                "type": "integer",
+                "required": true
+              },
+              {
+                "name": "severity",
+                "type": "^(critical|high|medium|low|info)$",
+                "required": true
+              },
+              {
+                "name": "category",
+                "type": "nonempty",
+                "required": true
+              },
+              {
+                "name": "remediation",
+                "type": "nonempty",
+                "required": true
+              },
+              {
+                "name": "theme",
+                "type": "nonempty",
+                "required": true
+              },
+              {
+                "name": "title",
+                "type": "nonempty",
+                "required": true
+              }
+            ],
+            "allowExtraFields": true
+          },
+          {
+            "kind": "nodeScriptPasses",
+            "script": "tests/security-oracle.mjs",
+            "timeoutMs": 30000,
+            "requiredOutput": [
+              {
+                "pattern": "Security precision/recall oracle passed",
+                "label": "every seeded defect reported, and no safe construct reported"
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "security-review/REPORT.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "verification",
+        "description": "Raw leads are confirmed as real source-to-sink or authorization paths."
+      },
+      {
+        "name": "systemic analysis",
+        "description": "Findings are grouped by root cause and blast radius."
+      },
+      {
+        "name": "remediation",
+        "description": "The report and JSON contain concrete, severity-consistent fixes."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "confirmed vulnerabilities",
+    "systemic themes",
+    "machine-readable findings"
+  ]
+}

package/data/craftbook-templates/de/dependency-audit/versions/1.1.3/craftbook.json

@@ -0,0 +1,275 @@
+{
+  "id": "dependency-audit",
+  "name": "Dependency Audit",
+  "description": "Audit a project's dependencies for security, staleness, license, and maintenance risk, then produce a prioritized remediation report. First scans the manifest and lockfile to inventory every dependency with its installed vs latest version, known CVEs, license, and maintenance signals, then assesses each into a risk tier weighing severity, exploitability, breaking-change cost, and removability, then writes a report with a concrete upgrade/replace/remove action and order for each risky dependency. Use this for a dependency audit, supply-chain review, checking for vulnerable or outdated packages, license compliance, npm/pip audit triage, or reducing dependency risk — it turns a raw audit dump into a prioritized, justified action plan rather than a wall of warnings.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Scan the dependency tree (developer) — inventory deps with versions, CVEs, licenses → gated on artifact `{{workPath}}/scan.md` (markdown-notes)\n2. Assess risk (reviewer) — tier each dep by risk and remediation cost → gated on artifact `{{workPath}}/assess.md` (markdown-notes)\n3. Write the audit report (reviewer) — prioritized upgrade/replace/remove plan → gated on artifact `{{workPath}}/dependency-audit.md` (markdown-report)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n\nEvidence discipline:\n\n- Treat supplied manifests, lockfiles, audit JSON, and dependency notes as the source of truth. Do not invent CVEs, licenses, package age, or network-audit results that are not in the evidence.\n- If evidence says no patched version exists, do not recommend a patch upgrade; recommend replacement, containment, or a human decision.\n- If evidence names a copyleft or incompatible license, the License flags section must name the package and license. Do not write that no license flags were found.\n- Dependencies with no seeded CVE, license issue, or maintenance issue should be explicitly deferred, not inflated into security or replacement work.\n- Recommended order is risk-first: critical no-patch security items come before unused cleanup and low-effort maintenance upgrades, even when the cleanup is easier.\n- Maintenance-only upgrades can still be recommended, but label them maintenance-only; do not describe them as security posture work unless the evidence names a vulnerability.\n- Copy exact license identifiers and exact target versions from the evidence, such as `GPL-3.0-only` or `4.18.3`; do not replace them with vague family labels or \"monitor later\" language.\n- Copy named replacement alternatives from the evidence, such as `chart.js 4.x`; do not replace them with vague \"find an alternative\" language.\n- If a dependency has no seeded CVE, avoid words like security, advisory, vulnerability, patch, or posture in that dependency's action unless the evidence explicitly supports them.\n- Do not infer missing licenses. If the evidence does not state a license for a dependency, say the license was not provided rather than guessing MIT or writing \"assumed.\"\n",
+  "entryStepId": "scan",
+  "triggers": [
+    "dependency audit",
+    "are my dependencies safe",
+    "check for outdated packages",
+    "supply chain review",
+    "npm audit triage",
+    "license compliance check"
+  ],
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "scan",
+      "name": "Scan the dependency tree",
+      "description": "inventory deps with versions, CVEs, licenses",
+      "prompt": "Step 1: Read the manifest and lockfile (package.json/lock, requirements/poetry, go.mod, Cargo.toml, etc.) to inventory direct and notable transitive dependencies. Step 2: For each, gather: installed version vs latest, the semver gap (patch/minor/major behind), known vulnerabilities (run the ecosystem audit tool if available — `npm audit`, `pip-audit`, `cargo audit` — and capture CVE id + severity), license, and maintenance signals (last release date, archived/deprecated, single-maintainer). If the task already provides audit output or dependency notes, treat those files as authoritative evidence and do not replace them with fresh network assumptions. Step 3: Flag duplicates/multiple versions of the same package and obviously unused or trivially-replaceable dependencies. Step 4: Write the acceptance-criteria checklist for the audit, e.g. 'every direct dependency is inventoried', 'all CVEs at high+ are captured with an id', 'each license is recorded and flagged if copyleft/incompatible', 'staleness is measured by both semver gap and release recency'. Step 5: Save the inventory table to `write_task_note` AND `{{workPath}}/scan.md`. No prioritization yet — this phase is the raw inventory.\n\nThe deliverable `{{workPath}}/scan.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "developer",
+      "advanceWhen": {
+        "file": "{{workPath}}/scan.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/scan.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/scan.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "scan",
+        "maxAttempts": 3
+      },
+      "next": "assess",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      }
+    },
+    {
+      "id": "assess",
+      "name": "Assess risk",
+      "description": "tier each dep by risk and remediation cost",
+      "prompt": "Step 1: For each dependency in the inventory, assign a risk tier (Critical / High / Medium / Low) weighing: CVE severity AND whether the vulnerable code path is actually used, how far behind it is, whether the upgrade is a breaking major (and the migration cost), license incompatibility, and abandonment/maintenance risk. Step 2: Decide the remediation per dep: patch-upgrade (safe), minor/major upgrade (note breaking changes to handle), replace (name the alternative), remove (if unused), or defer (if no seeded issue is present). If the evidence says no patched version exists, do not recommend an update-to-patch; recommend replacement, containment, or a human decision instead. Step 3: Determine a sensible ORDER — critical/no-patch security items first, then other high CVEs, then cleanup and low-effort maintenance; do not put unused cleanup or low-risk maintenance ahead of a critical no-patch replacement just because it is easy. Step 4: Distinguish real exposure from theoretical (a CVE in an unreachable code path is lower risk — say so), and distinguish maintenance-only upgrades from security fixes. Step 5: Note anything needing human judgment (license/legal, a major framework bump). Good looks like: a tier justified by both severity and actual exposure, not just the audit tool's color. Stage the tiered list to `write_task_note`. Do not write the report yet.\n\nThe deliverable `{{workPath}}/assess.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "{{workPath}}/assess.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/assess.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/assess.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "assess",
+        "maxAttempts": 3
+      },
+      "next": "report",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      }
+    },
+    {
+      "id": "report",
+      "name": "Write the audit report",
+      "description": "prioritized upgrade/replace/remove plan",
+      "prompt": "Step 1: Open `{{workPath}}/dependency-audit.md` and write a '## Summary' line: total deps, count by risk tier, and the headline risk. Step 2: Add an '## Action plan' ordered by priority; each entry: `package@installed → action (target version / replacement / remove / defer)` with the reason (CVE id + severity, semver gap, license, abandonment, or no seeded issue), the breaking-change note if any, and the migration effort. Keep exact target versions and named replacement alternatives from the evidence; do not downgrade a named maintenance upgrade to vague monitoring or replace a named alternative with generic wording. Step 3: Add a '## License flags' section for any copyleft/incompatible licenses; if the source names GPL/copyleft, the section must name that package and exact license identifier, not say no flags were found. Do not infer missing licenses; say license not provided when the evidence does not name one. Step 4: Add a '## Needs human decision' section for legal/major-bump/no-patch calls. Step 5: Add a one-paragraph '## Recommended order' (what to do this week vs later), keeping critical no-patch CVEs ahead of unused cleanup and low-effort maintenance upgrades. Every action must name a concrete target and a justification — no 'update your packages'. On a loop-back, fix only the named gaps. `write_task_note` the report path and the counts by tier.\n\nThe deliverable `{{workPath}}/dependency-audit.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "reviewer",
+      "advanceWhen": {
+        "file": "{{workPath}}/dependency-audit.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/dependency-audit.md",
+            "bytes": 1500,
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/dependency-audit.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i",
+            "label": "at least one markdown heading",
+            "artifact": true
+          }
+        ],
+        "onReject": "report",
+        "maxAttempts": 4
+      },
+      "next": "evaluate",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      }
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Open `{{workPath}}/dependency-audit.md` and grade it against the scan checklist. Check EACH criterion and write PASS/FAIL with a one-line reason: (1) every direct dependency is inventoried with installed vs latest; (2) all high+ CVEs are captured with an id and severity; (3) each risky dep has a concrete action (upgrade target / replacement / remove / defer) and a justification; (4) breaking-change/migration cost is noted for major upgrades; (5) licenses are recorded and incompatibilities flagged, especially any GPL/copyleft source note; (6) the plan is prioritized with a recommended order that puts critical/no-patch security items before unused cleanup and maintenance-only upgrades; (7) risk tiers reflect actual exposure, not just the tool's raw severity; (8) no dependency with no seeded issue is inflated into a security/replacement recommendation; (9) no dependency with no patched version is described as patch-upgradeable. If any criterion fails, name the exact gap and loop back.\n\nThe deliverable lives in the project's artifacts drawer — open `{{workPath}}/dependency-audit.md` with `read_artifact`, not `read_file`.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"report\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "{{workPath}}/dependency-audit.md",
+          "artifact": true
+        }
+      ],
+      "next": "report",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      }
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "terminal": true,
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      }
+    }
+  ],
+  "version": "1.1.3",
+  "releasedAt": "2026-09-01T20:00:00Z",
+  "minGezelVersion": "1.26233"
+}

package/data/craftbook-templates/de/dependency-audit/versions/1.1.3/test.json

@@ -0,0 +1,111 @@
+{
+  "schemaVersion": 1,
+  "title": "Dependency Audit evidence-discipline eval",
+  "objective": "Measure whether the audit prioritizes supplied vulnerability and license evidence without inventing package facts or patch versions.",
+  "tags": [
+    "corpus"
+  ],
+  "prompt": "Use the Dependency Audit craftbook for the weekly maintenance review. Treat evidence/dependencies.json as authoritative and write tasks/eval/dependency-audit.md. Do not use the network or modify package files.",
+  "setup": {
+    "projectName": "Dependency Maintenance Eval",
+    "about": "A package fixture with authoritative offline dependency evidence.",
+    "missionObjectives": "Prioritize the no-patch critical dependency, exact license issue, maintenance-only upgrade, and clean defer correctly.",
+    "files": [
+      {
+        "path": "package.json",
+        "content": "{\n  \"name\": \"returns-desk\",\n  \"dependencies\": {\n    \"legacy-parser\": \"1.2.0\",\n    \"chart-kit\": \"2.0.0\",\n    \"stable-lib\": \"4.2.0\"\n  }\n}\n"
+      },
+      {
+        "path": "evidence/dependencies.json",
+        "content": "[\n  {\"name\":\"legacy-parser\",\"installed\":\"1.2.0\",\"latest\":\"1.2.0\",\"advisory\":\"CVE-2026-4242\",\"severity\":\"critical\",\"patchedVersion\":null,\"reachableFrom\":\"src/import.ts\",\"replacement\":\"safe-parser 3.x\",\"license\":\"MIT\"},\n  {\"name\":\"chart-kit\",\"installed\":\"2.0.0\",\"latest\":\"3.1.0\",\"advisory\":null,\"maintenance\":\"major version available\",\"license\":\"GPL-3.0-only\",\"replacement\":\"chart.js 4.x\"},\n  {\"name\":\"stable-lib\",\"installed\":\"4.2.0\",\"latest\":\"4.2.0\",\"advisory\":null,\"maintenance\":null,\"license\":\"MIT\"}\n]\n"
+      },
+      {
+        "path": "src/import.ts",
+        "content": "import { parse } from 'legacy-parser';\nexport const importRows = (text: string) => parse(text);\n"
+      }
+    ],
+    "worker": {
+      "name": "Rae",
+      "role": "Reviewer"
+    },
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "tasks/eval/dependency-audit.md follows the evidence, orders the critical no-patch action first, and handles license and clean dependencies honestly.",
+    "deliverables": [
+      {
+        "path": "tasks/eval/dependency-audit.md",
+        "kind": "markdown-report",
+        "minBytes": 1300,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/dependency-audit.md",
+            "pattern": "legacy-parser[\\s\\S]{0,300}CVE-2026-4242",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/dependency-audit.md",
+            "pattern": "safe-parser 3\\.x|no patched version|contain",
+            "flags": "i",
+            "label": "no-patch action"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/dependency-audit.md",
+            "pattern": "chart-kit[\\s\\S]{0,300}GPL-3\\.0-only",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/dependency-audit.md",
+            "pattern": "chart\\.js 4\\.x",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/dependency-audit.md",
+            "pattern": "stable-lib[\\s\\S]{0,200}(defer|no action|current)",
+            "flags": "i"
+          },
+          {
+            "kind": "notContains",
+            "file": "tasks/eval/dependency-audit.md",
+            "pattern": "legacy-parser[\\s\\S]{0,120}(patch upgrade|upgrade to 1\\.)",
+            "flags": "i",
+            "label": "do not invent a patch"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "tasks/eval/dependency-audit.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "evidence discipline",
+        "description": "Package facts and versions come only from supplied evidence."
+      },
+      {
+        "name": "prioritization",
+        "description": "Risk, reachability, license, and migration cost drive a sensible order."
+      },
+      {
+        "name": "actionability",
+        "description": "Each package receives an exact upgrade, replace, contain, or defer action."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "offline evidence fidelity",
+    "no-patch handling",
+    "license accuracy"
+  ]
+}