@bendyline/gilde 0.1.55 → 0.1.56

package/data/craftbook-templates/re/release-artifact-sanity-check/versions/1.0.4/test.json

@@ -0,0 +1,138 @@
+{
+  "schemaVersion": 1,
+  "title": "Release Artifact Sanity Check evidence-fixture eval",
+  "objective": "Verify that the craftbook reconciles release integrity, signing, and package-member evidence into a conservative go/no-go report without live services or executable artifacts.",
+  "tags": [
+    "corpus",
+    "release",
+    "security"
+  ],
+  "prompt": "Use the Release Artifact Sanity Check craftbook on the captured dry-run evidence in `source/release-artifacts/`. These fixtures describe artifacts and package contents but are deliberately non-executable; do not use the network or invent new verification results. Write the final report to `release-artifact-sanity-report.md`.",
+  "setup": {
+    "projectName": "Release Artifact Sanity Check Eval",
+    "about": "A self-contained release-artifact audit. The source folder contains captured hashes, signature-tool results, and safe package listings for Boreal Desk v2.4.0.",
+    "missionObjectives": "Use the Release Artifact Sanity Check craftbook, reconcile every supplied item, treat missing trust or coverage as NOT VERIFIED, and produce an evidence-backed release-artifact-sanity-report.md without network calls or executing package contents.",
+    "files": [
+      {
+        "path": "source/release-artifacts/release-v2.4.0.md",
+        "content": "# Boreal Desk v2.4.0\n\nTag: v2.4.0\nRelease URL: https://example.invalid/boreal/releases/v2.4.0\nTop-level uploaded artifacts: 3\n\n| Artifact | GitHub sha256 digest | Bytes |\n| --- | --- | ---: |\n| BorealDesk-2.4.0-macos.zip | aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa | 4100 |\n| BorealDeskSetup-2.4.0.msi | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 5200 |\n| BorealDesk-2.4.0.AppImage | dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd | 6300 |\n"
+      },
+      {
+        "path": "source/release-artifacts/SHA256SUMS",
+        "content": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  BorealDesk-2.4.0-macos.zip\nbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb  BorealDeskSetup-2.4.0.msi\ndddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd  BorealDesk-2.4.0.AppImage\n"
+      },
+      {
+        "path": "source/release-artifacts/computed-hashes.txt",
+        "content": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  BorealDesk-2.4.0-macos.zip\ncccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc  BorealDeskSetup-2.4.0.msi\ndddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd  BorealDesk-2.4.0.AppImage\n"
+      },
+      {
+        "path": "source/release-artifacts/signature-evidence.md",
+        "content": "# Captured signature verifier output\n\n- `BorealDesk-2.4.0-macos.zip` expanded app: `codesign --verify --deep --strict` exit 0; Developer ID Application signer Team ID BDESK12345; `spctl` accepted and reported notarized. Trusted Apple root chain captured.\n- `BorealDeskSetup-2.4.0.msi`: `Get-AuthenticodeSignature` Status = NotSigned.\n- `BorealDesk-2.4.0.AppImage`: detached signature produced `GOODSIG build@boreal.example`, but the fixture contains no trusted fingerprint or key-source record. Treat signer trust as NOT VERIFIED.\n"
+      },
+      {
+        "path": "source/release-artifacts/package-inventory.txt",
+        "content": "SAFE LISTING ONLY — DO NOT EXECUTE\nDeclared contained regular files: 12\n\nmacos/Boreal Desk.app/Contents/MacOS/BorealDesk | Mach-O arm64+x86_64 | executable | signature covered\nmacos/Boreal Desk.app/Contents/Frameworks/Electron Framework.framework/Electron Framework | Mach-O | signature covered\nmacos/Boreal Desk.app/Contents/Resources/app.asar | ASAR | data\nmacos/Boreal Desk.app/Contents/Resources/current -> ../../outside | symlink escapes package root\nwindows/BorealDesk.exe | PE32+ | executable | Authenticode NotSigned\nwindows/updater.exe | PE32+ | executable | Authenticode NotSigned\nwindows/config/defaults.env | text | contains API_TOKEN=demo-hardcoded-token\nwindows/LICENSE.txt | text\nlinux/BorealDesk | ELF x86_64 | executable | covered only by untrusted outer GOODSIG\nlinux/usr/lib/libcrypto.so.3 | ELF shared library\nlinux/resources/app.asar | ASAR | data\nlinux/updater | ELF x86_64 | executable | no inner signature evidence\n\nArchive preflight: no absolute or `..` entry names; one escaping symlink is listed above. Expansion ratio stayed below the supplied limit. Local malware scanner was unavailable in the captured environment.\n"
+      }
+    ],
+    "worker": {
+      "name": "Ada",
+      "role": "Release Security Reviewer"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "The report reconciles all three artifacts and 12 package members, reaches NO-GO from the supplied integrity/signing/package blockers, and does not invent live verification.",
+    "deliverables": [
+      {
+        "path": "release-artifact-sanity-report.md",
+        "kind": "markdown-report",
+        "minBytes": 2000,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "NO-GO|NO GO",
+            "flags": "i",
+            "label": "derive a no-go decision from hard blockers"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "BorealDeskSetup-2\\.4\\.0\\.msi[\\s\\S]{0,500}(?:mismatch|cccc|FAIL)|(?:mismatch|cccc|FAIL)[\\s\\S]{0,500}BorealDeskSetup-2\\.4\\.0\\.msi",
+            "flags": "i",
+            "label": "catch the Windows installer digest mismatch"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "NotSigned|not signed|unsigned",
+            "flags": "i",
+            "label": "report missing Authenticode signing"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "GOODSIG[\\s\\S]{0,300}(?:NOT VERIFIED|untrusted|trust)|(?:NOT VERIFIED|untrusted|trust)[\\s\\S]{0,300}GOODSIG",
+            "flags": "i",
+            "label": "distinguish signature presence from trusted identity"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "Resources/current|escaping symlink|symlink escapes",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "API_TOKEN|hardcoded-token|credential",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-artifact-sanity-report.md",
+            "pattern": "3\\s+(?:top-level\\s+)?artifacts|12\\s+(?:contained\\s+)?(?:regular\\s+)?files",
+            "flags": "i",
+            "label": "reconcile top-level and contained-file counts"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "release-artifact-sanity-report.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "coverage",
+        "description": "Every top-level artifact and all 12 supplied package members are reconciled."
+      },
+      {
+        "name": "integrity",
+        "description": "Digest comparisons are explicit and the Windows mismatch drives the decision."
+      },
+      {
+        "name": "authenticity",
+        "description": "Signature presence, cryptographic validity, and trusted signer identity are kept distinct."
+      },
+      {
+        "name": "package safety",
+        "description": "The escaping symlink, unsigned executables, hardcoded token, and unavailable scanner are handled conservatively."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "complete artifact and package-member reconciliation",
+    "trust-aware signature verification",
+    "evidence-backed no-go decision",
+    "non-executing hostile-input inspection"
+  ]
+}

package/data/craftbook-templates/re/release-notes/versions/1.0.4/test.json

@@ -76,20 +76,20 @@
     },
     "axes": [
       {
-        "name": "safety",
-        "description": "Dry-run posture is explicit: no real credentials, clear stop-before-side-effect boundary."
+        "name": "grounding",
+        "description": "Seeded facts appear faithfully and the source is cited."
       },
       {
-        "name": "mapping",
-        "description": "Fake endpoints/commands are mapped completely to the workflow steps."
+        "name": "structure",
+        "description": "Sections progress logically for the artifact class."
       },
       {
-        "name": "signals",
-        "description": "Success, failure, retry, and abort conditions are all defined."
+        "name": "completeness",
+        "description": "Required elements (risks, next actions, scope) are all present."
       },
       {
-        "name": "containment",
-        "description": "The plan cannot accidentally reach a real service from a mock context."
+        "name": "tone",
+        "description": "The register fits the audience and artifact class."
       }
     ]
   },

package/data/craftbook-templates/re/release-notes/versions/1.0.5/craftbook.json

@@ -0,0 +1,339 @@
+{
+  "id": "release-notes",
+  "name": "Release Notes",
+  "description": "Turn a raw set of merged commits, pull requests, and ticket IDs into polished, human-readable release notes for a versioned release — grouped by theme (Features, Improvements, Bug Fixes, Breaking Changes), written for users rather than engineers, with upgrade/migration callouts surfaced first. The ordering is deliberate: a developer gathers and de-noises the change inventory before any prose is written, a copywriter turns that inventory into benefit-led notes in a consistent voice, and a reviewer verifies every shipped change is represented and nothing internal-only or unreleased leaked in. Use this for GitHub Releases, product announcement posts, or the user-facing notes that ship alongside a tagged version.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Gather the change inventory (developer) — collect and de-noise every shipped change since the last tag → gated on artifact `{{workPath}}/gather.md` (markdown-notes)\n2. Write the notes (copywriter) — turn the inventory into benefit-led, user-facing notes → gated on `release-notes.md` (markdown-doc)\n3. Review for completeness and tone (reviewer) — verify coverage, accuracy, and that nothing internal leaked → gated on artifact `{{workPath}}/review.md` (markdown-notes)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n",
+  "entryStepId": "gather",
+  "triggers": [
+    "write release notes",
+    "release notes for v2",
+    "what changed this release",
+    "draft release announcement",
+    "notes for the new version",
+    "cut a changelog",
+    "update CHANGELOG.md",
+    "roll unreleased into a version",
+    "stamp the changelog for v1.4",
+    "keep a changelog release",
+    "write a changelog",
+    "generate release notes",
+    "whats new writeup",
+    "changelog from commits",
+    "version notes"
+  ],
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "gather",
+      "name": "Gather the change inventory",
+      "description": "collect and de-noise every shipped change since the last tag",
+      "prompt": "1. Determine the version range: the last released tag (or last release date) up to HEAD/the release candidate. 2. Collect the raw inventory — merged PRs, commit subjects, and linked issue IDs (use git log, gh pr list --state merged, or the changelog source available to you). 3. Filter OUT noise that should never reach users: merge commits, dependency-bump-only commits, CI/build-config tweaks, lint/format-only commits, and anything not yet actually released. 4. Classify each remaining change into exactly one bucket: Features, Improvements, Bug Fixes, Breaking Changes. 5. Flag every Breaking Change and anything requiring a user action (config change, migration, new env var) — these get top billing later. 6. Good looks like: a deduplicated, categorized list where each item has a PR/issue reference and a one-line plain description, and every category is either populated or explicitly marked 'none'. Write an acceptance-criteria checklist (e.g. 'every shipped user-facing change appears exactly once', 'breaking changes are flagged with the required user action', 'no merge/dependency/CI-only noise', 'each item cites a PR or issue') plus the version range and the classified inventory to the notes file via write_task_note AND to {{workPath}}/gather.md.\n\nThe deliverable `{{workPath}}/gather.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "developer",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      },
+      "advanceWhen": {
+        "file": "{{workPath}}/gather.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/gather.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/gather.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "gather",
+        "maxAttempts": 3
+      },
+      "next": "write"
+    },
+    {
+      "id": "write",
+      "name": "Write the notes",
+      "description": "turn the inventory into benefit-led, user-facing notes",
+      "prompt": "1. Open {{workPath}}/gather.md and write the release notes for HUMANS, not for the commit log — lead each item with the user-visible benefit, not the implementation. 2. Order the document: a one-paragraph highlights summary, then Breaking Changes / Upgrade Notes (with the exact action the user must take), then Features, Improvements, Bug Fixes. 3. Keep each line tight and parallel in voice; use the imperative or present tense consistently ('Adds…', 'Fixes…'). 4. Preserve the PR/issue references as links or trailing (#123) so readers can dig in. 5. Open with the version number and release date as an H1/H2. 6. Good looks like: a reader who has never seen the codebase understands what changed and what they must do, breaking changes are impossible to miss, and every inventory item from gather.md is represented. Write the notes to release-notes.md.\n\nBefore working, open the artifact input `{{workPath}}/gather.md` with `read_artifact`; do not look for it in the workspace.",
+      "suggestedRole": "copywriter",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web"
+        ],
+        "outputMedium": "workspace",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      },
+      "consumes": [
+        {
+          "file": "{{workPath}}/gather.md",
+          "artifact": true
+        }
+      ],
+      "advanceWhen": {
+        "file": "release-notes.md",
+        "minBytes": 1,
+        "sniff": "nonempty"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "release-notes.md",
+            "bytes": 500
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkContains",
+            "scope": "standard",
+            "inputs": {
+              "file": "release-notes.md",
+              "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+              "flags": "i"
+            }
+          }
+        ],
+        "onReject": "write",
+        "maxAttempts": 3
+      },
+      "next": "review"
+    },
+    {
+      "id": "review",
+      "name": "Review for completeness and tone",
+      "description": "verify coverage, accuracy, and that nothing internal leaked",
+      "prompt": "1. Cross-check release-notes.md against {{workPath}}/gather.md: every classified item must appear, and nothing must appear that was filtered as noise or is unreleased. 2. Verify Breaking Changes are at the top with a concrete user action, not buried. 3. Check the voice is consistent and benefit-led, version + date are present, and references resolve. 4. Confirm no internal-only details (private ticket chatter, internal service names, secrets, profanity) leaked into a public document. 5. Write a PASS/FAIL against each acceptance criterion from gather.md, listing any specific gap. 6. If anything fails, the fix happens back in the write phase. Write your findings to {{workPath}}/review.md.\n\nBefore working, open the artifact input `{{workPath}}/gather.md` with `read_artifact`; do not look for it in the workspace.\n\nThe deliverable `{{workPath}}/review.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "reviewer",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact"
+      },
+      "consumes": [
+        {
+          "file": "{{workPath}}/gather.md",
+          "artifact": true
+        },
+        {
+          "file": "release-notes.md"
+        }
+      ],
+      "advanceWhen": {
+        "file": "{{workPath}}/review.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "requireChange": true,
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "release-notes.md",
+            "bytes": 500
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "{{workPath}}/review.md",
+            "minCitations": 2,
+            "artifact": true
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkContains",
+            "scope": "standard",
+            "inputs": {
+              "file": "release-notes.md",
+              "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+              "flags": "i"
+            }
+          }
+        ],
+        "onReject": "review",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Review `{{workPath}}/review.md` against the original scope: every claim cites a real path, the severities and priorities are defensible, and nothing important in scope was skipped. Open the underlying files for at least the top findings; do not grade from the report's own summary. If a finding cannot be verified, say so explicitly.\n\nWrite your review to the artifact `{{workPath}}/review.md` with one `write_artifact` call: what you checked, what held, what did not (as a findings table with columns `| Severity | File | Line | Problem | Fix |` when anything needs fixing), ending with exactly `Verdict: PASS` or `Verdict: REVISE`. The gate enforces the verdict: a well-formed REVISE is routed back to the `review` step automatically with your findings. On PASS, `advance_task_step` to `finish`.",
+      "suggestedRole": "reviewer",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact"
+      },
+      "consumes": [
+        {
+          "file": "release-notes.md"
+        }
+      ],
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/review.md",
+            "bytes": 300,
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/review.md",
+            "pattern": "Verdict:\\s*(?:PASS|REVISE)",
+            "flags": "i",
+            "label": "explicit PASS or REVISE verdict",
+            "artifact": true
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkFixReview",
+            "scope": "standard",
+            "inputs": {
+              "taskRef": "{{task.ref}}",
+              "reviewPath": "{{workPath}}/review.md",
+              "fixStepId": "review"
+            }
+          }
+        ],
+        "onReject": "evaluate",
+        "maxAttempts": 4
+      },
+      "next": "finish"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      },
+      "terminal": true
+    }
+  ],
+  "version": "1.0.5",
+  "releasedAt": "2026-09-05T03:30:00Z",
+  "minGezelVersion": "1.26236"
+}

package/data/craftbook-templates/re/release-notes/versions/1.0.5/test.json

@@ -0,0 +1,111 @@
+{
+  "schemaVersion": 1,
+  "title": "Public release notes from noisy change inventory",
+  "objective": "Measure whether the release-notes craftbook gathers, de-noises, classifies, and writes benefit-led release notes with breaking changes up front.",
+  "tags": [
+    "corpus"
+  ],
+  "prompt": "In the `Release Notes Eval` project, read `source/change-inventory.md` and write `release-notes.md` for HarborCRM 3.8.0 dated 2026-06-28. Include Highlights, Breaking Changes / Upgrade Notes, Features, Improvements, and Bug Fixes. Preserve PR references, exclude internal-only noise, and make the breaking config action impossible to miss.",
+  "setup": {
+    "projectName": "Release Notes Eval",
+    "about": "Self-contained eval project for release-notes. The raw change inventory is seeded in workspace/source/change-inventory.md.",
+    "missionObjectives": "Write public release notes from a noisy change inventory, preserving user-facing changes and references while excluding internal-only noise.",
+    "files": [
+      {
+        "path": "source/change-inventory.md",
+        "content": "# HarborCRM 3.8.0 change inventory\n\n- PR #812 Feature: adds saved invoice filters for finance teams.\n- PR #817 Improvement: webhook retry queue now shows next retry time in the admin panel.\n- PR #823 Breaking: integrations must rename env var `HC_WEBHOOK_SECRET` to `PAYMENTS_WEBHOOK_SECRET` before deploy.\n- PR #829 Bug fix: fixes duplicate customer merge suggestions after CSV import.\n- PR #831 Internal: renamed reducer files in the billing package.\n- PR #832 CI-only: upgraded lint runner and prettier config.\n- PR #835 Dependency bump only: patch-level dev dependency update.\n"
+      }
+    ],
+    "worker": {
+      "name": "Rina",
+      "role": "Copywriter"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "workspace/release-notes.md has version/date, public sections, PR references, all user-facing changes, a prominent breaking action, and excludes internal/CI/dependency noise.",
+    "deliverables": [
+      {
+        "path": "release-notes.md",
+        "kind": "markdown-doc",
+        "minBytes": 1500,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "release-notes.md",
+            "pattern": "HarborCRM|3\\.8\\.0|2026-06-28"
+          },
+          {
+            "kind": "contains",
+            "file": "release-notes.md",
+            "pattern": "Highlights|Breaking Changes|Upgrade Notes|Features|Improvements|Bug Fixes",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-notes.md",
+            "pattern": "#812|#817|#823|#829",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-notes.md",
+            "pattern": "saved invoice filters|retry queue|duplicate customer merge",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "release-notes.md",
+            "pattern": "HC_WEBHOOK_SECRET|PAYMENTS_WEBHOOK_SECRET|before deploy|breaking",
+            "flags": "i"
+          },
+          {
+            "kind": "notContains",
+            "file": "release-notes.md",
+            "pattern": "reducer|lint runner|prettier|dependency bump|#831|#832|#835",
+            "flags": "i"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "release-notes.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "safety",
+        "description": "Dry-run posture is explicit: no real credentials, clear stop-before-side-effect boundary."
+      },
+      {
+        "name": "mapping",
+        "description": "Fake endpoints/commands are mapped completely to the workflow steps."
+      },
+      {
+        "name": "signals",
+        "description": "Success, failure, retry, and abort conditions are all defined."
+      },
+      {
+        "name": "containment",
+        "description": "The plan cannot accidentally reach a real service from a mock context."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "de-noising",
+    "benefit-led notes",
+    "breaking action visibility"
+  ],
+  "extensions": {
+    "legacySimulators": [
+      {
+        "id": "release-notes-fake-service-fixture",
+        "kind": "data-source",
+        "status": "implemented",
+        "description": "Seeded local fake service contract replacing live CLIs, HTTP APIs, credentials, and side effects."
+      }
+    ]
+  }
+}