@bendyline/gilde 0.1.55 → 0.1.56

package/data/craftbook-templates/se/security-architecture-review/versions/2.0.8/test.json

@@ -0,0 +1,157 @@
+{
+  "schemaVersion": 1,
+  "title": "Security Architecture Review — admin export surface",
+  "objective": "Exercise the Security Architecture Review craftbook against a self-contained service slice and require a prioritized, evidence-linked report that includes both confirmed vulnerabilities and working controls.",
+  "tags": [
+    "workflow",
+    "security",
+    "architecture-review",
+    "typescript"
+  ],
+  "prompt": "Use the Security Architecture Review craftbook to review the seeded service slice. This is report-only: do not modify source files. Model assets, actors, trust boundaries, and data flows; audit authorization, command/SQL construction, secrets handling, and relevant common vulnerability classes. Produce the scope and findings register, then write `tasks/eval/security/security-architecture-review.md`. Every confirmed finding must name severity, confidence, concrete workspace evidence, exploit preconditions, impact, and a specific remediation plus verification. Include working controls and rejected hypotheses. Do not invent CVEs, dependency versions, scans, or tests you did not run, and do not reproduce the example secret value in the report.",
+  "setup": {
+    "projectName": "Admin export security review",
+    "about": "A hermetic source-review fixture. No network or dependency lookup is needed or authorized; conclusions must come from seeded files.",
+    "missionObjectives": "Deliver an actionable risk posture that distinguishes confirmed source defects, positive controls, and unverified areas without changing implementation.",
+    "managedWorkspaceWritePolicy": "deny",
+    "files": [
+      {
+        "path": "docs/architecture.md",
+        "content": "# Service slice\n\nAn authenticated HTTP handler receives an export name and email filter from a browser operated by support staff. The handler calls local process and database adapters. `requireUser` is the shared authentication boundary. Only administrators should reach backup export; ordinary authenticated users may search their own customer records. Deployment injects `SESSION_SECRET` from environment configuration.\n"
+      },
+      {
+        "path": "src/auth.ts",
+        "content": "export interface User { id: string; role: 'member' | 'admin' }\n\nexport function requireUser(value: User | undefined): User {\n  if (!value) throw new Error('unauthorized');\n  return value;\n}\n\nexport function requireAdmin(user: User): void {\n  if (user.role !== 'admin') throw new Error('forbidden');\n}\n"
+      },
+      {
+        "path": "src/admin-export.ts",
+        "content": "import { exec } from 'node:child_process';\nimport type { User } from './auth.js';\nimport { requireAdmin, requireUser } from './auth.js';\n\nexport function exportBackup(currentUser: User | undefined, requestedName: string): void {\n  const user = requireUser(currentUser);\n  requireAdmin(user);\n  exec(`tar -czf backups/${requestedName}.tgz data/`);\n}\n"
+      },
+      {
+        "path": "src/customer-search.ts",
+        "content": "export interface Db { query(sql: string): Promise<unknown[]> }\n\nexport function findCustomerByEmail(db: Db, email: string): Promise<unknown[]> {\n  return db.query(`SELECT id, email FROM customers WHERE email = '${email}'`);\n}\n"
+      },
+      {
+        "path": "src/safe-audit-log.ts",
+        "content": "export interface AuditSink { write(event: { actorId: string; action: string; target: string }): void }\n\nexport function recordExport(sink: AuditSink, actorId: string, target: string): void {\n  sink.write({ actorId, action: 'backup.exported', target });\n}\n"
+      },
+      {
+        "path": "config/example.env",
+        "content": "# Example only; deployment replaces this value\nSESSION_SECRET=local-dev-only-not-a-real-secret\n"
+      }
+    ],
+    "craftbookParams": {
+      "workPath": "tasks/eval"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "The named craftbook produces a source-grounded risk posture with prioritized findings, positive controls, remediation, verification, and terminal task evidence.",
+    "deliverables": [
+      {
+        "path": "tasks/eval/security/security-architecture-review.md",
+        "kind": "security-report",
+        "artifact": true,
+        "minBytes": 1700,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "^#{1,3}\\s+Executive risk posture\\b[\\s\\S]*^#{1,3}\\s+What is working\\b[\\s\\S]*^#{1,3}\\s+Prioritized findings\\b[\\s\\S]*^#{1,3}\\s+Remediation plan\\b[\\s\\S]*^#{1,3}\\s+Verification\\b[\\s\\S]*^#{1,3}\\s+Unverified areas\\b",
+            "flags": "im",
+            "label": "complete security-review structure"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "(command injection|shell injection)[\\s\\S]{0,500}src/admin-export\\.ts[\\s\\S]*(severity)[\\s\\S]*(confidence)",
+            "flags": "is",
+            "label": "command-injection finding with evidence metadata"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "(SQL injection|parameteri[sz]ed quer)[\\s\\S]{0,500}src/customer-search\\.ts",
+            "flags": "is",
+            "label": "SQL-injection finding and remediation"
+          },
+          {
+            "kind": "contains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "(requireUser|requireAdmin)[\\s\\S]{0,300}(working|control|authorization|authentication)[\\s\\S]*(safe-audit-log|audit)",
+            "flags": "is",
+            "label": "positive auth and audit controls"
+          },
+          {
+            "kind": "citationsResolve",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "minCitations": 4
+          },
+          {
+            "kind": "notContains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "CVE-\\d{4}-\\d+",
+            "label": "no invented CVEs"
+          },
+          {
+            "kind": "notContains",
+            "file": "tasks/eval/security/security-architecture-review.md",
+            "pattern": "local-dev-only-not-a-real-secret",
+            "label": "example secret value is not reproduced"
+          }
+        ]
+      }
+    ],
+    "taskNotes": {
+      "minBytes": 180,
+      "checks": [
+        {
+          "kind": "contains",
+          "file": "task-notes.md",
+          "pattern": "\\bDONE\\b[\\s\\S]*tasks/eval/security/security-architecture-review\\.md[\\s\\S]*(command|SQL)",
+          "flags": "i",
+          "label": "terminal note records report and principal risks"
+        }
+      ],
+      "requireCraftbookTask": true
+    },
+    "taskGraph": {
+      "requireCraftbookTask": true,
+      "requireTerminalStep": true
+    },
+    "unchangedFixtures": [
+      "docs/architecture.md",
+      "src/auth.ts",
+      "src/admin-export.ts",
+      "src/customer-search.ts",
+      "src/safe-audit-log.ts",
+      "config/example.env"
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "tasks/eval/security/security-architecture-review.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "Threat-model coverage",
+        "description": "The report connects assets, actors, trust boundaries, privileges, and data flows to the reviewed attack surface."
+      },
+      {
+        "name": "Finding rigor",
+        "description": "Confirmed findings cite exact source evidence, state preconditions and impact, and calibrate severity and confidence without overclaiming."
+      },
+      {
+        "name": "Remediation utility",
+        "description": "Recommendations are prioritized, source-specific, verifiable, and preserve or strengthen the controls that already work."
+      }
+    ],
+    "contextNote": "No live dependency or dynamic scan is part of this hermetic source-review scenario; the report should say so."
+  },
+  "qualityFocus": [
+    "Both injection paths are found and tied to exact source",
+    "Working authentication, authorization, and audit controls are recognized",
+    "Unverified areas and evidence limits are explicit"
+  ]
+}

package/data/craftbook-templates/so/social-digest/versions/1.0.3/craftbook.json

@@ -0,0 +1,239 @@
+{
+  "id": "social-digest",
+  "name": "Social Digest",
+  "description": "Read everything new on the synced social feeds since the lookback window opened, then compose a grounded morning digest: per-feed activity, notable mentions and replies, engagement movers, and 1-3 suggested next moves carrying one-click gezel-action blocks (fire the draft-social-post craftbook with a prefilled topic, or a reply task for a mention worth answering). Every number in the digest must trace to a synced record via the scan notes — no invented metrics. Runs happily with no connector bound: it reports from posts/index.json alone and names the missing corpus as a gap.",
+  "entryStepId": "scan",
+  "triggers": [
+    "social digest",
+    "what happened on our feeds",
+    "engagement digest",
+    "overnight social summary"
+  ],
+  "command": "social-digest",
+  "runModes": {
+    "scheduled": "supported",
+    "nightShift": "recommended"
+  },
+  "connectors": [
+    {
+      "typeId": "bluesky-posts",
+      "optional": true,
+      "reason": "Read the synced Bluesky posts, mentions, and engagement counts the digest reports on."
+    },
+    {
+      "typeId": "x-posts",
+      "optional": true,
+      "reason": "Read the synced X posts, mentions, and engagement counts the digest reports on."
+    },
+    {
+      "typeId": "instagram-media",
+      "optional": true,
+      "reason": "Read the synced Instagram records so captions and comments show up in the digest."
+    }
+  ],
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      },
+      "lookbackHours": {
+        "type": "integer",
+        "default": 24,
+        "description": "How many hours back to scan for new records. Default 24."
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "scan",
+      "name": "Scan the feeds",
+      "description": "Collect raw notes from every synced corpus record in the window — the only numbers the digest may cite.",
+      "prompt": "You are collecting the raw material for the overnight social digest. Look back {{lookbackHours}} hours (if that value reads as a raw {{...}} placeholder, use the default: 24).\n\n1. Call `list_artifacts` on `data/` in the project artifacts. Each subfolder there is one synced feed corpus (Bluesky, X, Instagram, ...); its `_meta.json` names the feed and the last sync. If there is no `data/` folder, nothing is synced: still write the notes artifact, open it with the line \"no synced corpus this run\", record what `posts/index.json` says we published lately, and never invent feed activity.\n2. Read every record inside the window with `read_artifact` — records are markdown files with frontmatter under each corpus, organized newest-first by folder. Collect per feed: posts by us, mentions and replies (author handle plus a short verbatim quote), and each record's engagement counts (`likes`, `reposts`, `replies`) together with its `metrics_updated_at` stamp.\n3. Read `posts/index.json` in the workspace with `read_file` so the digest can match feed records to the posts we shipped.\n4. Write your raw notes to the artifact `{{workPath}}/reports/social-digest-notes.md` with `write_artifact`: one section per feed, and every count copied verbatim next to the record path it came from (for example `data/bluesky/posts/2026-08/2026-08-02-meet-the-makers.md`). These notes are the only source of numbers the digest step may cite.\n\nWhen the notes artifact is written, call `advance_task_step` to move to compose.",
+      "suggestedRole": "omroeper",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      },
+      "advanceWhen": {
+        "file": "{{workPath}}/reports/social-digest-notes.md",
+        "minBytes": 150,
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/reports/social-digest-notes.md",
+            "bytes": 150,
+            "artifact": true
+          }
+        ],
+        "maxAttempts": 3
+      },
+      "next": "compose"
+    },
+    {
+      "id": "compose",
+      "name": "Compose the digest",
+      "description": "Write the morning digest from the scan notes, ending with 1-3 one-click actions.",
+      "prompt": "Write the digest from `{{workPath}}/reports/social-digest-notes.md` (read it with `read_artifact` first). Every number you cite must appear in those notes — no other source of numbers is allowed.\n\nWrite the digest to the artifact `{{workPath}}/reports/social-digest-<today YYYY-MM-DD>.md` with `write_artifact` (use today's real date in the filename), then write the exact same content to `{{workPath}}/reports/social-digest-latest.md` — the stable path the completion gate reads. Write the latest file last. Sections, in order:\n\n- `## What happened on each feed` — one short block per synced feed; when a feed has no corpus or no new activity, say so in one line.\n- `## Notable mentions & replies` — who said what: name each author, quote them briefly, and say whether the mention deserves a reply.\n- `## Engagement movers` — which of our posts moved: compare the engagement counts and their `metrics_updated_at` stamps from the notes, and call out over- and under-performers. Never invent a number.\n- `## Suggested next moves` — 1-3 concrete suggestions. When a suggestion is directly actionable, follow it with a ```gezel-action fenced YAML block so the user can fire it with one click in the morning. Rules for these blocks: one block per action; flat YAML keys (only `params` nests one level); each block carries a unique, stable `id` slug that stays the same when tomorrow's digest repeats the suggestion; keep `title` short and `reason` to a sentence or two; never invent craftbook ids — the only craftbook you may reference is `draft-social-post`, which ships alongside this workflow. Two kinds:\n\nTo suggest drafting a post (prefill the topic):\n```gezel-action\nkind: fire-craftbook\nid: draft-<short-topic-slug>\ntitle: Draft a post about <thing>\nreason: <why, one sentence grounded in the notes>\ncraftbookId: draft-social-post\nparams:\n  topic: <the suggested topic>\n```\n\nTo suggest replying to a mention (a bespoke task with a concrete prompt):\n```gezel-action\nkind: create-task\nid: reply-<author-slug>\ntitle: Reply to <author>\nreason: <why this mention matters, one sentence>\nprompt: Read <record path> in the project artifacts and draft a reply in our voice for the user to approve. Do not post it.\nrole: omroeper\n```\n\nWhen both digest files are written, call `advance_task_step` to move to evaluate.",
+      "suggestedRole": "omroeper",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      },
+      "advanceWhen": {
+        "file": "{{workPath}}/reports/social-digest-latest.md",
+        "minBytes": 400,
+        "requireChange": true,
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/reports/social-digest-latest.md",
+            "bytes": 400,
+            "artifact": true
+          },
+          {
+            "kind": "contains",
+            "file": "{{workPath}}/reports/social-digest-latest.md",
+            "pattern": "```gezel-action",
+            "label": "digest carries at least one one-click action",
+            "artifact": true
+          },
+          {
+            "kind": "judge",
+            "file": "{{workPath}}/reports/social-digest-latest.md",
+            "rubric": "Every count or metric named in the digest appears verbatim in the scan notes; mentions name real authors from the notes; nothing is invented.",
+            "sourceFiles": [
+              "{{workPath}}/reports/social-digest-notes.md"
+            ],
+            "label": "no invented metrics",
+            "artifact": true
+          }
+        ],
+        "onReject": "compose",
+        "maxAttempts": 4
+      },
+      "next": "evaluate"
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the digest against every criterion. All pass — finish; any fail — loop back to compose with the named gaps.",
+      "prompt": "Open `{{workPath}}/reports/social-digest-latest.md` and `{{workPath}}/reports/social-digest-notes.md` with `read_artifact` and grade the digest. Check EACH criterion and write PASS/FAIL with a one-line reason:\n\n1. Every number in the digest appears in the notes (spot-check at least three).\n2. Each feed present in the notes is covered — or its silence is stated in one line.\n3. Mentions name their authors and quote them accurately.\n4. The engagement-movers section compares real counts from the notes, not impressions.\n5. There are 1-3 suggested next moves, and every ```gezel-action block is valid flat YAML with `kind`, `id`, `title`, `reason`, and — for fire-craftbook — `craftbookId: draft-social-post` only.\n6. The digest is tight enough to read over coffee: no padding, no repeated sections.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to task notes with `write_task_note`, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"compose\" })` to loop back. The compose step fixes exactly those gaps.\n\nNever route to finish while a criterion is unmet. After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      },
+      "next": "compose"
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "Stamp the summary note and stop.",
+      "prompt": "Write a one-paragraph DONE summary with `write_task_note`: the digest artifact paths (the dated file and `{{workPath}}/reports/social-digest-latest.md`), the headline in one line, how many mentions deserve a reply, and how many one-click actions the digest carries. Report DONE.",
+      "suggestedRole": "omroeper",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      },
+      "terminal": true
+    }
+  ],
+  "version": "1.0.3",
+  "releasedAt": "2026-09-05T03:30:00Z",
+  "minGezelVersion": "1.26233"
+}

package/data/craftbook-templates/so/social-digest/versions/1.0.3/test.json

@@ -0,0 +1,168 @@
+{
+  "schemaVersion": 1,
+  "title": "Overnight digest grounded in a synced Bluesky corpus",
+  "objective": "Prove that social-digest reads the synced corpus records, names the people who mentioned us, reports engagement movers without inventing a number, and leaves one-click follow-up actions.",
+  "tags": [
+    "corpus"
+  ],
+  "prompt": "Run the Social Digest craftbook for this project. Treat every synced record in the artifacts drawer as inside the digest window (the lookback parameter is set very wide for this eval). Write the digest artifact, ground every number in the synced records via your scan notes, name the people who mentioned us, and close with suggested next moves carrying at least one one-click gezel-action block.",
+  "setup": {
+    "projectName": "Social Digest Eval",
+    "about": "Overnight digest eval for a small furniture workshop's Bluesky presence. The artifacts drawer carries a synced corpus of the account's posts plus two mentions; the workspace carries the post index.",
+    "missionObjectives": "Produce the morning social digest as a real craftbook task: scan notes first, then the digest with per-feed activity, both mentions named and quoted, engagement movers compared from real counts, and 1-3 suggested next moves with gezel-action blocks referencing only the draft-social-post craftbook.",
+    "files": [
+      {
+        "path": "posts/index.json",
+        "content": "{\n  \"entries\": [\n    {\n      \"slug\": \"shop-refresh\",\n      \"folder\": \"posts/2026-07-20-shop-refresh\",\n      \"title\": \"The shop got a fresh coat\",\n      \"status\": \"published\",\n      \"platforms\": [\"bluesky\"],\n      \"created\": \"2026-07-20\"\n    },\n    {\n      \"slug\": \"meet-the-makers\",\n      \"folder\": \"posts/2026-08-01-meet-the-makers\",\n      \"title\": \"Meet the makers\",\n      \"status\": \"published\",\n      \"platforms\": [\"bluesky\"],\n      \"created\": \"2026-08-01\"\n    },\n    {\n      \"slug\": \"oak-bench-run\",\n      \"folder\": \"posts/2026-08-07-oak-bench-run\",\n      \"title\": \"A short run of oak benches\",\n      \"status\": \"published\",\n      \"platforms\": [\"bluesky\"],\n      \"created\": \"2026-08-07\"\n    }\n  ]\n}\n"
+      },
+      {
+        "path": "data/bluesky/_meta.json",
+        "surface": "artifact",
+        "content": "{\n  \"bindingId\": \"bluesky-workshop\",\n  \"typeId\": \"bluesky-posts\",\n  \"displayName\": \"Bluesky — @bankenbeitel.bsky.social\",\n  \"completeness\": \"window\",\n  \"lastSyncedAt\": \"2026-08-12T05:00:00Z\"\n}\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-07/2026-07-20-shop-refresh.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3kshop001\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-07-20T09:05:00Z\nlikes: 14\nreposts: 2\nreplies: 1\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nThe shop got a fresh coat over the weekend. Same bench, better light. Come by and see.\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-07/2026-07-24-sharpening-night.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3ksharp01\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-07-24T18:30:00Z\nlikes: 9\nreposts: 1\nreplies: 0\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nSharpening night. Every chisel in the rack gets its turn.\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-07/2026-07-27-glue-up.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3kglue001\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-07-27T11:10:00Z\nlikes: 11\nreposts: 0\nreplies: 2\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nBig glue-up day. Twelve clamps, one tabletop, no room for lunch on the bench.\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-08/2026-08-01-meet-the-makers.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3kmake001\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-08-01T10:00:00Z\nlikes: 63\nreposts: 19\nreplies: 8\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nMeet the makers: three of us, one bench, thirty years of chisels between us.\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-08/2026-08-04-workbench-tour.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3ktour001\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-08-04T09:20:00Z\nlikes: 22\nreposts: 4\nreplies: 3\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nA thirty-second tour of the bench: shooting board, bench hooks, and the drawer of mystery screws.\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-08/2026-08-07-oak-bench-run.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3koak0001\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-08-07T08:45:00Z\nlikes: 37\nreposts: 11\nreplies: 5\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nA short run of oak benches: six pieces, numbered and signed. First come, first seated.\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-08/2026-08-09-offcut-boxes.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3kbox0001\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-08-09T16:00:00Z\nlikes: 8\nreposts: 0\nreplies: 1\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nOffcut boxes back in the window. Small wood, small prices.\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-08/2026-08-10-finish-test.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3kfin0001\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-08-10T13:30:00Z\nlikes: 12\nreposts: 2\nreplies: 4\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nThree finishes on the same oak offcut: raw, oiled, soaped. Which would you take home?\n"
+      },
+      {
+        "path": "data/bluesky/posts/2026-08/2026-08-11-bench-dog.md",
+        "surface": "artifact",
+        "content": "---\nrecord: post\nplatform: bluesky\npostId: at://did:plc:bankenbeitel/app.bsky.feed.post/3kdog0001\nauthor: bankenbeitel.bsky.social\ncreatedAt: 2026-08-11T09:00:00Z\nlikes: 5\nreposts: 0\nreplies: 0\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nNew bench dogs turned from leftover beech. The old ones earned their retirement.\n"
+      },
+      {
+        "path": "data/bluesky/mentions/2026-08/2026-08-10-meike-commission.md",
+        "surface": "artifact",
+        "content": "---\nrecord: mention\nplatform: bluesky\npostId: at://did:plc:meike/app.bsky.feed.post/3kmen0001\nauthor: meike.bsky.social\ninReplyTo: at://did:plc:bankenbeitel/app.bsky.feed.post/3kmake001\ncreatedAt: 2026-08-10T18:40:00Z\nlikes: 9\nreposts: 1\nreplies: 2\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nWent by the workshop after seeing this — walked out with a stool and a story. Do you take commissions for a matching bench?\n"
+      },
+      {
+        "path": "data/bluesky/mentions/2026-08/2026-08-11-stef-vandam-question.md",
+        "surface": "artifact",
+        "content": "---\nrecord: mention\nplatform: bluesky\npostId: at://did:plc:stefvandam/app.bsky.feed.post/3kmen0002\nauthor: stef-vandam.bsky.social\ninReplyTo: at://did:plc:bankenbeitel/app.bsky.feed.post/3kfin0001\ncreatedAt: 2026-08-11T20:15:00Z\nlikes: 3\nreposts: 0\nreplies: 1\nmetrics_updated_at: 2026-08-12T05:00:00Z\n---\nSoaped, every time. Does the soap finish hold up on a kitchen table, or is that asking for water rings?\n"
+      }
+    ],
+    "craftbookParams": {
+      "lookbackHours": "87600"
+    },
+    "worker": {
+      "name": "Nora",
+      "role": "Omroeper"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "The digest artifact exists at its stable path, names both mention authors, compares real engagement counts, and carries at least one gezel-action block; the scan notes artifact grounds every number.",
+    "checks": [
+      {
+        "kind": "minBytes",
+        "file": "{{task.dir}}/reports/social-digest-notes.md",
+        "bytes": 150,
+        "artifact": true
+      },
+      {
+        "kind": "minBytes",
+        "file": "{{task.dir}}/reports/social-digest-latest.md",
+        "bytes": 400,
+        "artifact": true
+      },
+      {
+        "kind": "contains",
+        "file": "{{task.dir}}/reports/social-digest-latest.md",
+        "pattern": "meike",
+        "flags": "i",
+        "label": "names the first mention author",
+        "artifact": true
+      },
+      {
+        "kind": "contains",
+        "file": "{{task.dir}}/reports/social-digest-latest.md",
+        "pattern": "stef-vandam|stef vandam",
+        "flags": "i",
+        "label": "names the second mention author",
+        "artifact": true
+      },
+      {
+        "kind": "contains",
+        "file": "{{task.dir}}/reports/social-digest-latest.md",
+        "pattern": "```gezel-action",
+        "label": "carries at least one one-click action",
+        "artifact": true
+      },
+      {
+        "kind": "contains",
+        "file": "{{task.dir}}/reports/social-digest-latest.md",
+        "pattern": "meet-the-makers|Meet the makers",
+        "label": "the standout post shows up in the digest",
+        "artifact": true
+      }
+    ],
+    "taskGraph": {
+      "requireCraftbookTask": true,
+      "requireTerminalStep": true
+    },
+    "unchangedFixtures": [
+      "posts/index.json"
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "tasks/eval/reports/social-digest-latest.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "grounding",
+        "description": "Every count in the digest appears in the seeded records; mentions are quoted accurately and attributed to meike.bsky.social and stef-vandam.bsky.social."
+      },
+      {
+        "name": "structure",
+        "description": "The four sections are present and each does its job: per-feed activity, mention triage, engagement movers compared from real counts, and suggested next moves."
+      },
+      {
+        "name": "actionability",
+        "description": "The gezel-action blocks are valid flat YAML with stable id slugs, reference only draft-social-post, and the suggestions follow from the evidence (e.g. people-first posts outperforming)."
+      }
+    ],
+    "contextNote": "The digest is an artifacts-drawer report; the lookback parameter was set very wide so all seeded records fall inside the window."
+  },
+  "qualityFocus": [
+    "every metric traceable to a synced record",
+    "mention triage names authors and quotes them",
+    "one-click actions valid and never inventing craftbook ids"
+  ]
+}