@dailephd/my-dev-kit-lab 0.4.4 → 0.4.6

package/dist/scripts/security/validate.js

@@ -1,266 +0,0 @@
-#!/usr/bin/env node
-import path from "node:path";
-import { runSecurityValidation } from "../../src/securityValidation/validate/runSecurityValidation.js";
-import { resolveValidationTarget, reportFilenamePrefix } from "../../src/securityValidation/validate/resolveTarget.js";
-import { buildSecurityReportFromSummary } from "../../src/securityValidation/report/buildSecurityReport.js";
-import { renderTextReport } from "../../src/securityValidation/report/renderSecurityReport.js";
-import { writeSecurityReportFiles } from "../../src/securityValidation/report/writeSecurityReportFiles.js";
-import { parseSecurityValidateArgs, normalizeSecurityValidateConfig, applyProfileDefaultChecksIfApplicable, } from "../../src/securityValidation/validate/cliOptions.js";
-import { resolveAttackProfile } from "../../src/securityValidation/attackScenarios/attackProfile.js";
-import { findingsBreachFailOnThreshold } from "../../src/securityValidation/validate/verdict.js";
-import { resolveToolRoot } from "./resolveToolRoot.js";
-import { validateAndroidTarget } from "../../src/mobile/android/validate/validateAndroidTarget.js";
-import { toAndroidReportModel } from "../../src/mobile/android/report/model.js";
-import { renderAndroidTextReport } from "../../src/mobile/android/report/renderAndroidReport.js";
-import { writeAndroidReportFiles } from "../../src/mobile/android/report/writeAndroidReportFiles.js";
-const USAGE = "Usage: npm run security:validate -- [--target <path>] [--out <dir>] [--report-prefix <name>] " +
-    "[--checks deps,package,static,cli-adversarial,fuzz,boundary,subprocess,secrets,network] " +
-    "[--profile node-cli-package|local-tool|npm-package|android] [--format text,json] [--fail-on blocker|high|medium|low] " +
-    "[--android-gradle-operations wrapper-version,tasks,assemble-debug,unit-test-debug,lint-debug] " +
-    "[--android-external-tools semgrep,osv,android-lint,dependency-check] " +
-    "[--android-external-network deny|allow-requested]\n" +
-    "\n" +
-    "Android profile:\n" +
-    "  --profile android performs static, read-only Android project detection, manifest parsing,\n" +
-    "  permission/exported-component/intent-filter/deep-link audits, static Gradle metadata\n" +
-    "  extraction, and (as of v0.4.1 Batch 8) eleven internal advanced security checks (network\n" +
-    "  security config, backup/release configuration, hardcoded secrets, signing configuration,\n" +
-    "  WebView, FileProvider, sensitive storage/logging, clipboard, and Firebase/Google services).\n" +
-    "  Gradle and external tools are never executed by default.\n" +
-    "  --android-gradle-operations explicitly opts into running ONLY the listed allowlisted Gradle\n" +
-    "  operations (wrapper-version, tasks, assemble-debug, unit-test-debug, lint-debug) via the\n" +
-    "  project's own Gradle wrapper. Arbitrary Gradle tasks cannot be passed. This option is only\n" +
-    "  valid together with --profile android.\n" +
-    "  --android-external-tools explicitly opts into running ONLY the listed allowlisted optional\n" +
-    "  external security tools (semgrep, osv, android-lint, dependency-check). No arbitrary tool\n" +
-    "  names, commands, or arguments can be passed. This option is only valid together with\n" +
-    "  --profile android.\n" +
-    "  --android-external-network controls whether a requested tool may use network access.\n" +
-    "  Defaults to deny (osv is skipped unless supported offline data is available; semgrep,\n" +
-    "  android-lint, and dependency-check always run offline/no-update regardless of this flag).\n" +
-    "  allow-requested authorizes network only for an explicitly requested tool whose Batch 7\n" +
-    "  contract supports it (currently only osv). This option is only valid together with\n" +
-    "  --profile android.\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-gradle-operations wrapper-version,tasks\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-external-tools semgrep,android-lint\n" +
-    "  Example: npm run security:validate -- --target \"<android-project-path>\" --profile android --android-external-tools osv --android-external-network allow-requested";
-// Parse CLI arguments from process.argv (after the node/tsx and script path).
-const rawArgs = process.argv.slice(2);
-const toolRoot = resolveToolRoot(import.meta.url);
-// Help deliberately wins over every other argument. It must remain a
-// no-work path: no target/default resolution, option normalization, report
-// directory creation, validation orchestration, or subprocess execution.
-if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
-    console.log(USAGE);
-    process.exitCode = 0;
-    process.exit(0);
-}
-let args;
-let config;
-try {
-    args = parseSecurityValidateArgs(rawArgs);
-    config = normalizeSecurityValidateConfig(args, toolRoot);
-    // v0.2.2 Batch 5: --profile with no --checks uses that profile's declared
-    // default checks. No-op unless the user passed --profile without --checks
-    // (see applyProfileDefaultChecksIfApplicable's guard) — the true no-flag
-    // case and any explicit --checks case are always unaffected. Skipped for
-    // "android": that profile does not use the classic --checks pipeline.
-    if (config.profile !== "android") {
-        config = applyProfileDefaultChecksIfApplicable(config, resolveAttackProfile(config.profile).defaultCheckIds);
-    }
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: ${msg}`);
-    console.error(USAGE);
-    process.exitCode = 2;
-    process.exit(2);
-}
-// Resolve and validate target early so we can fail fast with a clean error.
-let target;
-try {
-    target = resolveValidationTarget(args.target, toolRoot);
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: ${msg}`);
-    console.error(USAGE);
-    process.exitCode = 1;
-    process.exit(1);
-}
-console.log("=".repeat(60));
-console.log("my-dev-kit-lab security:validate");
-console.log("=".repeat(60));
-console.log(`Tool root  : ${toolRoot}`);
-if (!target.isSelf) {
-    console.log(`Target     : ${target.targetRoot}`);
-    if (target.packageName)
-        console.log(`Package    : ${target.packageName}${target.packageVersion ? `@${target.packageVersion}` : ""}`);
-}
-else {
-    console.log(`Mode       : self-validation`);
-}
-console.log(`Profile    : ${config.profile}`);
-// ---------------------------------------------------------------------------
-// v0.4.0 Batch 5 — Android profile path.
-//
-// A separate orchestrator (not the classic check-group/attack-scenario
-// pipeline below) because the Android check/finding/status vocabulary
-// established in Batches 1-4 does not fit SecurityCheckId/SecurityCheckResult.
-// Same command, same --profile flag, same reports/security/ output root.
-// ---------------------------------------------------------------------------
-if (config.profile === "android") {
-    if (config.androidGradleOperationIds.length > 0) {
-        console.log(`Gradle ops : ${config.androidGradleOperationIds.join(", ")} (explicitly requested — will execute via the target's Gradle wrapper)`);
-    }
-    else {
-        console.log(`Gradle ops : (none requested — static-only validation, zero Gradle process execution)`);
-    }
-    // v0.4.1 Batch 8 — external tools remain explicit opt-in, mirroring Gradle
-    // operations exactly. "allow-requested" (the CLI-facing value) maps to the
-    // Batch 7 dispatcher's "allow-for-requested-tool" network policy value.
-    const externalNetworkPolicy = config.androidExternalNetworkPolicy === "allow-requested" ? "allow-for-requested-tool" : "deny";
-    if (config.androidExternalToolIds.length > 0) {
-        console.log(`External   : ${config.androidExternalToolIds.join(", ")} (explicitly requested — network policy: ${config.androidExternalNetworkPolicy})`);
-    }
-    else {
-        console.log(`External   : (none requested — zero external-tool process execution)`);
-    }
-    console.log("");
-    const reportsDir = config.out;
-    let result;
-    try {
-        result = await validateAndroidTarget({
-            toolRoot,
-            targetPath: args.target,
-            requestedGradleOperationIds: config.androidGradleOperationIds,
-            requestedExternalToolIds: config.androidExternalToolIds,
-            externalNetworkPolicy: externalNetworkPolicy,
-            externalToolArtifactRoot: path.join(reportsDir, "external-tools"),
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`\nERROR: Android validation failed to run: ${msg}`);
-        process.exitCode = 3;
-        process.exit(3);
-    }
-    const reportModel = toAndroidReportModel(result, {
-        profile: config.profile,
-        requestedGradleOperations: config.androidGradleOperationIds,
-        requestedExternalTools: config.androidExternalToolIds,
-        externalNetworkPolicy: config.androidExternalNetworkPolicy,
-    });
-    const textReport = renderAndroidTextReport(reportModel);
-    const prefix = args.reportPrefix ??
-        reportFilenamePrefix({
-            isSelf: result.target.local.isSelf,
-            packageName: result.target.local.packageName,
-            packageVersion: result.target.local.packageVersion,
-            targetRoot: result.target.local.targetRoot,
-        });
-    let writtenPaths;
-    try {
-        ({ writtenPaths } = writeAndroidReportFiles({ outDir: reportsDir, prefix, report: reportModel, formats: config.formats }));
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`\nERROR: Failed to write Android report files: ${msg}`);
-        console.error("Validation completed but the report could not be written. The in-memory result was not persisted.");
-        process.exitCode = 4;
-        process.exit(4);
-    }
-    console.log(textReport);
-    console.log(`\nReports written:`);
-    for (const p of writtenPaths) {
-        console.log(`  ${p}`);
-    }
-    const blockerExists = result.verdict === "not-ready-security-blocker-remains";
-    const inconclusive = result.verdict === "inconclusive-audit-environment-incomplete";
-    if (blockerExists) {
-        console.error("\nExit 1 — security blocker remains.");
-        process.exitCode = 1;
-    }
-    else if (inconclusive) {
-        console.warn("\nExit 2 — android environment incomplete.");
-        process.exitCode = 2;
-    }
-    else {
-        console.log("\nExit 0 — validation completed.");
-        process.exitCode = 0;
-    }
-}
-else {
-    // ---------------------------------------------------------------------------
-    // Classic check-group/attack-scenario pipeline (unchanged from prior versions).
-    // ---------------------------------------------------------------------------
-    if (!config.checksWereDefault) {
-        console.log(`Checks     : ${config.checks.join(", ")}`);
-    }
-    if (config.plannedChecksRequested.length > 0) {
-        console.log(`Note       : ${config.plannedChecksRequested.join(", ")} are routed through the attack-scenario framework rather than the classic check-group runners. Review the attack-scenario section in the report for their concrete results.`);
-    }
-    console.log("");
-    const summary = await runSecurityValidation({
-        cwd: toolRoot,
-        targetPath: args.target,
-        fuzzIterations: parseInt(process.env["FUZZ_ITERATIONS"] ?? "50", 10),
-        fuzzSeed: parseInt(process.env["FUZZ_SEED"] ?? "0xDEADBEEF", 16),
-        // Full selection (implemented + planned/attack-scenario ids) — the runner
-        // gates both implemented check groups and attack-scenario checks off the
-        // same selectedChecks set.
-        selectedChecks: config.checks,
-        profile: config.profile,
-    });
-    // v0.2.2 Batch 5: --fail-on breach is additive to (never a substitute for)
-    // the existing verdict-based exit decision below — it can only escalate
-    // exit 0 to exit 1 (e.g. --fail-on medium/low catching minor/informational
-    // findings the verdict policy doesn't already treat as blocking), never
-    // downgrade an existing blocker.
-    const failOnBreached = findingsBreachFailOnThreshold(summary.findings, config.failOnThreshold);
-    // Build report object
-    const report = buildSecurityReportFromSummary(summary, {
-        profile: config.profile,
-        selectedChecks: config.checks,
-        failOnThreshold: config.failOnThreshold,
-        formats: config.formats,
-        failOnBreached,
-    });
-    const textReport = renderTextReport(report);
-    // Determine output directory
-    const reportsDir = config.out;
-    // Determine report filename prefix
-    const prefix = args.reportPrefix ?? reportFilenamePrefix(target);
-    const { writtenPaths } = writeSecurityReportFiles({
-        outDir: reportsDir,
-        prefix,
-        report,
-        formats: config.formats,
-    });
-    // Print report to stdout
-    console.log(textReport);
-    console.log(`\nReports written:`);
-    for (const p of writtenPaths) {
-        console.log(`  ${p}`);
-    }
-    // Exit code based on verdict, escalated (never downgraded) by --fail-on.
-    const blockerExists = summary.verdict === "not-ready-security-blocker-remains";
-    const inconclusive = summary.verdict === "inconclusive-audit-environment-incomplete";
-    if (blockerExists) {
-        console.error("\nExit 1 — security blocker remains.");
-        process.exitCode = 1;
-    }
-    else if (inconclusive) {
-        console.warn("\nExit 2 — audit environment incomplete.");
-        process.exitCode = 2;
-    }
-    else if (failOnBreached) {
-        console.error(`\nExit 1 — --fail-on ${config.failOnThreshold} threshold breached.`);
-        process.exitCode = 1;
-    }
-    else {
-        console.log("\nExit 0 — validation completed.");
-        process.exitCode = 0;
-    }
-}

package/dist/scripts/verify-benchmarks.js

@@ -1,202 +0,0 @@
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { REQUIRED_BENCHMARK_PROJECT_IDS, parseBenchmarkProjectProfiles, validateAnswerKey, validateBenchmarkProjectProfiles } from "../src/evaluation/benchmarkMetadata.js";
-const requiredProjects = REQUIRED_BENCHMARK_PROJECT_IDS;
-const projectRequiredPaths = {
-    "todo-ts": [
-        "README.md",
-        "package.json",
-        "tsconfig.json",
-        "src/taskStore.ts",
-        "src/taskService.ts",
-        "src/index.ts",
-        "tests/taskService.test.ts"
-    ],
-    "todo-python": [
-        "README.md",
-        "src/task_store.py",
-        "src/task_service.py",
-        "src/__init__.py",
-        "tests/test_task_service.py"
-    ],
-    "todo-js": [
-        "README.md",
-        "package.json",
-        "src/taskStore.js",
-        "src/taskService.js",
-        "src/index.js",
-        "tests/taskService.test.js"
-    ],
-    "todo-mixed-ts-py": [
-        "README.md",
-        "package.json",
-        "tsconfig.json",
-        "src/taskCli.ts",
-        "python/task_service.py",
-        "tests/mixedBoundary.test.ts"
-    ],
-    "task-workflow-medium-ts": [
-        "README.md",
-        "package.json",
-        "tsconfig.json",
-        "src/store/taskStore.ts",
-        "src/services/createTask.ts",
-        "src/services/importTasks.ts",
-        "src/services/summarizeTasks.ts",
-        "tests/importTasks.test.ts"
-    ],
-    "task-analytics-large-mixed": [
-        "README.md",
-        "ts/package.json",
-        "ts/tsconfig.json",
-        "ts/src/services/buildAnalyticsSnapshot.ts",
-        "ts/src/reporting/formatTaskHealthReport.ts",
-        "ts/tests/buildAnalyticsSnapshot.test.ts",
-        "py/task_analytics/metrics.py",
-        "py/task_analytics/quality.py",
-        "py/tests/test_reporting.py"
-    ]
-};
-function walk(dir) {
-    const entries = readdirSync(dir, { withFileTypes: true });
-    const files = [];
-    for (const entry of entries) {
-        const fullPath = path.join(dir, entry.name);
-        if (entry.isDirectory()) {
-            files.push(...walk(fullPath));
-        }
-        else {
-            files.push(fullPath);
-        }
-    }
-    return files;
-}
-export function validateBenchmarks(rootDir = process.cwd()) {
-    const checks = [];
-    const errors = [];
-    const contractsDir = path.join(rootDir, "benchmarks", "contracts");
-    const projectsDir = path.join(rootDir, "benchmarks", "projects");
-    const behaviorPath = path.join(contractsDir, "todo-behavior.md");
-    const casesPath = path.join(contractsDir, "todo-benchmark-case.json");
-    const profilesPath = path.join(contractsDir, "benchmark-project-profiles.json");
-    if (!existsSync(behaviorPath)) {
-        errors.push("Missing contract file: benchmarks/contracts/todo-behavior.md");
-    }
-    else {
-        checks.push("found todo-behavior.md");
-    }
-    let cases = [];
-    if (!existsSync(casesPath)) {
-        errors.push("Missing contract file: benchmarks/contracts/todo-benchmark-case.json");
-    }
-    else {
-        try {
-            cases = JSON.parse(readFileSync(casesPath, "utf8"));
-            checks.push("parsed todo-benchmark-case.json");
-        }
-        catch (error) {
-            errors.push(`Invalid JSON in todo-benchmark-case.json: ${error.message}`);
-        }
-    }
-    if (!existsSync(profilesPath)) {
-        errors.push("Missing contract file: benchmarks/contracts/benchmark-project-profiles.json");
-    }
-    else {
-        try {
-            const profiles = parseBenchmarkProjectProfiles(JSON.parse(readFileSync(profilesPath, "utf8")));
-            const profileErrors = validateBenchmarkProjectProfiles(profiles, rootDir);
-            errors.push(...profileErrors);
-            if (profileErrors.length === 0) {
-                checks.push("validated benchmark-project-profiles.json");
-            }
-        }
-        catch (error) {
-            errors.push(`Invalid benchmark-project-profiles.json: ${error.message}`);
-        }
-    }
-    const ids = new Set();
-    for (const benchmarkCase of cases) {
-        if (ids.has(benchmarkCase.id)) {
-            errors.push(`Duplicate benchmark case id: ${benchmarkCase.id}`);
-        }
-        ids.add(benchmarkCase.id);
-    }
-    if (cases.length > 0 && errors.every((error) => !error.startsWith("Duplicate benchmark case id:"))) {
-        checks.push("benchmark case ids are unique");
-    }
-    for (const project of requiredProjects) {
-        const projectDir = path.join(projectsDir, project);
-        if (!existsSync(projectDir) || !statSync(projectDir).isDirectory()) {
-            errors.push(`Missing benchmark project: benchmarks/projects/${project}`);
-            continue;
-        }
-        checks.push(`found benchmark project ${project}`);
-        for (const relPath of projectRequiredPaths[project]) {
-            const fullPath = path.join(projectDir, relPath);
-            if (!existsSync(fullPath)) {
-                errors.push(`Missing required file for ${project}: benchmarks/projects/${project}/${relPath}`);
-            }
-        }
-    }
-    for (const benchmarkCase of cases) {
-        if (!benchmarkCase.answerKey) {
-            errors.push(`Case ${benchmarkCase.id} does not define answerKey`);
-        }
-        else {
-            errors.push(...validateAnswerKey(benchmarkCase.answerKey, `Case ${benchmarkCase.id}`));
-        }
-        if (!Array.isArray(benchmarkCase.expectedSymbols) || benchmarkCase.expectedSymbols.length === 0) {
-            errors.push(`Case ${benchmarkCase.id} does not define expectedSymbols`);
-        }
-        for (const [project, expectedFiles] of Object.entries(benchmarkCase.expectedFilesByProject ?? {})) {
-            if (!requiredProjects.includes(project)) {
-                errors.push(`Case ${benchmarkCase.id} references unknown project id: ${project}`);
-                continue;
-            }
-            if (!Array.isArray(expectedFiles) || expectedFiles.length === 0) {
-                errors.push(`Case ${benchmarkCase.id} does not define expected files for ${project}`);
-                continue;
-            }
-            for (const expectedFile of expectedFiles) {
-                const fullPath = path.join(rootDir, "benchmarks", "projects", project, expectedFile);
-                if (!existsSync(fullPath)) {
-                    errors.push(`Case ${benchmarkCase.id} references missing file: benchmarks/projects/${project}/${expectedFile}`);
-                }
-            }
-        }
-    }
-    for (const project of requiredProjects) {
-        const projectDir = path.join(projectsDir, project);
-        if (!existsSync(projectDir)) {
-            continue;
-        }
-        const forbidden = walk(projectDir).filter((fullPath) => {
-            const rel = path.relative(projectDir, fullPath).replace(/\\/g, "/");
-            return /(^|\/)(node_modules|dist|build|coverage|lab-output)(\/|$)/.test(rel);
-        });
-        if (forbidden.length > 0) {
-            errors.push(`Forbidden generated output found in ${project}: ${forbidden[0]}`);
-        }
-    }
-    return { ok: errors.length === 0, errors, checks };
-}
-function printSummary(result) {
-    console.log(`Benchmark verification ${result.ok ? "passed" : "failed"}.`);
-    console.log(`Checks: ${result.checks.length}`);
-    if (result.errors.length > 0) {
-        console.log(`Errors: ${result.errors.length}`);
-        for (const error of result.errors) {
-            console.log(`- ${error}`);
-        }
-    }
-}
-const currentFile = fileURLToPath(import.meta.url);
-const invokedPath = process.argv[1] ? path.resolve(process.argv[1]) : "";
-if (invokedPath === currentFile) {
-    const result = validateBenchmarks();
-    printSummary(result);
-    if (!result.ok) {
-        process.exitCode = 1;
-    }
-}

package/examples/demo-report-input.json

@@ -1,78 +0,0 @@
-{
-  "reportId": "demo-report",
-  "title": "Benchmark Validation Demo Report",
-  "projectName": "my-dev-kit-lab",
-  "benchmarkProject": "todo-ts",
-  "workflowName": "benchmark validation demo",
-  "generatedAt": "2026-06-10T15:00:00.000Z",
-  "summary": "Deterministic sample report for Prompt 2 report rendering and screenshot capture. This report does not claim token-savings evaluation.",
-  "steps": [
-    {
-      "id": "load-contracts",
-      "label": "Load benchmark contracts",
-      "command": "npm run verify:benchmarks",
-      "status": "pass",
-      "durationMs": 42,
-      "notes": "Validated benchmark contract structure."
-    },
-    {
-      "id": "run-project-tests",
-      "label": "Run benchmark project tests",
-      "command": "npm run test:benchmarks",
-      "status": "pass",
-      "durationMs": 118,
-      "notes": "Todo benchmark behavior stayed aligned."
-    },
-    {
-      "id": "prepare-report",
-      "label": "Prepare report artifacts",
-      "command": "npm run capture-demo-report",
-      "status": "pass",
-      "durationMs": 35,
-      "notes": "No token-savings metrics are reported in this demo."
-    }
-  ],
-  "metrics": [
-    {
-      "id": "benchmark-project-count",
-      "label": "Benchmark projects",
-      "value": 4,
-      "interpretation": "Prompt 1 benchmark suite is available."
-    },
-    {
-      "id": "step-count",
-      "label": "Workflow steps",
-      "value": 3,
-      "interpretation": "Demo workflow uses a small deterministic sequence."
-    },
-    {
-      "id": "warning-count",
-      "label": "Warnings",
-      "value": 1,
-      "interpretation": "This demo explicitly notes that token comparison is not implemented yet."
-    },
-    {
-      "id": "artifact-count",
-      "label": "Artifacts declared",
-      "value": 2,
-      "interpretation": "JSON and HTML are always expected before optional PNG capture."
-    }
-  ],
-  "artifacts": [
-    {
-      "id": "report-json",
-      "label": "Demo report JSON",
-      "path": "lab-output/demo-report/demo-report.json",
-      "kind": "json"
-    },
-    {
-      "id": "report-html",
-      "label": "Demo report HTML",
-      "path": "lab-output/demo-report/demo-report.html",
-      "kind": "html"
-    }
-  ],
-  "warnings": [
-    "Token-savings evaluation is not implemented in Prompt 2."
-  ]
-}

package/examples/lab-demo-cases.json

@@ -1,35 +0,0 @@
-[
-  {
-    "id": "todo-ts-create-task-demo",
-    "title": "Todo TS create task demo retrieval",
-    "benchmarkProject": "todo-ts",
-    "projectProfileRef": "todo-ts",
-    "targetRoot": "benchmarks/projects/todo-ts",
-    "sourceRoots": ["src", "tests"],
-    "query": "create task deterministic id task-1",
-    "expectedFiles": ["src/taskService.ts", "src/taskStore.ts"],
-    "expectedSymbols": ["createTask", "TaskService"],
-    "answerKey": {
-      "expectedFiles": ["src/taskService.ts", "src/taskStore.ts"],
-      "expectedSymbols": ["createTask", "TaskService"],
-      "expectedFacts": [
-        {
-          "id": "create-deterministic-id",
-          "text": "createTask assigns deterministic IDs such as task-1 and task-2.",
-          "weight": 1,
-          "required": true
-        },
-        {
-          "id": "create-stores-incomplete-task",
-          "text": "createTask stores new tasks with completed set to false.",
-          "weight": 1,
-          "required": true
-        }
-      ],
-      "minimumCorrectFacts": 2,
-      "notes": "Demo metadata prepares later correctness scoring without changing the current lab-demo command."
-    },
-    "rawIncludeGlobs": ["src/**/*", "tests/**/*"],
-    "notes": "Small single-case lab demo fixture."
-  }
-]