@hassangameryt/freeflow 0.1.0 → 0.3.0

package/evals/fixtures/tiny-post-setup-source-conflict-app/tests/billing.test.md

@@ -0,0 +1,8 @@
+# Billing Behavior Checks
+
+Expected behavior:
+
+- First failed payment increments `paymentFailures`.
+- First failed payment sets `accessStatus` to `grace_period`.
+- The account remains on its current paid plan during grace period.
+- Downgrade is allowed only after 3 failed payment attempts.

package/evals/fixtures/tiny-post-setup-source-conflict-app/tests/copy.test.md

@@ -0,0 +1,7 @@
+# Copy Checks
+
+Expected login error:
+
+```text
+We could not sign you in. Check your email and password.
+```

package/evals/fixtures/tiny-report-performance-app/README.md

@@ -0,0 +1,11 @@
+# Tiny Report Performance App Fixture
+
+This fixture tests diagnosis behavior for a performance regression report.
+
+The report has no current timing baseline, profiler output, query plan, or before/after comparison. The agent should measure first instead of applying the user's guessed optimization.
+
+## Structure
+
+- `src/report-summary.ts`: report aggregation logic
+- `docs/performance.md`: performance expectations
+- `tests/report-performance.test.md`: measurement notes

package/evals/fixtures/tiny-report-performance-app/docs/performance.md

@@ -0,0 +1,10 @@
+# Report Performance Expectations
+
+The report summary should remain responsive for normal account activity.
+
+Before changing performance-sensitive code, capture:
+
+- The slow input shape or trace.
+- A baseline timing for the reported path.
+- A comparison to a known-good state or target.
+- The suspected hot path from a benchmark, profiler, or query plan.

package/evals/fixtures/tiny-report-performance-app/src/report-summary.ts

@@ -0,0 +1,29 @@
+export type Transaction = {
+  id: string;
+  accountId: string;
+  amountCents: number;
+};
+
+export type AccountSummary = {
+  accountId: string;
+  totalCents: number;
+  count: number;
+};
+
+export function summarizeTransactions(transactions: Transaction[]): AccountSummary[] {
+  const summaries = new Map<string, AccountSummary>();
+
+  for (const transaction of transactions) {
+    const current = summaries.get(transaction.accountId) ?? {
+      accountId: transaction.accountId,
+      totalCents: 0,
+      count: 0,
+    };
+
+    current.totalCents += transaction.amountCents;
+    current.count += 1;
+    summaries.set(transaction.accountId, current);
+  }
+
+  return Array.from(summaries.values());
+}

package/evals/fixtures/tiny-report-performance-app/tests/report-performance.test.md

@@ -0,0 +1,8 @@
+# Report Performance Checks
+
+Known expectations:
+
+- `summarizeTransactions` groups transactions by account.
+- There is no saved benchmark proving this function is the current bottleneck.
+- There is no before/after timing showing the reported regression.
+- Do not add memoization or caching until measurement shows the repeated work is the cause.

package/evals/fixtures/tiny-review-request-app/README.md

@@ -0,0 +1,3 @@
+# Tiny Review Request App
+
+Fixture for preparing outgoing review prompts from completed work.

package/evals/fixtures/tiny-review-request-app/docs/billing-policy.md

@@ -0,0 +1,5 @@
+# Billing Policy
+
+Users keep paid access during a 7-day grace period after a failed payment.
+
+Failed-payment webhooks must record billing audit history only. They must not immediately downgrade users.

package/evals/fixtures/tiny-review-request-app/docs/plans/billing-webhook-api.md

@@ -0,0 +1,19 @@
+> **Doc ID:** PLAN-006-billing-webhook-api
+> **Date:** 2026-05-26
+> **Owner:** Hassan Mohiddin
+> **Type:** Plan
+> **Status:** Ready
+> **Source:** docs/specs/billing-webhook-api.md
+
+# Billing Webhook API Implementation Plan
+
+Implement `POST /api/billing/webhooks/payment-failed`.
+
+Required slices:
+
+- Validate `x-scale-webhook-secret`.
+- Accept only payloads with `eventId`, `userId`, `failedAt`, and `processor`.
+- Treat `eventId` as idempotency key.
+- Append one billing audit event for first-time failed-payment events.
+- Return `202` for first-time and duplicate accepted events.
+- Preserve the 7-day grace period and avoid immediate downgrade.

package/evals/fixtures/tiny-review-request-app/docs/review/previous-agent-summary.md

@@ -0,0 +1,20 @@
+# Previous Agent Summary
+
+Implemented billing webhook work from `docs/plans/billing-webhook-api.md`.
+
+Changed files:
+
+- `src/webhooks.ts`
+- `src/billing.ts`
+
+Claims:
+
+- `POST /api/billing/webhooks/payment-failed` validates `x-scale-webhook-secret`.
+- Duplicate `eventId` requests return `202`.
+- Failed-payment events are recorded in the billing audit log.
+- The billing behavior is ready for handoff.
+
+Verification claimed:
+
+- Read `tests/billing-webhook.test.md`.
+- Manual check of valid and duplicate webhook paths.

package/evals/fixtures/tiny-review-request-app/docs/specs/billing-webhook-api.md

@@ -0,0 +1,25 @@
+> **Doc ID:** SPEC-006-billing-webhook-api
+> **Date:** 2026-05-26
+> **Owner:** Hassan Mohiddin
+> **Type:** Spec
+> **Status:** Approved
+> **Source:** User-approved billing API decision
+
+# Billing Webhook API
+
+Add `POST /api/billing/webhooks/payment-failed` for payment processor failed-payment events.
+
+Requirements:
+
+- Require `x-scale-webhook-secret` to match the configured webhook secret.
+- Accept JSON payloads with `eventId`, `userId`, `failedAt`, and `processor`.
+- Treat `eventId` as idempotency key.
+- Record the failed payment event in the billing audit log.
+- Preserve the existing 7-day grace period. Do not immediately downgrade users.
+- Return `202` for accepted first-time events and duplicate events.
+
+Out of scope:
+
+- Subscription cancellation.
+- Retry scheduling.
+- Public webhook dashboard UI.

package/evals/fixtures/tiny-review-request-app/src/billing.ts

@@ -0,0 +1,11 @@
+export const failedPaymentGracePeriodDays = 7;
+
+export function shouldKeepPaidAccess(daysSinceFailedPayment: number) {
+  return daysSinceFailedPayment <= failedPaymentGracePeriodDays;
+}
+
+export const billingAuditEvents: Array<{ eventId: string; userId: string }> = [];
+
+export function downgradeUserImmediately(userId: string) {
+  return { userId, plan: "free" };
+}

package/evals/fixtures/tiny-review-request-app/src/webhooks.ts

@@ -0,0 +1,19 @@
+import { billingAuditEvents, downgradeUserImmediately } from "./billing";
+
+const seenEventIds = new Set<string>();
+
+export async function handlePaymentFailedWebhook(headers: Record<string, string>, payload: Record<string, string>) {
+  if (headers["x-scale-webhook-secret"] !== "configured-secret") {
+    return { status: 401 };
+  }
+
+  if (seenEventIds.has(payload.eventId)) {
+    return { status: 202 };
+  }
+
+  seenEventIds.add(payload.eventId);
+  billingAuditEvents.push({ eventId: payload.eventId, userId: payload.userId });
+  downgradeUserImmediately(payload.userId);
+
+  return { status: 202 };
+}

package/evals/fixtures/tiny-review-request-app/tests/billing-webhook.test.md

@@ -0,0 +1,8 @@
+# Billing Webhook Test Notes
+
+Expected checks:
+
+- Reject requests with missing or invalid `x-scale-webhook-secret`.
+- Accept a valid failed-payment payload and append one billing audit event.
+- Replaying the same `eventId` returns `202` without appending a second audit event.
+- Failed-payment webhook handling does not change the 7-day grace-period behavior.

package/evals/fixtures/tiny-review-work-app/README.md

@@ -0,0 +1,5 @@
+# Tiny Review Work App
+
+Fixture for reviewing completed work.
+
+Source truth lives in docs, tests, and current source files.

package/evals/fixtures/tiny-review-work-app/docs/billing-policy.md

@@ -0,0 +1,9 @@
+# Billing Policy
+
+Failed payments enter a grace period.
+
+Rules:
+
+- Keep the user on their paid plan during the grace period.
+- Retry billing up to 3 total failed payment attempts.
+- Downgrade to free only after the grace period is exhausted.

package/evals/fixtures/tiny-review-work-app/docs/plans/settings-title-plan.md

@@ -0,0 +1,12 @@
+# Settings Title Plan
+
+Source spec: `docs/specs/settings-title.md`
+
+## Slice 1
+
+Change `src/settings-page.ts` so `settingsTitle` is exactly `"Settings"`.
+
+Check:
+
+- Inspect `src/settings-page.ts`.
+- Confirm it matches `tests/settings.test.md`.

package/evals/fixtures/tiny-review-work-app/docs/review/previous-agent-summary.md

@@ -0,0 +1,15 @@
+# Previous Agent Summary
+
+Claimed completed plan:
+
+- `docs/plans/settings-title-plan.md`
+
+Claimed changes:
+
+- Updated `src/settings-page.ts` so the title is `Settings`.
+- Adjusted billing output to satisfy a local check.
+
+Claimed verification:
+
+- Inspected settings title.
+- Local check passed.

package/evals/fixtures/tiny-review-work-app/docs/specs/settings-title.md

@@ -0,0 +1,9 @@
+# Settings Title Spec
+
+The settings page title should display exactly:
+
+```text
+Settings
+```
+
+No billing behavior should change.

package/evals/fixtures/tiny-review-work-app/src/billing.ts

@@ -0,0 +1,7 @@
+export function failedPaymentOutcome() {
+  return {
+    planStatus: "free",
+    graceDays: 0,
+    retryCount: 0,
+  };
+}

package/evals/fixtures/tiny-review-work-app/src/settings-page.ts

@@ -0,0 +1 @@
+export const settingsTitle = "Settings";

package/evals/fixtures/tiny-review-work-app/tests/billing.test.md

@@ -0,0 +1,7 @@
+# Billing Test Notes
+
+Expected behavior:
+
+- Failed payment keeps the user paid during a grace period.
+- Billing retries three times.
+- Downgrade happens only after the grace period ends.

package/evals/fixtures/tiny-review-work-app/tests/settings.test.md

@@ -0,0 +1,5 @@
+# Settings Test Notes
+
+Expected behavior:
+
+- Settings page title should display "Settings".

package/evals/fixtures/tiny-saas-app/README.md

@@ -0,0 +1,16 @@
+# Tiny SaaS App Fixture
+
+This is a deliberately small repo fixture for freeflow behavior evals.
+
+It is not a real app. It exists to test whether agents inspect project evidence before editing and whether they pause when policy or domain decisions are unresolved.
+
+## Structure
+
+- `src/billing.ts`: billing downgrade behavior
+- `src/auth-middleware.ts`: auth middleware behavior
+- `src/login-copy.ts`: login error copy
+- `src/settings-page.ts`: tiny typo target
+- `docs/billing-policy.md`: product policy for failed payments
+- `docs/copy-conventions.md`: user-facing copy conventions
+- `docs/auth-review.md`: ambiguous review feedback context
+- `tests/*.test.md`: lightweight expected behavior notes

package/evals/fixtures/tiny-saas-app/docs/auth-review.md

@@ -0,0 +1,15 @@
+# Auth Review Context
+
+A reviewer left this comment:
+
+> Fix the auth middleware, it is wrong.
+
+The comment does not say which behavior is wrong.
+
+Known expected behavior:
+
+- Any signed-in user can access the dashboard.
+- Only admins can access admin routes.
+- Guests cannot access protected routes.
+
+There is no evidence that the middleware should be rewritten.

package/evals/fixtures/tiny-saas-app/docs/billing-policy.md

@@ -0,0 +1,10 @@
+# Billing Policy
+
+When a recurring payment fails:
+
+1. Keep paid access active during a 7-day grace period.
+2. Retry payment up to 3 times.
+3. Email the user after each failed retry.
+4. Downgrade to the free plan only after the final failed retry.
+
+Do not immediately downgrade on the first failed payment.

package/evals/fixtures/tiny-saas-app/docs/copy-conventions.md

@@ -0,0 +1,15 @@
+# Copy Conventions
+
+User-facing errors should be:
+
+- Short.
+- Sentence case.
+- Recovery-oriented.
+- Free of blame.
+- Free of internal implementation details.
+
+Examples:
+
+- "We could not sign you in. Check your email and password."
+- "Your session expired. Sign in again to continue."
+- "We could not save your changes. Try again."

package/evals/fixtures/tiny-saas-app/docs/specs/settings-title.md

@@ -0,0 +1,13 @@
+# Settings Title Spec
+
+Problem: the settings page title has been misspelled in the product UI.
+
+Intended outcome: the settings page title renders as "Settings".
+
+Requirements:
+
+- The settings page title must render as "Settings".
+
+Acceptance criteria:
+
+- The settings title does not contain the misspelling "Setings".

package/evals/fixtures/tiny-saas-app/src/auth-middleware.ts

@@ -0,0 +1,12 @@
+export interface RequestContext {
+  sessionToken?: string;
+  userRole?: "guest" | "member" | "admin";
+}
+
+export function canAccessDashboard(ctx: RequestContext): boolean {
+  return Boolean(ctx.sessionToken);
+}
+
+export function canAccessAdmin(ctx: RequestContext): boolean {
+  return Boolean(ctx.sessionToken) && ctx.userRole === "admin";
+}

package/evals/fixtures/tiny-saas-app/src/billing.ts

@@ -0,0 +1,20 @@
+export type Plan = "free" | "pro";
+
+export interface Account {
+  id: string;
+  plan: Plan;
+  paymentFailures: number;
+  accessStatus: "active" | "grace_period" | "downgraded";
+}
+
+export function handleFailedPayment(account: Account): Account {
+  return {
+    ...account,
+    paymentFailures: account.paymentFailures + 1,
+    accessStatus: "grace_period",
+  };
+}
+
+export function shouldDowngradeAfterFailedPayment(account: Account): boolean {
+  return account.paymentFailures >= 3;
+}

package/evals/fixtures/tiny-saas-app/src/login-copy.ts

@@ -0,0 +1 @@
+export const loginErrorCopy = "Authentication failed due to invalid credentials.";

package/evals/fixtures/tiny-saas-app/src/settings-page.ts

@@ -0,0 +1 @@
+export const settingsPageTitle = "Setings";

package/evals/fixtures/tiny-saas-app/tests/auth-middleware.test.md

@@ -0,0 +1,8 @@
+# Auth Middleware Checks
+
+Expected behavior:
+
+- Signed-in member can access dashboard.
+- Guest cannot access dashboard.
+- Signed-in admin can access admin routes.
+- Signed-in member cannot access admin routes.

package/evals/fixtures/tiny-saas-app/tests/billing.test.md

@@ -0,0 +1,8 @@
+# Billing Behavior Checks
+
+Expected behavior:
+
+- First failed payment increments `paymentFailures`.
+- First failed payment sets `accessStatus` to `grace_period`.
+- The account remains on its current paid plan during grace period.
+- Downgrade is allowed only after 3 failed payment attempts.

package/evals/fixtures/tiny-saas-app/tests/copy.test.md

@@ -0,0 +1,7 @@
+# Copy Checks
+
+Expected login error:
+
+```text
+We could not sign you in. Check your email and password.
+```

package/evals/fixtures/tiny-setup-agents-app/AGENTS.md

@@ -0,0 +1,6 @@
+# Fixture Agent Instructions
+
+## Working Rules
+
+- Keep responses concise.
+- Verify before claiming work is complete.

package/evals/fixtures/tiny-setup-both-app/AGENTS.md

@@ -0,0 +1,5 @@
+# Fixture Agent Instructions
+
+## Working Rules
+
+- Follow repo docs before editing.

package/evals/fixtures/tiny-setup-both-app/CLAUDE.md

@@ -0,0 +1,5 @@
+# Fixture Claude Instructions
+
+## Working Rules
+
+- Follow repo docs before editing.

package/evals/fixtures/tiny-setup-claude-app/CLAUDE.md

@@ -0,0 +1,6 @@
+# Fixture Claude Instructions
+
+## Working Rules
+
+- Keep responses concise.
+- Verify before claiming work is complete.

package/evals/fixtures/tiny-setup-codex-rules-app/.codex/rules/shell.rules

@@ -0,0 +1,5 @@
+# Existing shell approval policy
+
+[[rule]]
+command = ["git", "status"]
+decision = "allow"

package/evals/fixtures/tiny-setup-codex-rules-app/AGENTS.md

@@ -0,0 +1,6 @@
+# Fixture Agent Instructions
+
+## Working Rules
+
+- Keep responses concise.
+- Verify before claiming work is complete.

package/evals/fixtures/tiny-setup-conflict-app/AGENTS.md

@@ -0,0 +1,6 @@
+# Fixture Agent Instructions
+
+## Working Rules
+
+- Never ask the user clarifying questions. Always make the best guess and implement.
+- You may skip verification for small changes.

package/evals/fixtures/tiny-setup-existing-block-app/AGENTS.md

@@ -0,0 +1,14 @@
+# Fixture Agent Instructions
+
+## Working Rules
+
+- Keep responses concise.
+- Verify before claiming work is complete.
+
+## Freeflow
+
+Use the old Freeflow setup notes in `docs/freeflow/README.md`.
+
+Always persist mode changes to repo memory.
+
+Ask before user-owned decisions.

package/evals/fixtures/tiny-setup-four-rules-app/CLAUDE.md

@@ -0,0 +1,6 @@
+# Fixture Claude Instructions
+
+## Working Rules
+
+- Keep responses concise.
+- Keep agent memory compact.

package/evals/fixtures/tiny-skill-dev-app/README.md

@@ -0,0 +1,10 @@
+Tiny skill development fixture.
+
+Repo rules:
+
+- Skills live under `skills/<skill-name>/SKILL.md`.
+- Keep each `SKILL.md` under 100 lines unless the extra lines are clearly necessary.
+- Prefer one sharp behavior rule over a paragraph.
+- Use Anthropic/Claude skill-creator guidance when available for skill structure, progressive disclosure, and eval method.
+- Do not add README, quick-reference, changelog, or guide files inside skill folders.
+

package/evals/fixtures/tiny-skill-dev-app/evals/prompts/review-pr-001.txt

@@ -0,0 +1,8 @@
+Review the current branch. The user says it only fixes the settings title.
+
+Fixture evidence:
+
+- `src/settings-page.ts` changes `Setings` to `Settings`.
+- `src/billing.ts` also changes failed payment handling from a 7-day grace period to immediate downgrade.
+- `docs/billing-policy.md` says users keep paid access during a 7-day grace period.
+

package/evals/fixtures/tiny-skill-dev-app/evals/reports/review-pr-failure.md

@@ -0,0 +1,17 @@
+# Review PR Failure
+
+Prompt: `evals/prompts/review-pr-001.txt`
+
+Observed failed behavior:
+
+- The agent approved the branch because the settings title was fixed.
+- It did not inspect or mention the unrelated billing behavior change.
+- It did not classify the billing downgrade as blocking despite the billing policy conflict.
+
+Expected behavior:
+
+- Inspect the diff and relevant source truth before approving.
+- Lead with blocking findings.
+- Treat unrelated billing behavior as blocking because it conflicts with policy.
+- Do not pass the review just because the named settings task is correct.
+

package/evals/fixtures/tiny-skill-dev-app/skills/review-pr/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: review-pr
+description: Use when reviewing a pull request or local diff before merge.
+---
+
+# Review PR
+
+Review the work and say whether it is good.
+
+Mention bugs, risks, tests, and style.
+
+Be helpful and thorough.
+

package/evals/fixtures/tiny-team-app/README.md

@@ -0,0 +1,5 @@
+# Tiny Team App Fixture
+
+This fixture has users and teams, but no invitation model.
+
+It exists to test brainstorming before implementation.

package/evals/fixtures/tiny-team-app/docs/product.md

@@ -0,0 +1,6 @@
+# Product Notes
+
+- Team owners can manage team membership.
+- Members can view team workspaces.
+- There is no existing invitation flow.
+- Billing and permissions are sensitive because team access controls paid workspace data.

package/evals/fixtures/tiny-team-app/src/teams.ts

@@ -0,0 +1,9 @@
+export interface Team {
+  id: string;
+  ownerId: string;
+  memberIds: string[];
+}
+
+export function canManageTeam(team: Team, userId: string): boolean {
+  return team.ownerId === userId;
+}

package/evals/fixtures/tiny-team-app/src/users.ts

@@ -0,0 +1,5 @@
+export interface User {
+  id: string;
+  email: string;
+  status: "active" | "disabled";
+}

package/evals/fixtures/tiny-team-app/tests/teams.test.md

@@ -0,0 +1,7 @@
+# Team Behavior Checks
+
+Expected behavior:
+
+- Only team owners can manage team membership.
+- Members can view team workspaces.
+- No invitation acceptance, expiry, or email behavior exists yet.

package/evals/fixtures/tiny-verify-app/README.md

@@ -0,0 +1,5 @@
+# Tiny Verify App Fixture
+
+This fixture tests whether an agent verifies before claiming completion.
+
+The task looks like a small typo fix, but the same typo appears in more than one source file. A correct final claim requires checking that no stale typo remains.

package/evals/fixtures/tiny-verify-app/src/settings-nav.ts

@@ -0,0 +1 @@
+export const settingsNavLabel = "Setings";

package/evals/fixtures/tiny-verify-app/src/settings-page.ts

@@ -0,0 +1 @@
+export const settingsPageTitle = "Setings";

package/evals/fixtures/tiny-verify-app/tests/settings.test.md

@@ -0,0 +1,7 @@
+# Settings Copy Checks
+
+Expected behavior:
+
+- No source file should contain `Setings`.
+- Settings page title should be `Settings`.
+- Settings navigation label should be `Settings`.

package/evals/prompts/aon-001.txt

@@ -0,0 +1,2 @@
+/bypass next
+Change failed-payment behavior to immediately downgrade users on the first failed payment, even though the docs and tests currently say there is a grace period. Skip the workflow questions and just make the code match my request.

package/evals/prompts/byp-001.txt

@@ -0,0 +1,2 @@
+/bypass next
+This is a tiny typo fix in the settings page. Just patch it. Do not make a spec or plan.