@ztothez/design-engineering 2.0.0

package/knowledge-base/benchmarks/aegisops/journeys.json

@@ -0,0 +1,91 @@
+{
+  "version": "1.0",
+  "contract": "aegisops",
+  "profiles": [
+    {
+      "id": "demo-success",
+      "name": "Deterministic demo pipeline success",
+      "environment": [
+        "Frontend and API are running",
+        "Demo mode returns a deterministic successful stream",
+        "Export service is available"
+      ],
+      "journeys": [
+        {
+          "id": "single-technique-success",
+          "name": "single-technique-success",
+          "steps": [
+            { "action": "fill", "selector": "input[aria-label=\"ATT&CK technique or target\"]", "value": "T1059.001" },
+            { "action": "click", "selector": "button:has-text(\"Single Technique\")" },
+            { "action": "expectAttribute", "selector": "[role=\"switch\"]", "name": "aria-checked", "value": "true" },
+            { "action": "expectResponse", "selector": "button:has-text(\"Run Pipeline\")", "urlIncludes": "/run", "status": 200, "method": "POST" },
+            { "action": "expectText", "selector": "body", "value": "Pipeline complete" },
+            { "action": "expectText", "selector": "body", "value": "DEPLOYABLE ARTIFACTS" },
+            { "action": "expectText", "selector": "body", "value": "Coverage Gate" },
+            { "action": "expectText", "selector": "body", "value": "READY" },
+            { "action": "expectDownload", "selector": "button:has-text(\"Download SIGMA\")", "filenameIncludes": "sigma_T1059.001.yml" }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "offline-recovery",
+      "name": "Unavailable backend recovery",
+      "environment": [
+        "Frontend is running",
+        "Pipeline API is unavailable or returns a controlled failure"
+      ],
+      "expectedNetwork": [
+        {
+          "id": "health-unavailable",
+          "method": "GET",
+          "urlIncludes": "/health",
+          "status": 500,
+          "minOccurrences": 1
+        },
+        {
+          "id": "pipeline-run-unavailable",
+          "method": "POST",
+          "urlIncludes": "/run",
+          "status": 500,
+          "minOccurrences": 1,
+          "maxOccurrences": 1
+        }
+      ],
+      "journeys": [
+        {
+          "id": "preserve-and-retry",
+          "name": "preserve-and-retry",
+          "steps": [
+            { "action": "fill", "selector": "input[aria-label=\"ATT&CK technique or target\"]", "value": "T1059.001" },
+            { "action": "expectResponse", "selector": "button:has-text(\"Run Pipeline\")", "urlIncludes": "/run", "status": 500, "method": "POST" },
+            { "action": "expectText", "selector": "body", "value": "Pipeline failed" },
+            { "action": "expectText", "selector": "body", "value": "Enable Demo mode" },
+            { "action": "expectVisible", "selector": "button:has-text(\"Retry\")" },
+            { "action": "expectValue", "selector": "input[aria-label=\"ATT&CK technique or target\"]", "value": "T1059.001" }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "responsive-overview",
+      "name": "Responsive operational overview",
+      "environment": [
+        "Frontend is running",
+        "No successful pipeline run is required"
+      ],
+      "journeys": [
+        {
+          "id": "overview-integrity",
+          "name": "overview-integrity",
+          "steps": [
+            { "action": "expectVisible", "selector": "input[aria-label=\"ATT&CK technique or target\"]" },
+            { "action": "expectVisible", "selector": "button:has-text(\"Run Pipeline\")" },
+            { "action": "expectText", "selector": "body", "value": "READINESS GATES" },
+            { "action": "expectText", "selector": "body", "value": "LIVE MONITOR" }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/knowledge-base/benchmarks/aegisops/product-contract.yaml

@@ -0,0 +1,328 @@
+version: "1.1"
+id: aegisops
+name: AegisOPS SOC Readiness Command Center
+status: benchmark
+purpose: >-
+  Enable a senior SOC analyst or detection engineer to transform authorized MITRE ATT&CK
+  scenarios into inspectable detection, response, validation, and export artifacts while
+  preserving evidence, recovery paths, and the distinction between live and demo execution.
+
+authority:
+  behavior: Current AegisOPS behavior summarized in SOURCE-EVIDENCE.md overrides historical product and submission material.
+  visual: Normalized design evidence guides hierarchy and identity but never overrides task integrity, responsive usability, or accessibility.
+  precedence:
+    - path: SOURCE-EVIDENCE.md
+      role: Independently normalized product, design, provenance, and snapshot evidence.
+      authority: primary
+    - path: MANIFEST.md
+      role: Benchmark scope, authority order, and clean-room usage rules.
+      authority: supporting
+    - path: acceptance-criteria.md
+      role: Evidence interpretation and blocker acceptance boundaries.
+      authority: supporting
+    - path: ../../../clean-room-ux-design-spec.md
+      role: Independent implementation, provenance, local-first, and abstention requirements.
+      authority: supporting
+
+actors:
+  - id: detection-engineer
+    name: Detection engineer
+    goals:
+      - Convert known ATT&CK behavior into field-mapped detection logic and deployable artifacts.
+      - Inspect covered and missing observables before accepting a result.
+      - Export evidence for implementation, review, or handoff.
+    responsibilities:
+      - Select an authorized scenario and verify its scope.
+      - Review generated logic against source telemetry and local environment requirements.
+      - Treat generated artifacts as reviewable engineering output, not automatic production truth.
+  - id: soc-analyst
+    name: SOC analyst
+    goals:
+      - Understand detection conditions and prioritized response actions.
+      - Distinguish live endpoint evidence from labeled demo fallback data.
+      - Recover safely from unavailable inference or export services.
+    responsibilities:
+      - Validate response guidance against organizational procedures.
+      - Preserve case evidence and avoid destructive action without authorization.
+
+outputs:
+  - id: authorized-simulation
+    name: Authorized simulation evidence
+    sourceOfTruth: Threat agent output bounded to known ATT&CK behavior.
+    requiredEvidence:
+      - Technique or scenario identifier
+      - Observable commands, process behavior, or telemetry
+      - Explicit authorized-use scope
+  - id: sigma-detection
+    name: Sigma detection
+    sourceOfTruth: Detection agent output derived from simulation observables.
+    requiredEvidence:
+      - Field mappings
+      - Detection condition
+      - Observable linkage
+  - id: spl-hunt
+    name: SPL hunt
+    sourceOfTruth: Detection agent output derived from supported telemetry fields.
+    requiredEvidence:
+      - Query text
+      - Required data sources
+  - id: soc-playbook
+    name: SOC response playbook
+    sourceOfTruth: Response agent output tied to detected telemetry.
+    requiredEvidence:
+      - Triage actions
+      - Containment or escalation conditions
+  - id: vectr-export
+    name: VECTR coverage export
+    sourceOfTruth: Structured run result and validation scores.
+    requiredEvidence:
+      - Scenario identifier
+      - Coverage data
+  - id: validation-report
+    name: Validation report
+    sourceOfTruth: Validation agent evaluation of simulation and detection outputs.
+    requiredEvidence:
+      - Coverage score
+      - Covered observables
+      - Missing observables or explicit none-found result
+      - Safety verdict
+  - id: pdf-report
+    name: PDF handoff report
+    sourceOfTruth: Completed structured run and export service response.
+    requiredEvidence:
+      - Scenario identifier
+      - Generation success or actionable failure
+
+modes:
+  - id: single-technique
+    name: Single Technique
+    purpose: Run the complete pipeline for one ATT&CK technique.
+    input: ATT&CK technique identifier such as T1059.001.
+    outputs: [authorized-simulation, sigma-detection, spl-hunt, soc-playbook, vectr-export, validation-report, pdf-report]
+  - id: apt-group
+    name: APT Group
+    purpose: Evaluate a bounded set of techniques attributed to a named threat group.
+    input: Recognized APT group name or identifier.
+    outputs: [authorized-simulation, sigma-detection, spl-hunt, soc-playbook, vectr-export, validation-report, pdf-report]
+  - id: kill-chain
+    name: Kill Chain
+    purpose: Evaluate an ordered sequence of known ATT&CK techniques and their combined defensive coverage.
+    input: Starting technique or supported chain selection.
+    outputs: [authorized-simulation, sigma-detection, spl-hunt, soc-playbook, vectr-export, validation-report, pdf-report]
+  - id: topology-lab
+    name: Topology Lab
+    purpose: Map an authorized sandbox path to telemetry, detection conditions, response actions, and reaction timing.
+    input: Supported sandbox topology path or seed technique.
+    outputs: [authorized-simulation, sigma-detection, soc-playbook, validation-report]
+
+stateMachines:
+  - id: pipeline-run
+    initial: idle
+    states:
+      - id: idle
+        category: idle
+        userVisible: true
+        requirement: Input remains editable and the interface explains what is required to run.
+      - id: running
+        category: loading
+        userVisible: true
+        requirement: The active agent and accumulated progress are visible without clearing user input.
+      - id: success
+        category: success
+        userVisible: true
+        requirement: Results, evidence, readiness status, and supported exports are available together.
+      - id: error
+        category: error
+        userVisible: true
+        requirement: The failure cause, preserved input, retry action, and demo fallback guidance are visible.
+      - id: fallback
+        category: fallback
+        userVisible: true
+        requirement: Demo execution is explicitly labeled and cannot be mistaken for live endpoint evidence.
+    transitions:
+      - from: idle
+        to: running
+        trigger: Submit valid scenario
+      - from: running
+        to: success
+        trigger: Receive one complete validated run result
+      - from: running
+        to: error
+        trigger: Network, stream, validation, or export initialization failure
+      - from: error
+        to: running
+        trigger: Retry preserved scenario
+      - from: error
+        to: fallback
+        trigger: Enable labeled Demo mode
+      - from: fallback
+        to: running
+        trigger: Run preserved scenario using demo data
+      - from: success
+        to: running
+        trigger: Run another scenario
+
+metrics:
+  - id: coverage
+    name: Detection coverage
+    definition: Percentage of required observables represented by the generated detection and validation result.
+    sourceOfTruth: Validation agent structured score with covered and missing observable lists.
+    format: percentage
+    evidenceRequired: true
+    range: { min: 0, max: 100 }
+  - id: safety-verdict
+    name: Safety verdict
+    definition: Structured assessment that generated content remains within authorized known-ATT&CK defensive scope.
+    sourceOfTruth: Validation agent structured verdict and supporting explanation.
+    format: status
+    evidenceRequired: true
+  - id: endpoint-latency
+    name: Endpoint latency
+    definition: Measured duration of a successful endpoint health or inference request.
+    sourceOfTruth: Current request timing; never a static placeholder.
+    format: duration
+    evidenceRequired: true
+  - id: readiness
+    name: Product readiness
+    definition: Gate state derived from completed coverage, safety, validator, and artifact requirements.
+    sourceOfTruth: Explicit readiness-gate evaluation over the current run result.
+    format: status
+    evidenceRequired: true
+
+constraints:
+  outOfScope:
+    - Zero-day discovery or exploit generation.
+    - Unauthorized offensive operations or targeting real systems without permission.
+    - Automatic production deployment of generated detections without human review.
+  prohibitedClaims:
+    - Unsourced cost, time-savings, coverage, performance, or market-superiority claims.
+    - Live AMD, ROCm, model, endpoint, latency, or throughput claims without current captured evidence.
+    - Readiness or safety claims derived only from hard-coded presentation state.
+  mockData:
+    allowedEnvironments: [development, test, demo]
+    mustBeLabeled: true
+    prohibitedInProduction: true
+    fallbackDisclosure: Demo output must be visibly labeled, preserve the selected scenario, and distinguish bundled provenance from current live execution evidence.
+
+acceptanceCriteria:
+  - id: valid-input-contract
+    title: Input and mode remain coherent
+    severity: blocker
+    requirement: The submitted scenario is valid for the selected mode, remains visible during execution, and is preserved after failure.
+    evidence: [contract, runtime]
+    appliesToModes: [single-technique, apt-group, kill-chain, topology-lab]
+  - id: progressive-pipeline-state
+    title: Pipeline progress is inspectable
+    severity: blocker
+    requirement: Running state identifies the active agent or stage, prevents duplicate submission, and announces progress accessibly.
+    evidence: [runtime, accessibility]
+    appliesToModes: [single-technique, apt-group, kill-chain]
+  - id: evidence-backed-results
+    title: Results preserve evidence chains
+    severity: blocker
+    requirement: Detection, response, and validation outputs trace back to the selected scenario and inspectable observables.
+    evidence: [contract, runtime, manual-review]
+    appliesToModes: [single-technique, apt-group, kill-chain, topology-lab]
+  - id: evidence-backed-metrics
+    title: Metrics have current sources of truth
+    severity: blocker
+    requirement: Coverage, safety, readiness, and latency values are computed from current structured evidence or explicitly labeled demo data.
+    evidence: [contract, network, manual-review]
+    appliesToModes: [single-technique, apt-group, kill-chain, topology-lab]
+  - id: offline-recovery
+    title: Offline execution has a recovery path
+    severity: blocker
+    requirement: Endpoint failure shows an actionable error, preserves input, offers retry, and explains labeled Demo mode without exposing a raw stack trace.
+    evidence: [runtime, network, screenshot]
+    appliesToModes: [single-technique, apt-group, kill-chain]
+  - id: export-integrity
+    title: Exports match the visible run
+    severity: blocker
+    requirement: Every offered download is generated from the current completed run, has a meaningful filename, and reports export failure without losing results.
+    evidence: [runtime, export]
+    appliesToModes: [single-technique, apt-group, kill-chain]
+  - id: authorized-scope
+    title: Authorized defensive scope is explicit
+    severity: blocker
+    requirement: Generated simulation material is bounded to known ATT&CK defensive validation and does not present unauthorized or zero-day generation as supported.
+    evidence: [contract, manual-review]
+    appliesToModes: [single-technique, apt-group, kill-chain, topology-lab]
+  - id: responsive-integrity
+    title: Operational content remains readable at required widths
+    severity: blocker
+    requirement: Controls, status pills, readiness gates, logs, and results do not clip, overlap, or create competing page-level scroll regions.
+    evidence: [runtime, screenshot]
+    appliesToModes: [single-technique, apt-group, kill-chain, topology-lab]
+  - id: accessible-operation
+    title: Critical workflow is keyboard and assistive-technology operable
+    severity: blocker
+    requirement: Inputs and controls have names, progress and errors are announced, focus remains visible, and status is not encoded by color alone.
+    evidence: [runtime, accessibility]
+    appliesToModes: [single-technique, apt-group, kill-chain, topology-lab]
+
+verification:
+  journeyFile: journeys.json
+  viewports:
+    - { name: mobile-375, width: 375, height: 812 }
+    - { name: tablet-768, width: 768, height: 1024 }
+    - { name: desktop-1024, width: 1024, height: 768 }
+    - { name: wide-1440, width: 1440, height: 900 }
+  bindings:
+    - profile: demo-success
+      journey: single-technique-success
+      actor: detection-engineer
+      mode: single-technique
+      acceptanceCriteria: [valid-input-contract, progressive-pipeline-state, evidence-backed-results, evidence-backed-metrics, export-integrity, authorized-scope]
+    - profile: offline-recovery
+      journey: preserve-and-retry
+      actor: soc-analyst
+      mode: single-technique
+      acceptanceCriteria: [valid-input-contract, offline-recovery, accessible-operation]
+    - profile: responsive-overview
+      journey: overview-integrity
+      actor: soc-analyst
+      mode: single-technique
+      acceptanceCriteria: [responsive-integrity, accessible-operation]
+
+benchmark:
+  archetype: operational-dashboard
+  interface: browser
+  qualityDimensions:
+    - { id: truthful-disclosure, status: required, reason: "Live and demo execution must remain distinguishable." }
+    - { id: information-design, status: required, reason: "Analysts must trace prioritized findings to evidence and action." }
+    - { id: visual-system, status: required, reason: "Dense security operations require consistent visual hierarchy." }
+    - { id: accessibility, status: required, reason: "Core analysis and export paths require keyboard and non-color operation." }
+    - { id: responsive-structure, status: required, reason: "The command center is verified from mobile through wide desktop." }
+    - { id: state-integrity, status: required, reason: "Pipeline progress, failure, fallback, and recovery must remain explicit." }
+    - { id: maintainability, status: required, reason: "Detection, response, validation, and export boundaries must remain separable." }
+  tasks:
+    - id: generate-detection-package
+      primary: true
+      actor: detection-engineer
+      mode: single-technique
+      intent: Generate and inspect evidence-linked detection, response, validation, and export artifacts for an authorized ATT&CK technique.
+      start:
+        stateMachine: pipeline-run
+        state: idle
+        observable: The authorized technique input is available and no pipeline run is active.
+      success:
+        stateMachine: pipeline-run
+        state: success
+        observable: Generated artifacts, source evidence, validation results, and export controls are inspectable.
+        evidence: [contract, runtime, network, export]
+      recovery:
+        required: true
+        failure:
+          stateMachine: pipeline-run
+          state: error
+          observable: The failed stage and preserved authorized input remain visible.
+        observable: The analyst can retry without losing the technique input or confusing fallback data with live output.
+      journey: { profile: demo-success, journey: single-technique-success }
+      browser: { route: /, narrowViewport: mobile-375 }
+  evidencePolicy:
+    missingEvidence: unverified
+    failedBehavior: failed
+    unsupportedCapability: limitation
+  comparison:
+    taskContractId: aegisops-detection-package
+    crossContractRanking: false

package/knowledge-base/benchmarks/azure-optimizer/SOURCE-EVIDENCE.md

@@ -0,0 +1,26 @@
+# Azure Optimizer Source Evidence
+
+## Authority Boundary
+
+- Product family: Azure infrastructure analysis and optimization dashboard.
+- Owner-authorized comparison workspace: `/home/ztothez/Studio/experiments/redesign-azure`.
+- Immutable control implementation: `azure-optimizer-og/`.
+- Comparison implementations: `lovable/`, `ui-ux-max-pro/`, and `uix-design-skill/`.
+- Repository snapshot at normalization: `6b0dbe1`.
+
+The benchmark contains independently normalized task and evidence requirements. It does not import implementation code from any candidate and does not treat a generator or external design product as authority.
+
+## Normalized Product Evidence
+
+- An infrastructure operator reviews tracked Azure resources, potential savings, issue severity, recommendations, recent analyses, and health or telemetry evidence.
+- The primary decision path is context, priority, impact, evidence, remediation, and validation.
+- Running an analysis must distinguish live backend execution from simulation or local fallback.
+- A metric requires a definition, source, scope, period, freshness, and supported decision.
+- Exported results must preserve data origin, environment, freshness, and limitations.
+- Operational, connected, online, production, and monitoring claims require current runtime evidence.
+
+## Baseline Role
+
+The original, Lovable, UI/UX Pro Max, and current ZtotheZ implementations are comparison candidates, not normative specifications. Failures and unsupported features remain evidence; the benchmark must not alter a candidate merely to make its baseline pass.
+
+The eventual V2 implementation must be created in a separate directory so the control and all baseline candidates remain reproducible.

package/knowledge-base/benchmarks/azure-optimizer/V2-IMPLEMENTATION.md

@@ -0,0 +1,39 @@
+# Azure Optimizer V2 Implementation
+
+## Scope
+
+The independently tracked implementation is in `benchmarks/azure-optimizer-v2/`. The original, Lovable, UI/UX Pro Max, and first ZtotheZ candidates in the comparison repository remain unchanged.
+
+The V2 implementation uses the normalized dataset and task model from this benchmark. It does not import candidate implementation code and does not connect to an Azure tenant.
+
+## Contract Mapping
+
+| Requirement | Implementation |
+|---|---|
+| Persistent data origin and freshness | `TrustBar.tsx` is rendered across overview, analysis, history, and export views |
+| Runtime-derived processing status | `analysis-client.ts` calls the local API boundary and retains response origin |
+| Explicit fallback | A 503 response exposes retry and opt-in local fallback; no automatic simulation occurs |
+| Prioritized information path | Overview presents context, priority, impact, evidence, action, owner, and validation |
+| Metric integrity | Every summary metric exposes definition, source, scope, period, freshness, baseline, and decision purpose |
+| Detailed finding review | Finding selection exposes observation, evidence, impact, remediation, owner, and validation |
+| Provenance-preserving export | Blob download contains environment, scenario, origins, freshness, scope, findings, and limitations |
+| Semantic visual system | Component source uses semantic CSS variables defined in `tokens.css` |
+| Focused orchestration boundary | Network and fallback behavior is isolated in `src/domain/analysis-client.ts` |
+
+## Verified States
+
+The `azure-v2-state-matrix` profile in `v2-journeys.json` covers:
+
+- Demo success.
+- Live local API processing over the disclosed imported fixture.
+- Slow analysis.
+- Backend failure followed by explicit local fallback.
+- Disconnection and recovery.
+- Partial result.
+- Stale result.
+- Detailed finding review and history.
+- Export with captured Blob provenance.
+
+## Evidence Boundary
+
+Automated verification establishes contract selectors, network responses, downloads, layout behavior, accessibility checks, and screenshot stability in the captured environment. It does not establish visual preference, domain correctness beyond the fixture, human comprehension, or representative-user task success. Those claims remain Item 8 reviewer-supplied work.

package/knowledge-base/benchmarks/azure-optimizer/acceptance-criteria.md

@@ -0,0 +1,23 @@
+# Azure Optimizer Acceptance Criteria
+
+The machine-readable criteria are in `product-contract.yaml`.
+
+## Task Integrity
+
+- The current environment, data origin, connection state, and freshness are visible without consulting documentation.
+- Priority is derived from severity, impact, evidence, and scope rather than decorative prominence.
+- Findings connect affected resources to observations, impact, remediation, and validation.
+- Analysis input and context remain available through loading, error, fallback, and completion.
+- Exports preserve the visible result and its provenance.
+
+## Comparison Integrity
+
+- Every candidate uses the same dataset, viewport dimensions, states, and task prompts.
+- Candidate-specific selectors may differ, but success criteria cannot change by candidate.
+- Unsupported or failed behavior is recorded as failed, partial, or not run.
+- Screenshot similarity, source-code inspection, and automated accessibility checks cannot become human or representative-user evidence.
+- Candidate labels remain anonymous in reviewer-facing materials.
+
+## Responsive Evidence
+
+At 375, 768, 1024, and 1440 CSS pixels, primary context, metrics, findings, provenance, and actions must not clip, overlap, or create incoherent competing scroll regions. Long labels, empty data, partial data, loading, fallback, disconnected, and export states remain in scope.

package/knowledge-base/benchmarks/azure-optimizer/anti-patterns.md

@@ -0,0 +1,13 @@
+# Azure Optimizer Anti-Patterns
+
+| Anti-pattern | Failure | Required correction |
+|---|---|---|
+| Unsupported operational badge | The interface claims online, operational, connected, production, or continuous monitoring without current evidence | Bind the label to runtime state or replace it with explicit demo, unknown, stale, or disconnected status |
+| Silent simulation | A failed or absent backend produces realistic results without persistent disclosure | Identify simulation before execution, during progress, in results, history, and exports |
+| Decorative savings | Currency values appear without formula, scope, period, source, or affected resources | Add a metric contract and drill-down evidence or remove the value |
+| Agent theater | Agent diagrams and logs imply orchestration that the implementation does not perform | Show only verified stages and distinguish scripted demonstration from live execution |
+| Sparse overview | Large unused space separates summary metrics from the findings and actions needed to interpret them | Follow context, priority, impact, evidence, action, and validation hierarchy |
+| Dense visual noise | Glow, grids, badges, and micro-labels compete with findings and next actions | Use restrained hierarchy, semantic emphasis, and task-driven density |
+| Fake credential | A realistic secret placeholder is displayed as an operational key | Use an empty secure field, documented fixture value, or connected secret-management flow |
+| Inert export or settings control | A control appears actionable but has no observable behavior | Implement the command with feedback and recovery or render noninteractive information honestly |
+| Cross-product contract | Azure is evaluated with selectors and semantics from another product | Use the Azure-specific contract and candidate-equivalent tasks |

package/knowledge-base/benchmarks/azure-optimizer/journeys.json

@@ -0,0 +1,88 @@
+{
+  "version": "1.0",
+  "contract": "azure-optimizer",
+  "profiles": [
+    {
+      "id": "overview-baseline",
+      "name": "Shared Azure overview comprehension surface",
+      "environment": [
+        "Candidate frontend is running with the fixed comparison dataset",
+        "No successful analysis run is required"
+      ],
+      "journeys": [
+        {
+          "id": "overview-integrity",
+          "name": "overview-integrity",
+          "steps": [
+            { "action": "expectText", "selector": "body", "value": "Azure Optimizer" },
+            { "action": "expectText", "selector": "body", "value": "Potential Savings" },
+            { "action": "expectText", "selector": "body", "value": "Top Recommendations" }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "original-analysis",
+      "name": "Original candidate analysis task",
+      "environment": ["Original candidate is running with its bundled comparison data"],
+      "journeys": [
+        {
+          "id": "run-original-analysis",
+          "name": "run-original-analysis",
+          "steps": [
+            { "action": "click", "selector": "button:has-text(\"Analysis\")" },
+            { "action": "click", "selector": "button:has-text(\"Run AI Audit\")" },
+            { "action": "expectText", "selector": "body", "value": "Analysis complete" }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "lovable-analysis",
+      "name": "Lovable candidate analysis task",
+      "environment": ["Lovable candidate is running with its bundled demo dataset"],
+      "journeys": [
+        {
+          "id": "run-lovable-analysis",
+          "name": "run-lovable-analysis",
+          "steps": [
+            { "action": "click", "selector": "button:has-text(\"Run analysis\")" },
+            { "action": "expectText", "selector": "body", "value": "Analysis complete" }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "uiux-analysis",
+      "name": "UIUX candidate analysis task",
+      "environment": ["UIUX candidate is running with its bundled comparison data"],
+      "journeys": [
+        {
+          "id": "run-uiux-analysis",
+          "name": "run-uiux-analysis",
+          "steps": [
+            { "action": "click", "selector": "button:has-text(\"Analysis\")" },
+            { "action": "click", "selector": "button:has-text(\"Start Full AI Audit\")" },
+            { "action": "expectText", "selector": "body", "value": "Report ready" }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "ztothez-analysis",
+      "name": "ZtotheZ candidate analysis task",
+      "environment": ["ZtotheZ candidate is running with its bundled comparison data"],
+      "journeys": [
+        {
+          "id": "run-ztothez-analysis",
+          "name": "run-ztothez-analysis",
+          "steps": [
+            { "action": "click", "selector": "button:has-text(\"Analysis\")" },
+            { "action": "click", "selector": "button:has-text(\"Run AI Audit\")" },
+            { "action": "expectText", "selector": "body", "value": "Operating in verified local demonstration mode" }
+          ]
+        }
+      ]
+    }
+  ]
+}