skilldrop-cli 0.16.18 → 0.16.20

package/packs/dev-team/skills/sonar-onboard/evals/files/2/.gitlab-ci.yml

@@ -0,0 +1,32 @@
+stages:
+  - test
+  - build
+
+python-tests:
+  stage: test
+  image: python:3.12
+  script:
+    - pip install -e . pytest pytest-cov
+    - pytest --cov=src/wayline --cov-report=xml:build/coverage.xml
+  artifacts:
+    paths:
+      - build/coverage.xml
+
+web-tests:
+  stage: test
+  image: node:20
+  script:
+    - cd web
+    - npm ci
+    - npm test
+  artifacts:
+    paths:
+      - web/coverage/lcov.info
+
+web-build:
+  stage: build
+  image: node:20
+  script:
+    - cd web
+    - npm ci
+    - npm run build

package/packs/dev-team/skills/sonar-onboard/evals/files/2/README.md

@@ -0,0 +1,11 @@
+# Wayline
+
+Timetable and departure-board service for Harrow Valley Transit (invented example project).
+
+- `src/wayline/` — Python service (timetable merge, departure predictions).
+- `src/wayline/_generated/` — generated by protoc from the stop-feed schema. Do not edit by hand.
+- `src/wayline/vendor/gtfs_lite/` — a vendored copy of a third-party feed parser, pinned. Not our code.
+- `tests/` — pytest suite for the Python service.
+- `web/` — TypeScript departure-board frontend; Jest tests sit next to the code as `*.test.ts`.
+
+CI runs on our GitLab instance (see `.gitlab-ci.yml`).

package/packs/dev-team/skills/sonar-onboard/evals/files/2/pyproject.toml

@@ -0,0 +1,16 @@
+[project]
+name = "wayline"
+version = "0.9.0"
+requires-python = ">=3.11"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[tool.coverage.run]
+source = ["src/wayline"]
+
+[tool.coverage.xml]
+output = "reports/coverage.xml"

package/packs/dev-team/skills/sonar-onboard/evals/files/2/src/wayline/__init__.py

@@ -0,0 +1 @@
+"""Wayline timetable service."""

package/packs/dev-team/skills/sonar-onboard/evals/files/2/src/wayline/_generated/stops_pb2.py

@@ -0,0 +1,4 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: stops.proto
+_STOP_FIELDS = ("stop_id", "name", "lat", "lon", "zone")

package/packs/dev-team/skills/sonar-onboard/evals/files/2/src/wayline/timetable.py

@@ -0,0 +1,12 @@
+from datetime import datetime, timedelta
+
+
+def next_departures(schedule, now: datetime, limit: int = 5):
+    """Return the next `limit` departures at or after `now` from a list of (route, datetime)."""
+    upcoming = sorted((d for d in schedule if d[1] >= now), key=lambda d: d[1])
+    return upcoming[:limit]
+
+
+def apply_delay(departure, minutes: int):
+    route, when = departure
+    return route, when + timedelta(minutes=minutes)

package/packs/dev-team/skills/sonar-onboard/evals/files/2/src/wayline/vendor/gtfs_lite/__init__.py

@@ -0,0 +1,3 @@
+# Vendored third-party feed parser, pinned at 2.3.1. Upstream owns this code; do not modify.
+def parse_stop_times(rows):
+    return [dict(zip(("trip_id", "arrival", "departure", "stop_id"), r)) for r in rows]

package/packs/dev-team/skills/sonar-onboard/evals/files/2/tests/test_timetable.py

@@ -0,0 +1,14 @@
+from datetime import datetime
+
+from wayline.timetable import apply_delay, next_departures
+
+
+def test_next_departures_orders_and_limits():
+    now = datetime(2026, 10, 1, 8, 0)
+    sched = [("12", datetime(2026, 10, 1, 8, 20)), ("7", datetime(2026, 10, 1, 8, 5)),
+             ("3", datetime(2026, 10, 1, 7, 50))]
+    assert next_departures(sched, now, limit=1) == [("7", datetime(2026, 10, 1, 8, 5))]
+
+
+def test_apply_delay():
+    assert apply_delay(("7", datetime(2026, 10, 1, 8, 5)), 4)[1] == datetime(2026, 10, 1, 8, 9)

package/packs/dev-team/skills/sonar-onboard/evals/files/2/web/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "wayline-board",
+  "version": "0.9.0",
+  "private": true,
+  "scripts": {
+    "build": "tsc -p .",
+    "test": "jest --coverage"
+  },
+  "jest": {
+    "preset": "ts-jest",
+    "testMatch": ["**/src/**/*.test.ts"],
+    "coverageDirectory": "coverage",
+    "coverageReporters": ["lcov", "text-summary"]
+  },
+  "devDependencies": {
+    "jest": "^29.7.0",
+    "ts-jest": "^29.1.0",
+    "typescript": "^5.4.0"
+  }
+}

package/packs/dev-team/skills/sonar-onboard/evals/files/2/web/src/board.test.ts

@@ -0,0 +1,9 @@
+import { formatRow } from "./board";
+
+test("due when zero minutes", () => {
+  expect(formatRow({ route: "7", minutes: 0 })).toBe("7  due");
+});
+
+test("minutes otherwise", () => {
+  expect(formatRow({ route: "12", minutes: 4 })).toBe("12  4 min");
+});

package/packs/dev-team/skills/sonar-onboard/evals/files/2/web/src/board.ts

@@ -0,0 +1,8 @@
+export interface Departure {
+  route: string;
+  minutes: number;
+}
+
+export function formatRow(d: Departure): string {
+  return d.minutes <= 0 ? `${d.route}  due` : `${d.route}  ${d.minutes} min`;
+}

package/packs/dev-team/skills/sonar-review/evals/evals.json

@@ -11,6 +11,33 @@
         "Findings are grouped into the lenses (bugs, vulnerabilities, security hotspots, code smells, coverage/duplication)",
         "Server vs cloud is auto-detected from sonar-project.properties rather than assumed"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Will my branch pass the quality gate? I can't run the scanner here: there's no Sonar token in this environment and no network. CI saved the last scan's output into this folder: quality-gate.json, issues.json, hotspots.json, and changed-files.txt (my branch's files against main). Locally pytest-cov says 85% coverage, so I think we're fine. Give me something I can paste into the PR description, under 300 words.",
+      "assertions": [
+        "Reports that the gate fails, taking the verdict from the status in quality-gate.json, and names at least the new-code coverage condition (61.3% against 80%) and the unreviewed security hotspot condition",
+        "Explains that the local 85% figure does not change the result: the gate measured 61.3% coverage on new code",
+        "Keeps the findings to the changed files: the blocker SQL-injection issue in legacy/ledger_import.py and the issue in intake/weighbridge.py are not presented as findings for this branch (they may be noted separately as pre-existing)",
+        "Does not list the issue resolved as a false positive (python:S1192 in intake/payments.py) as an open finding",
+        "Notes that the scan analysed revision 7f3c2e1 while the branch head is 9a41d07, whose commit message suggests the float-comparison bug was fixed after the scan, so the results may be out of date",
+        "Does not invent issues, rule IDs, line numbers or metric values that are not in the supplied files, and does not claim to have run a new scan",
+        "Stays under 300 words"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "Our contractor says the Sonar check 'went red' on their pull request and they're fixing it. I'm the project manager, not a developer. This is what I can see on the screen: 'Quality Gate failed. 2 conditions failed: Coverage on New Code 54.0% (required >= 80.0%), Duplicated Lines on New Code 6.1% (required <= 3.0%). 0 new bugs, 0 new vulnerabilities, 4 new code smells.' Is this serious? Should I hold Friday's release? Three sentences max.",
+      "assertions": [
+        "Gives a clear recommendation for Friday: this change should not go out until the gate passes, unless someone decides on purpose to accept the risk",
+        "Explains in plain words that the failures are about too little testing of the new code and too much copied code, and that no new bugs or security problems were reported",
+        "Does not describe the result as a security or data-loss problem",
+        "Does not invent files, rule IDs, specific issues or figures beyond the text on the screen, and does not claim to have run a scan",
+        "Uses at most three sentences",
+        "Answers without first asking for access, a token or more information"
+      ]
     }
   ]
 }

package/packs/dev-team/skills/sonar-review/evals/files/2/changed-files.txt

@@ -0,0 +1,5 @@
+# git diff --name-only main...HEAD
+# HEAD = 9a41d07 "fix float compare in litre totals"
+intake/api.py
+intake/payments.py
+tests/test_payments.py

package/packs/dev-team/skills/sonar-review/evals/files/2/hotspots.json

@@ -0,0 +1,7 @@
+{
+  "hotspots": [
+    {"key": "HSa01", "ruleKey": "python:S4790", "securityCategory": "weak-cryptography", "vulnerabilityProbability": "LOW",
+     "status": "TO_REVIEW", "component": "brookmere-intake:intake/api.py", "line": 41,
+     "message": "Make sure this weak hash algorithm is not used in a sensitive context here."}
+  ]
+}

package/packs/dev-team/skills/sonar-review/evals/files/2/issues.json

@@ -0,0 +1,26 @@
+{
+  "total": 7,
+  "issues": [
+    {"key": "AZx01", "rule": "python:S1244", "severity": "MAJOR", "type": "BUG", "status": "OPEN",
+     "component": "brookmere-intake:intake/payments.py", "line": 88,
+     "message": "Do not perform equality checks with floating point values."},
+    {"key": "AZx02", "rule": "python:S3776", "severity": "CRITICAL", "type": "CODE_SMELL", "status": "OPEN",
+     "component": "brookmere-intake:intake/payments.py", "line": 52,
+     "message": "Refactor this function to reduce its Cognitive Complexity from 23 to the 15 allowed."},
+    {"key": "AZx03", "rule": "python:S1192", "severity": "MINOR", "type": "CODE_SMELL", "status": "RESOLVED", "resolution": "FALSE-POSITIVE",
+     "component": "brookmere-intake:intake/payments.py", "line": 120,
+     "message": "Define a constant instead of duplicating this literal \"litres\" 4 times."},
+    {"key": "AZx04", "rule": "python:S1481", "severity": "MINOR", "type": "CODE_SMELL", "status": "OPEN",
+     "component": "brookmere-intake:intake/api.py", "line": 17,
+     "message": "Remove the unused local variable \"farm_ref\"."},
+    {"key": "AZx05", "rule": "python:S5754", "severity": "CRITICAL", "type": "CODE_SMELL", "status": "OPEN",
+     "component": "brookmere-intake:tests/test_payments.py", "line": 30,
+     "message": "Specify an exception class to catch or reraise the exception"},
+    {"key": "AZx06", "rule": "python:S3649", "severity": "BLOCKER", "type": "VULNERABILITY", "status": "OPEN",
+     "component": "brookmere-intake:legacy/ledger_import.py", "line": 204,
+     "message": "Change this code to not construct SQL queries directly from user-controlled data."},
+    {"key": "AZx07", "rule": "python:S1481", "severity": "MINOR", "type": "CODE_SMELL", "status": "OPEN",
+     "component": "brookmere-intake:intake/weighbridge.py", "line": 12,
+     "message": "Remove the unused local variable \"tare\"."}
+  ]
+}

package/packs/dev-team/skills/sonar-review/evals/files/2/quality-gate.json

@@ -0,0 +1,19 @@
+{
+  "analysis": {
+    "project": "brookmere-intake",
+    "branch": "feature/litre-rounding",
+    "revision": "7f3c2e1",
+    "date": "2026-10-16T14:02:11Z"
+  },
+  "projectStatus": {
+    "status": "ERROR",
+    "conditions": [
+      {"status": "ERROR", "metricKey": "new_coverage", "comparator": "LT", "errorThreshold": "80", "actualValue": "61.3"},
+      {"status": "ERROR", "metricKey": "new_security_hotspots_reviewed", "comparator": "LT", "errorThreshold": "100", "actualValue": "0.0"},
+      {"status": "ERROR", "metricKey": "new_reliability_rating", "comparator": "GT", "errorThreshold": "1", "actualValue": "3"},
+      {"status": "OK", "metricKey": "new_security_rating", "comparator": "GT", "errorThreshold": "1", "actualValue": "1"},
+      {"status": "OK", "metricKey": "new_maintainability_rating", "comparator": "GT", "errorThreshold": "1", "actualValue": "1"},
+      {"status": "OK", "metricKey": "new_duplicated_lines_density", "comparator": "GT", "errorThreshold": "3", "actualValue": "1.2"}
+    ]
+  }
+}

package/packs/dev-team/skills/tech-debt-register/evals/evals.json

@@ -40,6 +40,34 @@
         "It adds no debt items beyond the four the user listed",
         "Owners are unassigned"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-18",
+      "prompt": "I lead the warehouse systems team at Kestrel Freight. Our Q3 retro debt notes are in retro-notes.md and the incident log is incidents.csv. We've been given 3 engineer-weeks of debt time this quarter. Build the debt register and tell me what we should spend those 3 weeks on. I'm taking it to the operations director, so one page.",
+      "assertions": [
+        "Puts the scanner TLS certificate renewal among this quarter's work, citing the 2026-12-01 expiry and that the person who renewed it has left with no known notes",
+        "Treats the stock-sync notes (Marta's and Ines's split-pallet complaints) as one item",
+        "Recommends the roughly 3-day split-pallet patch rather than the two-person, full-quarter sync rewrite for this quarter, because the rewrite does not fit 3 engineer-weeks, and the items picked for the quarter fit within the 3 weeks",
+        "Flags at least one disagreement between the notes and the incident log, such as the claimed 40 engineer-hours on sync failures against 5 logged hours, or the label printer crashing 'every week' against two logged incidents, instead of silently using one figure",
+        "Does not recommend the Perl reporting rewrite for this quarter, since the notes give no evidence of what it costs today",
+        "Does not invent costs, hours, incident counts, owners or dates beyond those in the two files",
+        "Fits about one page"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-18",
+      "prompt": "I own a small bakery. My nephew built our online ordering site years ago. The new freelancer says it's 'full of tech debt' and sent me this list: PHP 5 site, no backups of the order database, customer passwords stored in plain text, copy-pasted code everywhere, no tests. She wants two weeks to fix it. What actually matters? Just a short list I can understand.",
+      "assertions": [
+        "Puts the missing database backups and the plain-text passwords at the top, saying in plain words what could go wrong for the bakery",
+        "Does not rank the copied code or the missing tests above those two",
+        "Treats the old PHP version as a real risk because it no longer gets security fixes, without inventing a specific vulnerability or attack",
+        "Does not invent costs, hours, incidents or customer numbers that are not in the message",
+        "Says what the two weeks should go on first, rather than only listing the items",
+        "Is a short list in plain language, without unexplained jargon",
+        "Answers without first asking questions"
+      ]
     }
   ]
 }

package/packs/dev-team/skills/tech-debt-register/evals/files/4/incidents.csv

@@ -0,0 +1,7 @@
+id,date,system,summary,duration_hours,owner
+WH-201,2026-07-08,label-print,Label print service hung; restarted,0.5,Tomas
+WH-207,2026-07-29,putaway,Deploy broke putaway location rules; rolled back,3,Ines
+WH-214,2026-08-19,stock-sync,Split-pallet rows missing from ledger; manual fix,2,
+WH-219,2026-09-02,label-print,Label print service hung; restarted,0.5,Tomas
+WH-223,2026-09-16,putaway,Deploy broke putaway for cold-store zone; rolled back,4,Ines
+WH-226,2026-09-24,stock-sync,Split-pallet rows missing from ledger; manual fix,3,

package/packs/dev-team/skills/tech-debt-register/evals/files/4/retro-notes.md

@@ -0,0 +1,21 @@
+# Warehouse Systems, Q3 retro: debt column (raw, as written on the board)
+
+Team: Kestrel Freight warehouse systems, Hollins depot. Five engineers.
+
+- (Marta) The nightly stock sync between the WMS and the finance ledger drops rows when a pallet is
+  split. Finance reconciles by hand every Monday. Oleksandr in finance says it takes him about half
+  a day each week.
+- (Ines) Monday reconciliation is painful because the sync misses split pallets. Can we fix the
+  sync?
+- (Tomas) Sync failures cost us about 40 engineer-hours this quarter.
+- (Marta) Doing the stock sync properly (rewrite on the new event feed) is a big job: two people
+  for a full quarter. A targeted patch for split pallets only is about 3 days.
+- (Dev) The old Perl reporting scripts are horrible. Nobody wants to touch them. We should rewrite
+  them in Python.
+- (Tomas) The label printing service crashes every week and we restart it by hand.
+- (Marta) The handheld scanners talk to the WMS API through a TLS certificate that Raj used to renew
+  by hand. Raj left in August and nobody knows where his renewal notes are. The gateway shows the
+  certificate expires on 2026-12-01. If it lapses, every scanner on the floor stops.
+- (Dev) The WMS adapter test suite takes 50 minutes, so people skip it before deploys.
+- (Ines) Both putaway incidents this quarter came from deploys where the tests were skipped.
+- (Ines) Speeding the adapter tests up to under 10 minutes: Dev thinks about a week of work.

package/packs/dev-team/skills/test-plan-generator/evals/evals.json

@@ -11,6 +11,33 @@
         "Each test is pushed to the lowest pyramid level that would catch the failure",
         "Out-of-scope areas are named rather than silently skipped"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Write the test plan for the parking permit renewal release described in permit-renewal-spec.md. QA starts on Monday. Two pages at most.",
+      "assertions": [
+        "Flags that the low-emission price conflicts (50% off £120 is £60, but the price table says £65) as something to settle before testing, rather than silently picking one as the expected result",
+        "Flags that the spec promises seven acceptance criteria but lists six, with AC5 missing",
+        "Every acceptance criterion in the spec is covered by at least one test or explicitly listed as not covered",
+        "Includes tests on both sides of each boundary: 30 days before expiry, 60 days after expiry, and 50 g/km of CO2",
+        "Uses the vehicle register stub for testing and lists the live register lookup as not tested, rather than planning tests against the live service",
+        "Does not invent a load target such as requests per second or concurrent users for the January rush; it says the figure is needed from Parking Services",
+        "Fits about two pages"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "I'm a teacher. I made a spreadsheet that works out final grades: homework is 40%, the exam is 60%, and a student who missed the exam gets 'INC'. A colleague said I should test it before I send grades home. What should I check? Just a checklist, 10 items max.",
+      "assertions": [
+        "Includes a check for a student with no exam score (expecting INC) and a check for a student with an exam score but missing homework",
+        "Includes at least one worked example with numbers and the expected result from the 40/60 weighting (for example homework 80 and exam 90 gives 86)",
+        "Includes checks for entry mistakes such as a score above 100, or a blank cell treated as zero",
+        "Does not invent letter-grade cut-offs, rounding rules or other rules the teacher did not state; if they matter, it asks the teacher to fill them in",
+        "Has no more than 10 items, written in spreadsheet terms a non-programmer understands",
+        "Delivers the checklist without first asking questions"
+      ]
     }
   ]
 }

package/packs/dev-team/skills/test-plan-generator/evals/files/2/permit-renewal-spec.md

@@ -0,0 +1,40 @@
+# Online resident parking permit renewal: low-emission discount
+
+Riverton Borough Council (invented), Parking Services. Status: approved for build, release planned
+for 1 December, before the January renewal rush.
+
+## Background
+
+Residents renew their parking permit online each year. From this release, permits for low-emission
+vehicles get a 50% discount on the standard annual price of £120. Emissions are looked up from the
+national vehicle register using the registration number the resident enters.
+
+## Acceptance criteria
+
+The seven acceptance criteria below must all pass before release.
+
+- AC1. A resident can start a renewal from 30 days before their permit's expiry date. Before that,
+  the renew button is hidden and the page shows the date renewal opens.
+- AC2. A permit that expired 60 days ago or less can still be renewed. A permit that expired more
+  than 60 days ago cannot be renewed; the resident is sent to the new-application form.
+- AC3. The registration number entered is looked up on the vehicle register. If the vehicle's
+  CO2 emissions are 50 g/km or less, the low-emission price applies.
+- AC4. If the vehicle register lookup fails or times out, the resident is charged the standard
+  price and told they can claim the discount by contacting Parking Services.
+- AC6. The price shown on the confirmation page is the amount sent to the payment provider.
+- AC7. A resident can hold at most one active permit per address. Renewal replaces the old permit;
+  it never creates a second one.
+
+## Prices
+
+| Vehicle            | Annual price |
+|--------------------|--------------|
+| Standard           | £120         |
+| Low-emission       | £65          |
+
+## Dependencies and constraints
+
+- Vehicle register: the test environment has a stub only. The live register cannot be called from
+  test or staging under the data-sharing agreement.
+- Payment provider: unchanged by this release and out of scope; it is tested by the provider.
+- Parking Services wants confidence that the site will cope with the January renewal rush.

package/packs/dev-team/skills/user-story-splitter/evals/evals.json

@@ -11,6 +11,33 @@
         "Dependencies between stories are stated, and a recommended build order follows from them",
         "Stories are independently shippable rather than layered horizontally (all backend, then all frontend)"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Turn the shift-swap PRD in prd-shift-swap.md into user stories for next week's planning, with acceptance criteria and the order we should build them in.",
+      "assertions": [
+        "Each story delivers something a nurse or ward manager can use, rather than a layer such as database schema, API endpoints or UI screens",
+        "Flags the conflict between 'manager approval is required for all swaps' and section 9.4 of the staff agreement (same-grade, same-ward swaps need only notification), and does not silently pick one",
+        "Notices that the PRD's worked example is wrong (40 + 12 hours is 52, which is over the 48-hour limit) and writes acceptance criteria that enforce the 48-hour rule",
+        "Any story that needs a change to the payroll export is marked as blocked until the January freeze lifts, not placed in the near-term build order",
+        "Acceptance criteria are pass/fail with specific values from the PRD, such as the 48 hours in a rolling 7 days and the grade rule",
+        "Does not invent requirements, roles or rules that are not in the PRD, and adds no mobile app stories",
+        "Has no more than eight stories"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "I coordinate volunteers for our town's food festival. We want our sign-up website to let people sign up for time slots, get reminders, and swap slots with each other. A developer friend said to send him 'user stories'. Can you write them? No more than five, as one short list I can send him.",
+      "assertions": [
+        "Splits the work into pieces a volunteer or coordinator could each try out on their own, with signing up for a slot coming before reminders and swapping",
+        "Each story has at least one concrete check for when it is done",
+        "Does not invent details the user didn't give, such as reminder channel, timing or slot limits, or marks them clearly as open questions for the developer",
+        "Gives a suggested build order with a reason",
+        "Has no more than five stories, short enough to send as one list",
+        "Delivers the list without first asking questions"
+      ]
     }
   ]
 }

package/packs/dev-team/skills/user-story-splitter/evals/files/2/prd-shift-swap.md

@@ -0,0 +1,38 @@
+# PRD excerpt: nurse shift swaps
+
+St Aldric Hospital (invented), nursing workforce team. Web rostering system only; a mobile app is a
+later project and not part of this work.
+
+## Problem
+
+Nurses arrange shift swaps by text message and a paper book on each ward. Managers find out late,
+wards end up short, and nobody can tell afterwards who worked which shift.
+
+## What we want
+
+1. A nurse can offer one of their rostered shifts for swap, and see shifts others have offered.
+2. A nurse can request to take an offered shift, giving one of their own shifts in exchange or
+   taking it as an extra shift.
+3. Manager approval is required for all swaps before the roster changes.
+4. The system blocks any swap that would take a nurse over 48 hours of work in any rolling 7-day
+   period (working-time rule). Example: a nurse on 40 hours who picks up a 12-hour shift would be
+   at 50 hours, which is allowed.
+5. A swap is only allowed between nurses of the same grade, or from a higher grade to cover a lower
+   one; never a lower grade covering a higher one.
+6. When a swap is approved, both nurses and the ward manager get a notification in the rostering
+   system.
+7. Extra shifts picked up through swaps are paid as overtime, and the overtime should flow
+   automatically into the payroll export.
+8. Every swap (offered, requested, approved, rejected) is kept in an audit history that the ward
+   manager can view.
+
+## Extract from the staff agreement (section 9.4)
+
+"Swaps between nurses of the same grade working on the same ward do not require manager approval.
+The ward manager must be notified of the swap before the first affected shift starts."
+
+## Constraints
+
+- The payroll export is frozen until January while payroll moves supplier. No changes to the export
+  this quarter.
+- Two developers. Planning wants the backlog in stories, no more than eight.

package/packs/experience-design/skills/content-design/evals/evals.json

@@ -13,6 +13,33 @@
         "The cut list includes the 'market-leading service' and 'industry accolades' sentence with a reason",
         "Does not invent a phone number, URL, excess amount or other fact not in the prompt; unknowns are placeholders listed as open questions"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Rewrite our Hardship Payment Plan page for Waterfold Water. The current page is in current-page.md. The policy it's meant to describe is policy-extract.md, and what customers actually ask us is in contact-centre-notes.md, along with some requests from our Comms manager. Give me the rewritten page ready to paste into the CMS, plus a short note of anything you changed on purpose or couldn't resolve.",
+      "assertions": [
+        "Uses the current policy's facts (income below £21,000, up to 24 months, 2 months of bank statements OR proof of benefit, no bill needed, decision within 10 working days) rather than the old page's figures, and notes that the old page disagreed with the policy",
+        "Does not carry over the '£900 over 12 months = £100 a month' example uncorrected; either flags that it doesn't add up or replaces it with a correct example",
+        "Does not promise a decision within 48 hours; keeps the policy's 10 working days and says why the Comms request was not followed",
+        "The page answers the callers' frequent questions in the reader's words, including that reminder letters and debt collection stop while the application is considered and what happens if payments are missed (two in a row, with 14 days' notice)",
+        "The rewritten page body is under 350 words",
+        "Does not invent a phone number, URL, approval rate or any other fact not in the files; the phone number and form link are left as clear placeholders",
+        "Delivers the finished page rather than stopping to ask questions first"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "hi, i run a small vet clinic. our 'before your pet's operation' sheet is a wall of text and people still feed their dogs the morning of surgery!! can you make it simple? half a page max, it gets printed. here's what it says now: 'Patients must be NPO from midnight prior to the procedure. Food must be withheld after 10pm the evening before. Water may be offered until 7am. Admission is between 8:00 and 8:30am. Owners should bring any current medication. Pre-anaesthetic bloods may be performed on admission. Owners will be telephoned after 2pm regarding discharge.'",
+      "assertions": [
+        "The no-food instruction is the most prominent thing on the sheet, since that is the problem the owner described",
+        "Notices that 'NPO from midnight' and 'no food after 10pm' disagree, and either uses one with a stated reason or asks the clinic to confirm, rather than silently picking one",
+        "Keeps the other facts: water until 7am, drop-off between 8:00 and 8:30am, bring current medication, possible blood test on arrival, and a call after 2pm about going home",
+        "Replaces jargon like 'NPO' and 'pre-anaesthetic bloods' with words a pet owner understands",
+        "Does not invent facts not given, such as different rules for cats, fasting for medication, prices or a phone number",
+        "Fits in half a printed page (roughly 200 words or fewer)"
+      ]
     }
   ]
 }

package/packs/experience-design/skills/content-design/evals/files/2/contact-centre-notes.md

@@ -0,0 +1,18 @@
+# Notes from the Contact Centre Lead and the Comms team
+
+Why people call us about the hardship page (sample of 400 calls, August 2026):
+
+| Reason for call | Share |
+|---|---|
+| "Am I eligible?" | 38% |
+| "What do I need to send?" | 27% |
+| "Will you keep chasing me / sending letters while you decide?" | 18% |
+| "How much will I pay each month?" | 11% |
+| Other | 6% |
+
+Lots of callers have already received a reminder letter and are anxious. Many read the page on a phone.
+
+From the Comms manager:
+- "Can we say decisions are made within 48 hours? It sounds much more reassuring."
+- "Please keep the page body under 350 words. The CMS template cuts off anything after that."
+- "Add the phone number and the link to the online form." (We'll supply both later; don't hold the draft for them.)

package/packs/experience-design/skills/content-design/evals/files/2/current-page.md

@@ -0,0 +1,17 @@
+# Hardship Payment Plan
+
+Waterfold Water is proud to be ranked among the region's most trusted utilities, and we are committed to supporting every customer through difficult times.
+
+Customers who are experiencing financial difficulty and who have accrued arrears on their water and wastewater account may, subject to eligibility criteria, be able to apply for a Hardship Payment Plan, whereby outstanding arrears are repaid in equal instalments in addition to ongoing charges.
+
+Eligibility is restricted to households whose gross annual household income is below £18,500, or where one or more members of the household are in receipt of a qualifying means-tested benefit.
+
+Arrears may be repaid in equal instalments over a period of up to 12 months. By way of illustration, a customer with arrears of £900 would repay the sum of £100 per month in addition to their usual charges.
+
+In order to be considered, applicants are required to furnish three months of bank statements for all accounts held by members of the household, together with proof of receipt of any qualifying benefit, and a copy of their most recent bill.
+
+Applications are typically processed within 5 working days of receipt of all documentation. Waterfold Water reserves the right to decline applications at its discretion.
+
+Please be advised that a Hardship Payment Plan may be cancelled in the event of non-payment.
+
+Waterfold Water has won the Regional Utility Customer Care Award three years running.

package/packs/experience-design/skills/content-design/evals/files/2/policy-extract.md

@@ -0,0 +1,17 @@
+# Waterfold Water — Customer Assistance Policy, section 4: Hardship Payment Plan
+
+Version 3.0. Effective 1 September 2026. Supersedes version 2.2 in full.
+
+4.1 Eligibility. A household is eligible if its gross annual household income is below £21,000, OR if any member of the household receives a qualifying means-tested benefit (Schedule B).
+
+4.2 Term. Arrears are repaid in equal monthly instalments over up to 24 months, on top of ongoing charges.
+
+4.3 Evidence. The applicant provides EITHER the last 2 months of bank statements for the household's main account, OR proof of a qualifying benefit. Not both. A copy of a bill is not required; we hold the account details.
+
+4.4 Decision. A decision is issued within 10 working days of receiving the evidence.
+
+4.5 Collection activity. All collection activity on the account (reminder letters, referral to debt collection agents) is paused from the day an application is received until the decision is issued.
+
+4.6 Cancellation. A plan is cancelled if two consecutive monthly payments are missed. Before cancelling, we write to the customer and give 14 days to make the missed payment.
+
+4.7 Reapplication. A customer whose plan is cancelled may reapply after 6 months.

package/packs/experience-design/skills/design-system-spec/evals/evals.json

@@ -14,6 +14,33 @@
         "Every WCAG citation is a real WCAG 2.2 criterion with the correct number and name",
         "Ends with open questions for engineering, each naming the decision it blocks"
       ]
+    },
+    {
+      "id": 2,
+      "held_out": "2026-10-18",
+      "prompt": "Write the component spec for the dose stepper in our MedRound ward medication app so engineering can build it. The designer's notes are in designer-notes.md, our tokens are in tokens.json, and the open build questions are in eng-thread.md. Keep it to one Confluence page, about 1,200 words maximum.",
+      "assertions": [
+        "Flags that the error text colour #E57373 on the white surface is about 3:1 and fails the 4.5:1 text contrast requirement, despite the designer's note saying it passes, and proposes the darker error token or another fix",
+        "Flags that 20 × 20 px buttons fall below the WCAG 2.2 AA minimum target size of 24 × 24 CSS px (2.5.8), and does not present 44 px as the AA requirement",
+        "Does not use 'color.border.focus-strong' as if it exists; notes it is missing from tokens.json and points to an existing token or leaves it as an open question",
+        "Does not specify press-and-hold auto-repeat as settled behaviour; it follows the clinical safety objection (one tap, one step) or raises the disagreement as a decision to be made",
+        "States what happens at 0.5 mL and 10 mL and when someone types an out-of-range or off-step value such as 12, 0 or 2.3, answering QA's question",
+        "Does not invent usage data (such as how often nurses hit 10 mL), token values or research not in the files",
+        "Stays within about 1,200 words"
+      ]
+    },
+    {
+      "id": 3,
+      "held_out": "2026-10-18",
+      "prompt": "our developer asked me to 'spec' the newsletter signup box on our garden centre website before he builds it. i'm the marketing person, i don't really know what that means lol. it's just an email box and a button that says Join. to save space i was going to put 'Your email' inside the box instead of a label above it. can you give me a short checklist he can work from? one screen max.",
+      "assertions": [
+        "Covers what happens with an invalid or empty email, while the form is sending, after a successful signup, and if sending fails",
+        "Advises against using the placeholder text as the only label, and explains why in plain terms (it disappears when typing, and screen readers and some users miss it)",
+        "Covers keyboard use and screen-reader needs, such as a programmatic label and error messages that are announced",
+        "Written plainly for a marketing person to hand to a developer, without unexplained design-system jargon",
+        "Does not invent brand colours, fonts, token names, pixel values or a privacy policy link not given; anything needed is left as something to fill in",
+        "Fits on one screen (roughly 300 words or fewer) as a checklist"
+      ]
     }
   ]
 }

package/packs/experience-design/skills/design-system-spec/evals/files/2/designer-notes.md

@@ -0,0 +1,23 @@
+# Dose stepper — designer notes (MedRound ward medication app, tablet)
+
+Context: nurses use MedRound on shared ward tablets to record liquid doses given at the bedside. The dose stepper replaces a free-text field that produced typing errors (e.g. "50" entered for "5.0").
+
+Anatomy as drawn:
+- Label above the field ("Dose (mL)")
+- Minus button, value field, plus button, in one row
+- Unit suffix "mL" inside the field, right-aligned
+- Helper text below ("Prescribed: 5 mL")
+- Error text below, replaces helper text
+
+Behaviour as drawn:
+- Step 0.5 mL. Minimum 0.5 mL, maximum 10 mL (the largest syringe the wards stock).
+- Nurses can also type a value directly.
+- Minus is disabled at the minimum, plus is disabled at the maximum.
+- If the entered dose differs from the prescribed dose, show a warning (not an error) and require a second tap on Confirm.
+
+Visual:
+- Plus/minus buttons are 20 × 20 px so the row fits the narrow MAR column. WCAG only asks for 44 px at AAA so 20 px is fine for AA.
+- Field border uses `color.border.default`; on focus use `color.border.focus-strong`.
+- Error text uses `color.text.error` (#E57373) on the white surface — checked, passes AA.
+- Disabled buttons use `color.icon.disabled`.
+- Warning uses `color.text.warning`.