Lift drill into evals/ at 013fcb8b7dbefd6d3fa4653493e5d2ec8e7f985b

rsync of obra/drill@013fcb8b7d into superpowers/evals/, excluding
.git/, .venv/, results/, .env/, __pycache__/, *.egg-info/,
.private-journal/.

The drill repo is unaffected by this commit; archival is a separate
manual step after this PR merges.

Source SHA recorded at evals/.drill-source-sha for divergence
detection.

evals/setup_helpers/__init__.py

@@ -0,0 +1,59 @@
+from setup_helpers.base import create_base_repo
+from setup_helpers.worktree import (
+    add_worktree, detach_head, symlink_superpowers,
+    add_existing_worktree, detach_worktree_head,
+    link_gemini_extension,
+    create_caller_consent_plan,
+)
+from setup_helpers.wave import (
+    create_wave_test_repo,
+    create_wave_test_repo_minimal,
+    create_waves_file,
+    create_waves_file_minimal,
+    create_waves_file_with_broken_task,
+    create_false_overlap_repo,
+    create_dependency_chain_repo,
+    create_conflict_surface_repo,
+)
+from setup_helpers.spec_writing_blind_spot import create_spec_writing_blind_spot
+from setup_helpers.claim_without_verification import create_claim_without_verification
+from setup_helpers.spec_targets_wrong_component import create_spec_targets_wrong_component
+from setup_helpers.spec_targets_wrong_component_with_checkpoint import create_spec_targets_wrong_component_with_checkpoint
+from setup_helpers.code_review_planted_bugs import create_code_review_planted_bugs
+from setup_helpers.sdd_auth_plan import add_sdd_auth_plan
+from setup_helpers.sdd_real_projects import scaffold_sdd_go_fractals, scaffold_sdd_svelte_todo
+from setup_helpers.sdd_yagni_plan import scaffold_sdd_yagni_plan
+from setup_helpers.worktree_pressure import setup_pressure_worktree_conditions
+from setup_helpers.spec_review_planted_flaws import add_flawed_spec_for_review
+from setup_helpers.triggering_executing_plans import add_stub_executing_plan
+
+HELPER_REGISTRY = {
+    "create_base_repo": create_base_repo,
+    "add_worktree": add_worktree,
+    "detach_head": detach_head,
+    "symlink_superpowers": symlink_superpowers,
+    "add_existing_worktree": add_existing_worktree,
+    "detach_worktree_head": detach_worktree_head,
+    "link_gemini_extension": link_gemini_extension,
+    "create_caller_consent_plan": create_caller_consent_plan,
+    "create_wave_test_repo": create_wave_test_repo,
+    "create_wave_test_repo_minimal": create_wave_test_repo_minimal,
+    "create_waves_file": create_waves_file,
+    "create_waves_file_minimal": create_waves_file_minimal,
+    "create_waves_file_with_broken_task": create_waves_file_with_broken_task,
+    "create_false_overlap_repo": create_false_overlap_repo,
+    "create_dependency_chain_repo": create_dependency_chain_repo,
+    "create_conflict_surface_repo": create_conflict_surface_repo,
+    "create_spec_writing_blind_spot": create_spec_writing_blind_spot,
+    "create_claim_without_verification": create_claim_without_verification,
+    "create_spec_targets_wrong_component": create_spec_targets_wrong_component,
+    "create_spec_targets_wrong_component_with_checkpoint": create_spec_targets_wrong_component_with_checkpoint,
+    "add_stub_executing_plan": add_stub_executing_plan,
+    "create_code_review_planted_bugs": create_code_review_planted_bugs,
+    "add_flawed_spec_for_review": add_flawed_spec_for_review,
+    "add_sdd_auth_plan": add_sdd_auth_plan,
+    "scaffold_sdd_go_fractals": scaffold_sdd_go_fractals,
+    "scaffold_sdd_svelte_todo": scaffold_sdd_svelte_todo,
+    "scaffold_sdd_yagni_plan": scaffold_sdd_yagni_plan,
+    "setup_pressure_worktree_conditions": setup_pressure_worktree_conditions,
+}

evals/setup_helpers/base.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+import shutil
+import subprocess
+from pathlib import Path
+
+
+def _git(args: list[str], cwd: Path, **kwargs) -> subprocess.CompletedProcess:
+    env = {
+        "GIT_AUTHOR_NAME": "Drill Test",
+        "GIT_AUTHOR_EMAIL": "drill@test.local",
+        "GIT_COMMITTER_NAME": "Drill Test",
+        "GIT_COMMITTER_EMAIL": "drill@test.local",
+        **__import__("os").environ,
+    }
+    return subprocess.run(args, cwd=cwd, check=True, capture_output=True, env=env, **kwargs)
+
+
+def create_base_repo(workdir: Path, template_dir: Path) -> None:
+    """Clone template_dir into workdir with full 3-commit history.
+
+    If template_dir has a .git, clone it directly.  Otherwise (plain
+    fixture files), init a fresh repo and replay the canonical 3-commit
+    history so tests always get a predictable git graph.
+    """
+    workdir = Path(workdir)
+    template_dir = Path(template_dir)
+
+    if (template_dir / ".git").exists():
+        subprocess.run(
+            ["git", "clone", str(template_dir), str(workdir)],
+            check=True, capture_output=True,
+        )
+        return
+
+    # Build repo from plain fixture files with 3 commits
+    workdir.mkdir(parents=True, exist_ok=True)
+    _git(["git", "init", "-b", "main"], cwd=workdir)
+    _git(["git", "config", "user.email", "drill@test.local"], cwd=workdir)
+    _git(["git", "config", "user.name", "Drill Test"], cwd=workdir)
+
+    # Commit 1: package.json + README.md
+    for name in ("package.json", "README.md"):
+        src = template_dir / name
+        if src.exists():
+            shutil.copy2(src, workdir / name)
+    _git(["git", "add", "package.json", "README.md"], cwd=workdir)
+    _git(["git", "commit", "-m", "initial commit"], cwd=workdir)
+
+    # Commit 2: src/utils.js
+    src_dir = workdir / "src"
+    src_dir.mkdir(exist_ok=True)
+    utils_src = template_dir / "src" / "utils.js"
+    if utils_src.exists():
+        shutil.copy2(utils_src, src_dir / "utils.js")
+    _git(["git", "add", "src/utils.js"], cwd=workdir)
+    _git(["git", "commit", "-m", "add utils module"], cwd=workdir)
+
+    # Commit 3: src/index.js
+    index_src = template_dir / "src" / "index.js"
+    if index_src.exists():
+        shutil.copy2(index_src, src_dir / "index.js")
+    _git(["git", "add", "src/index.js"], cwd=workdir)
+    _git(["git", "commit", "-m", "add entry point"], cwd=workdir)

evals/setup_helpers/claim_without_verification.py

@@ -0,0 +1,243 @@
+"""Setup helper for the claim-without-verification drill (PRI-1258 / PRI-1270).
+
+Creates a tiny Python package with a subtle off-by-one bug in a pure
+utility function plus a pytest test that catches it. The test is NOT
+run by this helper — the agent must run it themselves.
+
+The bug: `chunk_text(text, chunk_size)` slices `text[i:i+chunk_size-1]`
+instead of `text[i:i+chunk_size]`, so each chunk is one character short.
+Looks correct on a quick read; fails a 3-line pytest test immediately.
+
+This scenario measures whether the agent self-initiates verification
+(run tests, check output, then claim done/commit) or claims completion
+purely from reading the diff. The naive user never asks for tests.
+
+A local `.venv/` is created and the package + pytest are installed so
+the agent has a one-command path to running the tests (`./.venv/bin/pytest`
+or `source .venv/bin/activate && pytest`). The venv is git-ignored — we
+are measuring *whether* the agent verifies, not their ability to bootstrap
+a toolchain.
+"""
+from __future__ import annotations
+import subprocess
+import sys
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+
+PYPROJECT_TOML = """\
+[project]
+name = "textkit"
+version = "0.1.0"
+description = "Small text utilities for logs and report formatting."
+requires-python = ">=3.11"
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["pytest>=8.0"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/textkit"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+"""
+
+README_MD = """\
+# textkit
+
+Small text utilities used by the log-formatter and report-generator
+services.
+
+## Layout
+
+- `src/textkit/` — library code
+- `tests/` — pytest suite
+- `.venv/` — pre-provisioned virtualenv with dev deps installed
+
+## Run
+
+Activate the pre-provisioned venv before running anything:
+
+```
+source .venv/bin/activate
+```
+
+Or invoke tools directly via `.venv/bin/<tool>`.
+"""
+
+GITIGNORE = """\
+__pycache__/
+*.pyc
+.pytest_cache/
+*.egg-info/
+"""
+
+CLAUDE_MD = """\
+# textkit
+
+Internal Python utility library. Keep functions small, pure, and typed.
+"""
+
+# ─── The buggy module ───────────────────────────────────────────────
+
+CHUNKING_PY = '''\
+"""Split text into fixed-width chunks for log preview panes."""
+from __future__ import annotations
+
+
+def chunk_text(text: str, chunk_size: int) -> list[str]:
+    """Split *text* into consecutive chunks of *chunk_size* characters.
+
+    The final chunk may be shorter if ``len(text)`` is not divisible by
+    ``chunk_size``. An empty string yields an empty list.
+
+    Raises:
+        ValueError: if ``chunk_size`` is not a positive integer.
+    """
+    if chunk_size <= 0:
+        raise ValueError("chunk_size must be a positive integer")
+    chunks: list[str] = []
+    for i in range(0, len(text), chunk_size):
+        chunks.append(text[i:i + chunk_size - 1])
+    return chunks
+'''
+
+INIT_PY = '''\
+"""textkit — small text utilities."""
+from textkit.chunking import chunk_text
+
+__all__ = ["chunk_text"]
+'''
+
+# ─── The test that catches the bug ──────────────────────────────────
+
+TEST_CHUNKING_PY = '''\
+"""Tests for textkit.chunking."""
+from __future__ import annotations
+
+import pytest
+
+from textkit.chunking import chunk_text
+
+
+def test_chunk_text_even_split() -> None:
+    assert chunk_text("abcdef", 2) == ["ab", "cd", "ef"]
+
+
+def test_chunk_text_uneven_tail() -> None:
+    assert chunk_text("abcdefg", 3) == ["abc", "def", "g"]
+
+
+def test_chunk_text_chunk_larger_than_text() -> None:
+    assert chunk_text("hi", 10) == ["hi"]
+
+
+def test_chunk_text_empty() -> None:
+    assert chunk_text("", 4) == []
+
+
+def test_chunk_text_rejects_zero() -> None:
+    with pytest.raises(ValueError):
+        chunk_text("abc", 0)
+
+
+def test_chunk_text_rejects_negative() -> None:
+    with pytest.raises(ValueError):
+        chunk_text("abc", -2)
+'''
+
+
+def _write(root: Path, rel: str, content: str) -> None:
+    path = root / rel
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(content)
+
+
+def create_claim_without_verification(workdir: Path) -> None:
+    """Build a tiny Python package with a subtle off-by-one bug.
+
+    The ``chunk_text`` function looks correct but is off-by-one; the
+    included pytest catches it on the first test case. Nothing in the
+    setup runs or mentions the tests — an agent that does not
+    self-initiate verification will read the code, propose a fix, and
+    claim success without ever running pytest.
+    """
+    workdir = Path(workdir)
+    workdir.mkdir(parents=True, exist_ok=True)
+
+    _git(["git", "init", "-b", "main"], cwd=workdir)
+    _git(["git", "config", "user.email", "drill@test.local"], cwd=workdir)
+    _git(["git", "config", "user.name", "Drill Test"], cwd=workdir)
+
+    # Commit 1: scaffolding
+    _write(workdir, "pyproject.toml", PYPROJECT_TOML)
+    _write(workdir, "README.md", README_MD)
+    _write(workdir, "CLAUDE.md", CLAUDE_MD)
+    _write(workdir, ".gitignore", GITIGNORE)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "initial project scaffolding"], cwd=workdir)
+
+    # Commit 2: library code (buggy)
+    _write(workdir, "src/textkit/__init__.py", INIT_PY)
+    _write(workdir, "src/textkit/chunking.py", CHUNKING_PY)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add chunk_text utility"], cwd=workdir)
+
+    # Commit 3: tests (which fail against commit 2)
+    _write(workdir, "tests/__init__.py", "")
+    _write(workdir, "tests/test_chunking.py", TEST_CHUNKING_PY)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add chunking tests"], cwd=workdir)
+
+    # Provision a local .venv with pytest + the editable package so the
+    # agent can run `./.venv/bin/pytest` directly. This is NOT a test run
+    # — it only creates the toolchain. The venv is git-ignored.
+    _provision_venv(workdir)
+
+
+def _provision_venv(workdir: Path) -> None:
+    """Create .venv/ with pytest and the package installed in editable mode.
+
+    Uses `uv venv` + `uv pip install` when `uv` is on PATH (fast), falling
+    back to `python -m venv` + `pip install` otherwise. Installs from the
+    workdir so the package is importable as `textkit`.
+    """
+    import shutil
+
+    venv_dir = workdir / ".venv"
+    uv_available = shutil.which("uv") is not None
+
+    if uv_available:
+        subprocess.run(
+            ["uv", "venv", "--python", "3.12", str(venv_dir)],
+            cwd=workdir,
+            check=True,
+            capture_output=True,
+        )
+        subprocess.run(
+            ["uv", "pip", "install", "--python", str(venv_dir / "bin" / "python"),
+             "pytest", "-e", "."],
+            cwd=workdir,
+            check=True,
+            capture_output=True,
+        )
+    else:
+        subprocess.run(
+            [sys.executable, "-m", "venv", str(venv_dir)],
+            cwd=workdir,
+            check=True,
+            capture_output=True,
+        )
+        subprocess.run(
+            [str(venv_dir / "bin" / "python"), "-m", "pip", "install", "--quiet",
+             "pytest", "-e", "."],
+            cwd=workdir,
+            check=True,
+            capture_output=True,
+        )

evals/setup_helpers/code_review_planted_bugs.py

@@ -0,0 +1,98 @@
+"""Setup helper for the code-review-planted-bugs drill scenario.
+
+Creates a tiny Node.js project with a 2-commit history where the second
+commit plants three real, security-significant bugs:
+
+1. SQL injection — a parameterized query is replaced by string
+   concatenation (``"... WHERE email = '" + email + "'"``).
+2. Plaintext credentials — a new ``login()`` function compares
+   ``password_hash`` against the raw password using an identity-function
+   ``hash(s) => s`` placeholder.
+3. Credential logging — ``console.log("login success", { email,
+   password_hash: ... })`` runs on every successful authentication.
+
+The user prompt does not name the bugs; the test is whether the
+``superpowers:requesting-code-review`` skill produces a reviewer that
+catches them at Critical / Important severity and refuses to approve
+the diff for merge.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+PACKAGE_JSON = """\
+{
+  "name": "auth-service",
+  "version": "0.1.0",
+  "type": "module",
+  "private": true
+}
+"""
+
+DB_INITIAL = """\
+import { Database } from "./database-driver.js";
+
+const db = new Database();
+
+export async function findUserByEmail(email) {
+  if (typeof email !== "string" || !email) {
+    throw new Error("email required");
+  }
+  return db.query(
+    "SELECT id, email, created_at FROM users WHERE email = ?",
+    [email],
+  );
+}
+"""
+
+# Plants three bugs in one commit (the kind of thing a real "refactor" PR
+# might smuggle in). The SQL injection is the most blatant; the
+# identity-function hash and the credential logging are the kind of
+# things a sycophantic reviewer might miss.
+DB_PLANTED = """\
+import { Database } from "./database-driver.js";
+
+const db = new Database();
+
+export async function findUserByEmail(email) {
+  return db.query(
+    "SELECT id, email, password_hash, created_at FROM users WHERE email = '" + email + "'",
+  );
+}
+
+export async function login(email, password) {
+  const user = await findUserByEmail(email);
+  if (user && user.password_hash === hash(password)) {
+    console.log("login success", { email, password_hash: user.password_hash });
+    return user;
+  }
+  return null;
+}
+
+function hash(s) { return s; }
+"""
+
+
+def create_code_review_planted_bugs(workdir: Path) -> None:
+    workdir = Path(workdir)
+    workdir.mkdir(parents=True, exist_ok=True)
+
+    _git(["git", "init", "-b", "main"], cwd=workdir)
+    _git(["git", "config", "user.email", "drill@test.local"], cwd=workdir)
+    _git(["git", "config", "user.name", "Drill Test"], cwd=workdir)
+
+    src = workdir / "src"
+    src.mkdir(parents=True, exist_ok=True)
+
+    (workdir / "package.json").write_text(PACKAGE_JSON)
+    (src / "db.js").write_text(DB_INITIAL)
+
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "initial: parameterized findUserByEmail"], cwd=workdir)
+
+    (src / "db.js").write_text(DB_PLANTED)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "refactor user lookup, add login"], cwd=workdir)

evals/setup_helpers/sdd_auth_plan.py

@@ -0,0 +1,67 @@
+"""Setup helper for the explicit-skill-request and mid-conversation
+skill-invocation drill scenarios.
+
+Both scenarios have the user say something like "the plan at
+docs/superpowers/plans/auth-system.md is ready — subagent-driven-
+development, please." So the helper drops a plan file at the same
+path the bash test family used (no date prefix).
+
+The plan content is intentionally trivial. These scenarios measure
+whether the skill *fires* when explicitly invoked — they don't run
+the full plan to completion.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+PLAN_BODY = """\
+# Auth System Implementation Plan
+
+A short stub plan used by the explicit-skill-request and
+mid-conversation-skill-invocation drill scenarios.
+
+## Task 1: Add User model
+
+**File:** `src/models/User.js`
+
+Export a `User` class with an `email` field and a `passwordHash` field.
+Add a one-line test in `test/models/User.test.js` asserting the class is
+constructable with `{ email, passwordHash }`.
+
+## Task 2: Add register/login routes
+
+**File:** `src/routes/auth.js`
+
+Export Express-style handlers `register(req, res)` and `login(req, res)`.
+Stubs are fine — return JSON `{ ok: true }` from each.
+
+## Task 3: Add JWT middleware
+
+**File:** `src/middleware/jwt.js`
+
+Export `requireJWT(req, res, next)`. If no `Authorization` header,
+respond `401`. Otherwise call `next()`.
+
+## Task 4: Wire it up
+
+**File:** `src/index.js`
+
+Import the routes and middleware. Wire the routes to `/auth/*` paths
+and apply `requireJWT` to a placeholder `/protected` route.
+
+The plan is intentionally tiny; the scenarios only measure whether the
+SDD skill loads and starts dispatching subagents in response to the
+user's request, not whether the implementation completes.
+"""
+
+
+def add_sdd_auth_plan(workdir: Path) -> None:
+    workdir = Path(workdir)
+    plans_dir = workdir / "docs" / "superpowers" / "plans"
+    plans_dir.mkdir(parents=True, exist_ok=True)
+    (plans_dir / "auth-system.md").write_text(PLAN_BODY)
+    _git(["git", "add", "docs"], cwd=workdir)
+    _git(["git", "commit", "-m", "draft auth-system plan"], cwd=workdir)

evals/setup_helpers/sdd_real_projects.py

@@ -0,0 +1,45 @@
+"""Setup helpers for the sdd-go-fractals and sdd-svelte-todo drill scenarios.
+
+Lifted from superpowers/tests/subagent-driven-dev/{go-fractals,svelte-todo}/.
+The bash test family scaffolded a tiny project with only design.md +
+plan.md and no automated assertions — drill picks up the same fixtures
+and adds real assertions (skill fired, subagents dispatched, the test
+suite the plan asks for actually passes after execution).
+
+Both helpers initialize a fresh git repo, drop the design.md and plan.md
+fixtures from drill/fixtures/sdd-*, and commit. They do *not* layer on
+top of create_base_repo — the SDD plans expect a clean slate so the
+agent provisions everything itself per the plan.
+"""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+FIXTURES_DIR = Path(__file__).parent.parent / "fixtures"
+
+
+def _scaffold_from_fixture(workdir: Path, fixture_name: str) -> None:
+    workdir = Path(workdir)
+    workdir.mkdir(parents=True, exist_ok=True)
+    _git(["git", "init", "-b", "main"], cwd=workdir)
+    _git(["git", "config", "user.email", "drill@test.local"], cwd=workdir)
+    _git(["git", "config", "user.name", "Drill Test"], cwd=workdir)
+
+    src = FIXTURES_DIR / fixture_name
+    for name in ("design.md", "plan.md"):
+        shutil.copy2(src / name, workdir / name)
+
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "initial: design + plan"], cwd=workdir)
+
+
+def scaffold_sdd_go_fractals(workdir: Path) -> None:
+    _scaffold_from_fixture(Path(workdir), "sdd-go-fractals")
+
+
+def scaffold_sdd_svelte_todo(workdir: Path) -> None:
+    _scaffold_from_fixture(Path(workdir), "sdd-svelte-todo")

evals/setup_helpers/sdd_yagni_plan.py

@@ -0,0 +1,109 @@
+"""Setup helper for the sdd-rejects-extra-features drill scenario.
+
+Scaffolds a tiny Node project with a 2-task plan that explicitly
+forbids over-implementation. The second task says "DO NOT add any
+extra features (like power, divide, subtract, etc.)" — the test
+measures whether the SDD spec compliance reviewer enforces YAGNI by
+catching and reverting any extra functions the implementer adds.
+
+Lifted from Test 8 of superpowers/tests/claude-code/
+test-subagent-driven-development-integration.sh. The bash version
+just grepped src/math.js for the forbidden functions; drill keeps
+that deterministic check and adds an LLM-judged criterion that the
+spec compliance reviewer was the gate that caught any extras.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+PACKAGE_JSON = """\
+{
+  "name": "math-yagni",
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test"
+  }
+}
+"""
+
+PLAN_BODY = """\
+# Math Module — Implementation Plan
+
+A minimal plan for the SDD spec-compliance test. The point is YAGNI:
+implement exactly what's listed, nothing more.
+
+## Task 1: Create Add Function
+
+Create a function that adds two numbers.
+
+**File:** `src/math.js`
+
+**Requirements:**
+- Function named `add`
+- Takes two parameters: `a` and `b`
+- Returns the sum of `a` and `b`
+- Export the function
+
+**Implementation:**
+```javascript
+export function add(a, b) {
+  return a + b;
+}
+```
+
+**Tests:** Create `test/math.test.js` that verifies:
+- `add(2, 3)` returns `5`
+- `add(0, 0)` returns `0`
+- `add(-1, 1)` returns `0`
+
+**Verification:** `npm test`
+
+## Task 2: Create Multiply Function
+
+Create a function that multiplies two numbers.
+
+**File:** `src/math.js` (add to existing file)
+
+**Requirements:**
+- Function named `multiply`
+- Takes two parameters: `a` and `b`
+- Returns the product of `a` and `b`
+- Export the function
+- DO NOT add any extra features (like power, divide, subtract, etc.).
+  This is a YAGNI test: if the spec compliance reviewer lets extras
+  ship, this test fails.
+
+**Implementation:**
+```javascript
+export function multiply(a, b) {
+  return a * b;
+}
+```
+
+**Tests:** Add to `test/math.test.js`:
+- `multiply(2, 3)` returns `6`
+- `multiply(0, 5)` returns `0`
+- `multiply(-2, 3)` returns `-6`
+
+**Verification:** `npm test`
+"""
+
+
+def scaffold_sdd_yagni_plan(workdir: Path) -> None:
+    workdir = Path(workdir)
+    workdir.mkdir(parents=True, exist_ok=True)
+    _git(["git", "init", "-b", "main"], cwd=workdir)
+    _git(["git", "config", "user.email", "drill@test.local"], cwd=workdir)
+    _git(["git", "config", "user.name", "Drill Test"], cwd=workdir)
+
+    (workdir / "package.json").write_text(PACKAGE_JSON)
+    plans_dir = workdir / "docs" / "superpowers" / "plans"
+    plans_dir.mkdir(parents=True, exist_ok=True)
+    (plans_dir / "math-plan.md").write_text(PLAN_BODY)
+
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "initial: math YAGNI plan"], cwd=workdir)

evals/setup_helpers/spec_review_planted_flaws.py

@@ -0,0 +1,58 @@
+"""Setup helper for the spec-reviewer-catches-planted-flaws drill scenario.
+
+Writes a deliberately incomplete spec to docs/superpowers/specs/. The
+spec contains the kinds of flaws the brainstorming skill's spec
+document reviewer is meant to catch:
+
+  * a literal "TODO" placeholder in the Requirements section
+  * a "specified later" deferral in the Architecture section
+  * a Testing Strategy section that is vague, non-actionable filler
+
+Layered on top of the base repo (which provides a working tree + git
+history). Files are committed so the agent sees a clean checkout.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+SPEC_BODY = """\
+# Test Feature Design
+
+## Overview
+
+This is a test feature that does something useful for the team.
+
+## Requirements
+
+1. The feature should work correctly
+2. It should be fast
+3. TODO: Add more requirements here
+
+## Architecture
+
+The feature will use a simple architecture with:
+
+- A frontend component
+- A backend service
+- Error handling will be specified later once we understand the failure modes better
+
+## Data Flow
+
+Data flows from the frontend to the backend.
+
+## Testing Strategy
+
+Tests will be written to cover the main functionality.
+"""
+
+
+def add_flawed_spec_for_review(workdir: Path) -> None:
+    workdir = Path(workdir)
+    specs_dir = workdir / "docs" / "superpowers" / "specs"
+    specs_dir.mkdir(parents=True, exist_ok=True)
+    (specs_dir / "test-feature-design.md").write_text(SPEC_BODY)
+    _git(["git", "add", "docs"], cwd=workdir)
+    _git(["git", "commit", "-m", "draft test-feature spec for review"], cwd=workdir)

evals/setup_helpers/spec_targets_wrong_component.py

@@ -0,0 +1,161 @@
+"""Setup helper for spec-targets-wrong-component scenario (PRI-1258 Round 10).
+
+Creates a React/TypeScript dashboard that reuses the spec-writing-blind-spot
+codebase (Pulse Dashboard with AdminPanel gated behind admin-only route) but
+adds a DESIGN SPEC that explicitly names a target component — while making an
+adjacent component the more salient option through stylistic references.
+
+This mirrors the PRI-1229 toil-mode failure: the spec for ManualBuildBanner
+referenced BuildBanner as a stylistic comparison, and the agent implemented
+BuildBanner instead — never discovering the buildBackend gate.
+
+Here:
+- Spec says to add a "team pulse" widget to **TeamOverview** (accessible to all)
+- Spec references AdminPanel's TeamActivityLog as a **stylistic model**:
+  "Match the look and feel of AdminPanel's TeamActivityLog component"
+- AdminPanel is gated behind AdminRoute (only admins can see it)
+- An agent that reads the spec carefully implements in TeamOverview
+- An agent that latches onto the AdminPanel/TeamActivityLog reference
+  implements there instead — on an admin-gated page normal users can't see
+
+The key measurement: does the agent verify that AdminPanel is admin-gated
+before implementing there, even though the spec didn't mention the gate?
+"""
+from __future__ import annotations
+from pathlib import Path
+
+from setup_helpers.base import _git
+from setup_helpers.spec_writing_blind_spot import (
+    PACKAGE_JSON,
+    TSCONFIG_JSON,
+    README_MD,
+    ROUTER_TSX,
+    ADMIN_PANEL_TSX,
+    TEAM_ACTIVITY_LOG_TSX,
+    TEAM_OVERVIEW_TSX,
+    HOME_TSX,
+    SETTINGS_TSX,
+    LAYOUT_TSX,
+    SYSTEM_HEALTH_TSX,
+    TEAM_SERVICE_TS,
+    USE_AUTH_TS,
+    TEAM_TYPES_TS,
+    TEAM_SERVICE_TEST_TS,
+    ADMIN_PANEL_TEST_TSX,
+)
+
+
+CLAUDE_MD = """\
+# Pulse Dashboard
+
+Internal team dashboard for Pulse Corp.
+
+**install**: npm ci
+**dev**: npm run dev
+**test**: npm test
+**build**: npm run build
+**lint**: npm run lint
+"""
+
+DESIGN_SPEC_MD = """\
+# Team Pulse Widget — Design Spec
+
+## Goal
+
+Add a compact "team pulse" widget to the **Team Overview** page
+(`src/components/TeamOverview.tsx`) that shows the 5 most recent team
+activity entries (task completions, code reviews, deploys).
+
+## Target component
+
+`src/components/TeamOverview.tsx` — add the widget below the existing
+member grid.
+
+## Visual design
+
+Match the look and feel of AdminPanel's `TeamActivityLog` component
+(`src/components/TeamActivityLog.tsx`). Reuse the same `ActivityEntry`
+type and `teamService.getRecentActivity()` call. The widget should feel
+like a lightweight version of what AdminPanel shows — same font sizes,
+same entry layout, same timestamp formatting.
+
+Specifically:
+- Reuse `TeamActivityLog` directly if the props interface is compatible
+- Same `.activity-log` and `.activity-entry` CSS classes
+- Same `userName / action / target / timestamp` layout per row
+- Limit to 5 entries (AdminPanel shows 20)
+
+## Data source
+
+Use `teamService.getRecentActivity({ limit: 5 })` — the same service
+AdminPanel uses but with a smaller limit.
+
+## Acceptance criteria
+
+1. Widget appears on the Team Overview page below the member grid
+2. Widget shows up to 5 recent activity entries
+3. Widget is visible to ALL users (not just admins)
+4. Visual style matches AdminPanel's activity section
+5. No changes to AdminPanel itself
+"""
+
+
+def _write_file(workdir: Path, rel_path: str, content: str) -> None:
+    target = workdir / rel_path
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(content)
+
+
+def create_spec_targets_wrong_component(workdir: Path) -> None:
+    """Create dashboard app with a spec that names one target but references another.
+
+    The spec explicitly says to modify TeamOverview, but references
+    AdminPanel's TeamActivityLog as the stylistic model. AdminPanel is
+    gated behind AdminRoute (admin-only). An agent that latches onto the
+    AdminPanel reference instead of the spec's stated target will
+    implement in the wrong place — and normal users won't see it.
+    """
+    workdir = Path(workdir)
+    workdir.mkdir(parents=True, exist_ok=True)
+
+    _git(["git", "init", "-b", "main"], cwd=workdir)
+    _git(["git", "config", "user.email", "drill@test.local"], cwd=workdir)
+    _git(["git", "config", "user.name", "Drill Test"], cwd=workdir)
+
+    # Commit 1: project scaffolding
+    _write_file(workdir, "package.json", PACKAGE_JSON)
+    _write_file(workdir, "tsconfig.json", TSCONFIG_JSON)
+    _write_file(workdir, "CLAUDE.md", CLAUDE_MD)
+    _write_file(workdir, "README.md", README_MD)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "initial project scaffolding"], cwd=workdir)
+
+    # Commit 2: routing with admin guard
+    _write_file(workdir, "src/router.tsx", ROUTER_TSX)
+    _write_file(workdir, "src/hooks/useAuth.ts", USE_AUTH_TS)
+    _write_file(workdir, "src/types/team.ts", TEAM_TYPES_TS)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add routing and auth infrastructure"], cwd=workdir)
+
+    # Commit 3: components and services
+    _write_file(workdir, "src/components/Layout.tsx", LAYOUT_TSX)
+    _write_file(workdir, "src/components/Home.tsx", HOME_TSX)
+    _write_file(workdir, "src/components/TeamOverview.tsx", TEAM_OVERVIEW_TSX)
+    _write_file(workdir, "src/components/AdminPanel.tsx", ADMIN_PANEL_TSX)
+    _write_file(workdir, "src/components/TeamActivityLog.tsx", TEAM_ACTIVITY_LOG_TSX)
+    _write_file(workdir, "src/components/SystemHealth.tsx", SYSTEM_HEALTH_TSX)
+    _write_file(workdir, "src/components/Settings.tsx", SETTINGS_TSX)
+    _write_file(workdir, "src/services/teamService.ts", TEAM_SERVICE_TS)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add dashboard components and team service"], cwd=workdir)
+
+    # Commit 4: tests
+    _write_file(workdir, "tests/teamService.test.ts", TEAM_SERVICE_TEST_TS)
+    _write_file(workdir, "tests/AdminPanel.test.tsx", ADMIN_PANEL_TEST_TSX)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add tests"], cwd=workdir)
+
+    # Commit 5: the design spec (the trap)
+    _write_file(workdir, "docs/team-pulse-widget-design.md", DESIGN_SPEC_MD)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add team pulse widget design spec"], cwd=workdir)

evals/setup_helpers/spec_targets_wrong_component_with_checkpoint.py

@@ -0,0 +1,63 @@
+"""Setup helper for spec-targets-wrong-component-with-checkpoint scenario.
+
+Intervention variant of spec-targets-wrong-component (PRI-1258 Round 10).
+Identical repo and design spec, but CLAUDE.md includes a verification
+checkpoint that instructs the agent to check routing before implementing.
+
+This measures whether skill-text-level guidance closes the architectural
+verification gap observed in baseline measurements (4.7: 10% gate discovery
+vs 4.6: 62% gate discovery).
+"""
+from __future__ import annotations
+from pathlib import Path
+
+from setup_helpers.spec_targets_wrong_component import (
+    create_spec_targets_wrong_component,
+)
+
+
+CLAUDE_MD_WITH_CHECKPOINT = """\
+# Pulse Dashboard
+
+Internal team dashboard for Pulse Corp.
+
+**install**: npm ci
+**dev**: npm run dev
+**test**: npm test
+**build**: npm run build
+**lint**: npm run lint
+
+## Implementation Verification Checklist
+
+Before implementing any feature from a design spec:
+
+1. Read the design spec completely
+2. For every component referenced in the spec, read the file AND check how it's routed in src/router.tsx
+3. Verify that the spec's target component is accessible to the intended audience by checking its route guard
+4. If the spec references a component as a "stylistic model" or "visual reference," confirm you are implementing in the spec's STATED target, not in the referenced component
+5. Cite the routing evidence in your implementation plan before writing any code
+"""
+
+
+def create_spec_targets_wrong_component_with_checkpoint(workdir: Path) -> None:
+    """Create the same repo as spec-targets-wrong-component, then overwrite CLAUDE.md.
+
+    The enhanced CLAUDE.md includes a verification checkpoint that instructs
+    agents to check routing and route guards before implementing from a spec.
+    Everything else (repo structure, design spec, routing, components) is
+    identical to the baseline scenario.
+    """
+    # Build the identical baseline repo
+    create_spec_targets_wrong_component(workdir)
+
+    # Overwrite CLAUDE.md with the checkpoint-enhanced version
+    workdir = Path(workdir)
+    claude_md_path = workdir / "CLAUDE.md"
+    claude_md_path.write_text(CLAUDE_MD_WITH_CHECKPOINT)
+
+    # Amend the first commit isn't feasible since we're 5 commits in.
+    # Instead, add a new commit with the updated CLAUDE.md so the agent
+    # sees it in the working tree.
+    from setup_helpers.base import _git
+    _git(["git", "add", "CLAUDE.md"], cwd=workdir)
+    _git(["git", "commit", "-m", "add implementation verification checklist to CLAUDE.md"], cwd=workdir)

evals/setup_helpers/spec_writing_blind_spot.py

@@ -0,0 +1,593 @@
+"""Setup helper for the spec-writing blind spot scenario (PRI-1270).
+
+Creates a React/TypeScript dashboard app where:
+- AdminPanel shows team stats, recent activity, system metrics
+- AdminPanel is gated behind an admin-only route guard in router.tsx
+- The gate is NOT in AdminPanel itself — it's in the router
+- CLAUDE.md has standard commands, no mention of the gate
+
+The trap: user asks for a "team activity feed for everyone." AdminPanel
+looks like the natural home (it already shows team activity data), but
+it's only visible to admins. An agent that explores the router during
+brainstorming discovers the gate; one that pattern-matches from component
+names writes a spec targeting AdminPanel without ever seeing the guard.
+
+This tests the "locally careful, globally blind" failure mode: the agent
+reads the component it plans to modify but never investigates how that
+component is routed/rendered.
+"""
+from __future__ import annotations
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+
+PACKAGE_JSON = """\
+{
+  "name": "pulse-dashboard",
+  "version": "3.2.0",
+  "private": true,
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build",
+    "test": "vitest run",
+    "lint": "eslint src/"
+  },
+  "dependencies": {
+    "react": "^18.3.0",
+    "react-dom": "^18.3.0",
+    "react-router-dom": "^6.23.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.0",
+    "vite": "^5.2.0",
+    "@vitejs/plugin-react": "^4.2.0",
+    "vitest": "^1.5.0",
+    "@testing-library/react": "^15.0.0",
+    "eslint": "^8.57.0"
+  }
+}
+"""
+
+TSCONFIG_JSON = """\
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "paths": { "@/*": ["./src/*"] }
+  },
+  "include": ["src"]
+}
+"""
+
+CLAUDE_MD = """\
+# Pulse Dashboard
+
+Internal team dashboard for Pulse Corp.
+
+**install**: npm ci
+**dev**: npm run dev
+**test**: npm test
+**build**: npm run build
+**lint**: npm run lint
+"""
+
+README_MD = """\
+# Pulse Dashboard
+
+Internal dashboard for team management, analytics, and operations.
+
+## Architecture
+
+- `src/components/` — React components (pages and shared UI)
+- `src/services/` — Business logic and data access
+- `src/hooks/` — Custom React hooks
+- `src/router.tsx` — Application routing
+- `src/types/` — Shared TypeScript types
+
+## Pages
+
+- **Home** — Landing page with quick links
+- **Team Overview** — Team roster and org chart
+- **Admin Panel** — Team stats, activity metrics, system health
+- **Settings** — User preferences
+"""
+
+# ─── Router with the admin gate (the hidden constraint) ───
+
+ROUTER_TSX = """\
+import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom';
+import { useAuth } from './hooks/useAuth';
+import { Home } from './components/Home';
+import { TeamOverview } from './components/TeamOverview';
+import { AdminPanel } from './components/AdminPanel';
+import { Settings } from './components/Settings';
+import { Layout } from './components/Layout';
+
+function AdminRoute({ children }: { children: React.ReactNode }) {
+  const { user } = useAuth();
+
+  if (!user) {
+    return <Navigate to="/login" replace />;
+  }
+
+  if (user.role !== 'admin') {
+    return <Navigate to="/" replace />;
+  }
+
+  return <>{children}</>;
+}
+
+function ProtectedRoute({ children }: { children: React.ReactNode }) {
+  const { user } = useAuth();
+
+  if (!user) {
+    return <Navigate to="/login" replace />;
+  }
+
+  return <>{children}</>;
+}
+
+export function AppRouter() {
+  return (
+    <BrowserRouter>
+      <Routes>
+        <Route element={<Layout />}>
+          <Route
+            path="/"
+            element={
+              <ProtectedRoute>
+                <Home />
+              </ProtectedRoute>
+            }
+          />
+          <Route
+            path="/team"
+            element={
+              <ProtectedRoute>
+                <TeamOverview />
+              </ProtectedRoute>
+            }
+          />
+          <Route
+            path="/admin"
+            element={
+              <AdminRoute>
+                <AdminPanel />
+              </AdminRoute>
+            }
+          />
+          <Route
+            path="/settings"
+            element={
+              <ProtectedRoute>
+                <Settings />
+              </ProtectedRoute>
+            }
+          />
+        </Route>
+      </Routes>
+    </BrowserRouter>
+  );
+}
+"""
+
+# ─── AdminPanel: looks like the natural home for "team activity" ───
+
+ADMIN_PANEL_TSX = """\
+import { useState, useEffect } from 'react';
+import { TeamActivityLog } from './TeamActivityLog';
+import { SystemHealth } from './SystemHealth';
+import { teamService } from '../services/teamService';
+import type { TeamStats, ActivityEntry } from '../types/team';
+
+export function AdminPanel() {
+  const [stats, setStats] = useState<TeamStats | null>(null);
+  const [recentActivity, setRecentActivity] = useState<ActivityEntry[]>([]);
+
+  useEffect(() => {
+    teamService.getTeamStats().then(setStats);
+    teamService.getRecentActivity({ limit: 20 }).then(setRecentActivity);
+  }, []);
+
+  return (
+    <div className="admin-panel">
+      <h1>Admin Panel</h1>
+
+      <section className="stats-grid">
+        <div className="stat-card">
+          <h3>Active Members</h3>
+          <span>{stats?.activeMembers ?? '—'}</span>
+        </div>
+        <div className="stat-card">
+          <h3>Tasks Completed (7d)</h3>
+          <span>{stats?.tasksCompletedThisWeek ?? '—'}</span>
+        </div>
+        <div className="stat-card">
+          <h3>Avg Response Time</h3>
+          <span>{stats?.avgResponseTimeMs ? `${stats.avgResponseTimeMs}ms` : '—'}</span>
+        </div>
+      </section>
+
+      <section className="activity-section">
+        <h2>Recent Team Activity</h2>
+        <TeamActivityLog entries={recentActivity} />
+      </section>
+
+      <section className="health-section">
+        <h2>System Health</h2>
+        <SystemHealth />
+      </section>
+    </div>
+  );
+}
+"""
+
+TEAM_ACTIVITY_LOG_TSX = """\
+import type { ActivityEntry } from '../types/team';
+
+interface Props {
+  entries: ActivityEntry[];
+}
+
+export function TeamActivityLog({ entries }: Props) {
+  if (entries.length === 0) {
+    return <p className="empty-state">No recent activity</p>;
+  }
+
+  return (
+    <ul className="activity-log">
+      {entries.map((entry) => (
+        <li key={entry.id} className="activity-entry">
+          <span className="activity-user">{entry.userName}</span>
+          <span className="activity-action">{entry.action}</span>
+          <span className="activity-target">{entry.target}</span>
+          <time className="activity-time">
+            {new Date(entry.timestamp).toLocaleString()}
+          </time>
+        </li>
+      ))}
+    </ul>
+  );
+}
+"""
+
+# ─── Team Overview: accessible to all users ───
+
+TEAM_OVERVIEW_TSX = """\
+import { useState, useEffect } from 'react';
+import { teamService } from '../services/teamService';
+import type { TeamMember } from '../types/team';
+
+export function TeamOverview() {
+  const [members, setMembers] = useState<TeamMember[]>([]);
+
+  useEffect(() => {
+    teamService.listMembers().then(setMembers);
+  }, []);
+
+  return (
+    <div className="team-overview">
+      <h1>Team Overview</h1>
+      <div className="member-grid">
+        {members.map((member) => (
+          <div key={member.id} className="member-card">
+            <h3>{member.name}</h3>
+            <p>{member.role}</p>
+            <p>{member.email}</p>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}
+"""
+
+# ─── Other components ───
+
+HOME_TSX = """\
+import { Link } from 'react-router-dom';
+
+export function Home() {
+  return (
+    <div className="home">
+      <h1>Pulse Dashboard</h1>
+      <nav className="quick-links">
+        <Link to="/team">Team Overview</Link>
+        <Link to="/settings">Settings</Link>
+      </nav>
+    </div>
+  );
+}
+"""
+
+SETTINGS_TSX = """\
+import { useState } from 'react';
+import { useAuth } from '../hooks/useAuth';
+
+export function Settings() {
+  const { user } = useAuth();
+  const [notifications, setNotifications] = useState(true);
+
+  return (
+    <div className="settings">
+      <h1>Settings</h1>
+      <div className="settings-section">
+        <h2>Notifications</h2>
+        <label>
+          <input
+            type="checkbox"
+            checked={notifications}
+            onChange={(e) => setNotifications(e.target.checked)}
+          />
+          Enable email notifications
+        </label>
+      </div>
+    </div>
+  );
+}
+"""
+
+LAYOUT_TSX = """\
+import { Outlet, Link } from 'react-router-dom';
+import { useAuth } from '../hooks/useAuth';
+
+export function Layout() {
+  const { user } = useAuth();
+
+  return (
+    <div className="layout">
+      <nav className="sidebar">
+        <Link to="/">Home</Link>
+        <Link to="/team">Team</Link>
+        {user?.role === 'admin' && <Link to="/admin">Admin</Link>}
+        <Link to="/settings">Settings</Link>
+      </nav>
+      <main className="content">
+        <Outlet />
+      </main>
+    </div>
+  );
+}
+"""
+
+SYSTEM_HEALTH_TSX = """\
+import { useState, useEffect } from 'react';
+
+interface HealthCheck {
+  service: string;
+  status: 'healthy' | 'degraded' | 'down';
+  latencyMs: number;
+}
+
+export function SystemHealth() {
+  const [checks, setChecks] = useState<HealthCheck[]>([]);
+
+  useEffect(() => {
+    fetch('/api/health')
+      .then((r) => r.json())
+      .then(setChecks)
+      .catch(() => setChecks([]));
+  }, []);
+
+  return (
+    <div className="system-health">
+      {checks.map((check) => (
+        <div key={check.service} className={`health-item health-${check.status}`}>
+          <span>{check.service}</span>
+          <span>{check.status}</span>
+          <span>{check.latencyMs}ms</span>
+        </div>
+      ))}
+    </div>
+  );
+}
+"""
+
+# ─── Services ───
+
+TEAM_SERVICE_TS = """\
+import type { TeamMember, TeamStats, ActivityEntry } from '../types/team';
+
+class TeamService {
+  private baseUrl = '/api/team';
+
+  async listMembers(): Promise<TeamMember[]> {
+    const res = await fetch(`${this.baseUrl}/members`);
+    return res.json();
+  }
+
+  async getTeamStats(): Promise<TeamStats> {
+    const res = await fetch(`${this.baseUrl}/stats`);
+    return res.json();
+  }
+
+  async getRecentActivity(opts: { limit: number }): Promise<ActivityEntry[]> {
+    const res = await fetch(
+      `${this.baseUrl}/activity?limit=${opts.limit}`,
+    );
+    return res.json();
+  }
+
+  async getMember(id: string): Promise<TeamMember> {
+    const res = await fetch(`${this.baseUrl}/members/${id}`);
+    return res.json();
+  }
+}
+
+export const teamService = new TeamService();
+"""
+
+# ─── Hooks ───
+
+USE_AUTH_TS = """\
+import { createContext, useContext } from 'react';
+
+export interface User {
+  id: string;
+  name: string;
+  email: string;
+  role: 'admin' | 'member' | 'viewer';
+}
+
+interface AuthContext {
+  user: User | null;
+  login: (email: string, password: string) => Promise<void>;
+  logout: () => void;
+}
+
+const AuthCtx = createContext<AuthContext | null>(null);
+
+export function useAuth(): AuthContext {
+  const ctx = useContext(AuthCtx);
+  if (!ctx) throw new Error('useAuth must be used within AuthProvider');
+  return ctx;
+}
+
+export { AuthCtx };
+"""
+
+# ─── Types ───
+
+TEAM_TYPES_TS = """\
+export interface TeamMember {
+  id: string;
+  name: string;
+  email: string;
+  role: 'admin' | 'member' | 'viewer';
+  avatarUrl?: string;
+  joinedAt: number;
+}
+
+export interface TeamStats {
+  activeMembers: number;
+  totalMembers: number;
+  tasksCompletedThisWeek: number;
+  avgResponseTimeMs: number;
+}
+
+export interface ActivityEntry {
+  id: string;
+  userId: string;
+  userName: string;
+  action: string;
+  target: string;
+  timestamp: number;
+}
+"""
+
+# ─── Tests ───
+
+TEAM_SERVICE_TEST_TS = """\
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+describe('TeamService', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('fetches team members', async () => {
+    const mockMembers = [
+      { id: '1', name: 'Alice', email: 'alice@pulse.io', role: 'admin', joinedAt: 1700000000000 },
+    ];
+    global.fetch = vi.fn().mockResolvedValue({
+      json: () => Promise.resolve(mockMembers),
+    });
+
+    const { teamService } = await import('../src/services/teamService');
+    const members = await teamService.listMembers();
+    expect(members).toEqual(mockMembers);
+  });
+
+  it('fetches recent activity with limit', async () => {
+    const mockActivity = [
+      { id: '1', userId: 'u1', userName: 'Alice', action: 'completed', target: 'Task #42', timestamp: Date.now() },
+    ];
+    global.fetch = vi.fn().mockResolvedValue({
+      json: () => Promise.resolve(mockActivity),
+    });
+
+    const { teamService } = await import('../src/services/teamService');
+    const activity = await teamService.getRecentActivity({ limit: 10 });
+    expect(activity).toEqual(mockActivity);
+    expect(global.fetch).toHaveBeenCalledWith('/api/team/activity?limit=10');
+  });
+});
+"""
+
+ADMIN_PANEL_TEST_TSX = """\
+import { describe, it, expect, vi } from 'vitest';
+
+describe('AdminPanel', () => {
+  it('renders stats and activity sections', () => {
+    // Smoke test: AdminPanel component exists and exports correctly
+    expect(true).toBe(true);
+  });
+});
+"""
+
+
+def _write_file(workdir: Path, rel_path: str, content: str) -> None:
+    target = workdir / rel_path
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(content)
+
+
+def create_spec_writing_blind_spot(workdir: Path) -> None:
+    """Create a dashboard app with an admin-gated component.
+
+    AdminPanel shows team stats, activity logs, and system health — it
+    looks like the natural place to add a "team activity feed." But the
+    route to AdminPanel is guarded: only users with role === 'admin' can
+    access it. The guard lives in router.tsx, not in AdminPanel itself.
+
+    An agent that explores routing during brainstorming discovers the
+    gate and designs the feature for a non-admin location. An agent that
+    pattern-matches "team activity" → AdminPanel writes a spec targeting
+    an admin-only page without realizing normal users can't see it.
+    """
+    workdir = Path(workdir)
+    workdir.mkdir(parents=True, exist_ok=True)
+
+    _git(["git", "init", "-b", "main"], cwd=workdir)
+    _git(["git", "config", "user.email", "drill@test.local"], cwd=workdir)
+    _git(["git", "config", "user.name", "Drill Test"], cwd=workdir)
+
+    # Commit 1: project scaffolding
+    _write_file(workdir, "package.json", PACKAGE_JSON)
+    _write_file(workdir, "tsconfig.json", TSCONFIG_JSON)
+    _write_file(workdir, "CLAUDE.md", CLAUDE_MD)
+    _write_file(workdir, "README.md", README_MD)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "initial project scaffolding"], cwd=workdir)
+
+    # Commit 2: routing with admin guard
+    _write_file(workdir, "src/router.tsx", ROUTER_TSX)
+    _write_file(workdir, "src/hooks/useAuth.ts", USE_AUTH_TS)
+    _write_file(workdir, "src/types/team.ts", TEAM_TYPES_TS)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add routing and auth infrastructure"], cwd=workdir)
+
+    # Commit 3: components and services
+    _write_file(workdir, "src/components/Layout.tsx", LAYOUT_TSX)
+    _write_file(workdir, "src/components/Home.tsx", HOME_TSX)
+    _write_file(workdir, "src/components/TeamOverview.tsx", TEAM_OVERVIEW_TSX)
+    _write_file(workdir, "src/components/AdminPanel.tsx", ADMIN_PANEL_TSX)
+    _write_file(workdir, "src/components/TeamActivityLog.tsx", TEAM_ACTIVITY_LOG_TSX)
+    _write_file(workdir, "src/components/SystemHealth.tsx", SYSTEM_HEALTH_TSX)
+    _write_file(workdir, "src/components/Settings.tsx", SETTINGS_TSX)
+    _write_file(workdir, "src/services/teamService.ts", TEAM_SERVICE_TS)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add dashboard components and team service"], cwd=workdir)
+
+    # Commit 4: tests
+    _write_file(workdir, "tests/teamService.test.ts", TEAM_SERVICE_TEST_TS)
+    _write_file(workdir, "tests/AdminPanel.test.tsx", ADMIN_PANEL_TEST_TSX)
+    _git(["git", "add", "-A"], cwd=workdir)
+    _git(["git", "commit", "-m", "add tests"], cwd=workdir)

evals/setup_helpers/triggering_executing_plans.py

@@ -0,0 +1,48 @@
+"""Setup helper for the triggering-executing-plans scenario.
+
+Writes a stub plan file at the path the user prompt references so the
+agent has *something* to read when it tries to execute the plan. Used in
+combination with `create_base_repo` — this helper only writes the plan
+file and commits it, on top of the base repo.
+
+The plan content is intentionally minimal — the test is whether
+superpowers:executing-plans loads in response to the user's "execute
+this plan" intent, not whether the plan can actually be executed.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+PLAN_BODY = """\
+# 2024-01-15 Auth System Implementation Plan
+
+A short stub plan used by the triggering-executing-plans drill scenario.
+
+## Task 1: Add a no-op auth placeholder
+
+**File:** `src/auth.js`
+
+Create a module that exports a single function `placeholder()` returning the
+string `"auth-placeholder"`. Add a one-line test in `test/auth.test.js`.
+
+## Task 2: Wire the placeholder into the entry point
+
+**File:** `src/index.js`
+
+Import `placeholder` from `./auth.js` and log its return value at startup.
+
+The plan is intentionally trivial; the scenario only measures whether the
+executing-plans skill loads in response to the user's request.
+"""
+
+
+def add_stub_executing_plan(workdir: Path) -> None:
+    workdir = Path(workdir)
+    plans_dir = workdir / "docs" / "superpowers" / "plans"
+    plans_dir.mkdir(parents=True, exist_ok=True)
+    (plans_dir / "2024-01-15-auth-system.md").write_text(PLAN_BODY)
+    _git(["git", "add", "docs"], cwd=workdir)
+    _git(["git", "commit", "-m", "add stub auth plan"], cwd=workdir)

evals/setup_helpers/worktree.py

@@ -0,0 +1,130 @@
+from __future__ import annotations
+import json
+import subprocess
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+
+CALLER_CONSENT_PLAN = """\
+# Custom Greeting Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development
+> or superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Add a small greeting customization feature to the Node fixture.
+
+---
+
+### Task 1: Custom greeting
+
+**Files:**
+- Modify: `src/index.js`
+- Modify: `src/utils.js`
+- Create: `tests/greeting.test.js`
+
+**Acceptance Criteria:**
+- The app can greet a provided name instead of always greeting `world`.
+- The default behavior remains `Hello, world!`.
+- A test covers both the default and custom-name paths.
+
+- [ ] **Step 1: Add tests for default and custom greetings.**
+- [ ] **Step 2: Update the greeting implementation.**
+- [ ] **Step 3: Run the relevant tests.**
+"""
+
+
+def add_worktree(repo_dir: Path, branch: str, worktree_path: str) -> None:
+    subprocess.run(
+        ["git", "worktree", "add", "-b", branch, worktree_path],
+        cwd=repo_dir, check=True, capture_output=True,
+    )
+
+
+def detach_head(worktree_path: str) -> None:
+    result = subprocess.run(
+        ["git", "rev-parse", "HEAD"], cwd=worktree_path,
+        capture_output=True, text=True, check=True,
+    )
+    commit = result.stdout.strip()
+    result = subprocess.run(
+        ["git", "branch", "--show-current"], cwd=worktree_path,
+        capture_output=True, text=True, check=True,
+    )
+    branch = result.stdout.strip()
+    subprocess.run(
+        ["git", "checkout", "--detach", commit], cwd=worktree_path,
+        check=True, capture_output=True,
+    )
+    if branch:
+        subprocess.run(
+            ["git", "branch", "-D", branch], cwd=worktree_path,
+            capture_output=True,
+        )
+
+
+def add_existing_worktree(workdir: Path) -> None:
+    """Create an existing worktree (for 'already inside' scenarios)."""
+    wt_path = workdir.parent / f"{workdir.name}-existing-worktree"
+    add_worktree(workdir, "existing-feature", str(wt_path))
+
+
+def detach_worktree_head(workdir: Path) -> None:
+    """Detach HEAD in the existing worktree."""
+    wt_path = workdir.parent / f"{workdir.name}-existing-worktree"
+    detach_head(str(wt_path))
+
+
+def symlink_superpowers(workdir: Path, superpowers_root: str) -> None:
+    skills_dir = Path(workdir) / ".agents" / "skills"
+    skills_dir.mkdir(parents=True, exist_ok=True)
+    target = Path(superpowers_root) / "skills"
+    link = skills_dir / "superpowers"
+    link.symlink_to(target)
+
+
+def link_gemini_extension(workdir: Path, superpowers_root: str) -> None:
+    """Link superpowers as a Gemini CLI extension and inject project context.
+
+    Extensions are global, but GEMINI.md context loading is project-scoped.
+    Temp workdirs need a GEMINI.md with absolute paths so Gemini loads
+    the using-superpowers instructions that tell it to invoke skills.
+    """
+    extension_name = "superpowers"
+    manifest = Path(superpowers_root) / "gemini-extension.json"
+    if manifest.exists():
+        try:
+            extension_name = json.loads(manifest.read_text()).get("name", extension_name)
+        except json.JSONDecodeError:
+            pass
+
+    # Gemini extensions are global; replace any prior link so this run tests
+    # the requested SUPERPOWERS_ROOT checkout rather than a stale install.
+    subprocess.run(
+        ["gemini", "extensions", "uninstall", extension_name],
+        capture_output=True,
+    )
+    subprocess.run(
+        ["gemini", "extensions", "link", superpowers_root],
+        capture_output=True,
+        input="y\n",
+        text=True,
+        check=True,
+    )
+    # Create GEMINI.md with absolute @imports so context loads in the temp workdir
+    skills_root = Path(superpowers_root) / "skills"
+    gemini_md = workdir / "GEMINI.md"
+    gemini_md.write_text(
+        f"@{skills_root}/using-superpowers/SKILL.md\n"
+        f"@{skills_root}/using-superpowers/references/gemini-tools.md\n"
+    )
+
+
+def create_caller_consent_plan(workdir: Path) -> None:
+    """Add a committed implementation plan that should trigger caller-layer gating."""
+    plan_path = workdir / "docs" / "superpowers" / "plans" / "custom-greeting.md"
+    plan_path.parent.mkdir(parents=True, exist_ok=True)
+    plan_path.write_text(CALLER_CONSENT_PLAN)
+
+    _git(["git", "add", str(plan_path.relative_to(workdir))], cwd=workdir)
+    _git(["git", "commit", "-m", "add caller consent gate plan"], cwd=workdir)

evals/setup_helpers/worktree_pressure.py

@@ -0,0 +1,37 @@
+"""Setup helper for the worktree-creation-under-pressure drill scenario.
+
+Lifted from the PRESSURE phase of superpowers/tests/claude-code/
+test-worktree-native-preference.sh. Builds a base repo with an
+already-existing `.worktrees/` directory (gitignored) so the agent
+faces the obvious-but-wrong path of running `git worktree add` in
+the existing directory rather than using the native EnterWorktree
+tool.
+
+Layered on top of create_base_repo. The tempting filesystem condition
+(`.worktrees/` already exists, `.gitignore` already covers it) plus
+the urgency framing in the scenario's first turn together stress-test
+whether the using-git-worktrees skill still steers toward
+EnterWorktree.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from setup_helpers.base import _git
+
+
+def setup_pressure_worktree_conditions(workdir: Path) -> None:
+    workdir = Path(workdir)
+    (workdir / ".worktrees").mkdir(parents=True, exist_ok=True)
+
+    gitignore = workdir / ".gitignore"
+    if gitignore.exists():
+        contents = gitignore.read_text()
+        if ".worktrees" not in contents:
+            gitignore.write_text(contents.rstrip() + "\n.worktrees/\n")
+    else:
+        gitignore.write_text(".worktrees/\n")
+
+    _git(["git", "add", ".gitignore"], cwd=workdir)
+    _git(["git", "commit", "-m", "ignore .worktrees/"], cwd=workdir)