feat(v1.1.0): implement Sprints 1-3 venture operating system - #8
Conversation
- Add 5 universal multi-tab Excel financial models (B2B SaaS, Marketplace, Hardware IoT, D2C Retail, Corporate ROI) with auto Named Ranges sync and CFO sanity checks - Add Socratic YC & Founder AI Coach skill (casekit-yc-coach) with 4 Pillars & 5-Level Funnel enforcement - Add pre-configured Obsidian workspace starter pack with live Dataview 00-DASHBOARD.md - Add Global Deep Research primary source hierarchy, Rule of 3 triangulation, autopsy matrix, and URL archiver - Add progressive CLI presets (hackathon-sprint, corporate-launchpad, full-deep-drill), interactive helpers (casekit add/check), and CaseKit MCP Server - Upgrade 16:9 widescreen PowerPoint deck renderer and add 4-Judge Rehearsal Simulator (CFO, CTO, BU Head, YC Partner) - Add minimalist production-ready live HTML prototype generator - Add showcase reference case vaults (Airbnb 2008 Seed, Stripe Developer Wedge) and GitHub Actions PR audit workflow - Pass full 223/223 multi-tier automated test suite
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 6 potential issues.
3 flags not posted on this PR by your GitHub settings — view them in Devin Review. (Configure)
| ws[f"C{r}"] = f"=SUM(C{table_start}:C{r-1})" | ||
| ws[f"C{r}"].value = 10000000 | ||
| ws[f"C{r}"].number_format = "#,##0" | ||
| ws[f"C{r}"].font = BOLD_FONT | ||
| ws[f"C{r}"].border = TOTAL_BORDER | ||
|
|
||
| for col in ["D", "E", "F"]: | ||
| ws[f"{col}{r}"] = f"=SUM({col}{table_start}:{col}{r-1})" | ||
| ws[f"{col}{r}"].value = 1.00 |
There was a problem hiding this comment.
🔴 Financial models ignore edited assumptions
Changing any model assumption leaves every reported output unchanged. build_cap_table_section overwrites its formulas, while all other financial outputs are constants.
Prompt for agents
Rework scripts/build_financial_models.py and regenerate all five templates/financial-models workbooks so calculated cells retain Excel formulas linked to the Low/Base/High assumption cells. The current builder assigns formulas and immediately replaces them with constants in build_cap_table_section; all statement, unit-economics, sensitivity, and ROI outputs are also hard-coded. Preserve formulas in the generated files, ensure named ranges point to calculated outputs, and add regression tests that edit representative assumptions, recalculate the workbook, and verify dependent outputs change and reconcile.
Was this helpful? React with 👍 or 👎 to provide feedback.
| snapshot_file = matches[0] | ||
| content = snapshot_file.read_text(encoding="utf-8") | ||
| hash_match = re.search(r"content_hash_sha256:\s*([a-f0-9]{64})", content) | ||
| if not hash_match: | ||
| errors.append(f"{snapshot_file.name}: missing or invalid content_hash_sha256") |
There was a problem hiding this comment.
🟡 Archive tampering passes verification
After archived content changes, verify_archive still passes whenever its original hash header remains. The integrity command never recomputes or compares content.
Prompt for agents
Define an unambiguous hash scope for archive snapshots, then update verify_archive in skills/casekit-research/scripts/archive_source.py and the analogous --check-archive path in skills/casekit-validator/scripts/check_sources.py to recompute SHA-256 over that exact payload and compare it with content_hash_sha256. Ensure archive_source writes snapshots using the same scope. Add passing and tampered-snapshot regression fixtures.
Was this helpful? React with 👍 or 👎 to provide feedback.
| # 3. Smoke Tests (if requested via --smoke-only) | ||
| if args.smoke_only: | ||
| smoke_tests(errors) |
There was a problem hiding this comment.
🟡 Default validation skips smoke tests
Running validate_suite.py without flags no longer calls smoke_tests. CI can pass while its installation, finance, preset, MCP, and tamper checks remain unexecuted.
| # 3. Smoke Tests (if requested via --smoke-only) | |
| if args.smoke_only: | |
| smoke_tests(errors) | |
| # 3. Smoke Tests (unless explicitly running modular tests only) | |
| if not args.modular_only: | |
| smoke_tests(errors) |
Was this helpful? React with 👍 or 👎 to provide feedback.
| # Convert data to JSON for client-side reactivity | ||
| metrics_json = json.dumps(metrics, ensure_ascii=False) | ||
| evidence_json = json.dumps(evidence, ensure_ascii=False) |
There was a problem hiding this comment.
🟥 Generated prototypes execute workspace scripts
A crafted workspace value breaks build_html output contexts and runs JavaScript when a user opens the generated prototype.
Was this helpful? React with 👍 or 👎 to provide feedback.
| payload = response.read() | ||
| content_type = response.headers.get("Content-Type", "").lower() | ||
| if "application/pdf" in content_type or url.lower().endswith(".pdf"): | ||
| try: |
There was a problem hiding this comment.
🟥 Source archiving reaches internal services
Any caller can make archive_source fetch arbitrary HTTP destinations, including loopback, private-network, and cloud metadata services.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| elif name == "casekit_archive_source": | ||
| project = Path(arguments["project"]).expanduser().resolve() | ||
| res = archive_source( | ||
| project=project, | ||
| source_id=arguments["source_id"], | ||
| url=arguments["url"], | ||
| title=arguments.get("title", ""), | ||
| publisher=arguments.get("publisher", ""), | ||
| force=arguments.get("force", False), | ||
| ) |
There was a problem hiding this comment.
🟨 MCP tools access arbitrary host files
An MCP caller can pass unrestricted paths to read workbooks or overwrite output files anywhere writable by the server process.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Summary
Complete end-to-end upgrade of CaseKit Open Source (Sprints 1-3) transforming it into a domain-agnostic Venture & Hackathon Operating System.
Key Changes
b2b-saas,marketplace,hardware-iot,d2c-retail,corporate-roi) with auto Named Ranges sync and CFO sanity checks.casekit-yc-coachenforcing 4 Pillars & 5-Level Funnel..obsidian/starter pack with Dataview00-DASHBOARD.md.casekit init --preset hackathon-sprint | corporate-launchpad | full-deep-drill,casekit add, and CaseKit MCP server.Verification
casekit validate --strict.