wize-dev-kit 0.1.4 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (49) hide show
  1. package/CHANGELOG.md +78 -1
  2. package/README.md +64 -0
  3. package/package.json +1 -1
  4. package/src/app-overlay/playbooks/apple-hig.md +112 -0
  5. package/src/app-overlay/playbooks/detox-maestro.md +179 -0
  6. package/src/app-overlay/playbooks/device-matrix.md +121 -0
  7. package/src/app-overlay/playbooks/material-design-3.md +135 -0
  8. package/src/app-overlay/playbooks/mobile-perf-budgets.md +145 -0
  9. package/src/app-overlay/playbooks/permissions-ux.md +147 -0
  10. package/src/app-overlay/playbooks/touch-targets-and-gestures.md +127 -0
  11. package/src/app-overlay/stack-catalog.md +178 -0
  12. package/src/method-skills/1-analysis/wize-document-project/workflow.md +147 -20
  13. package/src/method-skills/1-analysis/wize-prfaq/workflow.md +150 -11
  14. package/src/method-skills/1-analysis/wize-product-brief/workflow.md +90 -19
  15. package/src/method-skills/1-analysis/wize-research/workflow.md +101 -9
  16. package/src/method-skills/1-analysis/wize-trigger-map/workflow.md +80 -16
  17. package/src/method-skills/2-plan-workflows/wize-create-prd/workflow.md +132 -23
  18. package/src/method-skills/2-plan-workflows/wize-ux-design/workflow.md +132 -28
  19. package/src/method-skills/2-plan-workflows/wize-ux-scenarios/workflow.md +91 -15
  20. package/src/method-skills/2-plan-workflows/wize-validate-prd/workflow.md +106 -12
  21. package/src/method-skills/3-solutioning/wize-check-implementation-readiness/workflow.md +101 -11
  22. package/src/method-skills/3-solutioning/wize-create-architecture/workflow.md +197 -29
  23. package/src/method-skills/3-solutioning/wize-create-epics-and-stories/workflow.md +127 -12
  24. package/src/method-skills/3-solutioning/wize-design-system/workflow.md +182 -22
  25. package/src/method-skills/3-solutioning/wize-nfr-principles/workflow.md +142 -16
  26. package/src/method-skills/3-solutioning/wize-tech-vision/workflow.md +127 -21
  27. package/src/method-skills/4-implementation/wize-code-review/workflow.md +105 -10
  28. package/src/method-skills/4-implementation/wize-create-story/workflow.md +131 -10
  29. package/src/method-skills/4-implementation/wize-dev-story/workflow.md +115 -17
  30. package/src/method-skills/4-implementation/wize-quick-dev/workflow.md +109 -18
  31. package/src/method-skills/4-implementation/wize-retrospective/workflow.md +112 -10
  32. package/src/method-skills/4-implementation/wize-sprint-planning/workflow.md +85 -10
  33. package/src/method-skills/4-implementation/wize-sprint-status/workflow.md +96 -11
  34. package/src/tea-skills/wize-tea-design/workflow.md +104 -13
  35. package/src/tea-skills/wize-tea-gate/workflow.md +108 -25
  36. package/src/tea-skills/wize-tea-nfr/workflow.md +104 -14
  37. package/src/tea-skills/wize-tea-review/workflow.md +107 -13
  38. package/src/tea-skills/wize-tea-risk/workflow.md +99 -10
  39. package/src/tea-skills/wize-tea-trace/workflow.md +83 -12
  40. package/src/web-overlay/playbooks/playwright-vitest.md +211 -0
  41. package/src/web-overlay/playbooks/responsive-breakpoints.md +104 -0
  42. package/src/web-overlay/playbooks/semantic-html.md +114 -0
  43. package/src/web-overlay/playbooks/wcag-aa.md +97 -0
  44. package/src/web-overlay/playbooks/web-perf-budgets.md +140 -0
  45. package/src/web-overlay/stack-catalog.md +208 -0
  46. package/tools/installer/commands/agent.js +197 -0
  47. package/tools/installer/commands/sync.js +45 -0
  48. package/tools/installer/commands/update.js +172 -0
  49. package/tools/installer/wize-cli.js +24 -8
@@ -4,48 +4,131 @@ name: TEA Gate Decision
4
4
  gate: gate
5
5
  owner: wize-agent-test-architect # Hawkeye
6
6
  when: story-final
7
- status: stub
7
+ status: ready
8
8
  ---
9
9
 
10
10
  # TEA — Gate Decision
11
11
 
12
- **Goal.** Final per-story gate. PASS / CONCERNS / FAIL / WAIVED with documented rationale.
12
+ **Goal.** Final per-story decision. **PASS / CONCERNS / FAIL / WAIVED** with documented rationale, score, and policy mode. This is the line: a story doesn't advance past it without a recorded gate.
13
+
14
+ Hawkeye drives. The four inputs (`design`, `trace`, `review`, plus `nfr` at epic boundary) feed in. Policy is read from `.wize/config/tea.toml`.
13
15
 
14
16
  ## Inputs
15
- - `design.md`, `trace.md`, `review.md` for the story
16
- - `nfr/{epic}.md` if applicable
17
- - Story file
17
+
18
+ - `.wize/implementation/tea/{epic}/{story}/design.md`
19
+ - `.wize/implementation/tea/{epic}/{story}/trace.md`
20
+ - `.wize/implementation/tea/{epic}/{story}/review.md`
21
+ - `.wize/implementation/tea/nfr/{epic}.md` (when the story is the last of its epic)
22
+ - `.wize/config/tea.toml`
18
23
 
19
24
  ## Output
25
+
20
26
  - `.wize/implementation/tea/{epic}/{story}/gate.md`
21
27
 
28
+ ## Decision rules
29
+
30
+ | Inputs | Recommendation |
31
+ |---|---|
32
+ | All ACs `met`, no findings | **PASS** |
33
+ | All ACs `met`, only low/medium non-blocking findings | **PASS** with notes (or **CONCERNS** depending on count) |
34
+ | Any AC `partial` | **CONCERNS** |
35
+ | Any AC `not-met` | **FAIL** |
36
+ | NFR `FAIL` on the epic (last story) | **FAIL** |
37
+ | Failing AC OR non-neg NFR with documented business rationale + senior signoff | **WAIVED** |
38
+
39
+ Score (0–100): heuristic. `100 - (10 × high) - (5 × medium) - (2 × low)`. Floor 0.
40
+
41
+ ## Policy
42
+
43
+ `.wize/config/tea.toml` sets `policy = "advisory"` (default) or `"enforcing"`.
44
+
45
+ - **Advisory:** `FAIL` is a visible warning in PR; merge isn't auto-blocked. The team decides.
46
+ - **Enforcing:** `FAIL` blocks merge via CI status check (`tea-gate`). PASS / CONCERNS allowed through.
47
+
48
+ ## Steps
49
+
50
+ ### 1. Read the three inputs
51
+
52
+ If trace shows `partial`, you know the recommendation. If review recommends FAIL, you've got your decision. The gate doc just records it.
53
+
54
+ ### 2. Compute score
55
+
56
+ Don't game it. The score communicates magnitude to humans skimming a backlog.
57
+
58
+ ### 3. Write the doc
59
+
60
+ Frontmatter is the structured truth. The body is the narrative for humans.
61
+
62
+ ### 4. Notify
63
+
64
+ Update the PR description with the gate verdict + link to the doc. Maria Hill watches the gate status in `sprint-status.md`.
65
+
22
66
  ## YAML frontmatter (canonical)
67
+
23
68
  ```yaml
24
69
  ---
25
70
  gate: gate
26
- story_id:
27
- status: PASS | CONCERNS | FAIL | WAIVED
28
- score: 0-100
29
- policy: advisory | enforcing
71
+ story_id: E01-S03
72
+ status: PASS
73
+ score: 95
74
+ policy: advisory
30
75
  inputs:
31
- - design.md: …
32
- - trace.md: …
33
- - review.md: …
34
- - nfr/{epic}.md:
76
+ design: ".wize/implementation/tea/E01-S03/design.md"
77
+ trace: ".wize/implementation/tea/E01-S03/trace.md"
78
+ review: ".wize/implementation/tea/E01-S03/review.md"
79
+ nfr: null # not the last story of E01
35
80
  findings:
36
- - id: G-1
37
- severity: low | medium | high
38
- summary:
39
- recommendation:
40
- waived_by: null | "wizer"
41
- waived_reason: null | "…"
42
- created_at: ISO-8601
81
+ - id: REV-01
82
+ severity: low
83
+ summary: "Empty-state copy slightly differs from Mantis' spec."
84
+ recommendation: "Update `<EmptyTeamPanel>` heading in a follow-up."
85
+ waived_by: null
86
+ waived_reason: null
87
+ created_at: 2026-06-11T20:30:00Z
43
88
  ---
44
89
  ```
45
90
 
46
- ## Body
47
- Narrative explanation; structured data is the YAML.
91
+ ## Body of `gate.md`
48
92
 
49
- ## Policy
50
- - **advisory** (default): FAIL is a warning. Merge proceeds.
51
- - **enforcing**: FAIL blocks merge via CI. Configured in `.wize/config/tea.toml`.
93
+ ```markdown
94
+ ## Verdict
95
+ **PASS** (score 95)
96
+
97
+ ## Why
98
+ - All ACs met with observed evidence.
99
+ - Trace clean; coverage 100% on ACs, partial on edges (E3, E4) — tracked for follow-up.
100
+ - Review found one low-severity copy finding (REV-01).
101
+ - Story is not the last in epic 01; NFR gate runs separately at epic boundary.
102
+
103
+ ## Notes for follow-up
104
+ - Open a tiny story (or include in next sprint planning) to fix REV-01 and close edges E3, E4.
105
+
106
+ ## Trail
107
+ - design.md → 4/1/1 split (unit/integration/e2e) + 4 edges declared.
108
+ - trace.md → all ACs `covered`; E3 `partial`, E4 `missing` (follow-up).
109
+ - review.md → ACs `met`, scope mostly disciplined, copy nit.
110
+ - nfr.md → N/A (mid-epic).
111
+ ```
112
+
113
+ ## When to WAIVE
114
+
115
+ Rare. Examples:
116
+ - A failing E2E that depends on a flaky external sandbox; the production code is unaffected; sign-off by Tony + Hill.
117
+ - A non-negotiable temporarily slipped because of an external integration blocker; we ship with mitigation in place; sign-off by Fury.
118
+
119
+ A WAIVE always lists:
120
+ - Who waived (`waived_by`).
121
+ - Why (`waived_reason`).
122
+ - The compensating control (a follow-up story, an SLA monitor, a feature flag).
123
+
124
+ ## Anti-patterns Hawkeye rejects
125
+
126
+ - **Gating without `review.md`.** No review → no gate.
127
+ - **PASS with a `not-met` AC.** Auto-fail.
128
+ - **WAIVED with no `waived_by` field.** Reject.
129
+ - **Scoring jiggered to clear a threshold.** Trust trumps point-scoring; if the count says 70, don't write 91.
130
+ - **Enforcing mode gates without CI check wiring.** Ghost gate; remove or wire it.
131
+
132
+ ## Hand-off
133
+
134
+ > Gate for E01-S03: **PASS** (score 95). One low-severity finding logged for follow-up. Maria Hill, sprint-status updated; Shuri, ready to start the next story.
@@ -4,34 +4,124 @@ name: TEA NFR Assessment
4
4
  gate: nfr
5
5
  owner: wize-agent-test-architect # Hawkeye
6
6
  when: pre-merge-per-epic
7
- status: stub
7
+ status: ready
8
8
  ---
9
9
 
10
10
  # TEA — NFR Assessment
11
11
 
12
- **Goal.** Verify the epic meets Fury's NFR principles: performance, security, reliability, maintainability, accessibility, cost.
12
+ **Goal.** Verify that the **epic** as a whole meets Fury's NFR principles: performance, security, reliability, maintainability, accessibility, cost. Story-level gates miss NFRs that emerge only at integration; this gate catches them.
13
+
14
+ Hawkeye drives. Tony reviews perf + security findings. Fury escalates if a non-negotiable is at risk. Runs **per epic**, just before any of its stories merges.
13
15
 
14
16
  ## Inputs
15
- - `.wize/planning/nfr-principles.md`
17
+
18
+ - `.wize/planning/nfr-principles.md` (Fury's targets)
16
19
  - Code from all stories in the epic
17
- - Telemetry/benchmark output
20
+ - Telemetry / benchmark output (lighthouse, web-vitals, macrobenchmark, Sentry perf)
21
+ - Overlay perf playbooks: `web-perf-budgets.md`, `mobile-perf-budgets.md`
18
22
 
19
23
  ## Output
24
+
20
25
  - `.wize/implementation/tea/nfr/{epic}.md`
21
26
 
22
- ## YAML frontmatter
27
+ ## Steps
28
+
29
+ ### 1. For each category, run the verifier
30
+
31
+ | Category | Verifier (typical) |
32
+ |---|---|
33
+ | Performance | lighthouse-ci against epic-scope routes; web-vitals beacon delta |
34
+ | Security | `npm audit --omit=dev`; manual OWASP Top 10 walk; secret scan |
35
+ | Reliability | injected-failure tests (`@chaos` tag); retry policy review; idempotency check |
36
+ | Maintainability | coverage delta; cyclomatic complexity delta; lint baseline |
37
+ | Accessibility | axe on every epic-scope route; keyboard walk on critical flows |
38
+ | Cost | cost dashboard delta in the epic window |
39
+
40
+ ### 2. Score each
41
+
42
+ For each category: `PASS` (meets non-negotiable) / `CONCERNS` (within stretch range; below non-negotiable on a measurable item with mitigation plan) / `FAIL` (non-negotiable missed; no plan) / `WAIVED` (with documented reason + sign-off).
43
+
44
+ ### 3. Findings (one per slip)
45
+
46
+ If anything failed or concerned, write the finding: what we measured, what was expected, why the slip, what the next step is.
47
+
48
+ ### 4. Hand off
49
+
50
+ `PASS` → epic can merge. `CONCERNS` (advisory) → flag in PR description. `FAIL` (enforcing) → blocks merge.
51
+
52
+ ## YAML frontmatter (canonical)
53
+
23
54
  ```yaml
24
55
  ---
25
56
  gate: nfr
26
- epic:
27
- status: PASS | CONCERNS | FAIL | WAIVED
57
+ epic: 01-onboarding
58
+ status: CONCERNS
28
59
  scores:
29
- performance:
30
- security:
31
- reliability:
32
- maintainability:
33
- accessibility:
34
- cost:
35
- findings: [...]
60
+ performance: PASS
61
+ security: PASS
62
+ reliability: CONCERNS
63
+ maintainability: PASS
64
+ accessibility: PASS
65
+ cost: PASS
66
+ findings:
67
+ - id: NFR-01-1
68
+ category: reliability
69
+ severity: medium
70
+ summary: "Outbox retry interval too aggressive for Resend's documented backoff."
71
+ expected: "Exponential 30s/2m/10m; we set 5s/15s/45s."
72
+ actual: "Spike in Resend 429s during integration test."
73
+ recommendation: "Update retry policy in `lib/email/outbox.ts`; capture with `outbox-retry.spec.ts`."
74
+ owner: shuri
75
+ blocking: false
76
+ created_at: 2026-06-11T18:00:00Z
36
77
  ---
37
78
  ```
79
+
80
+ ## Body of `nfr/{epic}.md`
81
+
82
+ ```markdown
83
+ ## Summary
84
+ Epic 01 (onboarding) at gate. Performance and a11y pass non-negotiables; reliability has one mid-severity concern around outbox backoff.
85
+
86
+ ## Per category
87
+
88
+ ### Performance — PASS
89
+ - LCP (signup): 1.45s p75 (target ≤ 2.5s).
90
+ - INP (signup): 90ms p75 (target ≤ 200ms).
91
+ - CLS (signup): 0.03 (target ≤ 0.1).
92
+ - LCP (onboarding): 1.7s p75.
93
+
94
+ ### Security — PASS
95
+ - `npm audit` clean (dev advisories noted in `.audit-ignore.md`).
96
+ - OWASP Top 10 walk: no findings.
97
+ - RLS verified on `users`, `teams`, `memberships`.
98
+
99
+ ### Reliability — CONCERNS
100
+ - See NFR-01-1.
101
+
102
+ ### Maintainability — PASS
103
+ - Coverage 84% on logic modules in this epic.
104
+ - No file > 300 LOC introduced.
105
+
106
+ ### Accessibility — PASS
107
+ - axe clean on `/signup`, `/signup/error`, `/onboarding`, `/onboarding/invite-sent`.
108
+ - Keyboard walk: focus order matches visual; modal traps + restores.
109
+
110
+ ### Cost — PASS
111
+ - No cost dashboard change beyond expected (account creation; mailer spend within budget).
112
+
113
+ ## Action items
114
+ - Shuri: PR-XXX fixes NFR-01-1. Re-run NFR after merge.
115
+ - Hawkeye: re-baseline web-vitals after epic ships to prod.
116
+ ```
117
+
118
+ ## Anti-patterns Hawkeye rejects
119
+
120
+ - **Self-reported "looks fine" with no verifier output.** Attach the artifact.
121
+ - **Concerns left for "later."** Either an action item with owner+deadline or it's not a concern.
122
+ - **Waived without sign-off.** WAIVED needs `waived_by: NAME` + reason.
123
+ - **NFR run on stage with synthetic data.** Use realistic distributions whenever possible.
124
+
125
+ ## Hand-off
126
+
127
+ > NFR gate for Epic 01: **CONCERNS**. PR can proceed if the reliability finding (NFR-01-1) is committed to be addressed in the next sprint. Otherwise hold the merge.
@@ -4,32 +4,126 @@ name: TEA Story Review
4
4
  gate: review
5
5
  owner: wize-agent-test-architect # Hawkeye
6
6
  when: story-end
7
- status: stub
7
+ status: ready
8
8
  ---
9
9
 
10
10
  # TEA — Story Review
11
11
 
12
- **Goal.** Structured story review (separate from Shuri's `wize-code-review`).
12
+ **Goal.** A structured review of one story before its gate decision. Distinct from Shuri's `wize-code-review` (which audits code health). This one audits **AC fulfillment, test discipline, and risk-spot coverage**.
13
+
14
+ Hawkeye drives. Runs at story end, right before `tea-gate`.
13
15
 
14
16
  ## Inputs
15
- - Story file (ACs)
16
- - Test results
17
- - Trace doc
17
+
18
+ - Story file (the AC list, out-of-scope, notes).
19
+ - `tea-design.md` + `tea-trace.md`.
20
+ - Test run results (PR CI).
21
+ - Code diff (the PR).
18
22
 
19
23
  ## Output
24
+
20
25
  - `.wize/implementation/tea/{epic}/{story}/review.md`
21
26
 
22
- ## YAML frontmatter
27
+ ## Steps
28
+
29
+ ### 1. AC check (per AC)
30
+
31
+ For each AC, observe the actual behavior on a staging or local build and decide: `met` / `partial` / `not-met`. Use the recorded video/screenshot when CI captured one (Playwright `screenshot: only-on-failure` or always for review tag).
32
+
33
+ ### 2. Test discipline
34
+
35
+ Walk:
36
+ - Are `tea-design.md`'s declared tests present in code?
37
+ - Is every assertion meaningful (not just `expect(true).toBe(true)`)?
38
+ - Are selectors stable (role/label/testid) rather than brittle (CSS classes)?
39
+ - Are mocks at the network boundary (MSW) rather than in the unit under test?
40
+ - Are there `test.skip` or `test.only` left in?
41
+
42
+ ### 3. Risk-spot coverage
43
+
44
+ If the story touches any `R-x` from the risk profile, walk the mitigation contract and confirm it's met.
45
+
46
+ ### 4. Story scope discipline
47
+
48
+ Did the story stay within its declared scope? Any out-of-scope item that crept in is flagged in the review (and either moved to a new story or backed out).
49
+
50
+ ### 5. Findings
51
+
52
+ For each issue, write: severity (`low / medium / high`), what, why it matters, what to do.
53
+
54
+ ### 6. Recommend gate outcome
55
+
56
+ Review doesn't *make* the gate decision (that's `tea-gate`); it recommends. Possible recommendations:
57
+ - `gate PASS`
58
+ - `gate CONCERNS` with N findings
59
+ - `gate FAIL` (only if a non-negotiable AC is `not-met`)
60
+ - `gate WAIVED` (only with documented reason + senior signoff)
61
+
62
+ ## YAML frontmatter (canonical)
63
+
23
64
  ```yaml
24
65
  ---
25
66
  gate: review
26
- story_id:
27
- status: PASS | CONCERNS | FAIL
67
+ story_id: E01-S03
68
+ status: PASS
28
69
  ac_check:
29
- - id: AC-1
30
- met: true|partial|false
31
- evidence:
32
- findings: [...]
33
- recommendations: [...]
70
+ - id: AC-02-1
71
+ met: true
72
+ evidence: "e2e/onboarding/invite.spec.ts::happy path passed on PR-#412; recording in CI artifact #412-1"
73
+ - id: AC-02-2
74
+ met: true
75
+ evidence: "InviteForm.spec.tsx::error region announces"
76
+ findings:
77
+ - id: REV-01
78
+ severity: low
79
+ summary: "Empty-state copy slightly differs from Mantis' spec."
80
+ recommendation: "Update `<EmptyTeamPanel>` heading to 'Invite your first teammate'."
81
+ owner: shuri
82
+ blocking: false
83
+ risk_links: [R-1]
84
+ recommendation: gate-PASS
85
+ created_at: 2026-06-11T20:00:00Z
34
86
  ---
35
87
  ```
88
+
89
+ ## Body of `review.md`
90
+
91
+ ```markdown
92
+ ## Per-AC
93
+
94
+ ### AC-02-1 — met
95
+ Evidence: E2E `e2e/onboarding/invite.spec.ts::happy path` passed locally + CI run #412. Banner appears 720ms after click (well within 1s NFR).
96
+
97
+ ### AC-02-2 — met
98
+ Evidence: Unit + component test both pass. Manually walked screen-reader output — VoiceOver announces "Email — error — Enter a valid email." correctly.
99
+
100
+ ## Test discipline
101
+ - All declared tests present.
102
+ - `data-testid` discipline solid (invite-form, invite-email, invite-cta, invite-sent-banner).
103
+ - No `test.skip` / `.only`.
104
+ - One snapshot test — small enough to be useful; not a tree snapshot.
105
+
106
+ ## Risk coverage
107
+ - R-1 (mailer): integration test covers the right path; happy path E2E confirms end-to-end. PASS.
108
+
109
+ ## Scope discipline
110
+ - Two minor copy tweaks crept in (out-of-spec; logged as REV-01).
111
+
112
+ ## Findings
113
+ - REV-01 (low): empty-state copy.
114
+
115
+ ## Recommendation
116
+ Recommend `gate PASS` with one low-severity finding to fix in a follow-up.
117
+ ```
118
+
119
+ ## Anti-patterns Hawkeye rejects
120
+
121
+ - **Review without walking the code.** Reading the test names isn't review.
122
+ - **AC marked "met" without observed evidence.** Tests passing + screenshot/recording, please.
123
+ - **Findings without owners.** Same as everywhere else in the kit.
124
+ - **Recommending PASS when an AC is `partial`.** No.
125
+ - **Recommending PASS when a non-negotiable NFR slipped.** That's a gate FAIL.
126
+
127
+ ## Hand-off
128
+
129
+ > Review for E01-S03 at `.wize/implementation/tea/E01-S03/review.md`. All ACs `met`, one low-severity copy finding. Recommending `gate PASS`. Final at `wize-tea-gate`.
@@ -4,36 +4,125 @@ name: TEA Risk Profile
4
4
  gate: risk
5
5
  owner: wize-agent-test-architect # Hawkeye
6
6
  when: once-after-architecture
7
- status: stub
7
+ status: ready
8
8
  ---
9
9
 
10
10
  # TEA — Risk Profile
11
11
 
12
- **Goal.** Build the probability × impact matrix that prioritizes the rest of TEA's work.
12
+ **Goal.** Build the **probability × impact** matrix that prioritizes the rest of TEA's work. Areas in `HIGH` get deep test design; areas in `LOW` get smoke. Without a risk profile, every story is tested the same — wasteful, and unsafe.
13
+
14
+ Hawkeye drives. Tony co-signs. Runs **once**, right after architecture is signed off; revisit only on significant scope or architecture changes.
13
15
 
14
16
  ## Inputs
17
+
15
18
  - `.wize/solutioning/architecture.md`
16
19
  - `.wize/solutioning/epics/`
20
+ - `.wize/planning/nfr-principles.md`
21
+ - `.wize/knowledge/document-project/risk-spots.md` (brownfield)
17
22
 
18
23
  ## Output
24
+
19
25
  - `.wize/implementation/tea/risk-profile.md`
20
26
 
27
+ ## Steps
28
+
29
+ ### 1. List candidate hot spots
30
+
31
+ For every architectural component + every epic, ask: *"If this misbehaves, what hurts?"*. Write candidates without filtering.
32
+
33
+ ### 2. Score each
34
+
35
+ | Axis | Levels |
36
+ |---|---|
37
+ | Probability | `low` (would be a surprise), `medium` (could happen), `high` (likely without explicit work) |
38
+ | Impact | `low` (cosmetic / opex), `medium` (user friction / revenue dent), `high` (data loss / outage / regulatory) |
39
+
40
+ Composite score:
41
+ - `low × low` = LOW
42
+ - `low × medium`, `medium × low`, `medium × medium` = MEDIUM
43
+ - anything touching `high` = HIGH
44
+
45
+ ### 3. For each finding, write the mitigation contract
46
+
47
+ Per row:
48
+ - **What test makes us confident?** Unit / integration / E2E / NFR / manual.
49
+ - **Who owns the mitigation?** Shuri / Tony / external service.
50
+ - **When is it verified?** Story-level / epic-level / pre-launch.
51
+
52
+ ### 4. Hand off
53
+
54
+ Hawkeye uses this in every `tea-design.md`. Tony respects it when picking ADR options.
55
+
21
56
  ## YAML frontmatter (canonical)
57
+
22
58
  ```yaml
23
59
  ---
24
60
  gate: risk
25
61
  status: PASS | CONCERNS | FAIL | WAIVED
26
62
  score: 0-100
27
- created_at: ISO-8601
63
+ created_at: 2026-06-11T12:00:00Z
28
64
  findings:
29
65
  - id: R-1
30
- area:
31
- probability: low | medium | high
32
- impact: low | medium | high
33
- rationale:
34
- mitigation:
66
+ area: "Outbox / mailer"
67
+ probability: high
68
+ impact: medium
69
+ rationale: "Sign-up flow depends on email delivery; first impression failure is high-cost."
70
+ mitigation: "Integration test against Resend sandbox; outbox retry with backoff; on-call alert on delivery failure rate > 5%."
71
+ owner: shuri + tony
72
+ verified_when: story E01-S04 + NFR per epic
73
+ - id: R-2
74
+ area: "Database migrations under load"
75
+ probability: medium
76
+ impact: high
77
+ rationale: "Future migrations must be rolled out without lock contention."
78
+ mitigation: "Online schema changes; canary on staging with synthetic load; ADR-006 process."
79
+ owner: tony
80
+ verified_when: pre-launch
81
+ - id: R-3
82
+ area: "Auth: token refresh during long-running tabs"
83
+ probability: medium
84
+ impact: medium
85
+ rationale: "Cookie refresh race in RSC + edge can sign user out unexpectedly."
86
+ mitigation: "E2E covering > 1h tab; refresh strategy ADR-008; on-call alert on `auth_session_expired_unexpected`."
87
+ owner: shuri
88
+ verified_when: story E04-S02 + post-launch monitoring
35
89
  ---
36
90
  ```
37
91
 
38
- ## Body
39
- Narrative summary; the structured data is the YAML.
92
+ ## Body of `risk-profile.md`
93
+
94
+ The narrative explains the matrix; the YAML is the structured truth. Hawkeye writes 1–2 lines per finding explaining the *why*.
95
+
96
+ ```markdown
97
+ ## Matrix
98
+
99
+ | | Impact LOW | Impact MEDIUM | Impact HIGH |
100
+ |---|---|---|---|
101
+ | **Prob HIGH** | R-7 | R-1 | R-2 |
102
+ | **Prob MEDIUM** | R-4 | R-3 | R-5 |
103
+ | **Prob LOW** | — | R-6 | — |
104
+
105
+ ## Top-3 (drive test design)
106
+
107
+ 1. **R-2** — Database migrations under load. Pre-launch verification mandatory.
108
+ 2. **R-1** — Outbox/mailer. Story E01-S04 covers; epic NFR re-verifies.
109
+ 3. **R-5** — Payment idempotency. Story E03-S02 covers.
110
+
111
+ ## What this means for `tea-design.md`
112
+
113
+ - E01-S04 (mailer): 1 unit (retry policy), 1 integration (Resend sandbox), 1 E2E (sign-up arrives within 5min).
114
+ - E03-S02 (payments): 2 integration (Stripe idempotency keys), 1 E2E (double-click guard).
115
+ - Other stories follow the default 70/20/10 split.
116
+ ```
117
+
118
+ ## Anti-patterns Hawkeye rejects
119
+
120
+ - **Findings without mitigation.** A finding without a contract is a wish.
121
+ - **Mitigation owned by "the team."** Name a persona/human.
122
+ - **HIGH impact, MEDIUM probability, no NFR re-check.** Wire it into epic NFR gate.
123
+ - **Cosmetic risks scored HIGH.** Calibration. Reserve HIGH for data, outage, regulatory.
124
+ - **Risk profile rewritten per sprint.** Run once; revise on real architecture changes.
125
+
126
+ ## Hand-off
127
+
128
+ > Risk profile at `.wize/implementation/tea/risk-profile.md`. Top-3 drive deep `tea-design.md` for E01-S04, E03-S02, plus pre-launch migration drill. Default 70/20/10 split for the rest.
@@ -4,33 +4,104 @@ name: TEA Traceability
4
4
  gate: trace
5
5
  owner: wize-agent-test-architect # Hawkeye
6
6
  when: during-or-after-implementation
7
- status: stub
7
+ status: ready
8
8
  ---
9
9
 
10
10
  # TEA — Traceability
11
11
 
12
- **Goal.** Map every Acceptance Criterion to one or more concrete tests in the repo.
12
+ **Goal.** Map every Acceptance Criterion to **one or more concrete tests in the repo**. Reports honest coverage: `covered`, `partial`, `missing`. A story with `missing` rows cannot pass gate.
13
+
14
+ Hawkeye drives. Runs while Shuri implements (or right after PR open).
13
15
 
14
16
  ## Inputs
15
- - Story file (ACs)
16
- - Test files produced by Shuri
17
+
18
+ - Story file (the AC list).
19
+ - `tea-design.md` (the test contract).
20
+ - Repo (the actual test files).
17
21
 
18
22
  ## Output
23
+
19
24
  - `.wize/implementation/tea/{epic}/{story}/trace.md`
20
25
 
21
- ## YAML frontmatter
26
+ ## Steps
27
+
28
+ ### 1. Walk every AC
29
+
30
+ For each AC ID:
31
+ - Find the test(s) that exercise it.
32
+ - Reference the file + test name precisely.
33
+ - Decide status: `covered` (every assertion of the AC has a test) / `partial` (some assertions only) / `missing` (no test).
34
+
35
+ ### 2. Compute coverage score
36
+
37
+ - `covered_count / total_acs`.
38
+ - Reported but doesn't drive gate alone; the **per-AC status** drives gate.
39
+
40
+ ### 3. Flag holes
41
+
42
+ For every `partial` / `missing`, write what's needed in one line. Hawkeye proposes the test; Shuri writes it.
43
+
44
+ ### 4. Hand off
45
+
46
+ If everything is `covered`, status `PASS`. Otherwise `CONCERNS` (advisory) or `FAIL` (enforcing) until holes are closed.
47
+
48
+ ## YAML frontmatter (canonical)
49
+
22
50
  ```yaml
23
51
  ---
24
52
  gate: trace
25
- story_id:
26
- status: PASS | CONCERNS | FAIL
53
+ story_id: E01-S03
54
+ status: PASS
27
55
  coverage:
28
- - ac_id: AC-1
56
+ - ac_id: AC-02-1
57
+ status: covered
29
58
  tests:
30
- - path/to/test.spec.ts::case-name
31
- status: covered | partial | missing
59
+ - "src/onboarding/invite/__tests__/validateInviteEmail.spec.ts::valid email"
60
+ - "src/onboarding/invite/__tests__/inviteTeammate.spec.ts::calls mailer with right args"
61
+ - "e2e/onboarding/invite.spec.ts::happy path on Playwright @chromium"
62
+ - ac_id: AC-02-2
63
+ status: covered
64
+ tests:
65
+ - "src/onboarding/invite/__tests__/validateInviteEmail.spec.ts::invalid email rules"
66
+ - "src/onboarding/invite/__tests__/InviteForm.spec.tsx::error region announces"
67
+ created_at: 2026-06-11T15:30:00Z
32
68
  ---
33
69
  ```
34
70
 
35
- ## Body
36
- For any `missing` or `partial`, propose what to write.
71
+ ## Body of `trace.md`
72
+
73
+ ```markdown
74
+ ## Per-AC
75
+
76
+ ### AC-02-1 — covered
77
+ Tests:
78
+ - `validateInviteEmail.spec.ts::valid email`
79
+ - `inviteTeammate.spec.ts::calls mailer with right args`
80
+ - `e2e/onboarding/invite.spec.ts::happy path`
81
+
82
+ ### AC-02-2 — covered
83
+ Tests:
84
+ - `validateInviteEmail.spec.ts::invalid email rules`
85
+ - `InviteForm.spec.tsx::error region announces`
86
+
87
+ ## Edges (from `design.md`)
88
+
89
+ - E1 (empty) — covered (validateInviteEmail.spec.ts::empty).
90
+ - E3 (idempotency) — **partial**. Integration test exists but doesn't assert second insert is no-op. Propose: assert `db.invites.count({ email, team_id })` = 1 after two calls.
91
+ - E4 (offline) — **missing**. Propose: Playwright `context.setOffline(true)` before click; assert offline banner.
92
+
93
+ ## Action items
94
+ - Shuri: add the missing offline E2E (or split into next story; flag in `review.md` then).
95
+ - Hawkeye: re-run trace once PR has the new tests.
96
+ ```
97
+
98
+ ## Anti-patterns Hawkeye rejects
99
+
100
+ - **Trace by file count, not per-AC.** "We have 24 tests" tells you nothing. Per AC, please.
101
+ - **Counting passing CI as trace.** CI passes when a test exists; trace cares whether the test exercises the AC.
102
+ - **`partial` left unflagged.** Either close or list as a known-open with story link.
103
+ - **Re-naming tests after trace.** The trace breaks; Shuri renames in agreement with Hawkeye or doesn't rename.
104
+
105
+ ## Hand-off
106
+
107
+ > Trace for E01-S03 at `.wize/implementation/tea/E01-S03/trace.md`. All ACs `covered`. Two edges still open (E3, E4); proposing follow-up. Ready for `tea-review`.