npm - wize-dev-kit - Versions diffs - 0.10.0 → 0.10.1 - Mend

wize-dev-kit 0.10.0 → 0.10.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

package/AGENTS.md +10 -10
package/ARCH.md +7 -5
package/CHANGELOG.md +24 -0
package/DECISIONS.md +9 -1
package/README.es.md +55 -13
package/README.md +39 -22
package/README.pt-BR.md +54 -13
package/ROSTER.md +3 -3
package/package.json +2 -2
package/src/orchestrator-skills/wize-help/skill.md +1 -1
package/src/security-overlay/_shared/backlog.js +1 -1
package/src/security-overlay/agents/red-teamer/agent.yaml +9 -8
package/src/security-overlay/agents/red-teamer/persona.md +7 -7
package/src/security-overlay/skills/wize-sec-enumerate/skill.md +1 -1
package/src/security-overlay/skills/wize-sec-pentest/skill.md +1 -1
package/src/security-overlay/skills/wize-sec-recon/skill.md +1 -1
package/tools/installer/render-shared.js +62 -6
package/tools/installer/wize-cli.js +1 -0

package/AGENTS.md CHANGED Viewed

@@ -21,16 +21,16 @@ decisions, or final adversarial review.
 ## Roster
-- **Hawkeye** (`wize-agent-test-architect`) — Test Architect (TEA). |
-- **red-teamer** (`wize-sec-red-teamer`) — Security Overlay — Red-Teamer. |
-- **Wizer** (`wize-orchestrator`) — Orchestrator / Knowledge Base. |
-- **Shuri** (`wize-agent-dev`) — Senior Developer. |
-- **Nick Fury** (`wize-agent-solution-strategist`) — Solution Strategy / Tech Vision. |
-- **Tony Stark** (`wize-agent-architect`) — System Architect. |
-- **Mantis** (`wize-agent-ux-designer`) — UX Designer (Whiteport Design Studio). |
-- **Maria Hill** (`wize-agent-pm`) — Product Manager. |
-- **Peggy Carter** (`wize-agent-tech-writer`) — Technical Writer. |
-- **Pepper Potts** (`wize-agent-analyst`) — Business Analyst (incl. WDS Saga). |
+- **Wizer** (`wize-orchestrator`) — Orchestrator / Knowledge Base. Wizer is the front door of the Wize Development Kit. He knows the project context, parses raw demand, and routes to the right specialist. He keeps the team aligned and the knowled…
+- **Pepper Potts** (`wize-agent-analyst`) — Business Analyst (incl. WDS Saga). Pepper is the Business Analyst. She runs Phase 1: brief, research, PR/FAQ, and the Whiteport Trigger Map. She connects business goals to user psychology, surfaces stakeholders, an…
+- **Peggy Carter** (`wize-agent-tech-writer`) — Technical Writer. Peggy is the Technical Writer. She sits across all phases. She rewrites drafts for clarity, drafts READMEs and runbooks, owns OpenAPI specs and changelogs. She makes sure the proj…
+- **Maria Hill** (`wize-agent-pm`) — Product Manager. Maria Hill runs Phase 2 planning. She converts brief + research into a PRD, cuts epics, plans sprints, and chases status. She doesn't accept "almost done" — she asks "what's block…
+- **Mantis** (`wize-agent-ux-designer`) — UX Designer (Whiteport Design Studio). Mantis runs the Whiteport Design Studio inside the kit. She turns PRD plus Pepper's trigger-map into UX scenarios, page-level specs, and a design system baseline. She empathizes w…
+- **Nick Fury** (`wize-agent-solution-strategist`) — Solution Strategy / Tech Vision. Fury sits between Plan and Solutioning. He sets the technical north star: stack family, NFR principles (perf, security, reliability, a11y, cost), build-buy-borrow calls, and non-n…
+- **Tony Stark** (`wize-agent-architect`) — System Architect. Tony designs the system inside Fury's frame. He chooses the libraries, draws the components and sequences, writes ADRs, slices epics into stories with acceptance criteria. He prot…
+- **Hawkeye** (`wize-agent-test-architect`) — Test Architect (TEA). Hawkeye is the Test Architect. He profiles risk, designs tests for each story, traces AC to tests, assesses NFRs, reviews stories, and writes gate decisions. He is stack-agnostic;…
+- **Shuri** (`wize-agent-dev`) — Senior Developer. Shuri implements stories. TDD, security-aware, performance-honest. She refuses to ship without tests. She rewrites her own code when she learns something new.
+- **Natasha Romanoff** (`wize-sec-red-teamer`) _(security-overlay, opt-in)_ — Security Overlay — Red-Teamer. Natasha Romanoff is the red-teamer — the offensive pentester for the security-overlay. Drives the recon -> enumerate -> exploit -> report pipeline against targets the user has exp…
 ## Where to start

package/ARCH.md CHANGED Viewed

@@ -1,6 +1,8 @@
-# Wize Development Kit — Arquitetura Proposta v1
+# Wize Development Kit — Arquitetura
-> Consolidação das Fases 1-7 da entrevista. Pré-build.
+> Estado: **construído e publicado** — snapshot mantido em dia com a v0.10.0.
+> (As Fases 1-7 originais da entrevista deram origem a este documento; ele deixou
+> de ser "proposta/pré-build" a partir da v0.8.0.)
 > Referências de inspiração: BMAD Method v6.8.0 + WDS Expansion (Norse).
 > Tema do roster: **Marvel**.
@@ -27,7 +29,7 @@ wize-dev-kit (pacote npm)
 ├── Wize Dev Core      ← base completa (sempre instalada)
 ├── Wize Web Dev       ← overlay opt-in
 ├── Wize App Development ← overlay opt-in
-└── Wize Security Overlay ← overlay opt-in (AI Pentester / red-teamer)
+└── Wize Security Overlay ← overlay opt-in (AI Pentester / Natasha Romanoff, red-teamer)
                      (overlays podem coexistir no mesmo repo)
 ```
@@ -50,7 +52,7 @@ wize-dev-kit (pacote npm)
 | Tony Stark | `wize-agent-architect` | System Architect | 3 (Solutioning) |
 | Hawkeye | `wize-agent-test-architect` | Test Architect (TEA) | Gates 2/3/4 |
 | Shuri | `wize-agent-dev` | Senior Developer | 4 (Implementation) |
-| red-teamer | `wize-sec-red-teamer` | AI Pentester (security-overlay, opt-in) | Transversal |
+| Natasha Romanoff | `wize-sec-red-teamer` | Red-Teamer / AI Pentester (security-overlay, opt-in) | Transversal |
 ---
@@ -358,7 +360,7 @@ wize-dev-kit/
 │   │   ├── wize-app-store-listing/
 │   │   └── module.yaml
 │   └── security-overlay/       # Wize Security Overlay (AI Pentester, opt-in)
-│       ├── agents/             # red-teamer (wize-sec-red-teamer)
+│       ├── agents/red-teamer/  # Natasha Romanoff (wize-sec-red-teamer)
 │       ├── skills/
 │       ├── data/
 │       └── _shared/

package/CHANGELOG.md CHANGED Viewed

@@ -3,8 +3,32 @@
 All notable changes to **wize-dev-kit** are documented here.
 Format inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+> **Language:** entries are written in **English from v0.10.1 onward**. Releases
+> **0.10.0 and earlier are in Brazilian Portuguese** and are kept verbatim as a
+> historical record (not back-translated).
 ## [Unreleased]
+## [0.10.1] — 2026-08-02
+Documentation polish + tooling fixes. The security-overlay persona gets a Marvel name; the README (3 languages) is aligned to v0.10.1; a rendering bug and the test glob are fixed; CI is added. Suite green (418 tests — the security-overlay suite now runs under `npm test`).
+### Added
+- **CI** (`.github/workflows/ci.yml`) — runs `npm test` + `npm run validate` on pushes to `main` and on pull requests, Node 20/24 matrix. Previously only `publish.yml` existed (tag-triggered), which let regressions slip through locally.
+- **`Natasha Romanoff` persona** — the 10th persona (security overlay, opt-in) gets a Marvel display name, aligned with the other 9. The `code` stays `wize-sec-red-teamer` (invocation/directory remain stable). Deadpool was evaluated and rejected: the name acts as an instruction inside the rendered SKILL.md and clashes with the overlay's consent / scope-gate design.
+### Fixed
+- **Rendered descriptions ended in `— |`** across all 9 adapters — `readYamlField` (render-shared) didn't parse block scalars (`description: |`), capturing the literal `|`. It now reads block scalars (literal and folded); a regression test was added. `AGENTS.md`, `.cursor/`, `.kimi/`, `.opencode/`, and the generic adapters were re-rendered.
+- **`npm test` skipped the security-overlay suite** — the `test/*.test.js` glob wasn't recursive, so `test/security-overlay/**` (26 files, 8 with stale assertions) never ran under `test` / `prepublishOnly` / publish. The glob is fixed; the 8 stale assertions were updated to the current contract (multi-script phases, severity-based nuclei, `env bash` shebang, the osv manifest guard).
+### Changed
+- **Generated `AGENTS.md`** — the roster is now ordered deterministically (canonical roster order) and the overlay persona is marked `(security-overlay, opt-in)`.
+- **README (en/pt-BR/es)** — status bumped to v0.10.1; documented `wize-grill`, mission contracts (`/wize-help mission`), loop verification + max-cycles guard, `wize-correct-course`, `wize-sprint-planning`, `wize-create-story`; fixed the 10th persona's Code column in the roster, the installer prompt list (7 prompts), and the `list` description; removed the pt-BR section leaked into the English README.
+- **`ROSTER.md` / `ARCH.md` / `DECISIONS.md`** — `Natasha Romanoff` persona; ARCH no longer calls itself "proposal / pre-build"; new Phase 10 in the decisions log (D10.1–D10.5).
 ## [0.10.0] — 2026-07-31
 Entrada da demanda ganha entrevista estruturada (**`wize-grill`**, adaptado do princípio grill-me) e o loop de implementação ganha verificação automática com guardas de ciclo. Suite verde (246 testes, validate 74 arquivos).

package/DECISIONS.md CHANGED Viewed

@@ -6,7 +6,7 @@
 ## Estado
-- **Fase atual:** Entrevista — Discovery
+- **Fase atual:** Construído e publicado — manutenção contínua (v0.10.0).
 - **Pasta destino:** `wize-dev-kit/`
 - **Repositório de inspiração:** BMAD Method (raiz deste repo)
@@ -153,6 +153,14 @@
 - **D9.1 — Security Overlay neste kit:** o perfil `security-overlay` (AI Pentester) passa a ser distribuído **dentro do `wize-dev-kit`** como 4º perfil opt-in do installer, com a persona **red-teamer** (`wize-sec-red-teamer`) em `src/security-overlay/`. _Supersede parcialmente D1.1 (3 perfis → 4 perfis), D3.2 (9 papéis → 9 core + 1 overlay) e D3.5 (security deixava de ser reservado para kit futuro)._ As entradas históricas permanecem inalteradas como registro.
 - **D9.2 — OpenCode com wiring nativo (0.8.0):** o adapter OpenCode passa a gerar **agents e commands nativos** (`.opencode/agents/` + `.opencode/commands/`), com commands vinculados à persona dona e workers de fan-out isolados — em vez do fallback genérico.
+### Fase 10 — Mission contracts, grill, loop e polish (2026-08)
+- **D10.1 — Mission contracts (0.9.0):** cada etapa da cadeia passa a operar por um contrato explícito (objetivo, fontes de verdade, escopo & limites, ACs, contratos de execução/validação, persistência em `.wize/`). `/wize-help mission` emite o contrato preenchido a partir do estado do projeto; templates de story ganham campos de contrato (sources of truth, restrictions, validation, done-means). Motivo: modelos de longo horizonte executam melhor com o alvo declarado.
+- **D10.2 — `wize-grill` (0.10.0):** nova skill core de entrevista-até-entendimento antes de qualquer passo de autoria (brief, PRD, epics, stories, planos). Sempre sugestiva, nunca imposta; sem artefato próprio (decisões caem nos campos do artefato alvo). Adaptado do princípio grill-me.
+- **D10.3 — Loop verification + max-cycles guard (0.10.0):** `wize-dev-story` ganha auto-check antes de declarar o loop concluído (evidência de iteração, mapa AC→teste completo, testes verdes) e guarda de ciclo (mesmo AC falhando 3+ vezes → escala para `wize-correct-course`, agora também auto-disparado).
+- **D10.4 — Persona do overlay ganha nome Marvel:** o `red-teamer` passa a ter o nome de exibição **Natasha Romanoff** (espionagem/operação ofensiva sob mandato — casa com o scope-gate do overlay). Mudança **apenas de nome de exibição**: o `code` permanece `wize-sec-red-teamer` (identificador de invocação e diretório dos 9 adapters, estável). "Red-Teamer" fica no `title`. _Deadpool foi avaliado e rejeitado: o nome entra no corpo do SKILL.md como instrução e o personagem é o que mais ignora autorização — conflita com o design de consentimento do overlay._ Remove Black Widow do pool de personas reservadas no `ROSTER.md`.
+- **D10.5 — Correções de tooling/qualidade:** (a) `readYamlField` passa a ler **block scalars** (`description: |`) — antes toda descrição renderizada terminava em `— |` nos 9 adapters; (b) `npm test` deixa de usar glob não-recursivo e passa a rodar também `test/security-overlay/**` (evita 8 testes stale passarem despercebidos); (c) adicionado workflow de **CI** (`ci.yml`) em push/PR (Node 20+24), já que só existia `publish.yml` por tag; (d) roster do `AGENTS.md` gerado passa a ser ordenado deterministicamente e marca a persona opt-in do overlay.
 ## Perguntas em aberto
 _(serão preenchidas conforme a entrevista avança)_

package/README.es.md CHANGED Viewed

@@ -34,7 +34,7 @@ Es **file-first y zero-runtime**: los agentes son skills en Markdown que tu IDE
 | **Wize Dev Core** | Ciclo completo (análisis → plan → solución → implementación) + Test Architect + UX Whiteport + Agent Builder. Siempre instalado. |
 | **Wize Web Dev** *(overlay)* | Scaffolds web, SEO, analytics, playbook WCAG para Mantis, Playwright/Vitest para Hawkeye. |
 | **Wize App Development** *(overlay)* | Scaffolds móviles, ficha de tienda, directrices de plataforma (HIG / Material 3), Detox/Maestro para Hawkeye. |
-| **Wize Security** *(overlay)* 🆕 | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conducido por la persona `red-teamer`, con gate de alcance, clasificación OWASP/CVSS e informe ejecutivo. |
+| **Wize Security** *(overlay)* | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conducido por **Natasha Romanoff**, la persona `red-teamer`, con gate de alcance, clasificación OWASP/CVSS e informe ejecutivo. |
 ---
@@ -54,10 +54,12 @@ npx github:qwize-br/wize-development-kit install
 El instalador pregunta:
-1. **Perfil(es)** — Core / +Web / +App / +Security (selección múltiple).
-2. **IDE(s) objetivo** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity o fallback genérico (selección múltiple).
-3. **Idiomas** — comunicación + salida de documentos.
-4. **Brownfield** — ofrece ejecutar `wize-document-project` para crear la baseline del código existente.
+1. **Nombre del proyecto** — escrito en `.wize/config/project.toml`.
+2. **Perfil(es)** — Core / +Web / +App / +Security (selección múltiple).
+3. **IDE(s) objetivo** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity o fallback genérico (selección múltiple).
+4. **Idiomas** — comunicación + salida de documentos.
+5. **Tu nombre** — cómo deben dirigirse a ti los agentes (guardado en `user.toml`).
+6. **Brownfield** — ofrece ejecutar `wize-document-project` para crear la baseline del código existente.
 Tras instalar, abre tu IDE y di:
@@ -96,7 +98,7 @@ Los 9 IDEs objetivo se renderizan desde la misma fuente; el formato y la mecáni
 | 7 | **Tony Stark** | `wize-agent-architect` | Arquitecto de Sistemas (arquitectura, ADRs, epics, stories) |
 | 8 | **Hawkeye** | `wize-agent-test-architect` | Test Architect — 6 gates (risk, design, trace, nfr, review, gate) |
 | 9 | **Shuri** | `wize-agent-dev` | Desarrolladora Senior (TDD, código, refactor) |
-| 10 | **red-teamer** 🆕 | `red-teamer` (overlay de seguridad) | Pentester de IA — recon, SAST/DAST, pruebas ofensivas con alcance, informe |
+| 10 | **Natasha Romanoff** | `wize-sec-red-teamer` (overlay de seguridad) | Red-Teamer / Pentester de IA — recon, SAST/DAST, pruebas ofensivas con alcance, informe |
 Consulta [`ROSTER.md`](ROSTER.md) para personas, estilos y equivalencias con BMAD.
@@ -109,7 +111,11 @@ Cada paso es un slash command en tu IDE; cada persona lee el artefacto anterior
 ```
 1.  /wize-orchestrator          Wizer saluda, lee config, detecta el estado y enruta.
-2.  /wize-product-brief         Pepper convierte la demanda bruta en brief.md.
+2.  /wize-grill                  Cualquier persona te entrevista hasta un entendimiento
+                                compartido antes de redactar — una pregunta a la vez,
+                                cada una con respuesta recomendada (ofrecida, nunca
+                                impuesta).
+    /wize-product-brief         Pepper convierte la demanda bruta en brief.md.
     /wize-trigger-map           Pepper mapea psicología del usuario → metas de negocio (WDS).
     /wize-research              Pepper sintetiza evidencia externa (opcional).
@@ -127,9 +133,14 @@ Cada paso es un slash command en tu IDE; cada persona lee el artefacto anterior
     /wize-create-epics-and-stories
                                 Tony divide epics → stories (cada una con ACs).
-7.  /wize-tea-risk              Hawkeye construye el perfil global de riesgo.
+7.  /wize-sprint-planning       Maria Hill abre el sprint desde los epics/stories.
+    /wize-tea-risk              Hawkeye construye el perfil global de riesgo.
     /wize-tea-design            Hawkeye escribe el test design de la próxima story.
-    /wize-dev-story             Shuri implementa (TDD, IDs de AC en los commits).
+    /wize-create-story          Tony escribe la siguiente story con los campos de
+                                contrato: fuentes de verdad, restricciones,
+                                validación, done-means.
+    /wize-dev-story             Shuri implementa (TDD, IDs de AC en los commits) con
+                                loop auto-verificable y guarda de 3 ciclos.
     /wize-tea-trace             Hawkeye mapea cada AC → tests.
     /wize-tea-review            Hawkeye ejecuta la revisión de la story.
     /wize-tea-gate              Hawkeye emite PASS / CONCERNS / FAIL / WAIVED.
@@ -138,8 +149,15 @@ Cada paso es un slash command en tu IDE; cada persona lee el artefacto anterior
     /wize-retrospective         Wizer facilita la retro al final de cada sprint.
 Transversales:
-    /wize-help                  Wizer averigua dónde estás y el próximo paso.
+    /wize-help                  Wizer te enruta: `next` (única acción siguiente),
+                                `status` (snapshot del proyecto), `mission` (un
+                                contrato de misión lleno para la persona ejecutora).
+    /wize-grill                 Entrevista-hasta-entendimiento antes de cualquier
+                                paso de autoría.
     /wize-quick-dev             Shuri toma un arreglo pequeño sin el ciclo completo.
+    /wize-correct-course        Re-planifica cuando un gate falla o el loop se
+                                estanca (auto-disparado por la guarda de max-cycles;
+                                también manual).
     /wize-code-review           Revisión adversarial antes del gate TEA de Hawkeye.
     /wize-party-mode            Wizer reúne multi-persona para decisiones difíciles.
 ```
@@ -150,7 +168,7 @@ Transversales:
 ## 🛡️ Overlay de seguridad — Pentester de IA
-Con el perfil **Wize Security** instalado, la persona `red-teamer` ejecuta un pentest file-first de tu proyecto y produce un informe listo para stakeholders.
+Con el perfil **Wize Security** instalado, **Natasha Romanoff** (`wize-sec-red-teamer`, la persona red-teamer) ejecuta un pentest file-first de tu proyecto y produce un informe listo para stakeholders.
 ### Cómo funciona
@@ -213,6 +231,8 @@ npx wize-dev-kit doctor          # diagnostica kit / proyecto / adapters / gates
 npx wize-dev-kit validate        # chequeos estructurales en los assets del kit
 npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
 npx wize-dev-kit uninstall       # elimina .wize/ (tu código queda intacto)
+npx wize-dev-kit help            # referencia de comandos
+npx wize-dev-kit version         # imprime la versión instalada del kit
 ```
 ---
@@ -221,15 +241,16 @@ npx wize-dev-kit uninstall       # elimina .wize/ (tu código queda intacto)
 - [`ARCH.md`](ARCH.md) — arquitectura completa: distribución, flujos, layout, instalador.
 - [`ROSTER.md`](ROSTER.md) — personas con estilo, rol, equivalencias BMAD.
+- [`AGENTS.md`](AGENTS.md) — el roster generado + el contexto operativo que las IDEs leen en la raíz del repo.
 - [`DECISIONS.md`](DECISIONS.md) — registro de decisiones.
 - [`CHANGELOG.md`](CHANGELOG.md) — historial de releases.
-- [`docs/harnesses/`](docs/harnesses/) — un doc por [harness soportado](#harnesses-soportados), en inglés.
+- [`docs/harnesses/`](docs/harnesses/) — un doc por [harness soportado](#harnesses-soportados), en inglés + [pt-BR](README.pt-BR.md#harnesses-suportadas).
 ---
 ## Estado
-**v0.8.0 — beta.** El ciclo completo (análisis → plan → solución → implementación) está montado con 10 agentes y una biblioteca estructurada de skills. El `security-overlay` (Pentester de IA) entrega un pipeline de pentest completo, un informe ejecutivo (puntuación de riesgo + briefing + plan de acción por IA) y planificación de remediación post-scan — validado de principio a fin contra una aplicación Laravel/PHP real. Los adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode y Antigravity se regeneran automáticamente — [OpenCode](docs/harnesses/opencode.md) recibe wiring nativo de `mode`/`agent`/`subtask`, la integración más profunda de las 9.
+**v0.10.1 — beta.** El ciclo completo (análisis → plan → solución → implementación) está montado con 10 agentes y una biblioteca estructurada de skills. Los releases recientes suman **contratos de misión** (`/wize-help mission` emite un contrato lleno de objetivo / fuentes de verdad / alcance / ACs / contrato de validación para la persona ejecutora), **`wize-grill`** (una pasada de entrevista hasta entendimiento compartido antes de cualquier paso de autoría) y **loop verification** en `wize-dev-story` (un loop de implementación auto-verificable con guarda de max-cycles que escala a `wize-correct-course`). El `security-overlay` (Pentester de IA) entrega un pipeline de pentest completo, un informe ejecutivo (puntuación de riesgo + briefing + plan de acción por IA) y planificación de remediación post-scan — validado de principio a fin contra una aplicación Laravel/PHP real. Los adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode y Antigravity se regeneran automáticamente — [OpenCode](docs/harnesses/opencode.md) recibe wiring nativo de `mode`/`agent`/`subtask`, la integración más profunda de las 9.
 ---
@@ -245,3 +266,24 @@ Wize Development Kit es una **adaptación independiente** — no afiliada ni res
 ## Licencia
 MIT — consulta [`LICENSE`](LICENSE).
+---
+## 🤖 Prerrequisito para colaborar con agentes de IA
+Antes de abrir este repo en cualquier agente (Claude Code, Cursor, Codex, Antigravity, OpenCode, Kimi, Qwen, …), instala el Wize Dev Kit:
+```bash
+npx wize-dev-kit@latest install
+```
+Por qué:
+- Inyecta las skills `/wize-*` (analista, PM, arquitecto, dev, TEA, orquestador) que le dan estructura al ciclo de vida del proyecto.
+- Crea/actualiza una baseline brownfield en `.wize/knowledge/document-project/` — la fuente canónica a consultar antes de decidir cambios.
+- Habilita el seguimiento de actividad en `.wize/implementation/` — cada story, plan y gate queda auditable.
+- Estandariza idiomas y quality gates entre agentes vía `.wize/config/`.
+Sin el kit, el agente trabaja sin contexto histórico, sin gates y sin trazabilidad. Esto vale para cualquier agente de IA usado en el proyecto.
+Para Claude Code: empieza con `/wize-help` para un diagnóstico y el siguiente paso recomendado.

package/README.md CHANGED Viewed

@@ -34,7 +34,7 @@ It is **file-first and zero-runtime**: the agents are Markdown skills your IDE r
 | **Wize Dev Core** | Full lifecycle (analysis → plan → solution → implementation) + Test Architect + Whiteport UX + Agent Builder. Always installed. |
 | **Wize Web Dev** *(overlay)* | Web scaffolds, SEO, analytics, WCAG playbook for Mantis, Playwright/Vitest for Hawkeye. |
 | **Wize App Development** *(overlay)* | Mobile scaffolds, store listing, platform guidelines (HIG / Material 3), Detox/Maestro for Hawkeye. |
-| **Wize Security** *(overlay)* 🆕 | **AI Pentester.** File-first pentest pipeline (recon → enumerate → SAST → DAST → report) driven by the `red-teamer` persona, with a scope gate, OWASP/CVSS classification, and a stakeholder report. |
+| **Wize Security** *(overlay)* | **AI Pentester.** File-first pentest pipeline (recon → enumerate → SAST → DAST → report) driven by **Natasha Romanoff**, the `red-teamer` persona, with a scope gate, OWASP/CVSS classification, and a stakeholder report. |
 ---
@@ -54,10 +54,12 @@ npx github:qwize-br/wize-development-kit install
 The installer asks:
-1. **Profile(s)** — Core / +Web / +App / +Security (multi-select).
-2. **IDE target(s)** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity, or generic fallback (multi-select).
-3. **Languages** — communication + document output.
-4. **Brownfield** — offers to run `wize-document-project` to baseline the existing codebase.
+1. **Project name** — written into `.wize/config/project.toml`.
+2. **Profile(s)** — Core / +Web / +App / +Security (multi-select).
+3. **IDE target(s)** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity, or generic fallback (multi-select).
+4. **Languages** — communication + document output.
+5. **Your name** — how the agents should address you (saved to `user.toml`).
+6. **Brownfield** — offers to run `wize-document-project` to baseline the existing codebase.
 After install, open your IDE and say:
@@ -96,7 +98,7 @@ All 9 IDE targets render from the same source; format and mechanics differ per h
 | 7 | **Tony Stark** | `wize-agent-architect` | System Architect (architecture, ADRs, epics, stories) |
 | 8 | **Hawkeye** | `wize-agent-test-architect` | Test Architect — 6 gates (risk, design, trace, nfr, review, gate) |
 | 9 | **Shuri** | `wize-agent-dev` | Senior Developer (TDD, code, refactor) |
-| 10 | **red-teamer** 🆕 | `red-teamer` (security overlay) | AI Pentester — recon, SAST/DAST, scoped offensive testing, reporting |
+| 10 | **Natasha Romanoff** | `wize-sec-red-teamer` (security overlay) | Red-Teamer / AI Pentester — recon, SAST/DAST, scoped offensive testing, reporting |
 See [`ROSTER.md`](ROSTER.md) for personas, styles and BMAD equivalences.
@@ -109,7 +111,10 @@ Each step is a slash command in your IDE; each persona reads the previous artifa
 ```
 1.  /wize-orchestrator          Wizer greets, reads config, detects state, routes you.
-2.  /wize-product-brief         Pepper turns raw demand into brief.md.
+2.  /wize-grill                  Any persona interviews you to shared understanding
+                                before drafting — one question at a time, each with a
+                                recommended answer (offered, never forced).
+    /wize-product-brief         Pepper turns raw demand into brief.md.
     /wize-trigger-map           Pepper maps user psychology → business goals (WDS).
     /wize-research              Pepper synthesizes external evidence (optional).
@@ -127,9 +132,13 @@ Each step is a slash command in your IDE; each persona reads the previous artifa
     /wize-create-epics-and-stories
                                 Tony slices epics → stories (each has ACs).
-7.  /wize-tea-risk              Hawkeye builds the global risk profile.
+7.  /wize-sprint-planning       Maria Hill opens the sprint from the epics/stories.
+    /wize-tea-risk              Hawkeye builds the global risk profile.
     /wize-tea-design            Hawkeye writes test design for the next story.
-    /wize-dev-story             Shuri implements (TDD, AC IDs in commits).
+    /wize-create-story          Tony writes the next story (contract fields: sources
+                                of truth, restrictions, validation, done-means).
+    /wize-dev-story             Shuri implements (TDD, AC IDs in commits) with a
+                                self-verifying loop and a 3-cycle escalation guard.
     /wize-tea-trace             Hawkeye maps each AC → tests.
     /wize-tea-review            Hawkeye runs story review.
     /wize-tea-gate              Hawkeye emits PASS / CONCERNS / FAIL / WAIVED.
@@ -138,8 +147,13 @@ Each step is a slash command in your IDE; each persona reads the previous artifa
     /wize-retrospective         Wizer facilitates retro at end of each sprint.
 Cross-cutting:
-    /wize-help                  Wizer figures out where you are and the next step.
+    /wize-help                  Wizer routes you: `next` (single next action),
+                                `status` (project snapshot), `mission` (a filled
+                                mission contract for the executing persona).
+    /wize-grill                 Interview-to-understanding before any authoring step.
     /wize-quick-dev             Shuri takes a small fix without the full ride.
+    /wize-correct-course        Re-plan when a gate fails or a loop stalls (auto-
+                                triggered by the max-cycles guard; also manual).
     /wize-code-review           Adversarial peer review before Hawkeye's TEA gate.
     /wize-party-mode            Wizer convenes multi-persona for hard calls.
 ```
@@ -150,7 +164,7 @@ Cross-cutting:
 ## 🛡️ Security overlay — AI Pentester
-When the **Wize Security** profile is installed, the `red-teamer` persona runs a file-first pentest of your project and produces a stakeholder-ready report.
+When the **Wize Security** profile is installed, **Natasha Romanoff** (`wize-sec-red-teamer`, the red-teamer persona) runs a file-first pentest of your project and produces a stakeholder-ready report.
 ### How it works
@@ -203,7 +217,7 @@ When the **Wize Security** profile is installed, the `red-teamer` persona runs a
 npx wize-dev-kit install         # interactive setup
 npx wize-dev-kit update          # bring an installed kit up to the current version
 npx wize-dev-kit sync            # re-render IDE adapters after editing config
-npx wize-dev-kit list            # list built-in + custom agents
+npx wize-dev-kit list            # list installed agents, skills and workflows
 npx wize-dev-kit agent list      # list built-in + custom agents
 npx wize-dev-kit agent create    # scaffold a new custom agent (validated + dry-run)
 npx wize-dev-kit agent edit <code>  # override a built-in agent
@@ -212,6 +226,8 @@ npx wize-dev-kit doctor          # diagnose kit / project / adapters / gates
 npx wize-dev-kit validate        # structural checks on the kit assets
 npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
 npx wize-dev-kit uninstall       # remove .wize/ (your code is left untouched)
+npx wize-dev-kit help            # command reference
+npx wize-dev-kit version         # print the installed kit version
 ```
 ---
@@ -220,6 +236,7 @@ npx wize-dev-kit uninstall       # remove .wize/ (your code is left untouched)
 - [`ARCH.md`](ARCH.md) — full architecture: distribution, flows, layout, installer.
 - [`ROSTER.md`](ROSTER.md) — personas with style, role, BMAD equivalences.
+- [`AGENTS.md`](AGENTS.md) — the generated roster + operating context IDEs read at the repo root.
 - [`DECISIONS.md`](DECISIONS.md) — decisions log.
 - [`CHANGELOG.md`](CHANGELOG.md) — release history.
 - [`docs/harnesses/`](docs/harnesses/) — one doc per [supported harness](#supported-harnesses), in English + [pt-BR](README.pt-BR.md#harnesses-suportadas).
@@ -228,7 +245,7 @@ npx wize-dev-kit uninstall       # remove .wize/ (your code is left untouched)
 ## Status
-**v0.8.0 — beta.** The full lifecycle (analysis → plan → solution → implementation) is wired with 10 agents and a structured skill library. The `security-overlay` (AI Pentester) ships a complete pentest pipeline, a stakeholder report (risk score + briefing + AI action plan), and post-scan remediation planning — validated end-to-end against a real Laravel/PHP app. IDE adapters for Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, and Antigravity are regenerated automatically — [OpenCode](docs/harnesses/opencode.md) gets native `mode`/`agent`/`subtask` wiring, the deepest integration of the 9.
+**v0.10.1 — beta.** The full lifecycle (analysis → plan → solution → implementation) is wired with 10 agents and a structured skill library. Recent releases add **mission contracts** (`/wize-help mission` emits a filled objective / sources-of-truth / scope / ACs / validation contract for the executing persona), **`wize-grill`** (an interview-to-shared-understanding pass before any authoring step), and **loop verification** in `wize-dev-story` (a self-checking implementation loop with a max-cycles guard that escalates to `wize-correct-course`). The `security-overlay` (AI Pentester) ships a complete pentest pipeline, a stakeholder report (risk score + briefing + AI action plan), and post-scan remediation planning — validated end-to-end against a real Laravel/PHP app. IDE adapters for Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, and Antigravity are regenerated automatically — [OpenCode](docs/harnesses/opencode.md) gets native `mode`/`agent`/`subtask` wiring, the deepest integration of the 9.
 ---
@@ -248,21 +265,21 @@ MIT — see [`LICENSE`](LICENSE).
 ---
-## 🤖 Pré-requisito para colaboração com Agentes de IA
+## 🤖 Prerequisite for collaborating with AI agents
-Antes de abrir o repositório em qualquer agente (Claude Code, Cursor, Codex, Antigravity, OpenCode, Kimi, Qwen, …), instale o Wize Dev Kit:
+Before opening this repo in any agent (Claude Code, Cursor, Codex, Antigravity, OpenCode, Kimi, Qwen, …), install the Wize Dev Kit:
 ```bash
 npx wize-dev-kit@latest install
 ```
-Por quê:
+Why:
-- Injeta skills `/wize-*` (analyst, PM, architect, dev, TEA, orchestrator) que dão estrutura ao lifecycle do projeto
-- Cria/atualiza baseline brownfield em `.wize/knowledge/document-project/` — fonte canônica antes de decidir mudanças
-- Habilita trackeamento de atividades em `.wize/implementation/` — toda story, plano e gate fica auditável
-- Padroniza idiomas e gates de qualidade entre agentes via `.wize/config/`
+- Injects the `/wize-*` skills (analyst, PM, architect, dev, TEA, orchestrator) that give the project lifecycle its structure.
+- Creates/updates a brownfield baseline in `.wize/knowledge/document-project/` — the canonical source to consult before deciding on changes.
+- Enables activity tracking in `.wize/implementation/` — every story, plan, and gate stays auditable.
+- Standardizes languages and quality gates across agents via `.wize/config/`.
-Sem o kit, o agente trabalha sem contexto histórico, sem gates e sem rastreabilidade. Premissa válida para todos os agentes de IA usados no projeto.
+Without the kit, the agent works with no historical context, no gates, and no traceability. This holds for every AI agent used on the project.
-Para Claude Code: comece com `/wize-help` para diagnóstico e recomendação do próximo passo.
+For Claude Code: start with `/wize-help` for a diagnosis and the recommended next step.

package/README.pt-BR.md CHANGED Viewed

@@ -34,7 +34,7 @@ O Wize Development Kit (WDK) é uma **stack de agentes de IA** instalável que r
 | **Wize Dev Core** | Ciclo completo (análise → plano → solução → implementação) + Test Architect + UX Whiteport + Agent Builder. Sempre instalado. |
 | **Wize Web Dev** *(overlay)* | Scaffolds web, SEO, analytics, playbook WCAG para o Mantis, Playwright/Vitest para o Hawkeye. |
 | **Wize App Development** *(overlay)* | Scaffolds mobile, listagem em loja, diretrizes de plataforma (HIG / Material 3), Detox/Maestro para o Hawkeye. |
-| **Wize Security** *(overlay)* 🆕 | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conduzido pela persona `red-teamer`, com gate de escopo, classificação OWASP/CVSS e relatório executivo. |
+| **Wize Security** *(overlay)* | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conduzido por **Natasha Romanoff**, a persona `red-teamer`, com gate de escopo, classificação OWASP/CVSS e relatório executivo. |
 ---
@@ -54,10 +54,12 @@ npx github:qwize-br/wize-development-kit install
 O instalador pergunta:
-1. **Perfil(is)** — Core / +Web / +App / +Security (múltipla escolha).
-2. **IDE(s) alvo** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity ou fallback genérico (múltipla escolha).
-3. **Idiomas** — comunicação + saída de documentos.
-4. **Brownfield** — oferece rodar `wize-document-project` para criar a baseline do código existente.
+1. **Nome do projeto** — gravado em `.wize/config/project.toml`.
+2. **Perfil(is)** — Core / +Web / +App / +Security (múltipla escolha).
+3. **IDE(s) alvo** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity ou fallback genérico (múltipla escolha).
+4. **Idiomas** — comunicação + saída de documentos.
+5. **Seu nome** — como os agentes devem te chamar (salvo em `user.toml`).
+6. **Brownfield** — oferece rodar `wize-document-project` para criar a baseline do código existente.
 Após instalar, abra sua IDE e diga:
@@ -96,7 +98,7 @@ Os 9 alvos de IDE são gerados a partir da mesma fonte; formato e mecânica muda
 | 7 | **Tony Stark** | `wize-agent-architect` | Arquiteto de Sistemas (arquitetura, ADRs, epics, stories) |
 | 8 | **Hawkeye** | `wize-agent-test-architect` | Test Architect — 6 gates (risk, design, trace, nfr, review, gate) |
 | 9 | **Shuri** | `wize-agent-dev` | Desenvolvedora Sênior (TDD, código, refactor) |
-| 10 | **red-teamer** 🆕 | `red-teamer` (overlay de segurança) | Pentester de IA — recon, SAST/DAST, testes ofensivos com escopo, relatório |
+| 10 | **Natasha Romanoff** | `wize-sec-red-teamer` (overlay de segurança) | Red-Teamer / Pentester de IA — recon, SAST/DAST, testes ofensivos com escopo, relatório |
 Veja [`ROSTER.md`](ROSTER.md) para personas, estilos e equivalências com o BMAD.
@@ -109,7 +111,11 @@ Cada passo é um slash command na sua IDE; cada persona lê o artefato anterior
 ```
 1.  /wize-orchestrator          Wizer cumprimenta, lê config, detecta estado e roteia.
-2.  /wize-product-brief         Pepper transforma a demanda bruta em brief.md.
+2.  /wize-grill                  Qualquer persona te entrevista até entendimento
+                                compartilhado antes de redigir — uma pergunta por
+                                vez, cada uma com resposta recomendada (oferecida,
+                                nunca imposta).
+    /wize-product-brief         Pepper transforma a demanda bruta em brief.md.
     /wize-trigger-map           Pepper mapeia psicologia do usuário → metas de negócio (WDS).
     /wize-research              Pepper sintetiza evidências externas (opcional).
@@ -127,9 +133,13 @@ Cada passo é um slash command na sua IDE; cada persona lê o artefato anterior
     /wize-create-epics-and-stories
                                 Tony fatia epics → stories (cada uma com ACs).
-7.  /wize-tea-risk              Hawkeye monta o perfil global de risco.
+7.  /wize-sprint-planning       Maria Hill abre a sprint a partir dos epics/stories.
+    /wize-tea-risk              Hawkeye monta o perfil global de risco.
     /wize-tea-design            Hawkeye escreve o test design da próxima story.
-    /wize-dev-story             Shuri implementa (TDD, IDs de AC nos commits).
+    /wize-create-story          Tony escreve a próxima story (campos de contrato:
+                                fontes de verdade, restrições, validação, done-means).
+    /wize-dev-story             Shuri implementa (TDD, IDs de AC nos commits) com
+                                loop auto-verificável e guarda de 3 ciclos.
     /wize-tea-trace             Hawkeye mapeia cada AC → testes.
     /wize-tea-review            Hawkeye faz a revisão da story.
     /wize-tea-gate              Hawkeye emite PASS / CONCERNS / FAIL / WAIVED.
@@ -138,8 +148,15 @@ Cada passo é um slash command na sua IDE; cada persona lê o artefato anterior
     /wize-retrospective         Wizer facilita a retro no fim de cada sprint.
 Transversais:
-    /wize-help                  Wizer descobre onde você está e o próximo passo.
+    /wize-help                  Wizer te direciona: `next` (próxima ação única),
+                                `status` (snapshot do projeto), `mission` (contrato
+                                de missão preenchido para a persona executora).
+    /wize-grill                 Entrevista-até-entendimento antes de qualquer passo
+                                de autoria.
     /wize-quick-dev             Shuri pega uma correção pequena sem o ciclo completo.
+    /wize-correct-course        Re-planeja quando um gate falha ou o loop trava
+                                (auto-disparado pela guarda de max-cycles; também
+                                manual).
     /wize-code-review           Revisão adversarial antes do gate TEA do Hawkeye.
     /wize-party-mode            Wizer reúne multi-persona para decisões difíceis.
 ```
@@ -150,7 +167,7 @@ Transversais:
 ## 🛡️ Overlay de segurança — Pentester de IA
-Com o perfil **Wize Security** instalado, a persona `red-teamer` roda um pentest file-first do seu projeto e produz um relatório pronto para stakeholders.
+Com o perfil **Wize Security** instalado, **Natasha Romanoff** (`wize-sec-red-teamer`, a persona red-teamer) roda um pentest file-first do seu projeto e produz um relatório pronto para stakeholders.
 ### Como funciona
@@ -203,7 +220,7 @@ Com o perfil **Wize Security** instalado, a persona `red-teamer` roda um pentest
 npx wize-dev-kit install         # setup interativo
 npx wize-dev-kit update          # atualiza um kit instalado para a versão atual
 npx wize-dev-kit sync            # re-renderiza os adapters de IDE após editar a config
-npx wize-dev-kit list            # lista agentes nativos + customizados
+npx wize-dev-kit list            # lista agentes, skills e workflows instalados
 npx wize-dev-kit agent list      # lista agentes nativos + customizados
 npx wize-dev-kit agent create    # cria um novo agente customizado (validado + dry-run)
 npx wize-dev-kit agent edit <code>  # sobrescreve um agente nativo
@@ -212,6 +229,8 @@ npx wize-dev-kit doctor          # diagnostica kit / projeto / adapters / gates
 npx wize-dev-kit validate        # checagens estruturais nos assets do kit
 npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
 npx wize-dev-kit uninstall       # remove .wize/ (seu código permanece intacto)
+npx wize-dev-kit help            # referência de comandos
+npx wize-dev-kit version         # imprime a versão instalada do kit
 ```
 ---
@@ -220,6 +239,7 @@ npx wize-dev-kit uninstall       # remove .wize/ (seu código permanece intacto)
 - [`ARCH.md`](ARCH.md) — arquitetura completa: distribuição, fluxos, layout, instalador.
 - [`ROSTER.md`](ROSTER.md) — personas com estilo, papel, equivalências BMAD.
+- [`AGENTS.md`](AGENTS.md) — o roster gerado + contexto operacional que as IDEs leem na raiz do repo.
 - [`DECISIONS.md`](DECISIONS.md) — log de decisões.
 - [`CHANGELOG.md`](CHANGELOG.md) — histórico de releases.
 - [`docs/harnesses/`](docs/harnesses/) — um doc por [harness suportada](#harnesses-suportadas), em português + [English](README.md#supported-harnesses).
@@ -228,7 +248,7 @@ npx wize-dev-kit uninstall       # remove .wize/ (seu código permanece intacto)
 ## Status
-**v0.8.0 — beta.** O ciclo completo (análise → plano → solução → implementação) está montado com 10 agentes e uma biblioteca estruturada de skills. O `security-overlay` (Pentester de IA) entrega um pipeline de pentest completo, um relatório executivo (score de risco + briefing + plano de ação por IA) e planejamento de correção pós-scan — validado de ponta a ponta contra uma aplicação Laravel/PHP real. Os adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode e Antigravity são regenerados automaticamente — o [OpenCode](docs/harnesses/opencode.pt-BR.md) tem a integração mais profunda das 9, com `mode`/`agent`/`subtask` nativos.
+**v0.10.1 — beta.** O ciclo completo (análise → plano → solução → implementação) está montado com 10 agentes e uma biblioteca estruturada de skills. Releases recentes adicionam **contratos de missão** (`/wize-help mission` emite um contrato preenchido de objetivo / fontes de verdade / escopo / ACs / validação para a persona executora), **`wize-grill`** (uma passagem de entrevista até entendimento compartilhado antes de qualquer passo de autoria) e **loop verification** no `wize-dev-story` (loop de implementação auto-verificável com guarda de max-cycles que escala para `wize-correct-course`). O `security-overlay` (Pentester de IA) entrega um pipeline de pentest completo, um relatório executivo (score de risco + briefing + plano de ação por IA) e planejamento de correção pós-scan — validado de ponta a ponta contra uma aplicação Laravel/PHP real. Os adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode e Antigravity são regenerados automaticamente — o [OpenCode](docs/harnesses/opencode.pt-BR.md) tem a integração mais profunda das 9, com `mode`/`agent`/`subtask` nativos.
 ---
@@ -244,3 +264,24 @@ O Wize Development Kit é uma **adaptação independente** — não afiliada nem
 ## Licença
 MIT — veja [`LICENSE`](LICENSE).
+---
+## 🤖 Pré-requisito para colaboração com Agentes de IA
+Antes de abrir o repositório em qualquer agente (Claude Code, Cursor, Codex, Antigravity, OpenCode, Kimi, Qwen, …), instale o Wize Dev Kit:
+```bash
+npx wize-dev-kit@latest install
+```
+Por quê:
+- Injeta as skills `/wize-*` (analista, PM, arquiteto, dev, TEA, orquestrador) que dão estrutura ao ciclo de vida do projeto.
+- Cria/atualiza a baseline brownfield em `.wize/knowledge/document-project/` — a fonte canônica a consultar antes de decidir mudanças.
+- Habilita trackeamento de atividade em `.wize/implementation/` — cada story, plano e gate fica auditável.
+- Padroniza idiomas e gates de qualidade entre agentes via `.wize/config/`.
+Sem o kit, o agente trabalha sem contexto histórico, sem gates e sem rastreabilidade. Isso vale para qualquer agente de IA usado no projeto.
+Para Claude Code: comece com `/wize-help` para diagnóstico e recomendação do próximo passo.

package/ROSTER.md CHANGED Viewed

@@ -23,11 +23,11 @@ Installs only with the `security-overlay` profile.
 | # | Persona | Code | Role | Phase | Motto / Style | BMAD equiv. |
 |---|---|---|---|---|---|---|
-| 10 | **red-teamer** | `wize-sec-red-teamer` | AI Pentester | Overlay | "Only what you're authorized to touch." File-first pentest pipeline: recon → enumerate → SAST → DAST → report, gated by a signed `.wize/security/scope.md`. Default passive; exploits opt-in via `--active`; every refusal audited. Hawkeye/TEA validates the overlay's implementation stories. | (new — no BMAD core equivalent) |
+| 10 | **Natasha Romanoff** | `wize-sec-red-teamer` | Red-Teamer / AI Pentester | Overlay | "Only what you're authorized to touch." File-first pentest pipeline: recon → enumerate → SAST → DAST → report, gated by a signed `.wize/security/scope.md`. Default passive; exploits opt-in via `--active`; every refusal audited. Hawkeye/TEA validates the overlay's implementation stories. | (new — no BMAD core equivalent) |
 ## Notes
 - **Visual theme:** emoji icons (📊 🛡️ 🦾 etc.) are placeholders; a full visual identity will be consolidated in a later phase.
 - **Agent Builder:** decided as a **skill** (`wize-create-agent`), not an agent. Wizer invokes the skill when a new persona or custom module needs to be registered.
-- **Overlays add skills, not persona variants.** Web/App overlays add extra skills + playbooks the core personas load (Mantis gets WCAG/HIG playbooks, Hawkeye gets Playwright/Detox patterns); the Security overlay adds one new persona (red-teamer). There are no per-profile "variants" of Tony or Shuri in code.
-- **Future Marvel personas (out of dev-kit scope):** Pepper is already Analyst here, Fury is already Strategist. Other Marvel personas (Black Panther, Wanda, Falcon, Vision, Riri Williams, Kamala Khan) remain reserved for future kits (Wize Ops Kit, Wize Data Kit, etc.). The Security overlay's red-teamer already lives in this kit.
+- **Overlays add skills, not persona variants.** Web/App overlays add extra skills + playbooks the core personas load (Mantis gets WCAG/HIG playbooks, Hawkeye gets Playwright/Detox patterns); the Security overlay adds one new persona (Natasha Romanoff, the red-teamer). There are no per-profile "variants" of Tony or Shuri in code.
+- **Future Marvel personas (out of dev-kit scope):** Pepper is already Analyst here, Fury is already Strategist, Natasha is the red-teamer. Other Marvel personas (Black Panther, Wanda, Falcon, Vision, Riri Williams, Kamala Khan) remain reserved for future kits (Wize Ops Kit, Wize Data Kit, etc.). The Security overlay's red-teamer already lives in this kit.

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "wize-dev-kit",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Full-lifecycle AI-assisted development kit with Test Architect and Whiteport Design Studio embedded. Inspired by BMAD Method and WDS.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "install:wize": "node tools/installer/wize-cli.js install",
     "uninstall:wize": "node tools/installer/wize-cli.js uninstall",
     "validate": "node tools/installer/validators/run-all.js",
-    "test": "node --test test/*.test.js",
+    "test": "node --test test/**/*.test.js test/*.test.js",
     "prepublishOnly": "npm test && npm run validate"
   },
   "engines": {

package/src/orchestrator-skills/wize-help/skill.md CHANGED Viewed

@@ -104,7 +104,7 @@ Next: /{workflow} ({persona}).
 For `status`, return a table (Phase / Profiles / Last TEA gate / In-flight stories / Active sprint / TEA policy).
-For `personas`, list only personas whose role applies. Always include Wizer, Pepper, Peggy, Maria Hill, Mantis, Fury, Tony, Hawkeye, Shuri. If **web-overlay** active: Mantis has the WCAG/responsive playbook, Hawkeye has Playwright/Vitest. If **app-overlay** active: HIG/Material 3 for Mantis, Detox/Maestro for Hawkeye. If **security-overlay** active: add **red-teamer** (offensive pipeline recon → enumerate → exploit → report; only runs against targets authorized in `.wize/security/scope.md`).
+For `personas`, list only personas whose role applies. Always include Wizer, Pepper, Peggy, Maria Hill, Mantis, Fury, Tony, Hawkeye, Shuri. If **web-overlay** active: Mantis has the WCAG/responsive playbook, Hawkeye has Playwright/Vitest. If **app-overlay** active: HIG/Material 3 for Mantis, Detox/Maestro for Hawkeye. If **security-overlay** active: add **Natasha Romanoff** (red-teamer; offensive pipeline recon → enumerate → exploit → report; only runs against targets authorized in `.wize/security/scope.md`).
 For `mission`, emit the filled **Mission contract** (see the section below) from the Step-2 class + current project state — nothing else.

package/src/security-overlay/_shared/backlog.js CHANGED Viewed

@@ -94,7 +94,7 @@ function buildBacklog({ findings = [], actionPlan = [], scopeSha = '', generated
   lines.push('---');
   lines.push('kind: security-remediation-backlog');
-  lines.push('owner: red-teamer');
+  lines.push('owner: Natasha Romanoff (red-teamer)');
   lines.push(`source_scope_sha256: ${escapeMd(scopeSha)}`);
   lines.push(`generated_at: ${escapeMd(generatedAt)}`);
   lines.push('consumed_by: wize-create-epics-and-stories');

package/src/security-overlay/agents/red-teamer/agent.yaml CHANGED Viewed

@@ -1,16 +1,17 @@
 code: wize-sec-red-teamer
-name: red-teamer
+name: Natasha Romanoff
 title: Security Overlay — Red-Teamer
-icon: "🔓"
+icon: "🕷️"
 team: software-development
 module: security-overlay
 phase: "4-implementation (per-project, gated)"
 description: |
-  Red-teamer is the offensive pentester for the security-overlay. Drives
-  the recon -> enumerate -> exploit -> report pipeline against targets
-  the user has explicitly authorized in .wize/security/scope.md. Runs
-  inside the user's AI harness — never as a remote service.
+  Natasha Romanoff is the red-teamer — the offensive pentester for the
+  security-overlay. Drives the recon -> enumerate -> exploit -> report
+  pipeline against targets the user has explicitly authorized in
+  .wize/security/scope.md. Runs inside the user's AI harness — never as a
+  remote service.
 style:
   voice: "pragmatic, direct, no-flourish pentester"
@@ -42,8 +43,8 @@ hand_off:
   to_tea: |
     Findings of severity High or Critical should be reviewable by
     Hawkeye/TEA in the implementation gate of the security-overlay
-    itself. The red-teamer's results are inputs to the user's security
-    review, NOT a substitute for it.
+    itself. Natasha's results (the red-teamer's findings) are inputs to
+    the user's security review, NOT a substitute for it.
 non_negotiables:
   - "Default passive — never run an offensive tool without scope + --active."

package/src/security-overlay/agents/red-teamer/persona.md CHANGED Viewed

@@ -1,10 +1,10 @@
-# red-teamer — Security Overlay Persona
+# Natasha Romanoff — Red-Teamer (Security Overlay)
 ## Identity
-I am **red-teamer**. I run an offensive pentest pipeline (recon → enumerate → exploit → report) against targets the user has **explicitly authorized** in `.wize/security/scope.md`. I live inside the user's AI harness — I am not a remote service, I do not exfiltrate, and I do not persist anything outside `.wize/security/`.
+I am **Natasha Romanoff**, the red-teamer. I run an offensive pentest pipeline (recon → enumerate → exploit → report) against targets the user has **explicitly authorized** in `.wize/security/scope.md`. I live inside the user's AI harness — I am not a remote service, I do not exfiltrate, and I do not persist anything outside `.wize/security/`.
-I am a pentester who respects the escopo. I treat every offensive action as if it were a real engagement: explicit authorization, dry-run default, audit trail, no surprises.
+I am a pentester who respects the scope. I treat every offensive action as if it were a real engagement: explicit authorization, dry-run default, audit trail, no surprises.
 ## What I do
@@ -20,9 +20,9 @@ Each phase is a standalone skill; the orchestrator `wize-sec-pentest` chains the
 ## How I work
-- **Default passivo.** Without `--active`, only read-only / passive checks (nuclei passive templates, nikto safe checks, no fuzzing, no sqlmap). Active exploitation requires the explicit flag.
+- **Default passive.** Without `--active`, only read-only / passive checks (nuclei passive templates, nikto safe checks, no fuzzing, no sqlmap). Active exploitation requires the explicit flag.
 - **Scope is the gate.** Before any `execFile` against an external tool, I call `assertTargetInScope(scope, target)`. If the target is not in the allowlist, the action is refused and logged to `.wize/security/.refusals.log`. No exceptions.
-- **Ferramentas ausentes degradam, não abortam.** If a tool is not on `$PATH`, the corresponding check is recorded as `degraded_checks` in the partial. The pipeline continues.
+- **Missing tools degrade, they don't abort.** If a tool is not on `$PATH`, the corresponding check is recorded as `degraded_checks` in the partial. The pipeline continues.
 - **Flags via allowlist.** Every argument to every external tool is filtered through `data/tool-allowlist.json`. I never pass user-supplied flags directly to `execFile`.
 ## Limits
@@ -38,6 +38,6 @@ Hawkeye / TEA may review the security-overlay's own implementation (this code) i
 When a finding is severity High or Critical, the orchestrator surfaces it with PoC + scope_sha256 + scope mode, so the user can act on it inside their normal review process.
-## Tom
+## Tone
-Pragmático. Direto. Sem floreio. Pentester real que respeita o escopo.
+Pragmatic. Direct. No flourish. A real pentester who respects the scope.

package/src/security-overlay/skills/wize-sec-enumerate/skill.md CHANGED Viewed

@@ -3,7 +3,7 @@ code: wize-sec-enumerate
 name: wize-sec-enumerate
 overlay: security
 module: security-overlay
-owner: red-teamer
+owner: wize-sec-red-teamer  # Natasha Romanoff
 status: ready
 ---

package/src/security-overlay/skills/wize-sec-pentest/skill.md CHANGED Viewed

@@ -3,7 +3,7 @@ code: wize-sec-pentest
 name: wize-sec-pentest
 overlay: security
 module: security-overlay
-owner: red-teamer
+owner: wize-sec-red-teamer  # Natasha Romanoff
 status: ready
 ---

package/src/security-overlay/skills/wize-sec-recon/skill.md CHANGED Viewed

@@ -3,7 +3,7 @@ code: wize-sec-recon
 name: wize-sec-recon
 overlay: security
 module: security-overlay
-owner: red-teamer
+owner: wize-sec-red-teamer  # Natasha Romanoff
 status: ready
 ---

package/tools/installer/render-shared.js CHANGED Viewed

@@ -13,10 +13,44 @@ const path = require('node:path');
 const { walkAgents, walkWorkflows, walkSkills } = require('./validators/walk.js');
 function readYamlField(content, field) {
-  const re = new RegExp('^' + field + ':\\s*(?:"([^"]*)"|\'([^\']*)\'|(.*?))\\s*$', 'm');
-  const m = content.match(re);
-  if (!m) return null;
-  return (m[1] || m[2] || m[3] || '').trim();
+  const lines = content.split('\n');
+  const keyRe = new RegExp('^' + field + ':\\s*(.*)$');
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(keyRe);
+    if (!m) continue;
+    const inline = m[1].trim();
+    // Block scalar (| literal, > folded) with optional chomp/indent indicator.
+    const block = inline.match(/^([|>])[+-]?\d*\s*$/);
+    if (block) {
+      const folded = block[1] === '>';
+      const collected = [];
+      let baseIndent = null;
+      for (let j = i + 1; j < lines.length; j++) {
+        const line = lines[j];
+        if (line.trim() === '') { collected.push(''); continue; }
+        const indent = line.match(/^(\s*)/)[1].length;
+        if (indent === 0) break; // dedent to a sibling top-level key ends the block
+        if (baseIndent === null) baseIndent = indent;
+        collected.push(line.slice(baseIndent));
+      }
+      while (collected.length && collected[collected.length - 1] === '') collected.pop();
+      if (folded) {
+        // Folded: blank line -> newline, otherwise join lines with a space.
+        return collected.reduce((acc, ln, idx) => {
+          if (idx === 0) return ln;
+          if (ln === '' || collected[idx - 1] === '') return acc + '\n' + ln;
+          return acc + ' ' + ln;
+        }, '').trim();
+      }
+      return collected.join('\n').trim();
+    }
+    // Inline scalar: quoted or plain.
+    const q = inline.match(/^"([^"]*)"$/) || inline.match(/^'([^']*)'$/);
+    return (q ? q[1] : inline).trim();
+  }
+  return null;
 }
 function readFrontmatter(content) {
@@ -197,9 +231,30 @@ function renderAnthropicSkills(kitRoot, targetDir, opts = {}) {
 // Convenience emitter for a root-level AGENTS.md — read by Codex, Cursor,
 // Windsurf and Antigravity as a baseline pointer to the kit's deeper docs.
+// Canonical roster order so AGENTS.md is deterministic regardless of the
+// filesystem walk order. Codes not listed sort last, alphabetically.
+const AGENT_ORDER = [
+  'wize-orchestrator',
+  'wize-agent-analyst',
+  'wize-agent-tech-writer',
+  'wize-agent-pm',
+  'wize-agent-ux-designer',
+  'wize-agent-solution-strategist',
+  'wize-agent-architect',
+  'wize-agent-test-architect',
+  'wize-agent-dev',
+  'wize-sec-red-teamer'
+];
 function renderAgentsMd(kitRoot, projectRoot, opts = {}) {
   const assets = collectAssets(kitRoot, opts);
-  const agents = assets.filter(a => a.kind === 'agent');
+  const rank = (code) => {
+    const i = AGENT_ORDER.indexOf(code);
+    return i === -1 ? AGENT_ORDER.length : i;
+  };
+  const agents = assets
+    .filter(a => a.kind === 'agent')
+    .sort((a, b) => rank(a.code) - rank(b.code) || a.code.localeCompare(b.code));
   const file = path.join(projectRoot, 'AGENTS.md');
   if (fs.existsSync(file) && !opts.overwrite) {
     return { written: [], skipped: ['AGENTS.md (already present; not overwritten)'] };
@@ -230,7 +285,8 @@ function renderAgentsMd(kitRoot, projectRoot, opts = {}) {
     ''
   ];
   for (const a of agents) {
-    lines.push(`- **${a.name}** (\`${a.code}\`) — ${a.title}. ${clipOneLine(a.description, 180)}`);
+    const optIn = a.code.startsWith('wize-sec-') ? ' _(security-overlay, opt-in)_' : '';
+    lines.push(`- **${a.name}** (\`${a.code}\`)${optIn} — ${a.title}. ${clipOneLine(a.description, 180)}`);
   }
   lines.push('', '## Where to start', '', 'Activate the orchestrator: `wize-orchestrator` (Wizer). Then ask `/wize-help`.', '');

package/tools/installer/wize-cli.js CHANGED Viewed

@@ -578,6 +578,7 @@ function cmdList() {
     ['wize-agent-dev', 'Shuri']
   ];
   for (const [code, name] of list) console.log(`  ${code.padEnd(36)} ${name}`);
+  console.log(`  ${'wize-sec-red-teamer'.padEnd(36)} Natasha Romanoff  (security-overlay, opt-in)`);
   console.log('\nWorkflows directories:');
   const phases = ['1-analysis', '2-plan-workflows', '3-solutioning', '4-implementation'];