wize-dev-kit 0.10.1 → 0.11.0

package/CHANGELOG.md

@@ -9,6 +9,25 @@ Format inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.11.0] — 2026-08-06
+
+**No-estimates policy.** The method now refuses to produce development estimates at any step — no hours, days, story points, or S/M/L/XL t-shirt sizes. Following the BMAD stance already stated in the architecture skill ("AI development speed has fundamentally changed"), estimates are treated as noise that only burns time and tokens. The only sizing signal that remains is binary: **does a story fit one PR? If not, slice it.** Suite green (417 tests, validate 74 files).
+
+### Removed
+
+- **`estimate` frontmatter field** from the story and epic templates (`wize-create-story`, `wize-create-epics-and-stories`).
+- **`estimateFor()`** helper and the `- **Estimativa:**` / `est S|M|L` output from the security remediation backlog (`security-overlay/_shared/backlog.js`) — the red-teamer's remediation epics/stories no longer carry a size estimate.
+- **"Estimation rough guide"** (S ≤ 4h, M 4h–1d, …) from `wize-create-story`.
+
+### Changed
+
+- **INVEST** — the "Estimable" letter is dropped on purpose across `wize-create-prd`, `wize-validate-prd`, `wize-create-story`, and `wize-create-epics-and-stories`. "Small (≤ 1 PR)" is now the only sizing test.
+- **`wize-sprint-planning`** — planning is by story count and priority, not velocity or person-day math; "Optimistic velocity" anti-pattern replaced with "don't estimate."
+- **`wize-retrospective`** — the dashboard reports stories committed vs shipped (a count) instead of velocity; the example retro no longer references M/L estimates.
+- **`wize-checkpoint-preview`** — the snapshot records "Commits so far" instead of "Time spent"; triggers refer to "larger stories," not "M/L stories."
+- **`wize-help`** — the Quick Dev classifier drops the "~≤1h" time threshold; it now reads "trivially scoped."
+- Each affected skill carries an explicit **"No estimates"** note so the rule holds when the skill is loaded standalone.
+
 ## [0.10.1] — 2026-08-02
 
 Documentation polish + tooling fixes. The security-overlay persona gets a Marvel name; the README (3 languages) is aligned to v0.10.1; a rendering bug and the test glob are fixed; CI is added. Suite green (418 tests — the security-overlay suite now runs under `npm test`).

package/README.es.md

@@ -250,7 +250,7 @@ npx wize-dev-kit version         # imprime la versión instalada del kit
 
 ## Estado
 
-**v0.10.1 — beta.** El ciclo completo (análisis → plan → solución → implementación) está montado con 10 agentes y una biblioteca estructurada de skills. Los releases recientes suman **contratos de misión** (`/wize-help mission` emite un contrato lleno de objetivo / fuentes de verdad / alcance / ACs / contrato de validación para la persona ejecutora), **`wize-grill`** (una pasada de entrevista hasta entendimiento compartido antes de cualquier paso de autoría) y **loop verification** en `wize-dev-story` (un loop de implementación auto-verificable con guarda de max-cycles que escala a `wize-correct-course`). El `security-overlay` (Pentester de IA) entrega un pipeline de pentest completo, un informe ejecutivo (puntuación de riesgo + briefing + plan de acción por IA) y planificación de remediación post-scan — validado de principio a fin contra una aplicación Laravel/PHP real. Los adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode y Antigravity se regeneran automáticamente — [OpenCode](docs/harnesses/opencode.md) recibe wiring nativo de `mode`/`agent`/`subtask`, la integración más profunda de las 9.
+**v0.11.0 — beta.** El método nunca produce estimaciones de desarrollo — ni horas, ni puntos, ni tallas de camiseta; una story se dimensiona solo por si cabe en un único PR. El ciclo completo (análisis → plan → solución → implementación) está montado con 10 agentes y una biblioteca estructurada de skills. Los releases recientes suman **contratos de misión** (`/wize-help mission` emite un contrato lleno de objetivo / fuentes de verdad / alcance / ACs / contrato de validación para la persona ejecutora), **`wize-grill`** (una pasada de entrevista hasta entendimiento compartido antes de cualquier paso de autoría) y **loop verification** en `wize-dev-story` (un loop de implementación auto-verificable con guarda de max-cycles que escala a `wize-correct-course`). El `security-overlay` (Pentester de IA) entrega un pipeline de pentest completo, un informe ejecutivo (puntuación de riesgo + briefing + plan de acción por IA) y planificación de remediación post-scan — validado de principio a fin contra una aplicación Laravel/PHP real. Los adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode y Antigravity se regeneran automáticamente — [OpenCode](docs/harnesses/opencode.md) recibe wiring nativo de `mode`/`agent`/`subtask`, la integración más profunda de las 9.
 
 ---
 

package/README.md

@@ -245,7 +245,7 @@ npx wize-dev-kit version         # print the installed kit version
 
 ## Status
 
-**v0.10.1 — beta.** The full lifecycle (analysis → plan → solution → implementation) is wired with 10 agents and a structured skill library. Recent releases add **mission contracts** (`/wize-help mission` emits a filled objective / sources-of-truth / scope / ACs / validation contract for the executing persona), **`wize-grill`** (an interview-to-shared-understanding pass before any authoring step), and **loop verification** in `wize-dev-story` (a self-checking implementation loop with a max-cycles guard that escalates to `wize-correct-course`). The `security-overlay` (AI Pentester) ships a complete pentest pipeline, a stakeholder report (risk score + briefing + AI action plan), and post-scan remediation planning — validated end-to-end against a real Laravel/PHP app. IDE adapters for Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, and Antigravity are regenerated automatically — [OpenCode](docs/harnesses/opencode.md) gets native `mode`/`agent`/`subtask` wiring, the deepest integration of the 9.
+**v0.11.0 — beta.** The method never produces development estimates — no hours, points, or t-shirt sizes; a story is sized only by whether it fits a single PR. The full lifecycle (analysis → plan → solution → implementation) is wired with 10 agents and a structured skill library. Recent releases add **mission contracts** (`/wize-help mission` emits a filled objective / sources-of-truth / scope / ACs / validation contract for the executing persona), **`wize-grill`** (an interview-to-shared-understanding pass before any authoring step), and **loop verification** in `wize-dev-story` (a self-checking implementation loop with a max-cycles guard that escalates to `wize-correct-course`). The `security-overlay` (AI Pentester) ships a complete pentest pipeline, a stakeholder report (risk score + briefing + AI action plan), and post-scan remediation planning — validated end-to-end against a real Laravel/PHP app. IDE adapters for Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, and Antigravity are regenerated automatically — [OpenCode](docs/harnesses/opencode.md) gets native `mode`/`agent`/`subtask` wiring, the deepest integration of the 9.
 
 ---
 

package/README.pt-BR.md

@@ -248,7 +248,7 @@ npx wize-dev-kit version         # imprime a versão instalada do kit
 
 ## Status
 
-**v0.10.1 — beta.** O ciclo completo (análise → plano → solução → implementação) está montado com 10 agentes e uma biblioteca estruturada de skills. Releases recentes adicionam **contratos de missão** (`/wize-help mission` emite um contrato preenchido de objetivo / fontes de verdade / escopo / ACs / validação para a persona executora), **`wize-grill`** (uma passagem de entrevista até entendimento compartilhado antes de qualquer passo de autoria) e **loop verification** no `wize-dev-story` (loop de implementação auto-verificável com guarda de max-cycles que escala para `wize-correct-course`). O `security-overlay` (Pentester de IA) entrega um pipeline de pentest completo, um relatório executivo (score de risco + briefing + plano de ação por IA) e planejamento de correção pós-scan — validado de ponta a ponta contra uma aplicação Laravel/PHP real. Os adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode e Antigravity são regenerados automaticamente — o [OpenCode](docs/harnesses/opencode.pt-BR.md) tem a integração mais profunda das 9, com `mode`/`agent`/`subtask` nativos.
+**v0.11.0 — beta.** O método nunca produz estimativas de desenvolvimento — nada de horas, pontos ou tamanhos de camiseta; uma story é dimensionada apenas por caber (ou não) em um único PR. O ciclo completo (análise → plano → solução → implementação) está montado com 10 agentes e uma biblioteca estruturada de skills. Releases recentes adicionam **contratos de missão** (`/wize-help mission` emite um contrato preenchido de objetivo / fontes de verdade / escopo / ACs / validação para a persona executora), **`wize-grill`** (uma passagem de entrevista até entendimento compartilhado antes de qualquer passo de autoria) e **loop verification** no `wize-dev-story` (loop de implementação auto-verificável com guarda de max-cycles que escala para `wize-correct-course`). O `security-overlay` (Pentester de IA) entrega um pipeline de pentest completo, um relatório executivo (score de risco + briefing + plano de ação por IA) e planejamento de correção pós-scan — validado de ponta a ponta contra uma aplicação Laravel/PHP real. Os adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode e Antigravity são regenerados automaticamente — o [OpenCode](docs/harnesses/opencode.pt-BR.md) tem a integração mais profunda das 9, com `mode`/`agent`/`subtask` nativos.
 
 ---
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "wize-dev-kit",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Full-lifecycle AI-assisted development kit with Test Architect and Whiteport Design Studio embedded. Inspired by BMAD Method and WDS.",
   "keywords": [
     "ai",

package/src/method-skills/2-plan-workflows/wize-create-prd/workflow.md

@@ -149,8 +149,7 @@ Maria Hill validates every story's ACs against INVEST:
 - **I**ndependent: no implicit dependency on another story being built first.
 - **N**egotiable: details can move; intent can't.
 - **V**aluable: a real outcome to a real user.
-- **E**stimable: Tony can size it.
-- **S**mall: ≤ 1 PR worth (sliced finer in Phase 3 if not).
+- **S**mall: ≤ 1 PR worth (sliced finer in Phase 3 if not) — the only sizing test. INVEST's "Estimable" is dropped on purpose: we don't produce time or point estimates.
 - **T**estable: every AC is observable.
 
 If any letter fails, fix the story before it leaves Plan.

package/src/method-skills/2-plan-workflows/wize-validate-prd/workflow.md

@@ -45,7 +45,7 @@ After `wize-create-prd` produces `status: ready-for-validation`. Run once per ma
 ### Quality
 - [ ] Every AC is observable (testable by Hawkeye without ambiguity).
 - [ ] No AC contains the word "easy", "intuitive", "responsive" without a numeric criterion.
-- [ ] INVEST: every backbone story passes (independent, negotiable, valuable, estimable, small, testable).
+- [ ] INVEST: every backbone story passes (independent, negotiable, valuable, small, testable) — "Estimable" is dropped; we don't estimate, we only check it fits one PR.
 - [ ] No goal repeats a brief constraint as if it were a goal.
 
 ### Cross-checks

package/src/method-skills/3-solutioning/wize-create-architecture/steps/step-02-context.md

@@ -108,7 +108,7 @@ Prepare the section to append:
 **Scale & Complexity:**
 - Primary domain: {{domain}}
 - Complexity level: {{level}}
-- Estimated architectural components: {{count}}
+- Architectural components: {{count}}
 
 ### Technical Constraints & Dependencies
 {{list}}

package/src/method-skills/3-solutioning/wize-create-epics-and-stories/workflow.md

@@ -12,6 +12,8 @@ status: ready
 
 Tony drives. Output lands in `.wize/solutioning/epics/` and `.wize/solutioning/stories/`.
 
+> **No estimates.** Epics and stories never carry a time or effort estimate (hours, days, story points, S/M/L/XL) — at any step. AI development speed has made them noise that only burns time and tokens. The only sizing question is binary: **does a story fit one PR?** If not, slice it.
+
 When slicing raises decisions the PRD doesn't answer — priority order, sequencing, protected behaviors, what's out of a story — offer a short `wize-grill` pass with the user instead of guessing. Decisions land in the epic/story fields; unresolved ones become open questions with owners.
 
 ## Inputs
@@ -47,7 +49,6 @@ owner: Tony Stark + Maria Hill
 linked_prd: E01
 trigger_map_row: 1
 priority: 1
-estimate: M
 ---
 
 # Epic 01: Sign-up + first invite
@@ -76,8 +77,7 @@ Each story passes:
 - **I**ndependent — can be implemented without waiting for another in-flight story.
 - **N**egotiable — wording can move; intent stays.
 - **V**aluable — a real outcome to a real user (or a clear test path that proves a slice).
-- **E**stimable — Tony can size: S/M/L/XL.
-- **S**mall — fits in one PR (≤ 1 day for an experienced dev, including tests).
+- **S**mall — fits in one PR, tests included. This is the *only* sizing test; no time or point estimate (see **No estimates** above).
 - **T**estable — every AC is observable.
 
 If a story is XL, slice it before merging it to `stories/`.
@@ -101,7 +101,6 @@ story_id: E01-S03
 epic: 01-onboarding
 status: ready-for-dev
 priority: 2
-estimate: M
 linked_screens: [onboarding-step-1, invite-modal]
 linked_acs: [AC-02-1, AC-02-2]
 ---
@@ -163,9 +162,9 @@ Every story declares the AC IDs it advances (from PRD). The union of stories per
 
 Each story carries its own **sources of truth**, **restrictions** (out-of-scope + protected behaviors + compatibility + security), and a **validation contract** (AC → test map + required checks). These aren't optional prose — they are what makes AC → code → test → gate traceable. A story missing them is not ready for dev.
 
-### 4. Estimates
+### 4. Slice check (no estimates)
 
-Story estimates S/M/L/XL. XL gets sliced before merging. If everything is L, slicing pattern is too coarse; revisit.
+Don't estimate stories — size them by one question: does each fit a single PR? Anything that doesn't gets sliced before it lands in `stories/`. If most stories feel too big to slice cleanly, the slicing pattern is too coarse; revisit it.
 
 ### 5. Hand off
 

package/src/method-skills/4-implementation/wize-checkpoint-preview/workflow.md

@@ -8,19 +8,19 @@ status: ready
 
 # Checkpoint Preview
 
-**Goal.** Pause mid-story to validate direction before continuing. For M/L stories where the cost of going off-rail is high, a quick checkpoint catches drift before it becomes rework.
+**Goal.** Pause mid-story to validate direction before continuing. For larger stories where the cost of going off-rail is high, a quick checkpoint catches drift before it becomes rework.
 
 Shuri drives. Tony on call for architectural drift. Hawkeye on call for test design drift.
 
 ## When to run
 
-- Manually, when a story is taking longer than expected.
-- After the first 2-3 commits of an M or L story.
+- Manually, when a story is running long or feels off-track.
+- After the first 2-3 commits of a larger story.
 - When a new constraint is mentioned (security review, perf budget, vendor change).
 
 ## When NOT to run
 
-- Quick-dev / S stories (overhead exceeds the value).
+- Quick-dev / small stories (overhead exceeds the value).
 - When the story is < 50% done and no surprise has come up yet.
 
 ## Inputs
@@ -49,7 +49,7 @@ Write 5 lines:
 - ACs done vs. remaining: (X / Y)
 - Tests added: (count, by split)
 - New dependencies: (list)
-- Time spent: (estimate)
+- Commits so far: (count)
 
 ### 3. Sanity check (3 questions)
 
@@ -92,7 +92,7 @@ author: Shuri
 - ACs done vs. remaining: 1 / 4
 - Tests added: 2 unit, 1 integration
 - New dependencies: none
-- Time spent: ~3h
+- Commits so far: 3
 
 ## Sanity check
 - Right problem? Yes.

package/src/method-skills/4-implementation/wize-correct-course/workflow.md

@@ -43,7 +43,7 @@ Wizer pulls the latest status file. If `last_updated` is older than 2 days, the
 
 Pick exactly one cause:
 
-- **Cut scope.** Story is bigger than estimated, or a non-essential AC can be deferred.
+- **Cut scope.** Story turned out larger than one PR, or a non-essential AC can be deferred.
 - **Re-route.** Story needs a different agent (e.g., Mantis for UX) or skill (e.g., `wize-investigate` for a regression).
 - **Escalate.** Story needs more hands, or a decision outside the team.
 

package/src/method-skills/4-implementation/wize-create-story/workflow.md

@@ -12,6 +12,8 @@ status: ready
 
 Tony drives. Shuri reads and proposes refinements before pulling the story.
 
+> **No estimates.** Never attach a time or effort estimate (hours, days, story points, S/M/L/XL) to a story — at any step. AI development speed has made them noise that only burns time and tokens. The only sizing question is binary: **does it fit one PR?** If not, slice it. Nothing else.
+
 ## When to use
 
 - New story splits from an epic (most common — done in `wize-create-epics-and-stories`).
@@ -47,7 +49,6 @@ story_id: E01-S03
 epic: 01-onboarding
 status: ready-for-dev
 priority: 2          # 1=now, 2=next, 3=later
-estimate: M          # S | M | L  (XL → slice further before merging here)
 linked_screens: [onboarding-step-1, invite-modal]
 linked_acs: [AC-02-1, AC-02-2]
 ---
@@ -95,20 +96,12 @@ Every story passes:
 - **I**ndependent.
 - **N**egotiable.
 - **V**aluable.
-- **E**stimable (Tony sizes).
-- **S**mall (≤ 1 PR).
+- **S**mall (≤ 1 PR) — the *only* sizing test; if it doesn't fit one PR, slice.
 - **T**estable.
 
-If any letter fails, fix before queueing.
-
-## Estimation rough guide
+(INVEST's "Estimable" is dropped on purpose — see **No estimates** above. We don't size in time or points.)
 
-- **S** ≤ 4h.
-- **M** 4h–1d.
-- **L** 1–2d.
-- **XL** > 2d → split.
-
-These are intervals, not commitments. Hill plans capacity against M-median.
+If any letter fails, fix before queueing.
 
 ## Full story template
 
@@ -118,7 +111,6 @@ story_id: E01-S03
 epic: 01-onboarding
 status: ready-for-dev
 priority: 2
-estimate: M
 linked_screens: [onboarding-step-1, invite-modal]
 linked_acs: [AC-02-1, AC-02-2]
 ---

package/src/method-skills/4-implementation/wize-retrospective/workflow.md

@@ -48,7 +48,7 @@ Going over 60 minutes is a sign the retro became therapy. Time-box.
 ### 1. Open with stats
 
 Wizer reads the sprint dashboard from `sprint-status.md`:
-- Velocity vs commitment.
+- Stories committed vs shipped (a count, not a velocity metric — we don't estimate).
 - Number of gates: PASS / CONCERNS / FAIL / WAIVED.
 - Blockers and their resolution times.
 - Carry-over count.
@@ -102,9 +102,9 @@ attendees: [Hill, Tony, Mantis, Pepper, Fury, Hawkeye, Shuri]
 - Mantis' "before/after" recordings in PRs accelerated review.
 
 ## Didn't work
-- Sprint-status entries went stale on Days 7–8 (Hill on vacation).
-- E02-S02 estimated M, actually L; we over-committed.
-- Vendor outage with no fallback caught us cold for 4h.
+- Sprint-status entries went stale mid-sprint (Hill on vacation).
+- E02-S02 was too big for one PR and should have been sliced; it stalled the sprint.
+- Vendor outage with no fallback caught us cold.
 
 ## Surprised us
 - A11y audit caught 3 issues on a screen Mantis had already signed off on (axe found dynamic-content edge cases).
@@ -113,7 +113,7 @@ attendees: [Hill, Tony, Mantis, Pepper, Fury, Hawkeye, Shuri]
 ## Changes for Sprint 8
 
 1. **Sprint-status delegation rotation** — when Hill is OOO, Wizer takes over. *Owner: Wizer. By: Sprint 8 Day 1.*
-2. **L estimates require justification** — any L gets one paragraph "why L not M" in the story file. *Owner: Tony. By: Sprint 8 planning.*
+2. **Slice-check every story at planning** — any story that can't be described as a single PR gets split before it's pulled. *Owner: Tony. By: Sprint 8 planning.*
 3. **Vendor fallback drill** — quarterly, simulate top-3 vendor outages. *Owner: Hawkeye + Tony. By: end of Q3.*
 
 ## Decisions made

package/src/method-skills/4-implementation/wize-sprint-planning/workflow.md

@@ -12,6 +12,8 @@ status: ready
 
 Maria Hill chairs. Tony advises on slicing. Hawkeye flags risk. Shuri commits to the load.
 
+> **No estimates.** Plan by story count and priority, never by velocity, points, or person-day math. Estimates only burn time and tokens. Pull what fits, keep a buffer, and let shipped-vs-committed counts (not a velocity number) tell you next time.
+
 ## Inputs
 
 - Story backlog: `.wize/solutioning/stories/`
@@ -26,10 +28,10 @@ Maria Hill chairs. Tony advises on slicing. Hawkeye flags risk. Shuri commits to
 
 ## Steps
 
-1. **Look back** — what shipped, what slipped, what surprised.
-2. **Refresh capacity** — person-days × utilization − overhead.
+1. **Look back** — what shipped, what slipped, what surprised (counts, not velocity).
+2. **Gauge availability** — who's around this interval and who's out. No person-day math.
 3. **Pull stories** — continuation first, then priority, then risk.
-4. **Reserve 10–15% buffer** for unknowns.
+4. **Leave slack** for unknowns — pull fewer stories than feel possible, not a padded number.
 5. **Walk the gate plan** — design/trace/review/gate per story.
 6. **Commit** — verbal + written into YAML.
 
@@ -65,11 +67,12 @@ development_status:
 
 ## Anti-patterns
 
-- Optimistic velocity.
+- Estimating — velocity, points, or person-days. Just don't.
+- Over-committing because "it looks like it fits."
 - Stories without owners.
 - Stretch goals that are really plan.
 - Pulling blocked dependencies.
-- Zero buffer.
+- Zero slack.
 
 ## Hand-off
 
@@ -83,4 +86,4 @@ development_status:
 >
 > `/loop /wize-dev-story` drives one story at a time: TDD red-green-refactor, AC IDs in commits, `tea-design.md` contract, knowledge update on the 5 baseline axes, and a clean gate at the end. `/loop` keeps it going across the sprint's `ready-for-dev` queue until the user pauses.
 >
-> Next: `/wize-sprint-status` (Maria Hill) to acompanhar o progresso.
+> Next: `/wize-sprint-status` (Maria Hill) to track progress.

package/src/orchestrator-skills/wize-help/skill.md

@@ -45,7 +45,7 @@ Read these if they exist (absence is information too):
 
 | Class | When | Route |
 |---|---|---|
-| **Quick Dev** | Small, predictable, ~≤1h for a careful dev, and touches **no** new feature, architecture, UX, or security surface — bug fix, copy edit, small refactor, dep bump, hotfix, brownfield maintenance. | **Shuri / `wize-quick-dev`** (light TEA) — skip the phase heuristic below. |
+| **Quick Dev** | Small, predictable, trivially scoped, and touches **no** new feature, architecture, UX, or security surface — bug fix, copy edit, small refactor, dep bump, hotfix, brownfield maintenance. | **Shuri / `wize-quick-dev`** (light TEA) — skip the phase heuristic below. |
 | **Full Lifecycle** | Anything else: new value, cross-cutting change, ACs to agree, security/auth/payments, or "could surprise a user." | Apply the phase heuristic below, top-down. |
 
 Never pick Quick Dev to dodge writing artifacts. If the demand needs an AC, it is Full Lifecycle. When unsure, ask one question rather than guess the class.

package/src/security-overlay/_shared/backlog.js

@@ -27,13 +27,6 @@ function priorityFor(severity) {
   }
 }
 
-// Group size -> rough estimate.
-function estimateFor(count) {
-  if (count <= 2) return 'S';
-  if (count <= 10) return 'M';
-  return 'L';
-}
-
 // Human label + remediation intent per section.
 const SECTION_THEME = {
   secrets: { theme: 'Rotacionar e remover segredos expostos', owasp: 'A07:2021' },
@@ -121,8 +114,6 @@ function buildBacklog({ findings = [], actionPlan = [], scopeSha = '', generated
   const planByTheme = {};
   for (const a of (actionPlan || [])) planByTheme[(a.title || '').toLowerCase()] = a;
 
-  const actionable = groups.filter(g => g.worstSeverity !== 'Info-surface' || g.priority !== 'P2' ? true : true);
-
   if (groups.length === 0) {
     lines.push('## (sem itens)');
     lines.push('');
@@ -134,7 +125,6 @@ function buildBacklog({ findings = [], actionPlan = [], scopeSha = '', generated
   let epicN = 0;
   for (const g of groups) {
     epicN++;
-    const est = estimateFor(g.count);
     // Find a matching action-plan detail by theme keyword overlap.
     let planDetail = '';
     for (const [title, a] of Object.entries(planByTheme)) {
@@ -150,14 +140,13 @@ function buildBacklog({ findings = [], actionPlan = [], scopeSha = '', generated
     lines.push(`- **Prioridade:** ${g.priority} (pior severidade: ${g.worstSeverity})`);
     lines.push(`- **Findings cobertos:** ${g.count}`);
     if (g.owasp) lines.push(`- **OWASP:** ${g.owasp}`);
-    lines.push(`- **Estimativa:** ${est}`);
     if (planDetail) lines.push(`- **Como corrigir:** ${planDetail}`);
     lines.push('');
     lines.push('### Stories');
     lines.push('');
     // For large groups, a single remediation story + a verification story.
-    lines.push(`- **${g.theme}** (${g.priority}, est ${est}) — corrigir os ${g.count} finding(s) de \`${g.section}\`. _Origem: ${g.section} (${g.count} findings, ${g.worstSeverity})._`);
-    lines.push(`- **Verificar correção de ${g.section}** (${g.priority}, est S) — re-rodar \`/wize-sec-pentest\` e confirmar que os findings de \`${g.section}\` sumiram (DoD).`);
+    lines.push(`- **${g.theme}** (${g.priority}) — corrigir os ${g.count} finding(s) de \`${g.section}\`. _Origem: ${g.section} (${g.count} findings, ${g.worstSeverity})._`);
+    lines.push(`- **Verificar correção de ${g.section}** (${g.priority}) — re-rodar \`/wize-sec-pentest\` e confirmar que os findings de \`${g.section}\` sumiram (DoD).`);
     lines.push('');
     // Sample of source findings for traceability (cap at 5).
     const sample = g.findings.slice(0, 5);
@@ -177,4 +166,4 @@ function buildBacklog({ findings = [], actionPlan = [], scopeSha = '', generated
   return lines.join('\n');
 }
 
-module.exports = { buildBacklog, priorityFor, estimateFor, groupFindings, CTA_COMMAND };
+module.exports = { buildBacklog, priorityFor, groupFindings, CTA_COMMAND };