wize-dev-kit 0.11.0 → 0.12.0

package/src/orchestrator-skills/wize-help/skill.md

@@ -1,9 +1,12 @@
 ---
+
 code: wize-help
+description: "Use quando o usuário invocar /wize-help para obter snapshot do projeto e o próximo passo recomendado."
 name: Help (Wizer)
 module: orchestrator
 owner: wize-orchestrator
 status: ready
+aliases: []
 ---
 
 # Wizer · `/wize-help`
@@ -41,18 +44,40 @@ Read these if they exist (absence is information too):
 
 ## Step 2 — route
 
+### Step 2a — first-run detection (check before anything else)
+
+If `.wize/planning/brief.md` does NOT exist AND `.wize/knowledge/document-project/` has no `.md` files, this is a **first run**. Do NOT apply the phase heuristic or intent routing. Instead:
+
+> "O que você está construindo?"
+
+Wait for the answer. Classify as greenfield or brownfield, then route:
+- **Greenfield** → **Pepper / `wize-product-brief`**
+- **Brownfield** → **Pepper / `wize-document-project`**
+
+If ambiguous, ask one clarifying question: "Is this a new project or an existing codebase?" Then route. Never show a menu on first run.
+
+### Step 2b — classify the demand (not a first run)
+
 **First, classify the demand — this is a contract decision, not a shortcut.**
 
 | Class | When | Route |
 |---|---|---|
 | **Quick Dev** | Small, predictable, trivially scoped, and touches **no** new feature, architecture, UX, or security surface — bug fix, copy edit, small refactor, dep bump, hotfix, brownfield maintenance. | **Shuri / `wize-quick-dev`** (light TEA) — skip the phase heuristic below. |
-| **Full Lifecycle** | Anything else: new value, cross-cutting change, ACs to agree, security/auth/payments, or "could surprise a user." | Apply the phase heuristic below, top-down. |
+| **Full Lifecycle** | Anything else: new value, cross-cutting change, ACs to agree, security/auth/payments, or "could surprise a user." | Apply routing below: intent first, phase heuristic as fallback. |
 
 Never pick Quick Dev to dodge writing artifacts. If the demand needs an AC, it is Full Lifecycle. When unsure, ask one question rather than guess the class.
 
+### Step 2c — intent-based routing (check first)
+
+When the user's message contains a clear intent phrase, route directly to the matching skill. The intent table maps user language to skills. Match is case-insensitive and substring-based — "quero pesquisar concorrência" matches `wize-market-research` because "pesquisar concorrência" is in the table.
+
+If multiple intents match, pick the most specific (longest phrase match). If still ambiguous, ask one clarifying question. In text-only harnesses, ask that question. In rich-UI harnesses, offer a menu of the matching options.
+
 **Fuzzy demand → suggest a grill.** When the route lands on an authoring step (brief, PRD, epics/stories, architecture, plan) and the demand still carries unresolved decisions, append one line: *"Want me to grill you first (`wize-grill`)? Sharper answers, sharper {artifact}."* Suggest, never force — and never for Quick Dev.
 
-Otherwise apply this heuristic top-down; stop at the first match:
+### Step 2d — phase heuristic (fallback)
+
+When intent is ambiguous or no intent phrase matches, apply this heuristic top-down; stop at the first match:
 
 | # | State | Next step |
 |---|---|---|
@@ -75,11 +100,107 @@ Otherwise apply this heuristic top-down; stop at the first match:
 | 17 | In-flight story, no implementation commits | **Shuri / `wize-dev-story`** |
 | 18 | Story has code, no `gate.md` | **Hawkeye / `wize-tea-trace` → `wize-tea-review` → `wize-tea-gate`** |
 | 19 | A story gated **FAIL**, or sprint drifting (blocked/overdue) | **Shuri fix + Maria Hill / `wize-correct-course`** |
-| 20 | All stories gated PASS/CONCERNS, no `ready-for-dev` left | Sprint ended → **Wizer / `wize-retrospective`** + **Pepper+Peggy / `wize-refresh-knowledge`** |
-| 21 | All gated, no new epic pulled | Plan next epic (Tony + Maria Hill), or a roadmap session |
+| 20 | All stories gated PASS/CONCERNS, no `ready-for-dev` left, no release tag for this sprint | **Shuri + Maria Hill / `wize-release`** (bump + changelog + tag) |
+| 21 | Release tagged, retrospective not done | **Wizer / `wize-retrospective`** + **Pepper+Peggy / `wize-refresh-knowledge`** |
+| 22 | All gated, no new epic pulled | Plan next epic (Tony + Maria Hill), or a roadmap session |
 
 **Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing`; security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
 
+### Intent routing table
+
+Match is case-insensitive, substring-based. Longest match wins. When no intent matches, fall back to the phase heuristic (Step 2b).
+
+**Research:**
+| Intent phrases | Skill |
+|---|---|
+| "pesquisar mercado", "market research", "concorrência", "competidores", "competition" | `wize-market-research` |
+| "pesquisar domínio", "domain research", "entender o domínio", "domain", "indústria", "industry" | `wize-domain-research` |
+| "pesquisar tecnologia", "tech research", "technical research", "stack research", "ferramentas" | `wize-technical-research` |
+| "pesquisar" (genérico, sem qualificador específico) | `wize-research` (dispatcher) |
+| "PR/FAQ", "press release", "working backwards" | `wize-prfaq` |
+| "documentar projeto", "baseline", "brownfield", "document project" | `wize-document-project` |
+| "trigger map", "mapear gatilhos", "trigger" | `wize-trigger-map` |
+| "refresh knowledge", "atualizar conhecimento", "consolidar docs" | `wize-refresh-knowledge` |
+
+**Planning:**
+| Intent phrases | Skill |
+|---|---|
+| "criar brief", "product brief", "briefing", "brief do produto" | `wize-product-brief` |
+| "criar prd", "PRD", "requisitos", "especificação", "product requirements" | `wize-create-prd` |
+| "validar prd", "revisar prd", "validate prd", "prd validation" | `wize-validate-prd` |
+| "editar prd", "atualizar prd", "mudar prd", "edit prd" | `wize-edit-prd` |
+| "cenários de UX", "ux scenarios", "cenários de uso", "user scenarios" | `wize-ux-scenarios` |
+| "design de interface", "ux design", "design system", "interface", "wireframe", "layout" | `wize-ux-design` |
+
+**Architecture:**
+| Intent phrases | Skill |
+|---|---|
+| "arquitetura", "architecture", "ADR", "decisão técnica", "design do sistema", "componentes" | `wize-create-architecture` |
+| "tech vision", "visão técnica", "north star", "stack decision", "stack family" | `wize-tech-vision` |
+| "NFR", "non-functional", "requisitos não-funcionais", "nfr principles", "performance", "segurança", "a11y", "accessibility" | `wize-nfr-principles` |
+| "epics", "stories", "histórias", "épicos", "slice", "fatiar", "criar stories" | `wize-create-epics-and-stories` |
+| "design system", "tokens", "component library", "biblioteca de componentes" | `wize-design-system` |
+| "project context", "contexto do projeto", "consolidar artefatos" | `wize-project-context` |
+| "readiness", "pronto para implementar", "implementation readiness", "gate de solução" | `wize-check-implementation-readiness` |
+
+**Implementation:**
+| Intent phrases | Skill |
+|---|---|
+| "corrigir bug", "bug fix", "consertar", "hotfix", "arrumar", "corrigir erro" | `wize-quick-dev` |
+| "implementar story", "dev story", "codar", "desenvolver", "implementar", "fazer story" | `wize-dev-story` |
+| "code review", "revisar código", "revisão de código", "peer review" | `wize-code-review` |
+| "investigar", "debug", "problema", "root cause", "causa raiz", "regressão" | `wize-investigate` |
+| "checkpoint", "validar direção", "mid-story check" | `wize-checkpoint-preview` |
+| "criar story", "nova story", "author story", "escrever story" | `wize-create-story` |
+| "sprint planning", "planejar sprint", "planejamento", "plan sprint" | `wize-sprint-planning` |
+| "sprint status", "status do sprint", "como está o sprint" | `wize-sprint-status` |
+| "correct course", "corrigir curso", "sprint drifting", "desbloquear" | `wize-correct-course` |
+| "release", "lançar", "publicar", "deploy core", "bump versão", "tag", "shipping" | `wize-release` |
+| "changelog", "notas de versão", "release notes", "gerar changelog" | `wize-changelog` |
+
+**Testing:**
+| Intent phrases | Skill |
+|---|---|
+| "test design", "tea design", "desenhar testes", "test contract", "contrato de teste" | `wize-tea-design` |
+| "gate decision", "tea gate", "decisão de gate", "pass/fail" | `wize-tea-gate` |
+| "risk profile", "perfil de risco", "matriz de risco", "tea risk" | `wize-tea-risk` |
+| "traceability", "trace", "rastreabilidade", "AC trace", "cobertura de AC" | `wize-tea-trace` |
+| "story review", "tea review", "revisão de story", "auditoria de AC" | `wize-tea-review` |
+| "NFR assessment", "avaliação de NFR", "tea nfr", "verificar NFR" | `wize-tea-nfr` |
+| "e2e", "end-to-end", "testes automatizados", "gerar testes e2e", "testes de interface" | `wize-qa-generate-e2e-tests` |
+
+**Security:**
+| Intent phrases | Skill |
+|---|---|
+| "pentest", "security test", "teste de segurança", "vulnerabilidade", "scan de segurança", "security scan" | `wize-sec-pentest` |
+| "security recon", "reconhecimento", "mapear superfície" | `wize-sec-recon` |
+| "enumerate", "enumeração", "surface enumeration", "levantar tech" | `wize-sec-enumerate` |
+| "criar escopo", "definir escopo", "scope security", "escopo de segurança", "scope de pentest" | `wize-sec-scope` |
+
+**Meta:**
+| Intent phrases | Skill |
+|---|---|
+| "help", "ajuda", "o que fazer", "próximo passo", "what next" | Show status + next step (no skill dispatch) |
+| "status", "como estamos", "onde estamos", "progresso" | Show sprint status / project snapshot |
+| "retrospective", "retrospectiva", "retro", "lições aprendidas" | `wize-retrospective` |
+| "personas", "quem faz o quê", "roster", "equipe" | List personas relevant to active profiles |
+| "mission", "missão", "contrato", "mission contract" | Emit filled mission contract |
+| "grill", "sabatinar", "questionar", "afiar", "elicitation" | `wize-grill` |
+| "brainstorm", "brainstorming", "ideias", "chuva de ideias" | `wize-brainstorming` |
+| "spec", "specification", "especificação formal" | `wize-spec` |
+| "adversarial review", "revisão adversarial", "ataque à solução" | `wize-review-adversarial` |
+| "edge case", "casos de borda", "edge case hunter" | `wize-review-edge-case-hunter` |
+| "editorial", "revisão de texto", "polir prosa", "polish prose" | `wize-editorial-review-prose` |
+| "editorial structure", "revisão estrutural", "estrutura do doc" | `wize-editorial-review-structure` |
+| "index docs", "indexar docs", "índice" | `wize-index-docs` |
+| "shard doc", "quebrar doc", "documento grande" | `wize-shard-doc` |
+| "customize", "customizar", "personalizar kit" | `wize-customize` |
+| "create agent", "criar agente", "novo agente" | `wize-create-agent` |
+| "create skill", "criar skill", "nova skill" | `wize-create-skill` |
+| "create workflow", "criar workflow", "novo workflow" | `wize-create-workflow` |
+| "onboarding", "instalar kit", "primeiro uso" | `wize-onboarding` |
+| "party mode", "multi-agent", "reunir agentes" | `wize-party-mode` |
+
 ## Step 2.5 — version skew (proactive)
 
 Compare `kit_version` (project.toml) vs the installed kit vs (if you have a terminal, 2s timeout) `npm view wize-dev-kit version`:
@@ -112,7 +233,7 @@ For `mission`, emit the filled **Mission contract** (see the section below) from
 
 End with one of: "Want me to call {persona}?" · "Want me to baseline the repo first?" (brownfield, no document-project) · "Want me to convene party-mode with {p1} + {p2}?" (cross-cutting decision) · "Want me to grill you first (`wize-grill`)?" (fuzzy demand heading into an authoring step).
 
-## Mission contract (`/wize-help mission`)
+## Mission contract (`/wize mission` or `/wize-help mission`)
 
 When asked for a mission, fill this from project state and hand it to the executing persona. It is a contract, not a spec dump — each field is the minimum that makes the work traceable. Leave a field blank only when the project genuinely has no answer, and say so. If Objective, Scope, or ACs can't be filled from project state, offer a `wize-grill` pass before emitting a hollow contract.
 

package/src/orchestrator-skills/wize-onboarding/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-onboarding
+description: "Use quando o kit for instalado e precisar fazer a triagem inicial: greenfield vs brownfield, perfil, objetivo e roteamento para a persona correta."
 name: Onboarding
 owner: wize-orchestrator   # Wizer
 status: ready
@@ -83,7 +85,7 @@ Never auto-launch the next workflow. The user must confirm.
 - Launching the next workflow without confirmation.
 - Re-asking the user’s name when it’s already in `user.toml`.
 - Dumping the full project state to the user. Summarize in ≤ 5 bullets.
-- Suggesting `wize-onboarding` from `/wize-help` once onboarding is complete. (Help should bypass onboarding for return users.)
+- Suggesting `wize-onboarding` from `/wize` (or `/wize-help`) once onboarding is complete. (Help should bypass onboarding for return users.)
 
 ## Hand-off
 

package/src/orchestrator-skills/wize-orchestrator/agent.yaml

@@ -33,6 +33,7 @@ routes_to:
   - wize-agent-tech-writer     # for docs
 
 skills:
+  - wize
   - wize-onboarding
   - wize-party-mode
   - wize-help

package/src/orchestrator-skills/wize-orchestrator/persona.md

@@ -7,10 +7,12 @@ I am **Wizer**. I am the host of this development kit. I know who you are, what
 ## Operating principles
 
 1. **Listen first.** Before routing, I make sure I understand the demand. One clarifying question is cheaper than three wrong hand-offs.
-2. **Route, don't perform.** I rarely do the specialist's job. When the question is a brief, I call Pepper. When it is a PRD, Maria Hill. When it is architecture, Tony.
-3. **Keep the thread.** I keep the knowledge of the project consistent across conversations. If something changed, I update `.wize/config/project.toml` before moving on.
-4. **Pair when needed.** When a decision crosses concerns (UX touching architecture, PM touching TEA), I open a **party-mode** with the relevant agents.
-5. **Treat the kit as the contract.** `.wize/`, `AGENTS.md`, and the installed `wize-*` skills are the operating instructions and persistent memory of whoever executes — not background reading. I make sure a demand is classified (Quick Dev vs Full Lifecycle, via `/wize-help`) and framed as a mission — objective, sources of truth, scope, acceptance criteria, validation — before any code is touched.
+2. **Route by intent, not just phase.** When the user's message contains a clear intent phrase ("quero pesquisar concorrência", "cria um PRD", "roda um pentest"), I route directly to the matching skill using the intent routing table. I use the phase heuristic only when intent is ambiguous or no intent phrase matches.
+3. **Route, don't perform.** I rarely do the specialist's job. When the question is a brief, I call Pepper. When it is a PRD, Maria Hill. When it is architecture, Tony.
+4. **Keep the thread.** I keep the knowledge of the project consistent across conversations. If something changed, I update `.wize/config/project.toml` before moving on.
+5. **Pair when needed.** When a decision crosses concerns (UX touching architecture, PM touching TEA), I open a **party-mode** with the relevant agents.
+6. **Treat the kit as the contract.** `.wize/`, `AGENTS.md`, and the installed `wize-*` skills are the operating instructions and persistent memory of whoever executes — not background reading. I make sure a demand is classified (Quick Dev vs Full Lifecycle, via `/wize` or `/wize-help`) and framed as a mission — objective, sources of truth, scope, acceptance criteria, validation — before any code is touched.
+7. **Harness-aware interaction.** In text-only harnesses, I ask one clarifying question when intent is ambiguous. In rich-UI harnesses, I offer a menu of matching options.
 
 ## Fan-out to subagents
 
@@ -39,6 +41,29 @@ Before greeting, read `.wize/config/user.toml` if it exists. If it has `[user] n
 
 If `user.toml` is missing or has no `name`, fall back to a neutral greeting.
 
+## First-run detection
+
+Before greeting, check whether this is a first run:
+
+1. Read `.wize/planning/brief.md` — if it exists, this is NOT a first run.
+2. Read `.wize/knowledge/document-project/` — if it has content (any `.md` files), this is NOT a first run.
+3. If neither exists: **first run**.
+
+## First-run flow
+
+When first run is detected, do NOT show a menu. Ask one question:
+
+> "O que você está construindo?"
+
+Wait for the answer. Then classify:
+
+- **Greenfield** (new project, idea, feature, product): route to **Pepper / `wize-product-brief`**.
+- **Brownfield** (existing codebase, legacy system, "we already have X"): route to **Pepper / `wize-document-project`**.
+
+If the answer is ambiguous, ask one clarifying question: "Is this a new project or an existing codebase?" Then route.
+
+Never show a menu on first run. One question → classify → route.
+
 ## Greet
 
 > "Welcome back{{`, ` + user.name when present, else ''}}. What are we working on?"

package/src/orchestrator-skills/wize-party-mode/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-party-mode
+description: "Use quando uma decisão cruzar preocupações de múltiplos agentes e precisar de discussão multi-agente facilitada."
 name: Party Mode (multi-agent)
 owner: wize-orchestrator   # Wizer facilitates
 status: stub

package/src/security-overlay/_shared/scope-parser.js

@@ -111,10 +111,37 @@ function loadScope(scopePath) {
   return scope;
 }
 
+// signScope(scopePath) — read, parse, recompute SHA-256 of the body, and
+// rewrite the scope_sha256 field in the frontmatter. Returns metadata about
+// the signed scope. Throws ScopeError on missing file or invalid format.
+// Idempotent: running twice on the same body produces the same hash.
+function signScope(scopePath) {
+  if (!fs.existsSync(scopePath)) {
+    throw new ScopeError('MISSING_FILE', null,
+      `scope.md ausente em ${scopePath} — crie com wize-sec-scope antes de assinar`);
+  }
+  const text = fs.readFileSync(scopePath, 'utf8');
+  const scope = parseScope(text);
+
+  const newHash = computeScopeSha256(scope.body);
+
+  // Replace scope_sha256 within the frontmatter block only (avoid
+  // accidental matches in the body).
+  const fmMatch = text.match(/^---\n([\s\S]*?)\n---\n/);
+  const fmBlock = fmMatch[0];
+  const newFmBlock = fmBlock.replace(/^(scope_sha256:\s*).*$/m, `$1${newHash}`);
+  const newText = text.replace(fmBlock, newFmBlock);
+
+  fs.writeFileSync(scopePath, newText, 'utf8');
+
+  return { path: scopePath, sha256: newHash, accepted_by: scope.frontmatter.accepted_by };
+}
+
 module.exports = {
   parseScope,
   validateScope,
   computeScopeSha256,
   loadScope,
+  signScope,
   ScopeError
 };

package/src/security-overlay/agents/red-teamer/agent.yaml

@@ -22,9 +22,11 @@ overlay: security
 
 skills:
   - wize-sec-pentest
+  - wize-sec-scope
 
 commands:
   - /wize-sec-pentest
+  - /wize-sec-scope
 
 inputs:
   - ".wize/security/scope.md (gate of authorization)"

package/src/security-overlay/agents/red-teamer/persona.md

@@ -25,6 +25,12 @@ Each phase is a standalone skill; the orchestrator `wize-sec-pentest` chains the
 - **Missing tools degrade, they don't abort.** If a tool is not on `$PATH`, the corresponding check is recorded as `degraded_checks` in the partial. The pipeline continues.
 - **Flags via allowlist.** Every argument to every external tool is filtered through `data/tool-allowlist.json`. I never pass user-supplied flags directly to `execFile`.
 
+## Scope management
+
+- **Create scope:** `/wize-sec-scope` — guided flow that asks for target URL, hosts, paths, and acceptance name. Generates `.wize/security/scope.md` with a valid `scope_sha256`.
+- **Re-sign scope:** `/wize-sec-pentest --sign-scope` — recomputes the SHA-256 of the body and rewrites `scope_sha256` in the frontmatter. Use after editing the allowlist manually.
+- **Validate scope:** `loadScope()` is called before any offensive action. An invalid scope (missing file, missing fields, hash mismatch) aborts the pipeline.
+
 ## Limits
 
 - I do NOT attack hosts, URLs, or paths outside the `scope.md` allowlist. Even with `--active`.

package/src/security-overlay/skills/wize-sec-enumerate/skill.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-sec-enumerate
+description: "Use quando o recon estiver concluído e precisar enumerar a superfície de ataque (portas, serviços, tecnologias) a partir dos alvos autorizados."
 name: wize-sec-enumerate
 overlay: security
 module: security-overlay

package/src/security-overlay/skills/wize-sec-pentest/scripts/run-pipeline.js

@@ -26,10 +26,11 @@ const PHASE_SCRIPTS = {
 };
 
 function parseArgv(argv) {
-  const out = { active: false, scopePath: null, kitRoot: DEFAULT_KIT_ROOT };
+  const out = { active: false, scopePath: null, kitRoot: DEFAULT_KIT_ROOT, signScope: false };
   for (let i = 0; i < (argv || []).length; i++) {
     const a = argv[i];
     if (a === '--active') out.active = true;
+    else if (a === '--sign-scope') out.signScope = true;
     else if (a === '--scope' && argv[i + 1]) { out.scopePath = argv[i + 1]; i++; }
     else if (a.startsWith('--scope=')) out.scopePath = a.slice('--scope='.length);
   }
@@ -120,6 +121,22 @@ async function runPipeline(opts = {}) {
 // user invokes `/wize-sec-pentest`.
 async function main() {
   const args = parseArgv(process.argv.slice(2));
+
+  // --sign-scope: recompute SHA-256 and exit (no pipeline run).
+  if (args.signScope) {
+    try {
+      const { signScope } = require('../../../_shared/scope-parser.js');
+      const result = signScope(args.scopePath);
+      console.log(`✓ Scope re-assinado. SHA-256: ${result.sha256}`);
+      console.log(`  aceite por: ${result.accepted_by}`);
+      console.log(`  arquivo: ${result.path}`);
+      process.exit(0);
+    } catch (err) {
+      console.error('✖ sign-scope falhou:', err && err.message ? err.message : err);
+      process.exit(2);
+    }
+  }
+
   let result;
   try {
     // Derive the securityDir from the scopePath's parent (the .wize/security

package/src/security-overlay/skills/wize-sec-pentest/skill.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-sec-pentest
+description: "Use quando o scope de segurança estiver definido e precisar executar o pipeline completo de pentest (recon → enumerate → exploit → report)."
 name: wize-sec-pentest
 overlay: security
 module: security-overlay

package/src/security-overlay/skills/wize-sec-recon/skill.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-sec-recon
+description: "Use quando o scope de segurança estiver autorizado e precisar executar reconhecimento passivo (nmap) nos alvos."
 name: wize-sec-recon
 overlay: security
 module: security-overlay

package/src/security-overlay/skills/wize-sec-scope/scripts/generate-scope.js

@@ -0,0 +1,106 @@
+'use strict';
+
+// generate-scope.js — creates a valid .wize/security/scope.md from CLI args.
+// Zero-dep. Computes scope_sha256 from the body (including the leading newline
+// separator, matching parseScope's convention).
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+function parseArgv(argv) {
+  const out = { url: null, hosts: [], paths: [], acceptedBy: null, outPath: null };
+  for (let i = 0; i < (argv || []).length; i++) {
+    const a = argv[i];
+    if (a === '--url' && argv[i + 1]) { out.url = argv[i + 1]; i++; }
+    else if (a.startsWith('--url=')) out.url = a.slice('--url='.length);
+    else if (a === '--hosts' && argv[i + 1]) { out.hosts = argv[i + 1].split(',').map(s => s.trim()).filter(Boolean); i++; }
+    else if (a.startsWith('--hosts=')) out.hosts = a.slice('--hosts='.length).split(',').map(s => s.trim()).filter(Boolean);
+    else if (a === '--paths' && argv[i + 1]) { out.paths = argv[i + 1].split(',').map(s => s.trim()).filter(Boolean); i++; }
+    else if (a.startsWith('--paths=')) out.paths = a.slice('--paths='.length).split(',').map(s => s.trim()).filter(Boolean);
+    else if (a === '--accepted-by' && argv[i + 1]) { out.acceptedBy = argv[i + 1]; i++; }
+    else if (a.startsWith('--accepted-by=')) out.acceptedBy = a.slice('--accepted-by='.length);
+    else if (a === '--out' && argv[i + 1]) { out.outPath = argv[i + 1]; i++; }
+    else if (a.startsWith('--out=')) out.outPath = a.slice('--out='.length);
+  }
+  if (!out.outPath) out.outPath = path.join(process.cwd(), '.wize', 'security', 'scope.md');
+  return out;
+}
+
+function buildBody({ url, hosts, paths }) {
+  const lines = [];
+
+  lines.push('## allowlist');
+
+  lines.push('hosts:');
+  for (const h of hosts) lines.push(`  - ${h}`);
+
+  lines.push('urls:');
+  if (url) lines.push(`  - ${url.replace(/\/+$/, '')}/`);
+
+  lines.push('paths:');
+  if (paths.length > 0) {
+    for (const p of paths) lines.push(`  - ${p}`);
+  } else {
+    lines.push('  - /');
+  }
+
+  lines.push('');
+  lines.push('## dast_target');
+  if (url) lines.push(`url: ${url}`);
+  lines.push('');
+  lines.push('## notes');
+  lines.push(`Scope gerado por wize-sec-scope em ${new Date().toISOString()}.`);
+  lines.push('');
+
+  return lines.join('\n');
+}
+
+function generateScope({ url, hosts, paths, acceptedBy, outPath }) {
+  const body = buildBody({ url, hosts, paths });
+
+  // The hash is computed on the body as parseScope returns it: with the
+  // leading newline separator between the closing --- and the body.
+  const signedBody = '\n' + body;
+  const scopeSha256 = crypto.createHash('sha256').update(signedBody, 'utf8').digest('hex');
+  const acceptedAt = new Date().toISOString();
+
+  const fm = [
+    `accepted_by: ${acceptedBy || 'unknown'}`,
+    `accepted_at: ${acceptedAt}`,
+    `scope_sha256: ${scopeSha256}`
+  ].join('\n');
+
+  const content = `---\n${fm}\n---\n${signedBody}`;
+
+  const dir = path.dirname(outPath);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(outPath, content, 'utf8');
+
+  return { path: outPath, sha256: scopeSha256, acceptedBy, acceptedAt };
+}
+
+function main() {
+  const args = parseArgv(process.argv.slice(2));
+
+  if (!args.url) {
+    console.error('✖ --url é obrigatório (ex: --url=http://localhost:8080)');
+    process.exit(2);
+  }
+  if (!args.acceptedBy) {
+    console.error('✖ --accepted-by é obrigatório (ex: --accepted-by="Seu Nome")');
+    process.exit(2);
+  }
+
+  const result = generateScope(args);
+  console.log(`✓ scope.md gerado em ${result.path}`);
+  console.log(`  SHA-256: ${result.sha256}`);
+  console.log(`  aceite por: ${result.acceptedBy}`);
+  console.log(`  aceite em: ${result.acceptedAt}`);
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { generateScope, buildBody, parseArgv };

package/src/security-overlay/skills/wize-sec-scope/skill.md

@@ -0,0 +1,52 @@
+---
+
+code: wize-sec-scope
+description: "Use para criar ou re-assinar o scope.md de segurança. Guia o usuário com perguntas e gera o arquivo com hash SHA-256."
+name: wize-sec-scope
+overlay: security
+module: security-overlay
+owner: wize-sec-red-teamer  # Natasha Romanoff
+status: ready
+---
+
+# wize-sec-scope — Criação guiada de scope.md
+
+Cria o arquivo `.wize/security/scope.md` a partir de perguntas interativas. Gera o frontmatter com `accepted_by`, `accepted_at`, e `scope_sha256` (SHA-256 do corpo). O arquivo gerado passa na validação do `loadScope()` sem intervenção manual.
+
+## Uso
+
+```bash
+/wize-sec-scope
+```
+
+## Fluxo guiado
+
+O agente faz uma pergunta por vez:
+
+1. **URL base do alvo** — ex: `http://localhost:8080`
+2. **Hosts adicionais no escopo** — um por linha, Enter para pular
+3. **Paths no escopo** — ex: `/api/*`, Enter para todos (`/`)
+4. **Nome para o aceite** — quem está autorizando o pentest
+
+Ao final, gera `scope.md` com:
+
+- Frontmatter: `accepted_by`, `accepted_at` (ISO-8601), `scope_sha256`
+- Corpo: `## allowlist` com hosts, urls e paths
+- `## dast_target` com a URL base
+- `## notes` com o timestamp de criação
+
+## Re-assinatura
+
+Se o `scope.md` já existe e foi editado, use `--sign-scope` para recomputar o hash:
+
+```bash
+/wize-sec-pentest --sign-scope
+```
+
+## Script
+
+`scripts/generate-scope.js` — gera o arquivo programaticamente (usado pelo agente ou chamado diretamente).
+
+```bash
+node scripts/generate-scope.js --url=http://localhost:8080 --hosts=localhost,127.0.0.1 --paths=/api,/admin --accepted-by="Seu Nome"
+```

package/src/tea-skills/wize-qa-generate-e2e-tests/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-qa-generate-e2e-tests
+description: "Use quando o UX design e PRD estiverem validados e precisar gerar casos de teste E2E a partir das telas e ACs."
 name: Generate E2E Tests
 owner: wize-agent-test-architect   # Hawkeye
 status: ready

package/src/tea-skills/wize-tea-design/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-design
+description: "Use quando uma story entrar em desenvolvimento e precisar do contrato de testes (split, fixtures, mocks, assertions) que a Shuri implementará."
 name: TEA Test Design
+phase: 4-implementation
 gate: design
 owner: wize-agent-test-architect   # Hawkeye
 when: per-story-start

package/src/tea-skills/wize-tea-gate/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-gate
+description: "Use quando uma story chegar ao final e precisar da decisão de gate (PASS/CONCERNS/FAIL/WAIVED) com rationale documentado."
 name: TEA Gate Decision
+phase: 4-implementation
 gate: gate
 owner: wize-agent-test-architect   # Hawkeye
 when: story-final

package/src/tea-skills/wize-tea-nfr/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-nfr
+description: "Use quando um epic estiver próximo do merge e precisar verificar se atende aos princípios de NFR definidos pelo Fury."
 name: TEA NFR Assessment
+phase: 4-implementation
 gate: nfr
 owner: wize-agent-test-architect   # Hawkeye
 when: pre-merge-per-epic

package/src/tea-skills/wize-tea-review/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-review
+description: "Use quando uma story terminar implementação e precisar de revisão estruturada de AC fulfillment, disciplina de teste e cobertura de risco."
 name: TEA Story Review
+phase: 4-implementation
 gate: review
 owner: wize-agent-test-architect   # Hawkeye
 when: story-end

package/src/tea-skills/wize-tea-risk/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-risk
+description: "Use quando a arquitetura for assinada e precisar construir a matriz probabilidade × impacto que prioriza todo o trabalho de TEA."
 name: TEA Risk Profile
+phase: 4-implementation
 gate: risk
 owner: wize-agent-test-architect   # Hawkeye
 when: once-after-architecture

package/src/tea-skills/wize-tea-trace/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-trace
+description: "Use quando uma story estiver em implementação e precisar mapear cada AC para testes concretos no repositório."
 name: TEA Traceability
+phase: 4-implementation
 gate: trace
 owner: wize-agent-test-architect   # Hawkeye
 when: during-or-after-implementation

package/src/web-overlay/wize-web-deploy/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-web-deploy
+description: "Use quando o projeto web estiver pronto para deploy e precisar do playbook de publicação."
 name: Web Deploy Playbook
 overlay: web
 owner: wize-agent-architect   # Tony

package/src/web-overlay/wize-web-scaffold/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-web-scaffold
+description: "Use quando precisar criar o scaffold inicial de um projeto web com a stack aprovada pelo Fury."
 name: Web Scaffold
 overlay: web
 owner: wize-agent-architect   # Tony executes; Fury approves stack family