wize-dev-kit 0.19.0 → 0.20.0

package/ARCH.md

@@ -261,8 +261,8 @@ wize-dev-kit sync     # regera adapters IDE
 
 ### Wize App Development (overlay)
 
-- Workflows extras: `wize-app-scaffold` (RN/Expo/Flutter/native), `wize-app-release-channels`, `wize-app-store-listing`.
-- Artefatos extras: `mobile-store-listing.md`, `app-perms-and-privacy.md`, `release-channels.md`.
+- Workflows extras: `wize-app-scaffold` (RN/Expo/Flutter/native), `wize-app-release-channels`, `wize-app-store-listing`, `wize-app-store-review` (publication gate).
+- Artefatos extras: `mobile-store-listing.md`, `app-store-review-report.md`, `app-perms-and-privacy.md`, `release-channels.md`.
 - Hawkeye playbook: Detox/Maestro patterns.
 - Mantis playbook: HIG/Material 3, touch targets, gestures, permissions UX.
 

package/CHANGELOG.md

@@ -7,6 +7,12 @@ Format inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 > **0.10.0 and earlier are in Brazilian Portuguese** and are kept verbatim as a
 > historical record (not back-translated).
 
+## [0.20.0] — 2026-09-18
+
+### Added
+
+- **`wize-app-store-review`** (app overlay workflow) — the publication gate the app-overlay was missing. Hawkeye audits the app's code and metadata as an App Store reviewer **after** `wize-app-store-listing` and **before** prod go-live via `wize-app-release-channels`: top rejection risks first (permissions, privacy manifest, IAP/restore, sign-in compliance, metadata mismatch, minimum functionality), compliance checklist by area with conditional Guideline checks (1.2 UGC, 4.3(b) spam, 4.5.3 Apple services), fixed report structure (executive summary, risk register P0–P3, detailed findings, reviewer-experience checklist, suggested "App Review Notes" for App Store Connect), then a fix pass handed to Shuri. Gate rule: no prod submission while any P0/P1 is open (or the user documents a `WAIVED`). Adapted from [awesome-copilot's apple-appstore-reviewer](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) (MIT, credited in the READMEs). New artifact: `.wize/planning/app/app-store-review-report.md` (also registered in `wize-help`/`wize` ship stages and `ARCH.md`).
+
 ## [0.19.0] — 2026-09-18
 
 ### Added

package/README.es.md

@@ -33,7 +33,7 @@ Es **file-first y zero-runtime**: los agentes son skills en Markdown que tu IDE
 |---|---|
 | **Wize Dev Core** | Ciclo completo (análisis → plan → solución → implementación) + Test Architect + UX Whiteport + Agent Builder. Siempre instalado. |
 | **Wize Web Dev** *(overlay)* | Scaffolds web, SEO, analytics, playbook WCAG para Mantis, Playwright/Vitest para Hawkeye. |
-| **Wize App Development** *(overlay)* | Scaffolds móviles, ficha de tienda, directrices de plataforma (HIG / Material 3), Detox/Maestro para Hawkeye. |
+| **Wize App Development** *(overlay)* | Scaffolds móviles, ficha de tienda, gate de revisión de App Store (auditoría de rechazo al publicar), directrices de plataforma (HIG / Material 3), Detox/Maestro para Hawkeye. |
 | **Wize Security** *(overlay)* | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conducido por **Natasha Romanoff**, la persona `red-teamer`, con gate de alcance, clasificación OWASP/CVSS e informe ejecutivo. |
 
 ---
@@ -272,6 +272,7 @@ npx wize-dev-kit version-check [--json]  # instalada vs. más reciente (con cach
 - [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) por Brian (BMad) Madison — ciclo ágil de IA, personas de agentes, patrón de instalador, sistema de módulos.
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — metodología UX-first, panteón nórdico (Saga, Freya), estructura de fases.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) por Peter Yang — higiene de escrita que elimina patrones de AI slop sin aplanar la voz del autor; la inspiración para `/wize-no-ai-slop`.
+- [apple-appstore-reviewer (awesome-copilot)](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — auditoría con mentalidad de reviewer para la submisión a App Store; la inspiración para `wize-app-store-review` (gate de publicación del overlay).
 
 Wize Development Kit es una **adaptación independiente** — no afiliada ni respaldada por los autores de BMAD o WDS. Los nombres de personas Marvel se usan como referencias creativas bajo uso nominativo justo.
 

package/README.md

@@ -33,7 +33,7 @@ It is **file-first and zero-runtime**: the agents are Markdown skills your IDE r
 |---|---|
 | **Wize Dev Core** | Full lifecycle (analysis → plan → solution → implementation) + Test Architect + Whiteport UX + Agent Builder. Always installed. |
 | **Wize Web Dev** *(overlay)* | Web scaffolds, SEO, analytics, WCAG playbook for Mantis, Playwright/Vitest for Hawkeye. |
-| **Wize App Development** *(overlay)* | Mobile scaffolds, store listing, platform guidelines (HIG / Material 3), Detox/Maestro for Hawkeye. |
+| **Wize App Development** *(overlay)* | Mobile scaffolds, store listing, App Store review gate (rejection-risk audit at publication), platform guidelines (HIG / Material 3), Detox/Maestro for Hawkeye. |
 | **Wize Security** *(overlay)* | **AI Pentester.** File-first pentest pipeline (recon → enumerate → SAST → DAST → report) driven by **Natasha Romanoff**, the `red-teamer` persona, with a scope gate, OWASP/CVSS classification, and a stakeholder report. |
 
 ---
@@ -271,6 +271,7 @@ npx wize-dev-kit version-check [--json]  # installed vs latest (cached; scriptab
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — UX-first methodology, Norse pantheon (Saga, Freya), phase structure.
 - [ELI5](https://github.com/dreambigou/eli5) by Andrew Ou — audience-calibrated explanations; the inspiration for `/wize-eli5`.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) by Peter Yang — writing hygiene that removes AI-slop patterns without flattening the writer's voice; the inspiration for `/wize-no-ai-slop` (Peggy Carter & Mantis apply it to end-user-facing prose).
+- [awesome-copilot's apple-appstore-reviewer](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — reviewer-mindset audit for App Store submission; the inspiration for `wize-app-store-review` (the app-overlay publication gate).
 
 Wize Development Kit is an **independent adaptation** — not affiliated with or endorsed by BMAD or WDS authors. Marvel persona names are used as creative references under nominative fair use.
 

package/README.pt-BR.md

@@ -33,7 +33,7 @@ O Wize Development Kit (WDK) é uma **stack de agentes de IA** instalável que r
 |---|---|
 | **Wize Dev Core** | Ciclo completo (análise → plano → solução → implementação) + Test Architect + UX Whiteport + Agent Builder. Sempre instalado. |
 | **Wize Web Dev** *(overlay)* | Scaffolds web, SEO, analytics, playbook WCAG para o Mantis, Playwright/Vitest para o Hawkeye. |
-| **Wize App Development** *(overlay)* | Scaffolds mobile, listagem em loja, diretrizes de plataforma (HIG / Material 3), Detox/Maestro para o Hawkeye. |
+| **Wize App Development** *(overlay)* | Scaffolds mobile, listagem em loja, gate de revisão da App Store (auditoria de rejeição no momento da publicação), diretrizes de plataforma (HIG / Material 3), Detox/Maestro para o Hawkeye. |
 | **Wize Security** *(overlay)* | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conduzido por **Natasha Romanoff**, a persona `red-teamer`, com gate de escopo, classificação OWASP/CVSS e relatório executivo. |
 
 ---
@@ -273,6 +273,7 @@ npx wize-dev-kit version-check [--json]  # instalada vs. mais recente (com cache
 - [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) por Brian (BMad) Madison — ciclo ágil de IA, personas de agentes, padrão de instalador, sistema de módulos.
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — metodologia UX-first, panteão nórdico (Saga, Freya), estrutura de fases.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) por Peter Yang — higiene de escrita que elimina padrões de AI slop sem achatar a voz do autor; a inspiração para `/wize-no-ai-slop`.
+- [apple-appstore-reviewer (awesome-copilot)](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — auditoria com mentalidade de reviewer para submissão na App Store; a inspiração para `wize-app-store-review` (gate de publicação do overlay de app).
 
 O Wize Development Kit é uma **adaptação independente** — não afiliada nem endossada pelos autores do BMAD ou do WDS. Os nomes de personas Marvel são referências criativas sob uso nominativo justo.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "wize-dev-kit",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Full-lifecycle AI-assisted development kit with Test Architect and Whiteport Design Studio embedded. Inspired by BMAD Method and WDS.",
   "keywords": [
     "ai",

package/src/app-overlay/module.yaml

@@ -1,6 +1,6 @@
 code: app-overlay
 name: "Wize App Development (overlay)"
-description: "Mobile-stack extension: scaffolds (RN/Expo/Flutter/native), store-listing, release channels, HIG/Material 3 playbook for Mantis, Detox/Maestro playbook for Hawkeye."
+description: "Mobile-stack extension: scaffolds (RN/Expo/Flutter/native), store-listing, App Store review gate, release channels, HIG/Material 3 playbook for Mantis, Detox/Maestro playbook for Hawkeye."
 default_selected: false
 required: false
 overlay_of: method
@@ -17,6 +17,7 @@ stack_catalog:
 # Extra artifacts:
 artifacts:
   - ".wize/planning/app/mobile-store-listing.md"
+  - ".wize/planning/app/app-store-review-report.md"
   - ".wize/planning/app/app-perms-and-privacy.md"
   - ".wize/planning/app/release-channels.md"
 
@@ -27,6 +28,8 @@ skills:
     description: "Define release channel strategy (dev/preview/prod, EAS branches, beta tracks)."
   - code: wize-app-store-listing
     description: "Draft store listing copy + screenshots brief + ASO keywords."
+  - code: wize-app-store-review
+    description: "Publication gate: audit the app as an App Store reviewer, prioritize rejection risks (P0–P3), draft reviewer notes; block prod channels while P0/P1 stay open."
 
 agent_playbooks:
   wize-agent-ux-designer:

package/src/app-overlay/wize-app-store-review/workflow.md

@@ -0,0 +1,75 @@
+---
+
+code: wize-app-store-review
+description: "Use no momento da publicação do app (antes de submeter para a App Store): audita código e metadados como um reviewer da Apple, prioriza riscos de rejeição e redige as reviewer notes."
+name: App Store Review Gate
+overlay: app
+owner: wize-agent-test-architect   # Hawkeye is the gatekeeper; Shuri owns the fix pass
+status: ready
+---
+
+# App Store Review Gate
+
+**Goal.** Audit the app's source code and metadata from an **App Store reviewer's** point of view and produce a prioritized rejection-risk report — so the submission passes fast approval with minimal re-review risk. Fits in the publication flow: run **after** `wize-app-store-listing` (listing drafted) and **before** going live in prod via `wize-app-release-channels`.
+
+Adapted to the Wize method from the [awesome-copilot apple-appstore-reviewer skill](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) (MIT) — credited in the README.
+
+## Rules of the pass
+
+- **Change no code in this pass.** Hawkeye reviews and reports; fixes land after, via Shuri.
+- Never invent features or claim something exists without evidence in code/config.
+- Distinguish **assumptions** from **Unverified** items that need the smallest specific evidence.
+- The [App Store Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) change — verify current wording when network is available before quoting a guideline.
+
+## Output
+
+- `.wize/planning/app/app-store-review-report.md`
+
+## Steps
+
+### 1. Identify the app's core
+
+- What is the app's primary purpose? Top 3 user flows?
+- What's required to use it (account, permissions, purchase)?
+- Build system: SwiftUI/UIKit, RN/Expo/Flutter, iOS min version, dependencies.
+
+### 2. Flag top rejection risks first (P0/P1)
+
+Scan for:
+
+- Missing/wrong `NS*UsageDescription` strings for permissions actually requested; vague justifications ("need camera"); launch-time permission asks without context.
+- Privacy: data collection without disclosure, tracking/fingerprinting, missing PrivacyInfo.xcprivacy, missing privacy policy link.
+- Broken IAP flows: subscription without visible restore purchases, misleading pricing, digital features gated behind external payments.
+- Login walls without justification; "Sign in with Apple" compliance when third-party social logins exist; account deletion accessible in-app where applicable.
+- Metadata mismatch with `wize-app-store-listing` output (listing copy vs actual behavior — misaligned copy is a rejection magnet).
+- Claims needing substantiation (health, medical, financial, safety) without proper framing.
+- Minimum functionality: empty states, placeholder screens, dead ends, broken network flows.
+
+### 3. Compliance checklist by area
+
+Systematically check: **Privacy & tracking → Permissions & entitlements → Monetization (IAP/Subscriptions) → Account & authentication → Content/UGC/external links → Technical stability → UX & reviewability.**
+
+Conditional checks, only when relevant: **UGC (Guideline 1.2)** — filtering, reporting, blocking, published contact info, effective content-removal path; **Spam/differentiation (Guideline 4.3(b))** — only when the shipped experience appears indistinguishable from widely available products; **Apple services (Guideline 4.5.3)** — inspect actual triggers/content/stop controls for Live Activities used in messaging, never infer violation from API use alone. Report only applicable findings.
+
+### 4. Write the report (fixed structure)
+
+1. **Executive summary** (5–10 bullets): app purpose in one line, top 3 approval risks, top 3 fast wins.
+2. **Risk register** (table): Priority (P0 blocker / P1 high / P2 medium / P3 low) · Area · Finding · Why review might reject · Evidence (file, symbol, screen, config) · Recommendation · Effort (S/M/L) · Confidence (High/Med/Low).
+3. **Detailed findings** grouped by the areas above; each with what you saw, why it's an issue, concrete change, and how to verify.
+4. **Reviewer experience checklist:** install & launch, first-run clarity, required permissions, core feature access, purchase/restore path, links/support/legal pages, edge cases (offline, empty state).
+5. **Suggested "App Review Notes"** draft for App Store Connect: steps to reach key features, test account credentials (placeholders), unusual permission justifications, gated content + how to test IAP, demo mode.
+
+### 5. Fix pass (after the report, on request)
+
+- Hawkeye hands the prioritized register to **Shuri** for concrete fixes: code changes, permission-prompt/paywall/privacy wording samples, and a pre-submission checklist before re-riding the gate.
+
+## Severity definitions
+
+- **P0 — blocker:** very likely rejection, or app is non-functional for review.
+- **P1 — high:** common rejection reason or serious reviewer friction.
+- **P2 — medium:** risky pattern, unclear compliance, or quality concern.
+- **P3 — low:** polish and improvements.
+
+## Gate rule
+
+No submission to production channels (`wize-app-release-channels` prod) while any **P0 or P1** is open in the register. Re-run or swipe-pass with `WAIVED` (documented in the report) if the user accepts the residual risk. **Unverified** items are not violations — list the minimal evidence needed.

package/src/orchestrator-skills/wize/skill.md

@@ -91,7 +91,7 @@ When intent is ambiguous or no intent phrase matches, apply this heuristic top-d
 | 20 | All stories gated PASS/CONCERNS, no `ready-for-dev` left | Sprint ended → **Wizer / `wize-retrospective`** + **Pepper+Peggy / `wize-refresh-knowledge`** |
 | 21 | All gated, no new epic pulled | Plan next epic (Tony + Maria Hill), or a roadmap session |
 
-**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing`; security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
+**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing` / `wize-app-store-review` (publication gate, after listing, before prod go-live); security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
 
 ### Intent routing table
 

package/src/orchestrator-skills/wize-help/skill.md

@@ -104,7 +104,7 @@ When intent is ambiguous or no intent phrase matches, apply this heuristic top-d
 | 21 | Release tagged, retrospective not done | **Wizer / `wize-retrospective`** + **Pepper+Peggy / `wize-refresh-knowledge`** |
 | 22 | All gated, no new epic pulled | Plan next epic (Tony + Maria Hill), or a roadmap session |
 
-**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing`; security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
+**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing` / `wize-app-store-review` (publication gate, after listing, before prod go-live); security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
 
 ### Intent routing table