wize-dev-kit 0.19.0 → 0.21.0

package/ARCH.md

@@ -261,8 +261,8 @@ wize-dev-kit sync     # regera adapters IDE
 
 ### Wize App Development (overlay)
 
-- Workflows extras: `wize-app-scaffold` (RN/Expo/Flutter/native), `wize-app-release-channels`, `wize-app-store-listing`.
-- Artefatos extras: `mobile-store-listing.md`, `app-perms-and-privacy.md`, `release-channels.md`.
+- Workflows extras: `wize-app-scaffold` (RN/Expo/Flutter/native), `wize-app-release-channels`, `wize-app-store-listing`, `wize-app-store-review` (publication gate).
+- Artefatos extras: `mobile-store-listing.md`, `app-store-review-report.md`, `app-perms-and-privacy.md`, `release-channels.md`.
 - Hawkeye playbook: Detox/Maestro patterns.
 - Mantis playbook: HIG/Material 3, touch targets, gestures, permissions UX.
 

package/CHANGELOG.md

@@ -7,6 +7,32 @@ Format inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 > **0.10.0 and earlier are in Brazilian Portuguese** and are kept verbatim as a
 > historical record (not back-translated).
 
+## [0.21.0] — 2026-09-25
+
+**Less code, and a way to verify it.** Four changes put the kit's reuse discipline to work *after* the code is written, not only while it is being written: a deletion-first review (`/wize-subtract`) wired as a fourth layer of `wize-code-review`, a ledger for deliberate shortcuts (`/wize-debt` + the `wize-debt:` marker), the code ladder promoted into the generated `AGENTS.md` (always-on in every harness), and code accounting in the retrospective. Inspired by [Ponytail](https://github.com/DietrichGebert/ponytail) by Dietrich Gebert (credited in all 3 READMEs).
+
+### Added
+
+- **`/wize-subtract`** (core skill) — over-engineering-only review of a diff: one line per finding (`delete:`, `stdlib:`, `native:`, `yagni:`, `shrink:`), ranked by lines saved, closing with `net: -<N> lines possible.` Names the replacement for every cut, verifies reuse claims against the codebase, and never flags tests, trust-boundary validation, security or accessibility. Lists findings; does not apply them.
+- **`/wize-debt`** (core skill) — harvests every `wize-debt:` marker (ceiling + upgrade path) into one ledger, so a deferral can't quietly become permanent. Flags markers that name no trigger as `no-trigger` rot risk. Read-only.
+- **`wize-code-review` runs a fourth layer: the Subtraction Hunter** — alongside the Blind Hunter, Edge Case Hunter and Acceptance Auditor on every code PR. Triage classifies its findings (`patch` for code this diff introduced, `defer` for pre-existing code, `dismiss` when a requirement or a safety floor protects it) and the summary reports the cuts and `net: -N lines possible`.
+- **Code accounting in `wize-retrospective`** — lines added/removed/net, files touched, dependencies added, new abstractions, `wize-debt:` markers added vs retired, and the complexity delta, all measured from git over the sprint window and reported as numbers in the retro doc.
+
+### Changed
+
+- **The generated `AGENTS.md` now carries the code ladder** — YAGNI → already-here → stdlib → native → installed dependency → one-liner → minimum, plus the anti-over-engineering rules (no unrequested abstractions or dependencies, deletion over addition, boring over clever, fewest files, bug fix = root cause) and the safety floor (trust-boundary validation, data-loss handling, security, accessibility, tests on non-trivial logic). The ladder is now **always-on** in every harness that reads `AGENTS.md`, instead of living only inside the implementation skills. Existing installs: delete the kit-generated `AGENTS.md` and re-run `npx wize-dev-kit sync` to regenerate it.
+- **Shuri's persona** — the blanket "no TODO" rule becomes "no *vague* TODO": a deliberate shortcut with a known ceiling ships with a `wize-debt:` marker naming ceiling and upgrade trigger, or it doesn't ship. Shuri also runs `/wize-subtract` on her own diff before opening the PR.
+
+### Fixed
+
+- **Validator: descriptions with escaped quotes** — the kit's frontmatter parser reads double-quoted scalars with `/^"([^"]*)"$/`, so a `description` containing `\"` was parsed with its wrapping quotes and re-escaped on render (visible in every harness). `npm run validate` now fails that pattern, with the fix spelled out.
+
+## [0.20.0] — 2026-09-18
+
+### Added
+
+- **`wize-app-store-review`** (app overlay workflow) — the publication gate the app-overlay was missing. Hawkeye audits the app's code and metadata as an App Store reviewer **after** `wize-app-store-listing` and **before** prod go-live via `wize-app-release-channels`: top rejection risks first (permissions, privacy manifest, IAP/restore, sign-in compliance, metadata mismatch, minimum functionality), compliance checklist by area with conditional Guideline checks (1.2 UGC, 4.3(b) spam, 4.5.3 Apple services), fixed report structure (executive summary, risk register P0–P3, detailed findings, reviewer-experience checklist, suggested "App Review Notes" for App Store Connect), then a fix pass handed to Shuri. Gate rule: no prod submission while any P0/P1 is open (or the user documents a `WAIVED`). Adapted from [awesome-copilot's apple-appstore-reviewer](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) (MIT, credited in the READMEs). New artifact: `.wize/planning/app/app-store-review-report.md` (also registered in `wize-help`/`wize` ship stages and `ARCH.md`).
+
 ## [0.19.0] — 2026-09-18
 
 ### Added

package/README.es.md

@@ -33,7 +33,7 @@ Es **file-first y zero-runtime**: los agentes son skills en Markdown que tu IDE
 |---|---|
 | **Wize Dev Core** | Ciclo completo (análisis → plan → solución → implementación) + Test Architect + UX Whiteport + Agent Builder. Siempre instalado. |
 | **Wize Web Dev** *(overlay)* | Scaffolds web, SEO, analytics, playbook WCAG para Mantis, Playwright/Vitest para Hawkeye. |
-| **Wize App Development** *(overlay)* | Scaffolds móviles, ficha de tienda, directrices de plataforma (HIG / Material 3), Detox/Maestro para Hawkeye. |
+| **Wize App Development** *(overlay)* | Scaffolds móviles, ficha de tienda, gate de revisión de App Store (auditoría de rechazo al publicar), directrices de plataforma (HIG / Material 3), Detox/Maestro para Hawkeye. |
 | **Wize Security** *(overlay)* | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conducido por **Natasha Romanoff**, la persona `red-teamer`, con gate de alcance, clasificación OWASP/CVSS e informe ejecutivo. |
 
 ---
@@ -170,7 +170,14 @@ Transversales:
     /wize-correct-course        Re-planifica cuando un gate falla o el loop se
                                 estanca (auto-disparado por la guarda de max-cycles;
                                 también manual).
-    /wize-code-review           Revisión adversarial antes del gate TEA de Hawkeye.
+    /wize-code-review           Revisión adversarial antes del gate TEA de Hawkeye
+                                (4 capas: ciega, casos-límite, sustracción, auditoría de AC).
+    /wize-subtract              Revisión de diff enfocada solo en over-engineering:
+                                lista de cortes (delete / stdlib / native / yagni /
+                                shrink) + el total de líneas ahorrables. También es capa.
+    /wize-debt                  Cosecha cada atajo deliberado marcado con `wize-debt:`
+                                (techo + ruta de upgrade) en un ledger único, para que
+                                "después" no se vuelva "nunca".
     /wize-party-mode            Wizer reúne multi-persona para decisiones difíciles.
 ```
 
@@ -272,6 +279,9 @@ npx wize-dev-kit version-check [--json]  # instalada vs. más reciente (con cach
 - [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) por Brian (BMad) Madison — ciclo ágil de IA, personas de agentes, patrón de instalador, sistema de módulos.
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — metodología UX-first, panteón nórdico (Saga, Freya), estructura de fases.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) por Peter Yang — higiene de escrita que elimina patrones de AI slop sin aplanar la voz del autor; la inspiración para `/wize-no-ai-slop`.
+- [apple-appstore-reviewer (awesome-copilot)](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — auditoría con mentalidad de reviewer para la submisión a App Store; la inspiración para `wize-app-store-review` (gate de publicación del overlay).
+- [ELI5](https://github.com/dreambigou/eli5) por Andrew Ou — explicaciones calibradas al oyente; inspiración de `/wize-eli5`.
+- [Ponytail](https://github.com/DietrichGebert/ponytail) por Dietrich Gebert — revisión orientada a la eliminación (`/wize-subtract`), el marcador de atajo `wize-debt:` con su ledger, y el encuadre medido de "menos código" detrás de la contabilidad de código de la retrospectiva. La reuse ladder del kit comparte los mismos peldaños.
 
 Wize Development Kit es una **adaptación independiente** — no afiliada ni respaldada por los autores de BMAD o WDS. Los nombres de personas Marvel se usan como referencias creativas bajo uso nominativo justo.
 

package/README.md

@@ -33,7 +33,7 @@ It is **file-first and zero-runtime**: the agents are Markdown skills your IDE r
 |---|---|
 | **Wize Dev Core** | Full lifecycle (analysis → plan → solution → implementation) + Test Architect + Whiteport UX + Agent Builder. Always installed. |
 | **Wize Web Dev** *(overlay)* | Web scaffolds, SEO, analytics, WCAG playbook for Mantis, Playwright/Vitest for Hawkeye. |
-| **Wize App Development** *(overlay)* | Mobile scaffolds, store listing, platform guidelines (HIG / Material 3), Detox/Maestro for Hawkeye. |
+| **Wize App Development** *(overlay)* | Mobile scaffolds, store listing, App Store review gate (rejection-risk audit at publication), platform guidelines (HIG / Material 3), Detox/Maestro for Hawkeye. |
 | **Wize Security** *(overlay)* | **AI Pentester.** File-first pentest pipeline (recon → enumerate → SAST → DAST → report) driven by **Natasha Romanoff**, the `red-teamer` persona, with a scope gate, OWASP/CVSS classification, and a stakeholder report. |
 
 ---
@@ -169,7 +169,14 @@ Cross-cutting:
                                 opening a PR — fail fast, zero CI runner cost.
     /wize-correct-course        Re-plan when a gate fails or a loop stalls (auto-
                                 triggered by the max-cycles guard; also manual).
-    /wize-code-review           Adversarial peer review before Hawkeye's TEA gate.
+    /wize-code-review           Adversarial peer review before Hawkeye's TEA gate
+                                (4 layers: blind, edge case, subtraction, AC audit).
+    /wize-subtract              Over-engineering-only review of a diff: ranked
+                                delete-list (delete / stdlib / native / yagni /
+                                shrink) + the net lines saved. Also a review layer.
+    /wize-debt                  Harvest every deliberate `wize-debt:` shortcut
+                                (ceiling + upgrade path) into one ledger, so a
+                                deferral can't quietly become permanent.
     /wize-party-mode            Wizer convenes multi-persona for hard calls.
 ```
 
@@ -271,6 +278,8 @@ npx wize-dev-kit version-check [--json]  # installed vs latest (cached; scriptab
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — UX-first methodology, Norse pantheon (Saga, Freya), phase structure.
 - [ELI5](https://github.com/dreambigou/eli5) by Andrew Ou — audience-calibrated explanations; the inspiration for `/wize-eli5`.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) by Peter Yang — writing hygiene that removes AI-slop patterns without flattening the writer's voice; the inspiration for `/wize-no-ai-slop` (Peggy Carter & Mantis apply it to end-user-facing prose).
+- [awesome-copilot's apple-appstore-reviewer](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — reviewer-mindset audit for App Store submission; the inspiration for `wize-app-store-review` (the app-overlay publication gate).
+- [Ponytail](https://github.com/DietrichGebert/ponytail) by Dietrich Gebert — deletion-first review (`/wize-subtract`), the `wize-debt:` shortcut marker and its ledger, and the measured "less code" framing behind the retrospective's code accounting. The kit's reuse ladder shares its rungs.
 
 Wize Development Kit is an **independent adaptation** — not affiliated with or endorsed by BMAD or WDS authors. Marvel persona names are used as creative references under nominative fair use.
 

package/README.pt-BR.md

@@ -33,7 +33,7 @@ O Wize Development Kit (WDK) é uma **stack de agentes de IA** instalável que r
 |---|---|
 | **Wize Dev Core** | Ciclo completo (análise → plano → solução → implementação) + Test Architect + UX Whiteport + Agent Builder. Sempre instalado. |
 | **Wize Web Dev** *(overlay)* | Scaffolds web, SEO, analytics, playbook WCAG para o Mantis, Playwright/Vitest para o Hawkeye. |
-| **Wize App Development** *(overlay)* | Scaffolds mobile, listagem em loja, diretrizes de plataforma (HIG / Material 3), Detox/Maestro para o Hawkeye. |
+| **Wize App Development** *(overlay)* | Scaffolds mobile, listagem em loja, gate de revisão da App Store (auditoria de rejeição no momento da publicação), diretrizes de plataforma (HIG / Material 3), Detox/Maestro para o Hawkeye. |
 | **Wize Security** *(overlay)* | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conduzido por **Natasha Romanoff**, a persona `red-teamer`, com gate de escopo, classificação OWASP/CVSS e relatório executivo. |
 
 ---
@@ -172,7 +172,14 @@ Transversais:
     /wize-correct-course        Re-planeja quando um gate falha ou o loop trava
                                 (auto-disparado pela guarda de max-cycles; também
                                 manual).
-    /wize-code-review           Revisão adversarial antes do gate TEA do Hawkeye.
+    /wize-code-review           Revisão adversarial antes do gate TEA do Hawkeye
+                                (4 camadas: cega, casos-limite, subtração, auditoria de AC).
+    /wize-subtract              Revisão de diff focada só em over-engineering: lista
+                                de cortes (delete / stdlib / native / yagni / shrink)
+                                + o total de linhas economizáveis. Também é uma camada.
+    /wize-debt                  Colhe todo atalho deliberado marcado com `wize-debt:`
+                                (teto + caminho de upgrade) num ledger único, para que
+                                "depois" não vire "nunca".
     /wize-party-mode            Wizer reúne multi-persona para decisões difíceis.
 ```
 
@@ -273,6 +280,9 @@ npx wize-dev-kit version-check [--json]  # instalada vs. mais recente (com cache
 - [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) por Brian (BMad) Madison — ciclo ágil de IA, personas de agentes, padrão de instalador, sistema de módulos.
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — metodologia UX-first, panteão nórdico (Saga, Freya), estrutura de fases.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) por Peter Yang — higiene de escrita que elimina padrões de AI slop sem achatar a voz do autor; a inspiração para `/wize-no-ai-slop`.
+- [apple-appstore-reviewer (awesome-copilot)](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — auditoria com mentalidade de reviewer para submissão na App Store; a inspiração para `wize-app-store-review` (gate de publicação do overlay de app).
+- [ELI5](https://github.com/dreambigou/eli5) por Andrew Ou — explicações calibradas ao ouvinte; inspiração do `/wize-eli5`.
+- [Ponytail](https://github.com/DietrichGebert/ponytail) por Dietrich Gebert — revisão orientada a deleção (`/wize-subtract`), o marcador de atalho `wize-debt:` com seu ledger, e o enquadramento medido de "menos código" por trás da contabilidade de código da retrospectiva. A reuse ladder do kit compartilha os mesmos degraus.
 
 O Wize Development Kit é uma **adaptação independente** — não afiliada nem endossada pelos autores do BMAD ou do WDS. Os nomes de personas Marvel são referências criativas sob uso nominativo justo.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "wize-dev-kit",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Full-lifecycle AI-assisted development kit with Test Architect and Whiteport Design Studio embedded. Inspired by BMAD Method and WDS.",
   "keywords": [
     "ai",

package/src/app-overlay/module.yaml

@@ -1,6 +1,6 @@
 code: app-overlay
 name: "Wize App Development (overlay)"
-description: "Mobile-stack extension: scaffolds (RN/Expo/Flutter/native), store-listing, release channels, HIG/Material 3 playbook for Mantis, Detox/Maestro playbook for Hawkeye."
+description: "Mobile-stack extension: scaffolds (RN/Expo/Flutter/native), store-listing, App Store review gate, release channels, HIG/Material 3 playbook for Mantis, Detox/Maestro playbook for Hawkeye."
 default_selected: false
 required: false
 overlay_of: method
@@ -17,6 +17,7 @@ stack_catalog:
 # Extra artifacts:
 artifacts:
   - ".wize/planning/app/mobile-store-listing.md"
+  - ".wize/planning/app/app-store-review-report.md"
   - ".wize/planning/app/app-perms-and-privacy.md"
   - ".wize/planning/app/release-channels.md"
 
@@ -27,6 +28,8 @@ skills:
     description: "Define release channel strategy (dev/preview/prod, EAS branches, beta tracks)."
   - code: wize-app-store-listing
     description: "Draft store listing copy + screenshots brief + ASO keywords."
+  - code: wize-app-store-review
+    description: "Publication gate: audit the app as an App Store reviewer, prioritize rejection risks (P0–P3), draft reviewer notes; block prod channels while P0/P1 stay open."
 
 agent_playbooks:
   wize-agent-ux-designer:

package/src/app-overlay/wize-app-store-review/workflow.md

@@ -0,0 +1,75 @@
+---
+
+code: wize-app-store-review
+description: "Use no momento da publicação do app (antes de submeter para a App Store): audita código e metadados como um reviewer da Apple, prioriza riscos de rejeição e redige as reviewer notes."
+name: App Store Review Gate
+overlay: app
+owner: wize-agent-test-architect   # Hawkeye is the gatekeeper; Shuri owns the fix pass
+status: ready
+---
+
+# App Store Review Gate
+
+**Goal.** Audit the app's source code and metadata from an **App Store reviewer's** point of view and produce a prioritized rejection-risk report — so the submission passes fast approval with minimal re-review risk. Fits in the publication flow: run **after** `wize-app-store-listing` (listing drafted) and **before** going live in prod via `wize-app-release-channels`.
+
+Adapted to the Wize method from the [awesome-copilot apple-appstore-reviewer skill](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) (MIT) — credited in the README.
+
+## Rules of the pass
+
+- **Change no code in this pass.** Hawkeye reviews and reports; fixes land after, via Shuri.
+- Never invent features or claim something exists without evidence in code/config.
+- Distinguish **assumptions** from **Unverified** items that need the smallest specific evidence.
+- The [App Store Review Guidelines](https://developer.apple.com/app-store/review/guidelines/) change — verify current wording when network is available before quoting a guideline.
+
+## Output
+
+- `.wize/planning/app/app-store-review-report.md`
+
+## Steps
+
+### 1. Identify the app's core
+
+- What is the app's primary purpose? Top 3 user flows?
+- What's required to use it (account, permissions, purchase)?
+- Build system: SwiftUI/UIKit, RN/Expo/Flutter, iOS min version, dependencies.
+
+### 2. Flag top rejection risks first (P0/P1)
+
+Scan for:
+
+- Missing/wrong `NS*UsageDescription` strings for permissions actually requested; vague justifications ("need camera"); launch-time permission asks without context.
+- Privacy: data collection without disclosure, tracking/fingerprinting, missing PrivacyInfo.xcprivacy, missing privacy policy link.
+- Broken IAP flows: subscription without visible restore purchases, misleading pricing, digital features gated behind external payments.
+- Login walls without justification; "Sign in with Apple" compliance when third-party social logins exist; account deletion accessible in-app where applicable.
+- Metadata mismatch with `wize-app-store-listing` output (listing copy vs actual behavior — misaligned copy is a rejection magnet).
+- Claims needing substantiation (health, medical, financial, safety) without proper framing.
+- Minimum functionality: empty states, placeholder screens, dead ends, broken network flows.
+
+### 3. Compliance checklist by area
+
+Systematically check: **Privacy & tracking → Permissions & entitlements → Monetization (IAP/Subscriptions) → Account & authentication → Content/UGC/external links → Technical stability → UX & reviewability.**
+
+Conditional checks, only when relevant: **UGC (Guideline 1.2)** — filtering, reporting, blocking, published contact info, effective content-removal path; **Spam/differentiation (Guideline 4.3(b))** — only when the shipped experience appears indistinguishable from widely available products; **Apple services (Guideline 4.5.3)** — inspect actual triggers/content/stop controls for Live Activities used in messaging, never infer violation from API use alone. Report only applicable findings.
+
+### 4. Write the report (fixed structure)
+
+1. **Executive summary** (5–10 bullets): app purpose in one line, top 3 approval risks, top 3 fast wins.
+2. **Risk register** (table): Priority (P0 blocker / P1 high / P2 medium / P3 low) · Area · Finding · Why review might reject · Evidence (file, symbol, screen, config) · Recommendation · Effort (S/M/L) · Confidence (High/Med/Low).
+3. **Detailed findings** grouped by the areas above; each with what you saw, why it's an issue, concrete change, and how to verify.
+4. **Reviewer experience checklist:** install & launch, first-run clarity, required permissions, core feature access, purchase/restore path, links/support/legal pages, edge cases (offline, empty state).
+5. **Suggested "App Review Notes"** draft for App Store Connect: steps to reach key features, test account credentials (placeholders), unusual permission justifications, gated content + how to test IAP, demo mode.
+
+### 5. Fix pass (after the report, on request)
+
+- Hawkeye hands the prioritized register to **Shuri** for concrete fixes: code changes, permission-prompt/paywall/privacy wording samples, and a pre-submission checklist before re-riding the gate.
+
+## Severity definitions
+
+- **P0 — blocker:** very likely rejection, or app is non-functional for review.
+- **P1 — high:** common rejection reason or serious reviewer friction.
+- **P2 — medium:** risky pattern, unclear compliance, or quality concern.
+- **P3 — low:** polish and improvements.
+
+## Gate rule
+
+No submission to production channels (`wize-app-release-channels` prod) while any **P0 or P1** is open in the register. Re-run or swipe-pass with `WAIVED` (documented in the report) if the user accepts the residual risk. **Unverified** items are not violations — list the minimal evidence needed.

package/src/core-skills/module.yaml

@@ -31,10 +31,16 @@ skills:
   - code: wize-review-adversarial
     name: "Adversarial Review"
     description: "Red-team review of artifacts — challenges assumptions, surfaces edge cases."
+  - code: wize-subtract
+    name: "Subtract"
+    description: "Over-engineering-only review of a diff: what to delete, simplify, or replace with stdlib/native — ranked delete-list plus the net lines saved."
   - code: wize-spec
     name: "Spec"
     description: "Distills any intent input into a canonical five-field spec kernel + companions."
   - code: wize-pre-pr-check
     name: "Pre-PR Check"
     description: "Quando for abrir um Pull Request ou PR leia — gate local para lint, format, build e testes rápidos antes de submeter código."
+  - code: wize-debt
+    name: "Debt Ledger"
+    description: "Harvests every deliberate `wize-debt:` shortcut (ceiling + upgrade path) into one ledger so deferrals don't rot into \"never\"."
 

package/src/core-skills/wize-debt/skill.md

@@ -0,0 +1,89 @@
+---
+
+code: wize-debt
+description: "Use quando precisar colher os atalhos deliberados espalhados no código (marcadores wize-debt:) num ledger único, para que o adiamento não vire esquecimento permanente."
+name: Debt Ledger
+module: core
+status: ready
+---
+
+# Debt Ledger
+
+**Goal.** Every deliberate shortcut with a known ceiling is marked in code as a `wize-debt:` comment naming its ceiling and its upgrade path. This skill harvests every marker into one ledger, so a deferral can't quietly become permanent.
+
+Reads and reports. Changes nothing.
+
+## When to run
+
+- Before the retrospective (`wize-retrospective`) — the debt marker count is a sprint metric.
+- Before a release (`wize-release`).
+- When the user says "what did we defer", "list the shortcuts", "debt ledger", "what's marked wize-debt", "/wize-debt".
+
+## The marker
+
+```js
+// wize-debt: single-threaded — upgrade to a queue when the second worker lands
+```
+
+```
+# wize-debt: O(n²) scan — index it if the list passes ~10k rows
+```
+
+- **ceiling** — the limit we knowingly accepted (global lock, O(n²) scan, naive heuristic, in-memory only, retry-less call).
+- **upgrade path** — the trigger to revisit. Prefer an **event or threshold** ("when the second worker lands", "if rows pass 10k") over a date — a date rots silently.
+
+A deliberate shortcut **without** a marker is the real problem: nobody remembers it. Vague TODOs (`// TODO: improve this`) are not a ceiling and not an upgrade path — they are noise, and they do not belong in the ledger.
+
+## Steps
+
+### 1. Scan
+
+Grep the repo for the marker, skipping `node_modules`, `.git`, build output and vendored code:
+
+```bash
+grep -rnE '(#|//|<!--|/\*|--) ?wize-debt:' . \
+  --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=dist --exclude-dir=build
+```
+
+Each hit is one ledger row. The `wize-debt:` prefix keeps prose that merely mentions the convention out of the ledger.
+
+### 2. Build the ledger
+
+One row per marker, grouped by file:
+
+```
+<file>:L<line> — <what was simplified>. ceiling: <limit>. upgrade: <trigger>.
+```
+
+Optional owner per row, when the user asks for one:
+
+```bash
+git blame -L<line>,<line> --date=short -- <file> | head -1
+```
+
+### 3. Flag the rot
+
+Any marker that names no trigger gets the tag `no-trigger`. Those are the ones that silently rot — say so explicitly rather than hiding them in the list.
+
+### 4. Report
+
+End with the count:
+
+```
+<N> markers, <M> no-trigger.
+```
+
+Nothing found: `Clean ledger — no wize-debt markers.`
+
+Write it to `.wize/implementation/debt.md` **only when asked**; otherwise it is a one-shot report in the conversation.
+
+## Rules
+
+- **Read-only.** Never edits the code, never removes a marker, never "fixes" one. Revisiting a ceiling is a separate change with its own review.
+- **A marker is not a TODO.** The ledger tracks shortcuts with a named ceiling and trigger. Missing behavior, unfinished work, or "improve later" notes are not debt rows.
+- **`no-trigger` markers are the finding.** A ceiling with no upgrade path is the definition of rot — surface it, don't normalize it.
+- **Skip generated and vendored code.** Markers in `dist/`, `node_modules/`, or vendored trees are noise.
+
+## Hand-off
+
+> Debt ledger complete. `<N>` marker(s), `<M>` no-trigger. Next: feed the count into `wize-retrospective`, or fix a ceiling via `wize-quick-dev`.

package/src/core-skills/wize-subtract/skill.md

@@ -0,0 +1,91 @@
+---
+
+code: wize-subtract
+description: "Use quando um diff ou PR precisar de revisão focada em over-engineering — o que dá para deletar, simplificar ou trocar por stdlib/nativo, com a lista de cortes e o total de linhas economizáveis."
+name: Subtract
+module: core
+status: ready
+---
+
+# Subtract
+
+**Goal.** Review a diff with one lens only: **unnecessary complexity**. Answer the question the other review layers don't ask — *what can be deleted, and what replaces it?* The best outcome for a diff is that it gets shorter.
+
+This complements `wize-code-review` (correctness, edge cases, acceptance criteria) and `wize-tea-review` (AC fulfillment). Subtract hunts bloat. It **lists** findings; it does not apply them.
+
+## When to run
+
+- Before opening a PR, once the diff is complete.
+- As the **Subtraction Hunter** layer inside `wize-code-review` (runs on every code PR).
+- When the user says "review for over-engineering", "what can we delete", "is this too much code", "simplify this", "/wize-subtract".
+
+## When NOT to run
+
+- As a replacement for correctness or security review — those are out of scope here.
+- On generated code, vendored code, or lockfiles.
+- When the diff is already minimal: say so and stop (see "Clean diff").
+
+## Inputs
+
+- The diff (PR, branch, commit range, or staged changes).
+- Read access to the codebase — reuse claims must be verified, not guessed.
+
+## Output
+
+One line per finding, ranked by lines saved (biggest cut first):
+
+```
+path/to/file:L<line>: <tag> <what to cut>. <what replaces it>.
+```
+
+Tags:
+
+- `delete:` — dead code, unused flexibility, speculative feature. Replacement: nothing.
+- `stdlib:` — a hand-rolled thing the standard library ships. Name the function.
+- `native:` — a dependency or code doing what the platform/framework already does. Name the feature.
+- `yagni:` — an abstraction with one implementation, config nobody sets, a layer with one caller.
+- `shrink:` — same logic, fewer lines. Show the shorter form.
+
+End with the only metric that matters: `net: -<N> lines possible.`
+
+**Clean diff:** `Lean already. Ship.` and stop.
+
+## Rules
+
+- **One line per finding.** Location, what to cut, what replaces it. The review's own output obeys the ladder — no essays.
+- **Name the replacement.** "This looks complex" is not a finding. `stdlib:` must name the function; `native:` must name the feature; `yagni:`/`delete:` must name what already exists or state that nothing replaces it.
+- **Complexity only.** Correctness bugs, security holes, and performance problems are out of scope — route them to `wize-code-review`, don't smuggle them in here.
+- **Never flag the floor.** Tests on non-trivial logic are the kit's minimum, not bloat. Validation at trust boundaries, data-loss handling, security, accessibility, and anything explicitly requested are **never** on the chopping block.
+- **Verify before claiming.** "Already in this codebase" requires the existing helper/pattern to be named; "the stdlib does it" requires the function to exist in the target language/runtime.
+- **Read before cutting.** Trace the real flow the change touches. The shortest diff in the wrong place is not lazy — it's a second bug.
+- **Report only.** Do not apply the findings. Applying them is a separate, reviewable change (usually `wize-quick-dev`).
+
+## Steps
+
+### 1. Read the diff against the codebase
+
+For every hunk, know what it touches and who calls it. Claims about reuse need the surrounding code read, not recalled.
+
+### 2. Walk the ladder backwards
+
+For each hunk, stop at the first question that holds:
+
+1. Does this need to exist at all? → `delete:` (replacement: nothing).
+2. Does it duplicate something already here? → `yagni:` or `delete:`, naming the existing helper/pattern.
+3. Does the standard library do it? → `stdlib:`, naming the function.
+4. Does the platform or framework do it? → `native:`, naming the feature.
+5. Is a dependency doing one small thing? → `native:` / `shrink:`, naming what replaces it.
+6. Same logic in fewer lines? → `shrink:`, showing the shorter form.
+7. Is it configuration, an interface, or a layer with a single caller? → `yagni:`.
+
+### 3. Rank and totalize
+
+Sort by estimated lines removed (descending). Sum them: `net: -<N> lines possible.`
+
+### 4. Hand back
+
+Present the list as-is. Findings that contradict an explicit requirement or the safety floor are dropped out loud — say which and why, so the omission is visible.
+
+## Hand-off
+
+> Subtraction review complete for `{change}`. `{count}` finding(s), `net: -{N} lines possible.` Next: apply via `wize-quick-dev`, or continue to `wize-code-review` for correctness.

package/src/method-skills/4-implementation/wize-agent-dev/persona.md

@@ -11,6 +11,7 @@ I am **Shuri**. Wakandan technologist. I implement the story Tony wrote, against
 3. **Red → green → refactor.** Tests first; minimum code to pass; clean.
 4. **Security & perf.** I think about both at write-time, not at review-time.
 5. **Commit with AC IDs.** Every commit cites the story acceptance criteria it advances.
+6. **Subtract before I push.** Before opening the PR I run `/wize-subtract` on my own diff — my code climbs the ladder too, and the review's best outcome is a shorter diff.
 
 ## Before I write new code (the reuse ladder)
 
@@ -34,7 +35,7 @@ At the "green" step, before typing a new function, I walk this ladder in order a
 
 - I won't change architecture without an ADR from Tony.
 - I won't waive a Hawkeye gate without Wizer's approval logged.
-- I won't ship code with TODO comments left for someone else.
+- I won't ship a vague TODO for someone else. A **deliberate shortcut with a known ceiling** is a different thing: it gets a `wize-debt:` marker naming its ceiling and its upgrade trigger (harvested by `/wize-debt`) — or it doesn't ship.
 
 ## Quick-dev mode
 

package/src/method-skills/4-implementation/wize-code-review/steps/step-02-review.md

@@ -9,6 +9,7 @@ failed_layers: ''
 - Speak in `{communication_language}`.
 - The Blind Hunter subagent receives **only** the diff — no project context.
 - The Edge Case Hunter subagent receives the diff and project read access.
+- The Subtraction Hunter subagent receives the diff and project read access.
 - The Acceptance Auditor subagent receives the diff, spec, and context docs.
 - All review subagents run at the same model capability as the current session.
 
@@ -26,6 +27,9 @@ This step is an instance of Wizer's subagent fan-out pattern (see `wize-orchestr
    - **Edge Case Hunter** — receives `{diff_output}` and read access to the project. Invoke via `wize-review-edge-case-hunter`.
      Prompt: "Walk every branching path and boundary condition in this diff. Report only unhandled edge cases as a JSON array."
 
+   - **Subtraction Hunter** — receives `{diff_output}` and read access to the project. Invoke via `wize-subtract`.
+     Prompt: "Review this diff for over-engineering only. One line per finding: `path:L<line>: <tag> <what to cut>. <what replaces it>.` Tags: delete | stdlib | native | yagni | shrink. Rank by lines saved. End with `net: -<N> lines possible.` Never flag tests, validation, security, or accessibility."
+
    - **Acceptance Auditor** (only if `{review_mode}` = `"full"`) — receives `{diff_output}`, `{spec_file}` content, and context docs.
      Prompt: "Review this diff against the spec. Check for violations of acceptance criteria, deviations from spec intent, and missing behavior. Output findings as a Markdown list with AC/constraint reference and evidence."
 

package/src/method-skills/4-implementation/wize-code-review/steps/step-03-triage.md

@@ -10,11 +10,12 @@
 1. **Normalize** findings into a common format. Expected input formats:
    - Blind Hunter: Markdown list of descriptions.
    - Edge Case Hunter: JSON array with `location`, `trigger_condition`, `guard_snippet`, `potential_consequence`.
+   - Subtraction Hunter: Markdown list of `path:L<line>: <tag> <what to cut>. <what replaces it>.` plus a closing `net: -<N> lines possible.` Keep the tags (`delete`, `stdlib`, `native`, `yagni`, `shrink`) and the net total verbatim.
    - Acceptance Auditor: Markdown list with title, AC/constraint reference, and evidence.
 
    Convert all to a unified list with:
    - `id` — sequential integer
-   - `source` — `blind`, `edge`, `auditor`, or merged (`blind+edge`, etc.)
+   - `source` — `blind`, `edge`, `subtract`, `auditor`, or merged (`blind+edge`, etc.)
    - `title` — one-line summary
    - `detail` — full description
    - `location` — file and line reference if available
@@ -30,6 +31,11 @@
    - **defer** — pre-existing issue not caused by this change.
    - **dismiss** — noise, false positive, or handled elsewhere.
 
+   Classification of Subtraction Hunter findings:
+   - Cutting code **this diff introduced** → `patch`.
+   - Cutting pre-existing code the diff didn't touch → `defer` (record it; the change is out of scope for this PR).
+   - A cut that contradicts an explicit requirement or the safety floor (validation at trust boundaries, data-loss handling, security, accessibility, tests on non-trivial logic) → `dismiss`, and say which requirement protected it.
+
    If `{review_mode}` = `"no-spec"` and a finding would be `decision_needed`, reclassify as `patch` or `defer`.
 
 4. **Drop** all `dismiss` findings. Record the dismiss count.

package/src/method-skills/4-implementation/wize-code-review/steps/step-04-present.md

@@ -45,6 +45,8 @@ Code review complete.
 - dismissed: {R}
 ```
 
+When the Subtraction Hunter ran, add its metric on the following line: `Subtraction: {C} cut(s) proposed, net: -{N} lines possible.` Report it as a number, not a vibe — a diff that got shorter is a review outcome, not a style preference.
+
 If `{spec_file}` is set, add: "Findings written to `{spec_file}`."
 
 ### 4. Resolve decision_needed findings

package/src/method-skills/4-implementation/wize-code-review/workflow.md

@@ -57,7 +57,7 @@ This skill uses **step-file architecture**:
 ## Steps
 
 1. `step-01-gather-context.md` — identify the diff source, construct `{diff_output}`, set `{review_mode}` and `{spec_file}`.
-2. `step-02-review.md` — launch parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor).
+2. `step-02-review.md` — launch parallel review layers (Blind Hunter, Edge Case Hunter, Subtraction Hunter, Acceptance Auditor).
 3. `step-03-triage.md` — normalize, deduplicate, and classify findings into `decision_needed`, `patch`, `defer`, `dismiss`.
 4. `step-04-present.md` — present findings, resolve decisions, apply patches, update story status.
 

package/src/method-skills/4-implementation/wize-retrospective/workflow.md

@@ -26,6 +26,7 @@ Wizer facilitates. Hill enforces output discipline. Everyone (including Pepper,
 - All `gate.md` files from current sprint
 - `tea/nfr/{epic}.md` if an epic closed this sprint
 - Quick-dev log
+- Git history for the sprint window (tag range, or first → last commit)
 
 ## Output
 
@@ -57,6 +58,21 @@ Wizer reads the sprint dashboard from `sprint-status.md`:
 
 Stats anchor the retro in observations, not feelings.
 
+#### Code accounting (numbers, not adjectives)
+
+Measured from git over the sprint window. Report the numbers even when they look bad — especially then:
+
+| Metric | How to get it |
+|---|---|
+| Lines added / removed / net | `git diff --shortstat <base>..<head>` (base = last sprint's tag or first commit) |
+| Files touched | count of distinct files in the range: `git diff --name-only <base>..<head> \| wc -l` |
+| Dependencies | entries added/removed in the manifest diff (`package.json`, `composer.json`, `pyproject.toml`, `Cargo.toml`) |
+| New abstractions | modules, classes, or interfaces introduced by the sprint (count from the diff) |
+| Debt markers | `wize-debt:` added vs retired this sprint (run `/wize-debt`) |
+| Complexity | cyclomatic-complexity delta from `tea/nfr/{epic}.md` when an epic closed |
+
+Why this exists: the kit's discipline (reuse ladder, `/wize-subtract`, debt markers) is only verifiable with numbers. A sprint that ships 4 stories while adding 3k net lines and 6 dependencies is telling you something — say it out loud in the retro, and turn it into a change if it repeats.
+
 ### 2. Worked / didn't / surprised
 
 Each engineer brings 2–3 items per section, written in advance ideally. Time-box discussion: any item that takes > 3 min becomes a follow-up.
@@ -98,6 +114,13 @@ attendees: [Hill, Tony, Mantis, Pepper, Fury, Hawkeye, Shuri]
 - Blockers: 1 (vendor sandbox, resolved Day 5)
 - Carry-over to S8: 0
 
+## Code accounting
+- Lines: +1.842 / −2.310 (net −468) across 71 files
+- Dependencies: +1 (`zod`), −0
+- New abstractions: 2 (one repository interface, one mapper — both with a single implementation; flagged by `/wize-subtract`)
+- Debt markers: +3 added, −1 retired (2 with a trigger, 1 `no-trigger`)
+- Complexity: no NFR delta this sprint (no epic closed)
+
 ## Worked
 - Pairing on E03-S02 (auth refresh) — issue caught at integration test instead of in prod.
 - TEA design done at planning for R-3 stories paid off.

package/src/orchestrator-skills/wize/skill.md

@@ -91,7 +91,7 @@ When intent is ambiguous or no intent phrase matches, apply this heuristic top-d
 | 20 | All stories gated PASS/CONCERNS, no `ready-for-dev` left | Sprint ended → **Wizer / `wize-retrospective`** + **Pepper+Peggy / `wize-refresh-knowledge`** |
 | 21 | All gated, no new epic pulled | Plan next epic (Tony + Maria Hill), or a roadmap session |
 
-**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing`; security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
+**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing` / `wize-app-store-review` (publication gate, after listing, before prod go-live); security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
 
 ### Intent routing table
 

package/src/orchestrator-skills/wize-help/skill.md

@@ -104,7 +104,7 @@ When intent is ambiguous or no intent phrase matches, apply this heuristic top-d
 | 21 | Release tagged, retrospective not done | **Wizer / `wize-retrospective`** + **Pepper+Peggy / `wize-refresh-knowledge`** |
 | 22 | All gated, no new epic pulled | Plan next epic (Tony + Maria Hill), or a roadmap session |
 
-**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing`; security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
+**Overlay ship stages** (when the profile is active): web-overlay adds `wize-web-deploy` / `wize-web-seo-audit`; app-overlay adds `wize-app-release-channels` / `wize-app-store-listing` / `wize-app-store-review` (publication gate, after listing, before prod go-live); security-overlay adds `wize-sec-pentest` (recon → enumerate → SAST → DAST → report, gated by `.wize/security/scope.md`).
 
 ### Intent routing table
 

package/tools/check-skills-all-adapters.js

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+// Verifica que as skills core novas (wize-subtract, wize-debt) — e a wize-eli5 —
+// são renderizadas por TODOS os 11 adapters de harness.
+//
+// Uso:
+//   node tools/check-skills-all-adapters.js            # valida a lista padrão
+//   node tools/check-skills-all-adapters.js wize-grill # valida skills específicas
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+const KIT = path.resolve(__dirname, '..');
+
+// Skill code -> { dir, marker } — `dir` é o diretório esperado dentro de cada
+// adapter e `marker` a string que precisa aparecer no arquivo renderizado.
+const SKILLS = {
+  'wize-subtract': { dir: 'wize-subtract', marker: 'Subtraction Hunter' },
+  'wize-debt':     { dir: 'wize-debt',     marker: 'wize-debt:' },
+  'wize-eli5':     { dir: 'wize-eli5',     marker: 'Explain Like I Am 5' },
+};
+
+// Onde cada harness deposita uma skill `wize-{code}`.
+const ADAPTERS = [
+  { code: 'claude-code', path: (c) => `.claude/skills/${c}/SKILL.md` },
+  { code: 'antigravity', path: (c) => `.agent/skills/${c}/SKILL.md` },
+  { code: 'codex',       path: (c) => `.agents/skills/${c}/SKILL.md` },
+  { code: 'kimi-code',   path: (c) => `.kimi/skills/${c}/SKILL.md` },
+  { code: 'hermes',      path: (c) => `.hermes/skills/${c}/SKILL.md` },
+  { code: 'kiro',        path: (c) => `.kiro/skills/${c}/SKILL.md` },
+  { code: 'cursor',      path: (c) => `.cursor/rules/${c}.mdc` },
+  { code: 'windsurf',    path: (c) => `.windsurf/rules/${c}.md` },
+  { code: 'continue',    path: (c) => `.continue/prompts/${c}.prompt` },
+  { code: 'opencode',    path: (c) => `.opencode/commands/${c}.md` },
+  { code: 'generic',     path: (c) => `.wize/agents/${c}.md` },
+];
+
+const requested = process.argv.slice(2);
+const targets = requested.length ? requested : Object.keys(SKILLS);
+for (const code of targets) {
+  if (!SKILLS[code]) {
+    console.error(`Skill desconhecida: ${code}. Conhecidas: ${Object.keys(SKILLS).join(', ')}`);
+    process.exit(2);
+  }
+}
+
+let ok = 0, fail = 0;
+
+for (const skill of targets) {
+  const { marker } = SKILLS[skill];
+  console.log(`\n${skill} (marcador: "${marker}")`);
+
+  for (const a of ADAPTERS) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), `wize-${skill}-${a.code}-`));
+    try {
+      const mod = require(path.join(KIT, 'adapters', a.code, 'render.js'));
+      mod.render(KIT, root, { profiles: ['core'] });
+      const rel = a.path(skill);
+      const f = path.join(root, rel);
+      if (!fs.existsSync(f)) {
+        console.log(`  ✖ ${a.code.padEnd(11)} -> ${rel} NÃO foi gerado`);
+        fail++;
+        continue;
+      }
+      const content = fs.readFileSync(f, 'utf-8');
+      // O corpo da skill é o que precisa estar lá; o código `wize-{skill}` só
+      // aparece no frontmatter, que não é copiado por todos os adapters
+      // (cursor/windsurf/opencode/generic não carregam o code no arquivo).
+      if (content.includes(marker)) {
+        console.log(`  ✓ ${a.code.padEnd(11)} -> ${rel}`);
+        ok++;
+      } else {
+        console.log(`  ✖ ${a.code}: ${rel} existe mas não contém o corpo esperado ("${marker}")`);
+        fail++;
+      }
+    } catch (e) {
+      console.log(`  ✖ ${a.code}: erro ao renderizar — ${e.message}`);
+      fail++;
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  }
+}
+
+const total = targets.length * ADAPTERS.length;
+console.log(`\n${ok}/${total} renderizações OK (${targets.length} skill(s) × ${ADAPTERS.length} harnesses).`);
+process.exit(fail ? 1 : 0);

package/tools/installer/render-shared.js

@@ -303,6 +303,34 @@ function renderAgentsMd(kitRoot, projectRoot, opts = {}) {
     'implementation and review, a high-capability tier only for architecture, critical',
     'decisions, or final adversarial review.',
     '',
+    '## Writing code (always on)',
+    '',
+    'Before writing new code, climb this ladder and stop at the first rung that holds:',
+    '',
+    '1. Does this need to exist? → no: skip it (YAGNI).',
+    '2. Already in this codebase? → reuse the helper, util, or pattern; don\'t rewrite it.',
+    '3. Does the standard library do it? → use it.',
+    '4. Does a platform or framework feature cover it? → use it.',
+    '5. Does an already-installed dependency solve it? → use it.',
+    '6. Is it one line? → write the one line.',
+    '7. Only then: the minimum code that works.',
+    '',
+    'The ladder runs **after** you understand the problem: read the code the change touches and',
+    'trace the real flow before picking a rung.',
+    '',
+    '- No abstractions, configuration, or boilerplate nobody asked for. No new dependency if it can be avoided.',
+    '- Deletion over addition. Boring over clever. Fewest files possible.',
+    '- Bug fix = root cause, not symptom: grep every caller of the function you touch and fix the shared function once.',
+    '- The shortest working diff wins — but only once you understand the problem.',
+    '',
+    'Lazy, not negligent — never on the chopping block: input validation at trust boundaries,',
+    'error handling that prevents data loss, security, accessibility, tests on non-trivial logic,',
+    'and anything explicitly requested.',
+    '',
+    'A deliberate shortcut with a known ceiling gets a `wize-debt:` comment naming the ceiling and',
+    'the upgrade trigger, so it can be harvested later with `/wize-debt`. Before a PR, run',
+    '`/wize-subtract` on the diff — the best review outcome is a shorter diff.',
+    '',
     '## Roster',
     ''
   ];

package/tools/installer/validators/run-all.js

@@ -28,6 +28,14 @@ function checkWorkflow(file) {
   if (!/^name:/m.test(content))      errs.push('missing "name:"');
   if (!/^owner:/m.test(content) && !/^module:/m.test(content)) errs.push('missing "owner:" or "module:"');
   if (!/^description:/m.test(content)) errs.push('missing "description:"');
+  // The kit's parser (readFrontmatter) reads a double-quoted scalar with
+  // /^"([^"]*)"$/, so an escaped quote inside the value (\" or \') breaks it:
+  // the value is parsed with its wrapping quotes and re-escaped on render.
+  // Write descriptions without inner quotes instead.
+  const dm = content.match(/^description:\s*"(.*)"\s*$/m);
+  if (dm && /\\["']/.test(dm[1])) {
+    errs.push('description contains escaped quotes (\\" or \\\') — the kit parser does not support them; rewrite without quotes');
+  }
   return errs;
 }