wize-dev-kit 0.23.0 → 0.25.0

package/CHANGELOG.md

@@ -7,6 +7,41 @@ Format inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 > **0.10.0 and earlier are in Brazilian Portuguese** and are kept verbatim as a
 > historical record (not back-translated).
 
+## [0.25.0] — 2026-10-19
+
+**Writing hygiene.** `wize-no-ai-slop` stops at the README: the commit messages, PR bodies, code comments and review replies an agent writes get the same pass, and the pattern list gains the one tell it was missing. Ideas from [unslop](https://github.com/michaelshimeles/skills/tree/main/unslop) by Lauren Tan (MIT), rewritten in kit voice; none of its rule text is copied.
+
+### Added
+
+- **Dev text scope in `wize-no-ai-slop`** — a short "Dev text" section: the subject says what changed in plain words, the body gives the why with a mechanism or number, no chatbot closers, no "This PR enhances" puffery, and prose the agent did not write is never touched. Conventional Commits and the dev-story PR template stay as they are. Shuri (`wize-agent-dev`) now carries the skill.
+- **Pattern 18, chatbot artifacts and sycophancy** — "I hope this helps", "Certainly!", "Great question", "Let me know if"; stacked hedges collapse to one.
+- **Advisory line in `wize-pre-pr-check`** — when a commit range or PR draft exists, run detect mode on commit subjects and the PR title/body. Reports only; never fails the gate.
+- Credit for unslop in the skill header and in the 3 READMEs, next to the No AI Slop entry.
+- `test/writing-hygiene.test.js` guards the rules.
+
+### Changed
+
+- **`wize-no-ai-slop` Goal** — only PRD, ADR, story and gate keep their own conventions; agent-written dev text is in scope. The self-check says "the patterns above" instead of a hard-coded count (module catalog now says 18). The module catalog entry and the README command line mention commit and PR text.
+- **Principles** — new "Name the actor" line (`is`/`are`/`was` + participle hides who did it; an adverb propping a weak verb means the measured delta is missing). **Pattern 16** — a bold label plus colon that restates the line is a tell; a bold lead-in ending in a period with new detail is fine.
+
+## [0.24.0] — 2026-10-19
+
+**Ship discipline.** The kit already demanded proof and a clean gate; this release defines what proof is, where it lives and which commit it belongs to, and makes the implementation flows start on a branch instead of assuming one. Ideas from [michaelshimeles/skills](https://github.com/michaelshimeles/skills), rewritten in kit voice.
+
+### Added
+
+- **Branch guard** in `wize-dev-story` (step 0) and `wize-quick-dev` (step 1.5) — read the current branch and status, resolve the default branch with `git symbolic-ref refs/remotes/origin/HEAD` (no hardcoded `main`), keep any other branch or assigned worktree, and on the default branch create `feat/<story-id>` / `fix/<slug>` (or the repo's own convention). No remote: branch locally.
+- **Proof per change type in `wize-dev-story` step 10** — UI screenshots/recording, CLI/API/perf command output with measured numbers, bug-fix red run plus a captured before-state, docs content and link check. Each proof is labeled with its AC and `passed`/`failed`/`untested` (`untested` needs a reason); UI before/after comes from a pre-change baseline, never a branch switch or stash. Step 9 self-check points at it; `wize-quick-dev` asks for before/after on an observable bug fix.
+- **Hosting and privacy rule for captures** — attach through the PR host's own channel or a CI artifact, never anonymous or public third-party hosts or env-supplied upload endpoints; capture with seeded or fake data and check for PII, tokens, internal URLs and admin screens first. Mirrored as a `wize-pre-pr-check` anti-pattern.
+- **Success-path capture in the Playwright playbook** — a `review` project/tag with always-on screenshot and video, and a `try/finally` context close so the video finalizes even when an assertion fails.
+- **Two lines in the generated `AGENTS.md` Operating context** — a request for a plan, review or investigation never implies editing, pushing or publishing; and the shared-repo rules (one branch or worktree per agent, never touch another agent's uncommitted work, no force-push of the default branch, `--force-with-lease` only on your own branch, regenerate lockfiles instead of hand-merging, stop and report on an unresolvable conflict). Existing installs: delete the kit-generated `AGENTS.md` and re-run `npx wize-dev-kit sync` to regenerate it (the file is skip-if-exists).
+- `test/ship-discipline.test.js` guards the core rules.
+
+### Changed
+
+- **TEA evidence is pinned to a commit.** `wize-tea-review` records `evidence` as the artifact or test id plus the commit SHA it was observed on, points at the dev-story proof-per-type block as the single definition of observed evidence, and rejects evidence from a commit other than HEAD. `wize-tea-gate` adds a row — all ACs `met` but evidence unpinned or stale → `CONCERNS` (advisory) / `FAIL` (enforcing) — and counts an `untested` AC as `not-met` unless `WAIVED` with a reason. `wize-check` names the commit in its evidence rule. Gate frontmatter status values are unchanged.
+- **`wize-pre-pr-check` rebases before the push** onto the latest `origin` default branch and re-runs the fast checks; a force push is `--force-with-lease` on your own task branch only, never plain `--force`, never on the default branch or a shared branch.
+
 ## [0.23.0] — 2026-10-19
 
 ### Added

package/README.es.md

@@ -164,7 +164,8 @@ Transversales:
                                 paso de autoría.
     /wize-no-ai-slop            Higiene de escrita para texto de usuario final:
                                 elimina patrones de "AI slop" y palabras de relleno
-                                preservando la voz del autor. También detecta slop.
+                                preservando la voz del autor; cubre también commits y PRs.
+                                También detecta slop.
     /wize-quick-dev             Shuri toma un arreglo pequeño sin el ciclo completo.
     /wize-pre-pr-check          Corre lint/format/build/tests unitarios localmente
                                 antes de abrir un PR — falla rápido, cero costo de runner.
@@ -283,6 +284,7 @@ npx wize-dev-kit version-check [--json]  # instalada vs. más reciente (con cach
 - [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) por Brian (BMad) Madison — ciclo ágil de IA, personas de agentes, patrón de instalador, sistema de módulos.
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — metodología UX-first, panteón nórdico (Saga, Freya), estructura de fases.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) por Peter Yang — higiene de escrita que elimina patrones de AI slop sin aplanar la voz del autor; la inspiración para `/wize-no-ai-slop`.
+- [unslop](https://github.com/michaelshimeles/skills/tree/main/unslop) por Lauren Tan (MIT) — chequeos de artefactos de chatbot, de actor oculto y de listas con etiqueta en negrita en `/wize-no-ai-slop`; ideas adaptadas, sin texto copiado.
 - [apple-appstore-reviewer (awesome-copilot)](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — auditoría con mentalidad de reviewer para la submisión a App Store; la inspiración para `wize-app-store-review` (gate de publicación del overlay).
 - [ELI5](https://github.com/dreambigou/eli5) por Andrew Ou — explicaciones calibradas al oyente; inspiración de `/wize-eli5`.
 - [Ponytail](https://github.com/DietrichGebert/ponytail) por Dietrich Gebert — revisión orientada a la eliminación (`/wize-subtract`), el marcador de atajo `wize-debt:` con su ledger, y el encuadre medido de "menos código" detrás de la contabilidad de código de la retrospectiva. La reuse ladder del kit comparte los mismos peldaños.

package/README.md

@@ -164,7 +164,8 @@ Cross-cutting:
                                 (age, role, relationship).
     /wize-no-ai-slop            Writing hygiene for end-user-facing prose: removes
                                 AI-slop patterns and filler while preserving the
-                                writer's voice. Detects slop on request.
+                                writer's voice, and agent-written commit/PR text.
+                                Detects slop on request.
     /wize-quick-dev             Shuri takes a small fix without the full ride.
     /wize-pre-pr-check          Run lint/format/build/unit tests locally before
                                 opening a PR — fail fast, zero CI runner cost.
@@ -282,6 +283,7 @@ npx wize-dev-kit version-check [--json]  # installed vs latest (cached; scriptab
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — UX-first methodology, Norse pantheon (Saga, Freya), phase structure.
 - [ELI5](https://github.com/dreambigou/eli5) by Andrew Ou — audience-calibrated explanations; the inspiration for `/wize-eli5`.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) by Peter Yang — writing hygiene that removes AI-slop patterns without flattening the writer's voice; the inspiration for `/wize-no-ai-slop` (Peggy Carter & Mantis apply it to end-user-facing prose).
+- [unslop](https://github.com/michaelshimeles/skills/tree/main/unslop) by Lauren Tan (MIT) — chatbot-artifact, actor-hiding and inline-header-list checks in `/wize-no-ai-slop`; ideas adapted, no text copied.
 - [awesome-copilot's apple-appstore-reviewer](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — reviewer-mindset audit for App Store submission; the inspiration for `wize-app-store-review` (the app-overlay publication gate).
 - [Ponytail](https://github.com/DietrichGebert/ponytail) by Dietrich Gebert — deletion-first review (`/wize-subtract`), the `wize-debt:` shortcut marker and its ledger, and the measured "less code" framing behind the retrospective's code accounting. The kit's reuse ladder shares its rungs.
 - [akitaonrails's my-skills — pr-audit](https://github.com/akitaonrails/my-skills/tree/master/pr-audit) by Fabio Akita — untrusted-input PR threat model, claim ledger, and hostile-change gate before execution; the reference behind `wize-pr-audit`.

package/README.pt-BR.md

@@ -166,7 +166,8 @@ Transversais:
                                 para o ouvinte (idade, papel, relação).
     /wize-no-ai-slop            Higiene de escrita para texto de usuário final:
                                 remove padrões de "AI slop" e palavras de enchimento
-                                preservando a voz do autor. Também detecta slop.
+                                preservando a voz do autor; cobre também commits e PRs.
+                                Também detecta slop.
     /wize-quick-dev             Shuri pega uma correção pequena sem o ciclo completo.
     /wize-pre-pr-check          Roda lint/format/build/testes unitários localmente
                                 antes de abrir um PR — falha cedo, zero custo de runner.
@@ -284,6 +285,7 @@ npx wize-dev-kit version-check [--json]  # instalada vs. mais recente (com cache
 - [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) por Brian (BMad) Madison — ciclo ágil de IA, personas de agentes, padrão de instalador, sistema de módulos.
 - [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — metodologia UX-first, panteão nórdico (Saga, Freya), estrutura de fases.
 - [No AI Slop](https://github.com/petergyang/no-ai-slop) por Peter Yang — higiene de escrita que elimina padrões de AI slop sem achatar a voz do autor; a inspiração para `/wize-no-ai-slop`.
+- [unslop](https://github.com/michaelshimeles/skills/tree/main/unslop) por Lauren Tan (MIT) — checagens de artefatos de chatbot, de ator oculto e de listas com rótulo em negrito no `/wize-no-ai-slop`; ideias adaptadas, sem texto copiado.
 - [apple-appstore-reviewer (awesome-copilot)](https://github.com/github/awesome-copilot/blob/main/skills/apple-appstore-reviewer/SKILL.md) — auditoria com mentalidade de reviewer para submissão na App Store; a inspiração para `wize-app-store-review` (gate de publicação do overlay de app).
 - [ELI5](https://github.com/dreambigou/eli5) por Andrew Ou — explicações calibradas ao ouvinte; inspiração do `/wize-eli5`.
 - [Ponytail](https://github.com/DietrichGebert/ponytail) por Dietrich Gebert — revisão orientada a deleção (`/wize-subtract`), o marcador de atalho `wize-debt:` com seu ledger, e o enquadramento medido de "menos código" por trás da contabilidade de código da retrospectiva. A reuse ladder do kit compartilha os mesmos degraus.

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "wize-dev-kit",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Full-lifecycle AI-assisted development kit with Test Architect and Whiteport Design Studio embedded. Inspired by BMAD Method and WDS.",
   "keywords": [
     "ai",

package/src/core-skills/module.yaml

@@ -21,7 +21,7 @@ skills:
     description: "Explain anything to anyone — adapts vocabulary, analogies, tone, depth and framing to the audience (age, role, relationship)."
   - code: wize-no-ai-slop
     name: "No AI Slop"
-    description: "Writing hygiene for end-user-facing prose — removes 17 AI-generated patterns and banned words while preserving the writer's voice; also detects slop without rewriting."
+    description: "Writing hygiene for end-user prose and agent-written commits and PRs — removes 18 AI-generated patterns and banned words while preserving the writer's voice; also detects slop without rewriting."
   - code: wize-brainstorming
     name: "Brainstorming"
     description: "Divergent-then-convergent ideation; produces idea-pool.md."

package/src/core-skills/wize-no-ai-slop/skill.md

@@ -1,6 +1,6 @@
 ---
 code: wize-no-ai-slop
-description: "Use quando qualquer agente for escrever ou editar texto para usuário final — READMEs, runbooks, microcopy, release notes, UX copy — para remover padrões de 'AI slop' sem achatar a voz do autor. Também detecta slop em rascunhos sem reescrever."
+description: "Use quando qualquer agente for escrever ou editar texto para usuário final — READMEs, runbooks, microcopy, release notes, UX copy — ou texto de dev (commits, PRs) para remover padrões de 'AI slop' sem achatar a voz do autor. Também detecta slop em rascunhos sem reescrever."
 name: No AI Slop
 module: core
 status: ready
@@ -8,9 +8,9 @@ status: ready
 
 # No AI Slop — human writing hygiene
 
-**Goal.** End-user-facing prose (READMEs, runbooks, release notes, UX microcopy, docs, announcements) that reads like a sharp human wrote it — not like a model's default register. Remove AI-generated patterns without flattening the writer's personal voice. This is a hygiene pass every Wize agent applies when the reader is outside the team; internal artifacts (PRD, ADR, gate) keep their own conventions.
+**Goal.** End-user-facing prose (READMEs, runbooks, release notes, UX microcopy, docs, announcements) that reads like a sharp human wrote it — not like a model's default register. Remove AI-generated patterns without flattening the writer's personal voice. This is a hygiene pass every Wize agent applies when the reader is outside the team, and to the dev text an agent writes itself: commit messages, PR titles and bodies, code comments, review replies. PRD, ADR, story and gate keep their own conventions.
 
-Adapted to the Wize method from [no-ai-slop](https://github.com/petergyang/no-ai-slop) by Peter Yang (MIT) — credited in the README.
+Adapted to the Wize method from [no-ai-slop](https://github.com/petergyang/no-ai-slop) by Peter Yang (MIT) and, for the chatbot-artifact, actor and inline-header-list checks, [unslop](https://github.com/michaelshimeles/skills/tree/main/unslop) by Lauren Tan (MIT) — credited in the README.
 
 ## Two jobs
 
@@ -32,6 +32,7 @@ Adapted to the Wize method from [no-ai-slop](https://github.com/petergyang/no-ai
 - **Every sentence earns its place.** Cut empty qualifiers and throat-clearing.
 - **Active voice, human subjects.** "The team shipped it Tuesday" beats "the decision emerged". Never let inanimate things do human verbs.
 - **Verbs do the work.** "Made a decision" → "decided". "Has the ability to" → "can". Prefer plain `is`/`has` over fake-strong verbs ("serves as a hub").
+- **Name the actor.** `is`/`are`/`was` + participle hides who did it ("the config was updated" → "Maria updated the config"). An adverb propping a weak verb ("greatly improved") means the measured delta is missing; use it.
 - **Concrete beats abstract.** "Improved efficiency" → "cut deploy time from 40 min to 4". Names, numbers, dates, mechanisms, examples.
 - **Portability test.** A sentence that could move unchanged to another company or product is filler — cut it or replace it with something specific to this subject.
 - **Show, don't label.** Make facts carry the emphasis; delete commentary that tells the reader a point is important, surprising, or obvious.
@@ -61,8 +62,13 @@ Adapted to the Wize method from [no-ai-slop](https://github.com/petergyang/no-ai
 13. **Rhetorical setups** — "What if I told you…", "Think about it:", self-answered "Question? Answer."
 14. **Fake-profound kickers** — delete the cute final line; end on the clearest concrete sentence, takeaway, or next action.
 15. **Summary-recap endings** — "In conclusion", "Ultimately", restating the piece.
-16. **Formatting slop** — emoji in headings, bold sprinkled mid-sentence, bullets where two sentences of prose read better, headers over two-sentence sections.
+16. **Formatting slop** — emoji in headings, bold sprinkled mid-sentence, bullets where two sentences of prose read better, headers over two-sentence sections. In inline-header lists, a bold label plus colon that restates the line ("**Speed:** it is faster") is a tell; a bold lead-in ending in a period that opens new detail is fine.
 17. **Em dashes as a rhythm crutch** — none in short copy; 1–2 in long drafts only when they clearly beat commas or parentheses.
+18. **Chatbot artifacts and sycophancy** — "I hope this helps", "Certainly!", "Great question", "Let me know if…". Delete. Stacked hedges ("could potentially possibly") collapse to one: "may".
+
+## Dev text
+
+Commit messages, PR titles and bodies, code comments and review replies the agent wrote are in scope. The subject says what changed in plain words; the body gives the why, with a mechanism or number. No chatbot closers, no "This PR enhances…" puffery. Conventional Commits format and the dev-story PR template stay as they are. Never touch prose the agent did not write.
 
 ## Self-check (eval)
 
@@ -71,7 +77,7 @@ Before handing off end-user prose, answer:
 - Does it preserve the writer's point, voice, and useful edge — without invented claims? (pass/fail)
 - Is cutting proportional, leaving strong human sentences alone? (pass/fail)
 - Does every generic sentence survive the portability test? (pass/fail)
-- Are banned words, filler phrases, and the 17 patterns absent? (pass/fail)
+- Are banned words, filler phrases, and the patterns above absent? (pass/fail)
 - Would the writer recognize it as their own voice when read to a sharp colleague? (pass/fail)
 
 If any check fails, fix and re-check before returning the draft.

package/src/core-skills/wize-pre-pr-check/skill.md

@@ -95,6 +95,10 @@ Comandos típicos por stack (detectados em tempo real, não hardcoded):
 
 Se um check falhar, pare e reporte. Não prossiga para o próximo.
 
+Consultivo, nunca bloqueia: se já existir intervalo de commits ou rascunho de PR, rode o modo detect de `wize-no-ai-slop` nos assuntos dos commits e no título/corpo do PR e reporte os padrões achados.
+
+Antes do push: faça rebase na última branch default do `origin` e rode de novo os checks rápidos. Se precisar de force push, use `--force-with-lease` só na sua própria branch de tarefa — nunca `--force` puro, nunca na branch default ou em branch compartilhada.
+
 ### 4. Reportar
 
 Formato compacto, uma linha por check:
@@ -125,6 +129,7 @@ Gate limpo. Pode abrir o PR.
 - **Ignorar falhas de lint.** Lint fail = PR fail. Corrija antes.
 - **Executar E2E localmente toda vez.** E2E é caro; deixe para o CI ou rode antes de merge.
 - **Substituir o CI.** Este gate é complementar, não substituto.
+- **Mudança de UI com capturas não revisadas.** Prints e gravações podem vazar PII, tokens ou URLs internas; confira antes de anexar.
 
 ## Hand-off
 

package/src/method-skills/4-implementation/wize-agent-dev/agent.yaml

@@ -22,6 +22,7 @@ skills:
   - wize-quick-dev
   - wize-code-review
   - wize-pr-audit
+  - wize-no-ai-slop           # commit and PR text hygiene
   - wize-retrospective
 
 inputs:

package/src/method-skills/4-implementation/wize-dev-story/workflow.md

@@ -39,6 +39,10 @@ I work inside a repo with WDK installed: `.wize/`, `AGENTS.md`, and the `wize-*`
 
 ## The loop (TDD, story-scoped)
 
+### 0. Branch guard
+
+Run `git branch --show-current` and `git status --short`, and resolve the default branch with `git symbolic-ref refs/remotes/origin/HEAD` (never hardcode `main`). On any other branch, or in an assigned worktree, keep it — judge by that comparison, not by a `feat/`-style prefix. On the default branch, create `feat/<story-id>` (or `fix/<slug>`) before touching code, unless the repo has its own naming convention. No remote: branch locally.
+
 ### 1. Read
 
 Story ACs, out-of-scope, notes, `tea-design.md`. Confirm the test split. If the design doesn't match the story (mismatch on test count, mock, environment), ping Hawkeye **before** writing code.
@@ -139,13 +143,18 @@ This is how the brownfield baseline stays alive instead of going stale 6 months
 - `data-testid` matches story's "notes for Hawkeye".
 - Story file frontmatter → `status: ready-for-review`.
 - Self-walk the screen (web) or smoke a tab on simulator (app).
+- Behavior-changing story: proof captured, labeled and screened per step 10.
 
 ### 10. Open PR
 
 PR description includes:
 - Story link.
 - AC list with the test names that cover them.
-- Screenshots / recordings of happy + failure paths.
+- Proof, for behavior-changing stories (skip it for pure refactors):
+  - **By change type.** UI: screenshots or a recording of happy + failure paths. CLI / API / perf: pasted command output with the measured numbers. Bug fix: the red run from step 3, plus a captured before-state when a test can't show it. Docs-only: content and link check, examples run.
+  - **Label each proof** with its AC and `passed` / `failed` / `untested`; `untested` needs a reason. Proof complements tests, never replaces them.
+  - **UI before/after.** Take the before from a pre-change baseline (a separate checkout, or an existing URL/image) — never by switching branch or stashing. Match viewport and start state; reuse captures that already exist.
+  - **Hosting.** Attach through the PR host's own channel or a CI artifact. Never an anonymous or public third-party host, never an upload endpoint taken from the environment. Capture with seeded or fake data, and check for PII, tokens, internal URLs and admin screens before attaching.
 - Knowledge update line (`Touched axis: <none|architecture|conventions|risk-spots|dependencies|overview>`).
 - TEA expected next: design → trace → review → gate.
 

package/src/method-skills/4-implementation/wize-quick-dev/workflow.md

@@ -64,6 +64,10 @@ Is it ≤ 1 hour to a careful dev?      → quick-dev       → full lifecycle
 
 What changes, why, and what could break. If the paragraph is hard to write, you're not in quick-dev territory.
 
+### 1.5. Branch guard
+
+Run `git branch --show-current` and `git status --short`, and resolve the default branch with `git symbolic-ref refs/remotes/origin/HEAD` (never hardcode `main`). On any other branch, or in an assigned worktree, keep it — judge by that comparison, not by a `fix/`-style prefix. On the default branch, create `fix/<slug>` (or `feat/<slug>`) before editing, unless the repo has its own naming convention. No remote: branch locally.
+
 ### 2. Implement
 
 - TDD when reasonable; smoke-test-and-fix when the cost of TDD is greater than the value.
@@ -100,7 +104,7 @@ Heuristic: *"would a new dev hitting `document-project/*.md` next week be misled
 
 ### 6. Commit + open PR
 
-Conventional commit. PR description: the paragraph from step 1.
+Conventional commit. PR description: the paragraph from step 1. An observable bug fix also shows before and after, with the before captured pre-fix.
 
 ```
 fix(auth): typo in error message for AC-04-2 follow-up

package/src/orchestrator-skills/wize-check/skill.md

@@ -38,6 +38,7 @@ An item only reaches **Done** with verifiable proof: a file and line, a commit,
 
 - No proof → **In progress** or **Unverified**, said out loud.
 - Intent, a plan, or "I implemented it" are not evidence.
+- Evidence names the commit it was observed on; a result from an older commit is stale, so the item stays `[~]`.
 - If something was written but not validated, the item is `[~]` with the missing validation named next to it.
 
 Overstating progress is the one serious failure mode of this skill.

package/src/tea-skills/wize-tea-gate/workflow.md

@@ -38,8 +38,11 @@ Hawkeye drives. The four inputs (`design`, `trace`, `review`, plus `nfr` at epic
 | Any AC `not-met` | **FAIL** |
 | NFR `FAIL` on the epic (last story) | **FAIL** |
 | `tea-review` flagged `knowledge_axes_touched` ≠ `knowledge_axes_updated` (any axis touched without update) | **CONCERNS** (advisory mode) / **FAIL** (enforcing mode) — adds finding `KN-NN` |
+| All ACs `met`, but `review.md` evidence is unpinned (no commit SHA) or from a commit other than HEAD | **CONCERNS** (advisory mode) / **FAIL** (enforcing mode) |
 | Failing AC OR non-neg NFR with documented business rationale + senior signoff | **WAIVED** |
 
+An AC the story left `untested` counts as `not-met`, unless **WAIVED** with a reason.
+
 Score (0–100): heuristic. `100 - (10 × high) - (5 × medium) - (2 × low)`. Floor 0.
 
 ## Policy

package/src/tea-skills/wize-tea-review/workflow.md

@@ -31,7 +31,7 @@ Hawkeye drives. Runs at story end, right before `tea-gate`.
 
 ### 1. AC check (per AC)
 
-For each AC, observe the actual behavior on a staging or local build and decide: `met` / `partial` / `not-met`. Use the recorded video/screenshot when CI captured one (Playwright `screenshot: only-on-failure` or always for review tag).
+For each AC, observe the actual behavior on a staging or local build and decide: `met` / `partial` / `not-met`. Record the `evidence` as the artifact or test id **plus the commit SHA it was observed on**. What counts as observed evidence is defined once, in the proof-per-type block of `wize-dev-story` step 10; for UI ACs, prefer a before/after pair when a baseline exists.
 
 ### 2. Test discipline
 
@@ -83,10 +83,10 @@ status: PASS
 ac_check:
   - id: AC-02-1
     met: true
-    evidence: "e2e/onboarding/invite.spec.ts::happy path passed on PR-#412; recording in CI artifact #412-1"
+    evidence: "e2e/onboarding/invite.spec.ts::happy path passed @ 4f2a9c1 (PR-#412); recording in CI artifact #412-1"
   - id: AC-02-2
     met: true
-    evidence: "InviteForm.spec.tsx::error region announces"
+    evidence: "InviteForm.spec.tsx::error region announces @ 4f2a9c1"
 knowledge_axes_touched: [conventions, risk-spots]
 knowledge_axes_updated: [conventions, risk-spots]   # leave empty array if axes touched but no update happened
 findings:
@@ -136,6 +136,7 @@ Recommend `gate PASS` with one low-severity finding to fix in a follow-up.
 
 - **Review without walking the code.** Reading the test names isn't review.
 - **AC marked "met" without observed evidence.** Tests passing + screenshot/recording, please.
+- **Evidence from a commit other than HEAD.** Re-observe on HEAD.
 - **Findings without owners.** Same as everywhere else in the kit.
 - **Recommending PASS when an AC is `partial`.** No.
 - **Recommending PASS when a non-negotiable NFR slipped.** That's a gate FAIL.

package/src/web-overlay/playbooks/playwright-vitest.md

@@ -110,6 +110,23 @@ export default defineConfig({
 });
 ```
 
+### Capturing proof (success path)
+
+The config above records failures only. For review evidence, scope always-on capture to a project (or tag) so the full suite stays cheap:
+
+```ts
+{ name: 'review', grep: /@review/, use: { ...devices['Desktop Chrome'], screenshot: 'on', video: 'on' } }
+```
+
+Outside the test runner, close the context in `finally` so the video finalizes even when an assertion throws:
+
+```ts
+const context = await browser.newContext({ recordVideo: { dir: 'test-results/proof' } });
+try { /* walk the flow, assert */ } finally { await context.close(); }
+```
+
+Write captures to a gitignored directory and attach them per the hosting rule in `wize-dev-story` step 10. `reuseExistingServer: true` will happily record someone else's app, so confirm the server on the port is your build first.
+
 ### Page Object Model (light)
 
 ```ts

package/tools/installer/render-shared.js

@@ -307,6 +307,12 @@ function renderAgentsMd(kitRoot, projectRoot, opts = {}) {
     'implementation and review, a high-capability tier only for architecture, critical',
     'decisions, or final adversarial review.',
     '',
+    'A request for a plan, review or investigation never implies editing, pushing or publishing.',
+    '',
+    'If several agents share a repo: one branch or worktree per agent; never touch another agent\'s',
+    'uncommitted work; never force-push the default branch (`--force-with-lease` only on your own',
+    'branch); regenerate lockfiles instead of hand-merging; on an unresolvable conflict, stop and report.',
+    '',
     '## Writing code (always on)',
     '',
     'Before writing new code, climb this ladder and stop at the first rung that holds:',