wize-dev-kit 0.7.3 → 0.8.1

package/AGENTS.md

@@ -2,7 +2,7 @@
 
 This repo is wired with the [`wize-dev-kit`](https://www.npmjs.com/package/wize-dev-kit).
 Detailed artifacts live under `.wize/`. The agents below are activated through your AI IDE
-using slash commands (Claude Code, Codex, Cursor, Windsurf, Antigravity all read this file).
+using slash commands (Codex, Cursor, Windsurf, Antigravity all read this file).
 
 ## Roster
 

package/ARCH.md

@@ -9,7 +9,7 @@
 ## 1. Identidade
 
 - **Nome do pacote npm:** `wize-dev-kit`
-- **CLI:** `wize-dev-kit` (subcomandos: `install`, `update`, `uninstall`, `agent`, `workflow`, `sync`)
+- **CLI:** `wize-dev-kit` (subcomandos: `install`, `update`, `uninstall`, `list`, `sync`, `agent`, `workflow`, `validate`, `doctor`, `document-project`)
 - **Namespace de arquivos/agentes/skills:** `wize-*`
 - **Licença:** MIT — open-source desde o dia 1.
 - **Tema visual do roster:** Marvel.
@@ -19,15 +19,16 @@
 
 ## 2. Modelo de distribuição
 
-**1 pacote, 3 perfis selecionáveis, overlays combináveis.**
+**1 pacote, 4 perfis selecionáveis, overlays combináveis.**
 
 ```
 wize-dev-kit (pacote npm)
 │
 ├── Wize Dev Core      ← base completa (sempre instalada)
 ├── Wize Web Dev       ← overlay opt-in
-└── Wize App Development ← overlay opt-in
-                     (Web + App podem coexistir no mesmo repo)
+├── Wize App Development ← overlay opt-in
+└── Wize Security Overlay ← overlay opt-in (AI Pentester / red-teamer)
+                     (overlays podem coexistir no mesmo repo)
 ```
 
 - Selecionar perfil no installer aplica Core + overlay correspondente.
@@ -36,7 +37,7 @@ wize-dev-kit (pacote npm)
 
 ---
 
-## 3. Roster final (9 personas Marvel)
+## 3. Roster final (9 core personas + 1 overlay persona)
 
 | Persona | Code | Papel | Fase principal |
 |---|---|---|---|
@@ -49,6 +50,7 @@ wize-dev-kit (pacote npm)
 | Tony Stark | `wize-agent-architect` | System Architect | 3 (Solutioning) |
 | Hawkeye | `wize-agent-test-architect` | Test Architect (TEA) | Gates 2/3/4 |
 | Shuri | `wize-agent-dev` | Senior Developer | 4 (Implementation) |
+| red-teamer | `wize-sec-red-teamer` | AI Pentester (security-overlay, opt-in) | Transversal |
 
 ---
 
@@ -162,12 +164,12 @@ E nos IDE-targets (selecionáveis no install):
 ```
 .claude/skills/wize-*           (Claude Code)
 .cursor/rules/wize-*.mdc        (Cursor)
-.windsurf/...                   (Windsurf)
-.codex/...                      (Codex)
-.continue/...                   (Continue)
-.kimi/...                       (Kimi Code)
-.opencode/...                   (OpenCode)
-.antigravity/...                (Antigravity CLI/IDE)
+.windsurf/rules/wize-*.md       (Windsurf)
+.agents/skills/wize-*           (Codex — .codex/ foi revertido na 0.7.3)
+.continue/prompts/wize-*.prompt (Continue)
+.kimi/skills/wize-*             (Kimi Code)
+.opencode/agents/ + .opencode/commands/  (OpenCode)
+.agent/skills/wize-*            (Antigravity CLI/IDE)
 .wize/agents/                   (fallback genérico)
 ```
 
@@ -196,7 +198,7 @@ wize-dev-kit install
   ├─ Detecta: greenfield vs brownfield
   ├─ Pergunta: perfil(s) — Core / +Web / +App
   ├─ Pergunta: IDE targets — multi-select
-  ├─ Pergunta: idioma e output_folder
+  ├─ Pergunta: idioma (output folder é fixo: .wize/)
   ├─ Cria .wize/ + adapters IDE
   ├─ Se brownfield: oferece `wize-document-project`
   └─ Se ok: dispara onboarding (Wizer → Pepper/Mantis/Tony)
@@ -268,7 +270,7 @@ wize-dev-kit sync     # regera adapters IDE
 
 - 3 skills meta: `wize-create-agent`, `wize-create-skill`, `wize-create-workflow`.
 - Customização de built-ins via `.wize/custom/{tipo}/{code}/customize.toml` (override sem fork).
-- Validação obrigatória: schema → lint → dry-run.
+- Validação: checks estruturais (validação de schema via Ajv pendente de orçamento de dependências).
 - Auto-sync: regera adapters de todos os IDEs ativos a cada criação/edição.
 
 ---
@@ -295,7 +297,7 @@ wize-dev-kit/
 ├── ROSTER.md                   # ← quadro Marvel
 │
 ├── src/
-│   ├── core-skills/            # Core (advanced-elicitation, brainstorming, party-mode, etc)
+│   ├── core-skills/            # Core (advanced-elicitation, brainstorming, spec, etc)
 │   │   └── wize-*/
 │   ├── method-skills/          # AI Agile dev: 1-analysis, 2-plan, 3-solutioning, 4-implementation
 │   │   ├── 1-analysis/
@@ -347,12 +349,19 @@ wize-dev-kit/
 │   │   └── wize-create-workflow/
 │   ├── web-overlay/            # Wize Web Dev overlay
 │   │   ├── wize-web-scaffold/
+│   │   ├── wize-web-deploy/
 │   │   ├── wize-web-seo-audit/
 │   │   └── module.yaml
-│   └── app-overlay/            # Wize App Development overlay
-│       ├── wize-app-scaffold/
-│       ├── wize-app-release-channels/
-│       └── module.yaml
+│   ├── app-overlay/            # Wize App Development overlay
+│   │   ├── wize-app-scaffold/
+│   │   ├── wize-app-release-channels/
+│   │   ├── wize-app-store-listing/
+│   │   └── module.yaml
+│   └── security-overlay/       # Wize Security Overlay (AI Pentester, opt-in)
+│       ├── agents/             # red-teamer (wize-sec-red-teamer)
+│       ├── skills/
+│       ├── data/
+│       └── _shared/
 │
 ├── adapters/                   # IDE adapters
 │   ├── claude-code/
@@ -371,6 +380,12 @@ wize-dev-kit/
 │       ├── detect.js           # greenfield/brownfield detector
 │       ├── onboarding.js
 │       ├── sync.js
+│       ├── render-shared.js
+│       ├── baseline.js
+│       ├── version-check.js
+│       ├── setup-helpers.js
+│       ├── commands/
+│       ├── document-project/
 │       └── validators/         # schema, lint, dry-run
 │
 └── test/                       # specs validating skills + workflows

package/CHANGELOG.md

@@ -5,6 +5,42 @@ Format inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.8.1] — 2026-07-12
+
+Release de alinhamento: documentação ↔ realidade, fecho do ciclo ágil e `/wize-help` corrigido. Sem novas features de produto; suite verde (246 testes, validate 73 arquivos).
+
+### Fixed
+
+- **`/wize-help` roteava contra o arquivo errado.** Lia `.wize/implementation/sprint-status.md`, mas o canônico é `sprint-status.yaml` — toda detecção de Fase 4 falhava e projetos em sprint eram re-roteados para o começo. Reescrito e re-renderizado para todos os adapters: agora lê o `.yaml`, conhece o atalho `wize-quick-dev`, inclui os gates `wize-validate-prd` e `wize-check-implementation-readiness`, a persona `red-teamer` e os workflows de overlay, tem branch para gate FAIL → `wize-correct-course`, e não anuncia mais o alias `/wize` inexistente. Mais conciso (heurístico em tabela única).
+- **Schemas rejeitavam os assets do security-overlay já publicados.** `agent.schema.json` passa a aceitar `code: wize-sec-*` e `module: security-overlay`; `workflow.schema.json` aceita `overlay: security`.
+
+### Docs
+
+- **Baseline `wize-document-project` atualizado** (estava congelado em v0.3.0 apesar do "refresh" de 2026-07-04): versão, contagem de agentes (10), core skills (10), testes (24 arquivos / 246), LOC, commits e subcomandos de CLI. Riscos e perguntas obsoletas removidos.
+- **README.es** trazido à paridade com en/pt-BR (estava em 0.7.0, sem a seção de harnesses). Nos três READMEs: removida a pergunta de "output folder" (o instalador não pergunta), corrigida a afirmação sobre dependências npm (`prompts`), e documentados os comandos `list` e `workflow`.
+- **ARCH.md / DECISIONS.md / ROSTER.md / AGENTS.md e os 9 READMEs de adapter** atualizados para 4 profiles, a 10ª persona (`red-teamer`) e os paths reais de cada adapter; decisão Fase 9 registrada.
+- **PRD / architecture / readiness**: contagem de ACs corrigida (30), stubs de template vazios removidos, notas de snapshot 0.6.0.
+
+### Cycle
+
+- **Registro ágil reconciliado.** `sprint-status.yaml` regenerado contra a árvore real (8 epics / 27 stories, todas `done`); epics `01`–`07` fechados; releases 0.7.x/0.8.0 registradas em `quick-dev-log.md` e `sprint-status.md`; `backlog.md` atualizado.
+- **Épico E09 aberto** ("Melhor aproveitamento de components e intenção do usuário") em `.wize/solutioning/epics/09-ux-intent.md`, com 8 stories verificadas contra o código; relatório completo em `REVIEW-2026-07-11.md`.
+
+## [0.8.0] — 2026-07-04
+
+### Added
+
+- **OpenCode: commands agora rodam sob a persona dona.** O adapter deriva `agent: <code>` do `owner:` de cada workflow/skill (código, nome de exibição ou combinações "X + Y"), então `/wize-dev-story` já ativa o system prompt da Shuri em vez de depender de qual agente estava ativo.
+- **OpenCode: fan-out isolado nativamente.** `wize-review-adversarial` e `wize-review-edge-case-hunter` — os dois workers nomeados que o `wize-code-review` dispara em paralelo — ganham `subtask: true`, isolando-os do contexto de quem invoca independentemente do chamador.
+- **Escada de reuso (YAGNI) na persona da Shuri.** Antes de escrever código novo: precisa existir? já está no repo? a stdlib resolve? é nativo da plataforma? uma dependência instalada resolve? é uma linha? Só então código novo — referenciada por `wize-dev-story` e `wize-quick-dev`.
+- **Padrão de fan-out de subagentes documentado na persona do Wizer**, generalizado a partir do `wize-code-review`: nomear cada worker, escopar contexto, despachar pela primitiva nativa do harness (Task/Agent tool no Claude Code; `mode`/`subtask` no OpenCode; geração de prompts + fallback manual nos demais), tolerar falha parcial.
+- **`docs/harnesses/`** — um doc por harness suportada (9 adapters, em inglês + pt-BR), com overview curto e tabela no README apontando pra cada um. `package.json` passa a publicar `docs/` no pacote npm.
+
+### Fixed
+
+- **Instalador não tenta mais abrir a harness detectada ao final do `install`.** Em vez do prompt "abrir agora com Wizer?", sugere o comando inicial certo pro estado do repo (greenfield/brownfield) via `composeOnboarding`.
+- Comentário desatualizado no adapter do Kimi Code, que ainda citava o path antigo do Codex (`.codex/skills/`).
+
 ## [0.7.3] — 2026-06-27
 
 ### Fixed

package/DECISIONS.md

@@ -148,6 +148,11 @@
 - **D8.4 — Versionamento dos workflows antigos:** cópias dos `workflow.md` monolíticos de `wize-create-architecture` e `wize-code-review` são arquivadas em `.wize/knowledge/decisions/` para referência, não mantidas em produção.
 - **D8.5 — Registro em catálogos:** skills adicionados a `src/core-skills/module.yaml` e `src/method-skills/module.yaml`; fluxos refletidos no `README.md`.
 
+### Fase 9 — Security Overlay + OpenCode nativo (2026-07-11)
+
+- **D9.1 — Security Overlay neste kit:** o perfil `security-overlay` (AI Pentester) passa a ser distribuído **dentro do `wize-dev-kit`** como 4º perfil opt-in do installer, com a persona **red-teamer** (`wize-sec-red-teamer`) em `src/security-overlay/`. _Supersede parcialmente D1.1 (3 perfis → 4 perfis), D3.2 (9 papéis → 9 core + 1 overlay) e D3.5 (security deixava de ser reservado para kit futuro)._ As entradas históricas permanecem inalteradas como registro.
+- **D9.2 — OpenCode com wiring nativo (0.8.0):** o adapter OpenCode passa a gerar **agents e commands nativos** (`.opencode/agents/` + `.opencode/commands/`), com commands vinculados à persona dona e workers de fan-out isolados — em vez do fallback genérico.
+
 ## Perguntas em aberto
 
 _(serão preenchidas conforme a entrevista avança)_

package/README.es.md

@@ -25,7 +25,7 @@ Elige tus perfiles y tu IDE; luego, en tu IDE con IA, di *"Activa a Wizer y dale
 
 Wize Development Kit (WDK) es un **stack de agentes de IA** instalable que funciona dentro de tu IDE con IA (Claude Code, Cursor, Windsurf, Codex y otros) y escribe artefactos estructurados en una carpeta oculta `.wize/` de tu repositorio. Lleva un proyecto de **brief → PRD → estrategia de UX → arquitectura → implementación testeada**, y también puede **hacer pentest de la app en ejecución y planificar el sprint de remediación**.
 
-Es **file-first y zero-runtime**: los agentes son skills en Markdown que tu IDE lee; el tooling es Node puro (sin nuevas dependencias npm). Nada está simulado — cada paso lee el artefacto anterior y escribe uno real.
+Es **file-first y zero-runtime**: los agentes son skills en Markdown que tu IDE lee; el tooling es Node puro (una única dependencia npm — `prompts`, usada solo por el instalador; nada se añade a tu proyecto). Nada está simulado — cada paso lee el artefacto anterior y escribe uno real.
 
 ### Perfiles (combinables en monorepos)
 
@@ -57,8 +57,7 @@ El instalador pregunta:
 1. **Perfil(es)** — Core / +Web / +App / +Security (selección múltiple).
 2. **IDE(s) objetivo** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity o fallback genérico (selección múltiple).
 3. **Idiomas** — comunicación + salida de documentos.
-4. **Carpeta de salida** — por defecto `.wize/`.
-5. **Brownfield** — ofrece ejecutar `wize-document-project` para crear la baseline del código existente.
+4. **Brownfield** — ofrece ejecutar `wize-document-project` para crear la baseline del código existente.
 
 Tras instalar, abre tu IDE y di:
 
@@ -66,6 +65,24 @@ Tras instalar, abre tu IDE y di:
 
 ---
 
+## Harnesses soportados
+
+Los 9 IDEs objetivo se renderizan desde la misma fuente; el formato y la mecánica varían por harness. **OpenCode** recibe la integración más profunda — la separación persona/workflow del kit se mapea sobre las primitivas propias de OpenCode (`mode: primary|subagent`, `agent:`, `subtask:`) en lugar de aplanarse en un único tipo de archivo.
+
+| Harness | Salida | Destacado |
+|---|---|---|
+| **OpenCode** 🆕 | `.opencode/agents/` + `.opencode/commands/` | `mode: primary\|subagent` nativo; los comandos se vinculan automáticamente a su persona propietaria (`agent:`); los workers de fan-out corren aislados (`subtask: true`). [Docs →](docs/harnesses/opencode.md) |
+| **Claude Code** | `.claude/skills/*/SKILL.md` | Formato Skill de Anthropic; fan-out ad-hoc vía Task/Agent tool (`wize-code-review`). [Docs →](docs/harnesses/claude-code.md) |
+| **Codex** | `.agents/skills/*/SKILL.md` | Mismo formato Skill + `AGENTS.md` en la raíz. [Docs →](docs/harnesses/codex.md) |
+| **Kimi Code** | `.kimi/skills/*/SKILL.md` | Mismo formato Skill; autodetecta árboles de skills de Claude/Codex. [Docs →](docs/harnesses/kimi-code.md) |
+| **Antigravity** | `.agent/skills/*/SKILL.md` | Mismo formato Skill + `AGENTS.md` en la raíz. [Docs →](docs/harnesses/antigravity.md) |
+| **Cursor** | `.cursor/rules/*.mdc` | Reglas on-demand (`alwaysApply: false`), emparejadas por descripción. [Docs →](docs/harnesses/cursor.md) |
+| **Windsurf** | `.windsurf/rules/*.md` | Markdown plano; el modo de activación se define dentro del IDE. [Docs →](docs/harnesses/windsurf.md) |
+| **Continue.dev** | `.continue/prompts/*.prompt` | Slash commands con `invokable: true`. [Docs →](docs/harnesses/continue.md) |
+| **Fallback genérico** | `.wize/agents/*.md` + `AGENTS.md` en la raíz | Para cualquier IDE sin adapter dedicado. [Docs →](docs/harnesses/generic.md) |
+
+---
+
 ## El elenco
 
 | # | Persona | Código | Rol |
@@ -186,9 +203,12 @@ Con el perfil **Wize Security** instalado, la persona `red-teamer` ejecuta un pe
 npx wize-dev-kit install         # setup interactivo
 npx wize-dev-kit update          # actualiza un kit instalado a la versión actual
 npx wize-dev-kit sync            # re-renderiza los adapters de IDE tras editar la config
+npx wize-dev-kit list            # lista agentes, skills y workflows instalados
 npx wize-dev-kit agent list      # lista agentes nativos + personalizados
 npx wize-dev-kit agent create    # crea un nuevo agente personalizado (validado + dry-run)
 npx wize-dev-kit agent edit <code>  # sobrescribe un agente nativo
+npx wize-dev-kit workflow list   # lista workflows nativos + personalizados
+npx wize-dev-kit workflow create # crea un nuevo workflow personalizado
 npx wize-dev-kit doctor          # diagnostica kit / proyecto / adapters / gates
 npx wize-dev-kit validate        # chequeos estructurales en los assets del kit
 npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
@@ -203,12 +223,13 @@ npx wize-dev-kit uninstall       # elimina .wize/ (tu código queda intacto)
 - [`ROSTER.md`](ROSTER.md) — personas con estilo, rol, equivalencias BMAD.
 - [`DECISIONS.md`](DECISIONS.md) — registro de decisiones.
 - [`CHANGELOG.md`](CHANGELOG.md) — historial de releases.
+- [`docs/harnesses/`](docs/harnesses/) — un doc por [harness soportado](#harnesses-soportados), en inglés.
 
 ---
 
 ## Estado
 
-**v0.7.0 — beta.** El ciclo completo (análisis → plan → solución → implementación) está montado con 10 agentes y una biblioteca estructurada de skills. El `security-overlay` (Pentester de IA) entrega un pipeline de pentest completo, un informe ejecutivo (puntuación de riesgo + briefing + plan de acción por IA) y planificación de remediación post-scan — validado de principio a fin contra una aplicación Laravel/PHP real. Los adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode y Antigravity se regeneran automáticamente.
+**v0.8.0 — beta.** El ciclo completo (análisis → plan → solución → implementación) está montado con 10 agentes y una biblioteca estructurada de skills. El `security-overlay` (Pentester de IA) entrega un pipeline de pentest completo, un informe ejecutivo (puntuación de riesgo + briefing + plan de acción por IA) y planificación de remediación post-scan — validado de principio a fin contra una aplicación Laravel/PHP real. Los adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode y Antigravity se regeneran automáticamente — [OpenCode](docs/harnesses/opencode.md) recibe wiring nativo de `mode`/`agent`/`subtask`, la integración más profunda de las 9.
 
 ---
 

package/README.md

@@ -25,7 +25,7 @@ Pick your profiles and IDE, then in your AI IDE say *"Activate Wizer and brief h
 
 Wize Development Kit (WDK) is an installable **AI agent stack** that runs inside your AI IDE (Claude Code, Cursor, Windsurf, Codex, and others) and writes structured artifacts to a hidden `.wize/` folder in your repo. It takes a project from **brief → PRD → UX strategy → architecture → tested implementation**, and can also **pentest the running app and plan the remediation sprint**.
 
-It is **file-first and zero-runtime**: the agents are Markdown skills your IDE reads; the tooling is plain Node (no new npm dependencies). Nothing is mocked — every step reads the previous artifact and writes a real one.
+It is **file-first and zero-runtime**: the agents are Markdown skills your IDE reads; the tooling is plain Node (a single runtime dependency, `prompts`, powers the interactive installer — nothing is added to your project). Nothing is mocked — every step reads the previous artifact and writes a real one.
 
 ### Profiles (combinable in monorepos)
 
@@ -57,8 +57,7 @@ The installer asks:
 1. **Profile(s)** — Core / +Web / +App / +Security (multi-select).
 2. **IDE target(s)** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity, or generic fallback (multi-select).
 3. **Languages** — communication + document output.
-4. **Output folder** — default `.wize/`.
-5. **Brownfield** — offers to run `wize-document-project` to baseline the existing codebase.
+4. **Brownfield** — offers to run `wize-document-project` to baseline the existing codebase.
 
 After install, open your IDE and say:
 
@@ -66,6 +65,24 @@ After install, open your IDE and say:
 
 ---
 
+## Supported harnesses
+
+All 9 IDE targets render from the same source; format and mechanics differ per harness. **OpenCode** gets the deepest integration — the kit's persona/workflow split maps onto OpenCode's own primitives (`mode: primary|subagent`, `agent:`, `subtask:`) instead of being flattened into one file type.
+
+| Harness | Output | Notable |
+|---|---|---|
+| **OpenCode** 🆕 | `.opencode/agents/` + `.opencode/commands/` | Native `mode: primary\|subagent`; commands auto-bind to their owning persona (`agent:`); fan-out workers run isolated (`subtask: true`). [Docs →](docs/harnesses/opencode.md) |
+| **Claude Code** | `.claude/skills/*/SKILL.md` | Anthropic Skill format; ad-hoc Task/Agent-tool fan-out (`wize-code-review`). [Docs →](docs/harnesses/claude-code.md) |
+| **Codex** | `.agents/skills/*/SKILL.md` | Same Skill format + root `AGENTS.md`. [Docs →](docs/harnesses/codex.md) |
+| **Kimi Code** | `.kimi/skills/*/SKILL.md` | Same Skill format; auto-detects Claude/Codex skill trees. [Docs →](docs/harnesses/kimi-code.md) |
+| **Antigravity** | `.agent/skills/*/SKILL.md` | Same Skill format + root `AGENTS.md`. [Docs →](docs/harnesses/antigravity.md) |
+| **Cursor** | `.cursor/rules/*.mdc` | On-demand rules (`alwaysApply: false`), matched by description. [Docs →](docs/harnesses/cursor.md) |
+| **Windsurf** | `.windsurf/rules/*.md` | Plain markdown; activation mode set inside the IDE. [Docs →](docs/harnesses/windsurf.md) |
+| **Continue.dev** | `.continue/prompts/*.prompt` | `invokable: true` slash commands. [Docs →](docs/harnesses/continue.md) |
+| **Generic fallback** | `.wize/agents/*.md` + root `AGENTS.md` | For any IDE without a dedicated adapter. [Docs →](docs/harnesses/generic.md) |
+
+---
+
 ## The roster
 
 | # | Persona | Code | Role |
@@ -186,9 +203,11 @@ When the **Wize Security** profile is installed, the `red-teamer` persona runs a
 npx wize-dev-kit install         # interactive setup
 npx wize-dev-kit update          # bring an installed kit up to the current version
 npx wize-dev-kit sync            # re-render IDE adapters after editing config
+npx wize-dev-kit list            # list built-in + custom agents
 npx wize-dev-kit agent list      # list built-in + custom agents
 npx wize-dev-kit agent create    # scaffold a new custom agent (validated + dry-run)
 npx wize-dev-kit agent edit <code>  # override a built-in agent
+npx wize-dev-kit workflow <create|list>  # scaffold or list custom workflows
 npx wize-dev-kit doctor          # diagnose kit / project / adapters / gates
 npx wize-dev-kit validate        # structural checks on the kit assets
 npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
@@ -203,12 +222,13 @@ npx wize-dev-kit uninstall       # remove .wize/ (your code is left untouched)
 - [`ROSTER.md`](ROSTER.md) — personas with style, role, BMAD equivalences.
 - [`DECISIONS.md`](DECISIONS.md) — decisions log.
 - [`CHANGELOG.md`](CHANGELOG.md) — release history.
+- [`docs/harnesses/`](docs/harnesses/) — one doc per [supported harness](#supported-harnesses), in English + [pt-BR](README.pt-BR.md#harnesses-suportadas).
 
 ---
 
 ## Status
 
-**v0.7.0 — beta.** The full lifecycle (analysis → plan → solution → implementation) is wired with 10 agents and a structured skill library. The `security-overlay` (AI Pentester) ships a complete pentest pipeline, a stakeholder report (risk score + briefing + AI action plan), and post-scan remediation planning — validated end-to-end against a real Laravel/PHP app. IDE adapters for Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, and Antigravity are regenerated automatically.
+**v0.8.0 — beta.** The full lifecycle (analysis → plan → solution → implementation) is wired with 10 agents and a structured skill library. The `security-overlay` (AI Pentester) ships a complete pentest pipeline, a stakeholder report (risk score + briefing + AI action plan), and post-scan remediation planning — validated end-to-end against a real Laravel/PHP app. IDE adapters for Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, and Antigravity are regenerated automatically — [OpenCode](docs/harnesses/opencode.md) gets native `mode`/`agent`/`subtask` wiring, the deepest integration of the 9.
 
 ---
 

package/README.pt-BR.md

@@ -25,7 +25,7 @@ Escolha os perfis e a IDE; depois, na sua IDE com IA, diga *"Ative o Wizer e dê
 
 O Wize Development Kit (WDK) é uma **stack de agentes de IA** instalável que roda dentro da sua IDE com IA (Claude Code, Cursor, Windsurf, Codex e outras) e grava artefatos estruturados em uma pasta oculta `.wize/` no seu repositório. Leva um projeto de **brief → PRD → estratégia de UX → arquitetura → implementação testada** e também pode **fazer pentest da aplicação rodando e planejar a sprint de correção**.
 
-É **file-first e zero-runtime**: os agentes são skills em Markdown que sua IDE lê; o tooling é Node puro (sem novas dependências npm). Nada é simulado — cada passo lê o artefato anterior e grava um real.
+É **file-first e zero-runtime**: os agentes são skills em Markdown que sua IDE lê; o tooling é Node puro (uma única dependência de runtime, `prompts`, usada pelo instalador interativo — nada é adicionado ao seu projeto). Nada é simulado — cada passo lê o artefato anterior e grava um real.
 
 ### Perfis (combináveis em monorepos)
 
@@ -57,8 +57,7 @@ O instalador pergunta:
 1. **Perfil(is)** — Core / +Web / +App / +Security (múltipla escolha).
 2. **IDE(s) alvo** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity ou fallback genérico (múltipla escolha).
 3. **Idiomas** — comunicação + saída de documentos.
-4. **Pasta de saída** — padrão `.wize/`.
-5. **Brownfield** — oferece rodar `wize-document-project` para criar a baseline do código existente.
+4. **Brownfield** — oferece rodar `wize-document-project` para criar a baseline do código existente.
 
 Após instalar, abra sua IDE e diga:
 
@@ -66,6 +65,24 @@ Após instalar, abra sua IDE e diga:
 
 ---
 
+## Harnesses suportadas
+
+Os 9 alvos de IDE são gerados a partir da mesma fonte; formato e mecânica mudam por harness. O **OpenCode** tem a integração mais profunda — a divisão persona/workflow do kit mapeia pras primitivas nativas do próprio OpenCode (`mode: primary|subagent`, `agent:`, `subtask:`) em vez de ser achatada num único tipo de arquivo.
+
+| Harness | Saída | Destaque |
+|---|---|---|
+| **OpenCode** 🆕 | `.opencode/agents/` + `.opencode/commands/` | `mode: primary\|subagent` nativo; commands se ligam à persona dona (`agent:`); workers de fan-out rodam isolados (`subtask: true`). [Docs →](docs/harnesses/opencode.pt-BR.md) |
+| **Claude Code** | `.claude/skills/*/SKILL.md` | Formato Skill da Anthropic; fan-out ad hoc via Task/Agent tool (`wize-code-review`). [Docs →](docs/harnesses/claude-code.pt-BR.md) |
+| **Codex** | `.agents/skills/*/SKILL.md` | Mesmo formato Skill + `AGENTS.md` na raiz. [Docs →](docs/harnesses/codex.pt-BR.md) |
+| **Kimi Code** | `.kimi/skills/*/SKILL.md` | Mesmo formato Skill; autodetecta as árvores do Claude/Codex. [Docs →](docs/harnesses/kimi-code.pt-BR.md) |
+| **Antigravity** | `.agent/skills/*/SKILL.md` | Mesmo formato Skill + `AGENTS.md` na raiz. [Docs →](docs/harnesses/antigravity.pt-BR.md) |
+| **Cursor** | `.cursor/rules/*.mdc` | Rules sob demanda (`alwaysApply: false`), casadas por descrição. [Docs →](docs/harnesses/cursor.pt-BR.md) |
+| **Windsurf** | `.windsurf/rules/*.md` | Markdown puro; modo de ativação definido dentro da IDE. [Docs →](docs/harnesses/windsurf.pt-BR.md) |
+| **Continue.dev** | `.continue/prompts/*.prompt` | Slash commands via `invokable: true`. [Docs →](docs/harnesses/continue.pt-BR.md) |
+| **Fallback genérico** | `.wize/agents/*.md` + `AGENTS.md` na raiz | Para qualquer IDE sem adapter dedicado. [Docs →](docs/harnesses/generic.pt-BR.md) |
+
+---
+
 ## O elenco
 
 | # | Persona | Código | Papel |
@@ -186,9 +203,11 @@ Com o perfil **Wize Security** instalado, a persona `red-teamer` roda um pentest
 npx wize-dev-kit install         # setup interativo
 npx wize-dev-kit update          # atualiza um kit instalado para a versão atual
 npx wize-dev-kit sync            # re-renderiza os adapters de IDE após editar a config
+npx wize-dev-kit list            # lista agentes nativos + customizados
 npx wize-dev-kit agent list      # lista agentes nativos + customizados
 npx wize-dev-kit agent create    # cria um novo agente customizado (validado + dry-run)
 npx wize-dev-kit agent edit <code>  # sobrescreve um agente nativo
+npx wize-dev-kit workflow <create|list>  # cria ou lista workflows customizados
 npx wize-dev-kit doctor          # diagnostica kit / projeto / adapters / gates
 npx wize-dev-kit validate        # checagens estruturais nos assets do kit
 npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
@@ -203,12 +222,13 @@ npx wize-dev-kit uninstall       # remove .wize/ (seu código permanece intacto)
 - [`ROSTER.md`](ROSTER.md) — personas com estilo, papel, equivalências BMAD.
 - [`DECISIONS.md`](DECISIONS.md) — log de decisões.
 - [`CHANGELOG.md`](CHANGELOG.md) — histórico de releases.
+- [`docs/harnesses/`](docs/harnesses/) — um doc por [harness suportada](#harnesses-suportadas), em português + [English](README.md#supported-harnesses).
 
 ---
 
 ## Status
 
-**v0.7.0 — beta.** O ciclo completo (análise → plano → solução → implementação) está montado com 10 agentes e uma biblioteca estruturada de skills. O `security-overlay` (Pentester de IA) entrega um pipeline de pentest completo, um relatório executivo (score de risco + briefing + plano de ação por IA) e planejamento de correção pós-scan — validado de ponta a ponta contra uma aplicação Laravel/PHP real. Os adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode e Antigravity são regenerados automaticamente.
+**v0.8.0 — beta.** O ciclo completo (análise → plano → solução → implementação) está montado com 10 agentes e uma biblioteca estruturada de skills. O `security-overlay` (Pentester de IA) entrega um pipeline de pentest completo, um relatório executivo (score de risco + briefing + plano de ação por IA) e planejamento de correção pós-scan — validado de ponta a ponta contra uma aplicação Laravel/PHP real. Os adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode e Antigravity são regenerados automaticamente — o [OpenCode](docs/harnesses/opencode.pt-BR.md) tem a integração mais profunda das 9, com `mode`/`agent`/`subtask` nativos.
 
 ---
 

package/ROSTER.md

@@ -10,16 +10,24 @@
 | 1 | **Wizer** | `wize-orchestrator` | Orchestrator / Knowledge Base / Briefing | All | "I know the qwize methodology, I know the project — I activate the right agent." Style: host, picks, routes. Tools: global. | (none — orchestrator role surfaces only in BMAD's `party-mode`) |
 | 2 | **Pepper Potts** | `wize-agent-analyst` | Business Analyst | 1 — Analysis | "Relentless efficiency." Brainstorming, market research, product brief, PR/FAQ, ROI, stakeholder map. Style: pragmatic, anticipates, connects business → tech. | Mary (`bmad-agent-analyst`) |
 | 3 | **Peggy Carter** | `wize-agent-tech-writer` | Technical Writer | Transversal (1–4) | "Structure, audience, clarity." DITA, CommonMark, OpenAPI, READMEs, runbooks. Style: organized, didactic, technical but accessible. | Paige (`bmad-agent-tech-writer`) |
-| 4 | **Maria Hill** | `wize-agent-pm` | Product Manager | 2 — Planning | "Mission first." PRD, epics, sprint planning, deadline enforcement. Style: military discipline, no excuses, outcome-focused. | John (`bmad-agent-pm`) |
+| 4 | **Maria Hill** | `wize-agent-pm` | Product Manager | 2 — Planning | "Mission first." PRD, validation, sprint planning, sprint status, correct-course, deadline enforcement (epics/stories are Tony's). Style: military discipline, no excuses, outcome-focused. | John (`bmad-agent-pm`) |
 | 5 | **Mantis** | `wize-agent-ux-designer` | UX Designer (Whiteport Strategic UX v0.4.3) | 2–3 | "I feel the user before I sketch." Jobs-to-be-done, journeys, empathy mapping, design tokens, IA, design system. Style: research-heavy, qualitative, empathic narrative. | Sally (`bmad-agent-ux-designer`) — replaced with Whiteport methodology |
 | 6 | **Nick Fury** | `wize-agent-solution-strategist` | Solution Strategy / Tech Vision | 2 → 3 (boundary) | "People > Objective." Big-picture, NFRs, stack family, principles, strategic trade-offs. Style: authoritative, direct, few words. | (partial) Winston — strategic side |
 | 7 | **Tony Stark** | `wize-agent-architect` | System Architect | 3 — Solutioning | "I build the thing." System design, components, ADRs, prototyping, pattern selection. Style: confident, irreverent, shows with code. | Winston (`bmad-agent-architect`) — systemic side |
 | 8 | **Hawkeye** | `wize-agent-test-architect` | Test Architect (TEA) | Transversal (gates in 2, 3, 4) | "I always hit where it hurts." Risk profile, test design, traceability, NFR assessment, review, gate decision. Style: pragmatic, edge-case hunter, focused on what matters. | (new — does not exist in BMAD core; inspired by BMAD-Method v5 TEA) |
 | 9 | **Shuri** | `wize-agent-dev` | Senior Developer | 4 — Implementation | "Wakanda forever — now it compiles." TDD red-green-refactor, security, performance. Style: genius innovator, fast, clean code, protective of the ecosystem. | Amelia (`bmad-agent-dev`) |
 
+## Security overlay (opt-in)
+
+Installs only with the `security-overlay` profile.
+
+| # | Persona | Code | Role | Phase | Motto / Style | BMAD equiv. |
+|---|---|---|---|---|---|---|
+| 10 | **red-teamer** | `wize-sec-red-teamer` | AI Pentester | Overlay | "Only what you're authorized to touch." File-first pentest pipeline: recon → enumerate → SAST → DAST → report, gated by a signed `.wize/security/scope.md`. Default passive; exploits opt-in via `--active`; every refusal audited. Hawkeye/TEA validates the overlay's implementation stories. | (new — no BMAD core equivalent) |
+
 ## Notes
 
 - **Visual theme:** emoji icons (📊 🛡️ 🦾 etc.) are placeholders; a full visual identity will be consolidated in a later phase.
 - **Agent Builder:** decided as a **skill** (`wize-create-agent`), not an agent. Wizer invokes the skill when a new persona or custom module needs to be registered.
-- **Teams:** default team is `software-development`. Optional teams (`web-dev`, `app-dev`) activate variants of Tony and Shuri per profile.
-- **Future Marvel personas (out of dev-kit scope):** Pepper is already Analyst here, Fury is already Strategist. Other Marvel personas (Black Panther, Wanda, Falcon, Vision, Riri Williams, Kamala Khan) remain reserved for future kits (Wize Ops Kit, Wize Data Kit, Wize Security Kit, etc.).
+- **Overlays add skills, not persona variants.** Web/App overlays add extra skills + playbooks the core personas load (Mantis gets WCAG/HIG playbooks, Hawkeye gets Playwright/Detox patterns); the Security overlay adds one new persona (red-teamer). There are no per-profile "variants" of Tony or Shuri in code.
+- **Future Marvel personas (out of dev-kit scope):** Pepper is already Analyst here, Fury is already Strategist. Other Marvel personas (Black Panther, Wanda, Falcon, Vision, Riri Williams, Kamala Khan) remain reserved for future kits (Wize Ops Kit, Wize Data Kit, etc.). The Security overlay's red-teamer already lives in this kit.

package/adapters/README.md

@@ -8,12 +8,12 @@ Each adapter renders the kit's agents/skills/workflows into the file layout that
 |---|---|---|---|
 | `claude-code` | `.claude/skills/wize-*/` | `SKILL.md` per agent/workflow | Default. Uses Claude Code skill folder pattern. |
 | `cursor` | `.cursor/rules/wize-*.mdc` | MDC | Each agent/skill becomes a rule file. |
-| `windsurf` | `.windsurf/agents/wize-*.md` | Markdown | Cascade-friendly. |
+| `windsurf` | `.windsurf/rules/wize-*.md` | Markdown | Cascade-friendly. |
 | `codex` | `.agents/skills/wize-*/` | `SKILL.md` per agent/workflow | OpenAI Codex. |
-| `continue` | `.continue/agents/wize-*.md` | Markdown | Continue agent slot. |
-| `kimi-code` | `.kimi/agents/wize-*.md` | Markdown | Moonshot Kimi Code. |
-| `opencode` | `.opencode/agents/wize-*.md` | Markdown | OpenCode CLI. |
-| `antigravity` | `.antigravity/agents/wize-*.md` | Markdown | Antigravity CLI + IDE. |
+| `continue` | `.continue/prompts/wize-*.prompt` | `.prompt` | Continue prompt slot. |
+| `kimi-code` | `.kimi/skills/wize-*/` | `SKILL.md` per agent/workflow | Moonshot Kimi Code. |
+| `opencode` | `.opencode/agents/wize-*.md` + `.opencode/commands/wize-*.md` | Markdown | OpenCode CLI. Native agents + commands. |
+| `antigravity` | `.agent/skills/wize-*/` | `SKILL.md` per agent/workflow | Antigravity CLI + IDE. |
 | `generic` | `.wize/agents/wize-*.md` | Markdown | Fallback for any agent that can read a folder of markdown. |
 
 ## Adapter shape

package/adapters/antigravity/README.md

@@ -1,9 +1,9 @@
 # Adapter — antigravity
 
-Antigravity CLI + IDE.
+Antigravity CLI + IDE skills.
 
-- **Target path:** `.antigravity/agents/`
-- **File pattern:** `wize-*.md`
-- **Format:** markdown
+- **Target path:** `.agent/skills/`
+- **File pattern:** `wize-*/SKILL.md`
+- **Format:** Anthropic-compatible `SKILL.md`
 
-This v0.1 adapter ships the descriptor only. Actual rendering of `wize-*` agents/skills/workflows into the target IDE format is on the v0.2 roadmap.
+Renders the Wize skills directly into the folder Antigravity loads at startup.

package/adapters/claude-code/README.md

@@ -6,4 +6,4 @@ Native Claude Code skills.
 - **File pattern:** `wize-*/SKILL.md`
 - **Format:** markdown
 
-This v0.1 adapter ships the descriptor only. Actual rendering of `wize-*` agents/skills/workflows into the target IDE format is on the v0.2 roadmap.
+Renders the Wize skills directly into the folder Claude Code loads at startup.

package/adapters/continue/README.md

@@ -1,9 +1,9 @@
 # Adapter — continue
 
-Continue agent slot.
+Continue prompt files.
 
-- **Target path:** `.continue/agents/`
-- **File pattern:** `wize-*.md`
-- **Format:** markdown
+- **Target path:** `.continue/prompts/`
+- **File pattern:** `wize-*.prompt`
+- **Format:** Continue `.prompt` (markdown with frontmatter)
 
-This v0.1 adapter ships the descriptor only. Actual rendering of `wize-*` agents/skills/workflows into the target IDE format is on the v0.2 roadmap.
+Renders each Wize agent/skill/workflow as a prompt file that Continue loads.

package/adapters/cursor/README.md

@@ -4,6 +4,6 @@ Cursor MDC rules.
 
 - **Target path:** `.cursor/rules/`
 - **File pattern:** `wize-*.mdc`
-- **Format:** markdown
+- **Format:** MDC (markdown with frontmatter)
 
-This v0.1 adapter ships the descriptor only. Actual rendering of `wize-*` agents/skills/workflows into the target IDE format is on the v0.2 roadmap.
+Renders each Wize agent/skill/workflow as an MDC rule file that Cursor picks up automatically.

package/adapters/generic/README.md

@@ -6,4 +6,4 @@ Generic markdown fallback for any AI agent runtime that can read a folder of mar
 - **File pattern:** `wize-*.md`
 - **Format:** markdown
 
-This v0.1 adapter ships the descriptor only. Actual rendering of `wize-*` agents/skills/workflows into the target IDE format is on the v0.2 roadmap.
+Renders each Wize agent/skill/workflow as a plain markdown file that any runtime can read.

package/adapters/kimi-code/README.md

@@ -1,9 +1,9 @@
 # Adapter — kimi-code
 
-Moonshot Kimi Code agents.
+Moonshot Kimi Code skills.
 
-- **Target path:** `.kimi/agents/`
-- **File pattern:** `wize-*.md`
-- **Format:** markdown
+- **Target path:** `.kimi/skills/`
+- **File pattern:** `wize-*/SKILL.md`
+- **Format:** Anthropic-compatible `SKILL.md`
 
-This v0.1 adapter ships the descriptor only. Actual rendering of `wize-*` agents/skills/workflows into the target IDE format is on the v0.2 roadmap.
+Renders the Wize skills directly into the folder Kimi Code loads at startup.

package/adapters/kimi-code/render.js

@@ -1,7 +1,7 @@
 // Moonshot Kimi Code adapter — emits .kimi/skills/wize-{code}/SKILL.md per asset.
 // Kimi Code consumes the Anthropic SKILL.md format verbatim and additionally
-// auto-detects .claude/skills/ and .codex/skills/, so installing alongside
-// those adapters is harmless.
+// auto-detects .claude/skills/ and .agents/skills/ (Codex), so installing
+// alongside those adapters is harmless.
 
 'use strict';
 

package/adapters/opencode/README.md

@@ -1,9 +1,9 @@
 # Adapter — opencode
 
-OpenCode CLI agents.
+OpenCode CLI native agents and commands.
 
-- **Target path:** `.opencode/agents/`
+- **Target paths:** `.opencode/agents/` and `.opencode/commands/`
 - **File pattern:** `wize-*.md`
 - **Format:** markdown
 
-This v0.1 adapter ships the descriptor only. Actual rendering of `wize-*` agents/skills/workflows into the target IDE format is on the v0.2 roadmap.
+Renders each Wize agent as a native OpenCode agent in `.opencode/agents/` and each skill/workflow as a command in `.opencode/commands/`, bound to its owning persona.

package/adapters/opencode/render.js

@@ -2,7 +2,10 @@
 //   - .opencode/agents/wize-{code}.md     (personas → system prompts)
 //   - .opencode/commands/wize-{code}.md   (workflows/skills → slash commands)
 // Frontmatter (agents): description, mode (primary|subagent|all)
-// Frontmatter (commands): description, template (the prompt body)
+// Frontmatter (commands): description, agent (derived from the source's
+//   `owner:` field, when it resolves to a known persona), subtask (from the
+//   source's `subtask: true`, for skills meant to run isolated regardless of
+//   which agent invokes them — e.g. the wize-code-review fan-out workers)
 // Reference: https://opencode.ai/docs/agents/ + /docs/commands/
 
 'use strict';
@@ -11,10 +14,30 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { collectAssets, escapeYamlDouble, clipOneLine, ensureDir } = require('../../tools/installer/render-shared.js');
 
+// `owner:` in workflow/skill frontmatter is written for humans (agent code,
+// display name, "X + Y" pairings, trailing "# comment"). Resolve it to a
+// single known agent code, or null if it doesn't clearly name one (e.g.
+// builder-skills' `owner: builder`, which isn't a persona).
+function resolveOwnerAgentCode(ownerRaw, agents) {
+  if (!ownerRaw) return null;
+  const withoutComment = ownerRaw.split('#')[0].trim();
+  const primary = withoutComment.split(/\s*\+\s*|,/)[0].trim();
+  if (!primary) return null;
+  const byCode = agents.find(a => a.code === primary);
+  if (byCode) return byCode.code;
+  const lower = primary.toLowerCase();
+  const byName = agents.find(a => {
+    const name = a.name.toLowerCase();
+    return name === lower || name.includes(lower) || lower.includes(name.split(' ')[0]);
+  });
+  return byName ? byName.code : null;
+}
+
 function render(kitRoot, projectRoot, opts = {}) {
   const agentsDir = path.join(projectRoot, '.opencode', 'agents');
   const commandsDir = path.join(projectRoot, '.opencode', 'commands');
   const assets = collectAssets(kitRoot, opts);
+  const agents = assets.filter(a => a.kind === 'agent');
   const written = [];
 
   if (!opts.dryRun) {
@@ -46,9 +69,12 @@ function render(kitRoot, projectRoot, opts = {}) {
     } else {
       // workflow or skill → command
       const desc = clipOneLine(a.description, 180);
+      const agentCode = resolveOwnerAgentCode(a.owner, agents);
       const content = [
         '---',
         `description: "${escapeYamlDouble(desc)}"`,
+        ...(agentCode ? [`agent: ${agentCode}`] : []),
+        ...(a.subtask ? ['subtask: true'] : []),
         '---',
         '',
         `# ${a.name}`,