wizz-method 2.21.0 → 2.23.0

package/src/skills-lib/wizz-premium-landing-ui-researcher/scripts/design_sources.py

@@ -0,0 +1,221 @@
+# /// script
+# requires-python = ">=3.10"
+# dependencies = ["ruamel.yaml>=0.18"]
+# ///
+"""Query the design-source catalogue and keep the local cache honest.
+
+Prints ONLY JSON to stdout. Reads ../references/design-sources.yaml.
+
+Subcommands:
+  list        Sources that answer a need tag (--need, repeatable), optionally
+              filtered by --kind. Paid sources are listed with their access so
+              the miner can apply the paid-source condition; study_only sources
+              say so.
+  freshness   For every source with a `cache` folder: revision, last commit,
+              last sync with the remote (FETCH_HEAD, else the clone date), age
+              of that sync in days, local changes, and `stale` when the age
+              passes max_cache_age_days. --remote also compares HEAD with
+              origin (network). Exit 0 always; the JSON carries the verdict.
+  refresh     Fast-forward the cached clones that have no local changes
+              (`git fetch` + `git merge --ff-only`). A clone with local changes
+              is skipped and reported, never reset. --id limits it to one source.
+
+Run with `uv run --no-cache scripts/design_sources.py <subcommand>`: uv
+provisions ruamel.yaml from the header above.
+"""
+
+import argparse
+import datetime as dt
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+CATALOGUE = HERE.parent / "references" / "design-sources.yaml"
+
+
+def emit(payload, code=0):
+    print(json.dumps(payload, ensure_ascii=False, indent=2, default=str))
+    sys.exit(code)
+
+
+def load_catalogue(path):
+    from ruamel.yaml import YAML
+
+    yaml = YAML(typ="safe")
+    with open(path, encoding="utf-8") as handle:
+        data = yaml.load(handle)
+    if not isinstance(data, dict) or not isinstance(data.get("sources"), list):
+        raise ValueError(f"{path}: expected a mapping with a `sources` list")
+    return data
+
+
+def cmd_list(data, needs, kind):
+    wanted = {tag.lower() for tag in needs}
+    rows = []
+    for source in data["sources"]:
+        tags = {str(tag).lower() for tag in source.get("need_tags") or []}
+        if wanted and not wanted & tags:
+            continue
+        if kind and source.get("kind") != kind:
+            continue
+        rows.append(
+            {
+                "id": source["id"],
+                "kind": source.get("kind"),
+                "access": source.get("access"),
+                "license": source.get("license"),
+                "study_only": bool(source.get("study_only")),
+                "matches": sorted(wanted & tags) if wanted else [],
+                "url": source.get("url"),
+                "registry": source.get("registry"),
+                "note": source.get("note"),
+            }
+        )
+    rows.sort(key=lambda row: (-len(row["matches"]), row["access"] != "free", row["id"]))
+    return {"need": sorted(wanted), "count": len(rows), "sources": rows}
+
+
+def git(repo, *args):
+    result = subprocess.run(
+        ["git", "-C", str(repo), *args], capture_output=True, text=True, timeout=120
+    )
+    if result.returncode != 0:
+        raise RuntimeError(result.stderr.strip() or f"git {' '.join(args)} failed")
+    return result.stdout.strip()
+
+
+def cache_root(data, override):
+    root = override or data.get("cache_root") or "~/.claude/design-sources"
+    return Path(os.path.expanduser(root))
+
+
+def last_sync(repo):
+    """When the clone last talked to its remote.
+
+    FETCH_HEAD is rewritten by every fetch. A clone that was never fetched has
+    no FETCH_HEAD, so the last HEAD reflog entry (the clone itself, or the last
+    pull) is used. The .git folder's mtime is not: `git status` touches it.
+    """
+    git_dir = repo / ".git"
+    marker = git_dir / "FETCH_HEAD"
+    if marker.exists():
+        return dt.date.fromtimestamp(marker.stat().st_mtime)
+    reflog = git_dir / "logs" / "HEAD"
+    if reflog.exists():
+        lines = [line for line in reflog.read_text(encoding="utf-8").splitlines() if line.strip()]
+        if lines:
+            identity = lines[-1].split("\t", 1)[0].split()
+            return dt.date.fromtimestamp(int(identity[-2]))
+    return None
+
+
+def remote_status(repo, revision):
+    try:
+        line = git(repo, "ls-remote", "origin", "HEAD")
+    except RuntimeError as error:
+        return {"remote": f"unreachable: {error}"}
+    remote = line.split()[0] if line else ""
+    return {"remote": "current" if remote.startswith(revision) else "behind", "remote_revision": remote[:8]}
+
+
+def inspect_cache(repo, max_age, today, check_remote):
+    if not (repo / ".git").exists():
+        return {"present": repo.is_dir(), "error": None if not repo.is_dir() else "not a git clone"}
+    try:
+        revision = git(repo, "rev-parse", "--short", "HEAD")
+        committed = git(repo, "log", "-1", "--format=%cs")
+        dirty = bool(git(repo, "status", "--porcelain"))
+    except RuntimeError as error:
+        return {"present": True, "error": str(error)}
+    synced = last_sync(repo)
+    if synced is None:
+        return {"present": True, "revision": revision, "last_commit": committed, "error": "no fetch or reflog record"}
+    age = (today - synced).days
+    row = {
+        "present": True,
+        "revision": revision,
+        "last_commit": committed,
+        "last_sync": synced.isoformat(),
+        "age_days": age,
+        "local_changes": dirty,
+        "stale": age > max_age,
+    }
+    if check_remote:
+        row.update(remote_status(repo, revision))
+    return row
+
+
+def cmd_freshness(data, root, today, check_remote=False):
+    max_age = int(data.get("max_cache_age_days") or 30)
+    rows = []
+    for source in data["sources"]:
+        if not source.get("cache"):
+            continue
+        row = {"id": source["id"], "path": str(root / source["cache"])}
+        row.update(inspect_cache(root / source["cache"], max_age, today, check_remote))
+        rows.append(row)
+    stale = [row["id"] for row in rows if row.get("stale")]
+    return {"max_age_days": max_age, "today": today.isoformat(), "stale": stale, "caches": rows}
+
+
+def cmd_refresh(data, root, only_id):
+    rows = []
+    for source in data["sources"]:
+        if not source.get("cache") or (only_id and source["id"] != only_id):
+            continue
+        repo = root / source["cache"]
+        row = {"id": source["id"], "path": str(repo)}
+        if not repo.is_dir():
+            row["result"] = "absent"
+        else:
+            try:
+                if git(repo, "status", "--porcelain"):
+                    row["result"] = "skipped: local changes"
+                else:
+                    before = git(repo, "rev-parse", "--short", "HEAD")
+                    git(repo, "fetch", "--quiet")
+                    git(repo, "merge", "--ff-only", "--quiet", "@{u}")
+                    after = git(repo, "rev-parse", "--short", "HEAD")
+                    row["result"] = "updated" if after != before else "already current"
+                    row["revision"] = after
+            except RuntimeError as error:
+                row["result"] = f"error: {error}"
+        rows.append(row)
+    return {"caches": rows}
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(prog="design_sources.py")
+    parser.add_argument("--catalogue", default=str(CATALOGUE))
+    parser.add_argument("--cache-root", default=None)
+    sub = parser.add_subparsers(dest="command", required=True)
+    listing = sub.add_parser("list")
+    listing.add_argument("--need", action="append", default=[])
+    listing.add_argument("--kind", default=None)
+    fresh = sub.add_parser("freshness")
+    fresh.add_argument("--today", default=None, help="YYYY-MM-DD, for tests")
+    fresh.add_argument("--remote", action="store_true", help="compare HEAD with origin (network)")
+    refresh = sub.add_parser("refresh")
+    refresh.add_argument("--id", default=None)
+    try:
+        args = parser.parse_args(argv)
+    except SystemExit as error:
+        emit({"error": "invalid arguments"}, int(error.code or 2))
+    try:
+        data = load_catalogue(args.catalogue)
+    except (OSError, ValueError, ImportError) as error:
+        emit({"error": str(error)}, 1)
+    root = cache_root(data, args.cache_root)
+    if args.command == "list":
+        emit(cmd_list(data, args.need, args.kind))
+    if args.command == "freshness":
+        today = dt.date.fromisoformat(args.today) if args.today else dt.date.today()
+        emit(cmd_freshness(data, root, today, args.remote))
+    emit(cmd_refresh(data, root, args.id))
+
+
+if __name__ == "__main__":
+    main()

package/src/skills-lib/wizz-premium-landing-ui-researcher/scripts/tests/test_design_sources.py

@@ -0,0 +1,130 @@
+# /// script
+# requires-python = ">=3.10"
+# dependencies = ["pytest>=8.0", "ruamel.yaml>=0.18"]
+# ///
+"""Tests for design_sources.py: list by need tag, cache freshness, refresh."""
+
+import datetime as dt
+import importlib.util
+import json
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+SCRIPT = Path(__file__).resolve().parents[1] / "design_sources.py"
+REAL_CATALOGUE = Path(__file__).resolve().parents[2] / "references" / "design-sources.yaml"
+
+spec = importlib.util.spec_from_file_location("design_sources", SCRIPT)
+mod = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(mod)
+
+GIT_ENV = {
+    **os.environ,
+    "GIT_AUTHOR_NAME": "t",
+    "GIT_AUTHOR_EMAIL": "t@t",
+    "GIT_COMMITTER_NAME": "t",
+    "GIT_COMMITTER_EMAIL": "t@t",
+}
+
+
+def run_main(capsys, *argv):
+    with pytest.raises(SystemExit) as exit_info:
+        mod.main(list(argv))
+    return exit_info.value.code, json.loads(capsys.readouterr().out)
+
+
+def git(cwd, *args):
+    subprocess.run(["git", "-C", str(cwd), *args], check=True, capture_output=True, env=GIT_ENV)
+
+
+def make_clone(tmp_path, name):
+    upstream = tmp_path / f"{name}-upstream"
+    upstream.mkdir()
+    git(upstream, "init", "-q", "-b", "main")
+    (upstream / "a.txt").write_text("1", encoding="utf-8")
+    git(upstream, "add", "a.txt")
+    git(upstream, "commit", "-q", "-m", "one")
+    root = tmp_path / "cache"
+    root.mkdir(exist_ok=True)
+    subprocess.run(["git", "clone", "-q", str(upstream), str(root / name)], check=True, capture_output=True, env=GIT_ENV)
+    return upstream, root
+
+
+def write_catalogue(tmp_path, cache_name):
+    path = tmp_path / "sources.yaml"
+    path.write_text(
+        "version: 1\nmax_cache_age_days: 30\nsources:\n"
+        f"  - {{ id: demo, kind: registry, access: free, cache: {cache_name}, need_tags: [hover] }}\n"
+        "  - { id: paid, kind: code, access: paid, need_tags: [hover, card] }\n"
+        "  - { id: study, kind: visual, access: free, study_only: true, need_tags: [shader] }\n",
+        encoding="utf-8",
+    )
+    return path
+
+
+def test_real_catalogue_parses_and_every_source_has_tags(capsys):
+    code, out = run_main(capsys, "--catalogue", str(REAL_CATALOGUE), "list")
+    assert code == 0
+    assert out["count"] > 20
+    data = mod.load_catalogue(REAL_CATALOGUE)
+    for source in data["sources"]:
+        assert source.get("need_tags"), source["id"]
+        assert source.get("kind") in {"code", "registry", "engine", "visual", "taste", "extractor"}, source["id"]
+
+
+def test_real_catalogue_keeps_the_no_license_source_study_only():
+    data = mod.load_catalogue(REAL_CATALOGUE)
+    ali = next(source for source in data["sources"] if source["id"] == "ali-imam")
+    assert ali["study_only"] is True and ali["kind"] == "visual" and ali["license"] is None
+
+
+def test_list_filters_by_need_and_ranks_free_first(tmp_path, capsys):
+    catalogue = write_catalogue(tmp_path, "demo")
+    code, out = run_main(capsys, "--catalogue", str(catalogue), "list", "--need", "hover")
+    assert code == 0
+    assert [row["id"] for row in out["sources"]] == ["demo", "paid"]
+    _, shader = run_main(capsys, "--catalogue", str(catalogue), "list", "--need", "shader")
+    assert shader["sources"][0]["study_only"] is True
+
+
+def test_freshness_marks_old_sync_as_stale(tmp_path, capsys):
+    _, root = make_clone(tmp_path, "demo")
+    catalogue = write_catalogue(tmp_path, "demo")
+    future = (dt.date.today() + dt.timedelta(days=45)).isoformat()
+    code, out = run_main(capsys, "--catalogue", str(catalogue), "--cache-root", str(root), "freshness", "--today", future)
+    assert code == 0
+    assert out["stale"] == ["demo"]
+    row = out["caches"][0]
+    assert row["present"] is True and row["local_changes"] is False and row["age_days"] >= 45
+
+
+def test_freshness_today_is_fresh_and_absent_cache_is_reported(tmp_path, capsys):
+    _, root = make_clone(tmp_path, "demo")
+    catalogue = write_catalogue(tmp_path, "demo")
+    _, out = run_main(capsys, "--catalogue", str(catalogue), "--cache-root", str(root), "freshness")
+    assert out["stale"] == []
+    missing = write_catalogue(tmp_path, "nowhere")
+    _, absent = run_main(capsys, "--catalogue", str(missing), "--cache-root", str(root), "freshness")
+    assert absent["caches"][0]["present"] is False
+
+
+def test_refresh_fast_forwards_clean_clone_and_skips_dirty_one(tmp_path, capsys):
+    upstream, root = make_clone(tmp_path, "demo")
+    (upstream / "a.txt").write_text("2", encoding="utf-8")
+    git(upstream, "commit", "-q", "-am", "two")
+    catalogue = write_catalogue(tmp_path, "demo")
+    _, out = run_main(capsys, "--catalogue", str(catalogue), "--cache-root", str(root), "refresh")
+    assert out["caches"][0]["result"] == "updated"
+    (root / "demo" / "a.txt").write_text("local edit", encoding="utf-8")
+    _, dirty = run_main(capsys, "--catalogue", str(catalogue), "--cache-root", str(root), "refresh")
+    assert dirty["caches"][0]["result"] == "skipped: local changes"
+    assert (root / "demo" / "a.txt").read_text(encoding="utf-8") == "local edit"
+
+
+def test_bad_catalogue_is_a_json_error(tmp_path, capsys):
+    bad = tmp_path / "bad.yaml"
+    bad.write_text("nothing: here\n", encoding="utf-8")
+    code, out = run_main(capsys, "--catalogue", str(bad), "list")
+    assert code == 1 and "sources" in out["error"]

package/src/skills-lib/wizz-router/references/routing-table-flat.md

@@ -19,6 +19,8 @@ Use this table to map skills/CLIs/MCPs directly **outside a Wizz project** (no `
 | **Autonomous, offensive** pentest that actually runs the app and proves each finding with a real PoC | CLI `strix` (qa registry). CONDITIONAL, never the default: only on an app the user owns/is authorized to test, and only when they ask for validated exploitation rather than a review. Start from `wizz-security-audit-pentest` | 2 |
 | Error monitoring, crash/exception triage, releases and source maps in Sentry | CLI `sentry-cli` (architect registry). CONDITIONAL: only if the project ALREADY uses Sentry (`SENTRY_DSN` in env, `sentry.properties`, or `@sentry/` in package.json) and it's at production stage — never propose adopting Sentry from this row | 2 |
 | Launch-readiness audit, "is it ready to launch?", broad release checklist (technical, security, SEO, analytics, content, legal, infra), "what's missing before going to production" | `wizz-launch-readiness` | 1 |
+| Build, sign and install an iOS app on the iPhone from the command line without the Xcode IDE (SwiftPM + xtool), also from Linux or Windows/WSL | `wizz-ios-build` + CLI `xtool` (dev registry). Reviewing native UI against the HIG is CLI `apple-design`; TestFlight/App Store is out of scope | 2 |
+| Understand how a feature of a THIRD-PARTY app, Electron app, APK, binary or HAR capture works, without its source, to build a similar one | MCP `rea` (dev registry, optional: recommended, never configured by default; own code is `wizz-investigate`) | 2 |
 | Desktop, Electron, contextIsolation, code signing | `wizz-desktop-security` | 2 |
 
 ## Technical Area — Code and Quality
@@ -62,6 +64,8 @@ Use this table to map skills/CLIs/MCPs directly **outside a Wizz project** (no `
 | **Edit/cut video** (cuts, selects, roughcut) | CLI `buttercut` (designer registry; **Apple Silicon only**, clone-and-run in the project, heavy deps) | 1 |
 | Generate an AI video/image (Veo/Kling/Wan), UGC / ad-ready style | `wizz-ad-creative` writes the prompt for the user to paste into Flow or another AI tool. No generation API is integrated in the method | 1 |
 | Analyze/understand an existing video (frames + transcription) | CLI `claude-video` (designer registry; `npx skills add bradautomates/claude-video`) | 2 |
+| One-take product/app/skill film (10-60 s, no cuts, every beat grows out of the last) made WITH the onetake skill, for personal or noncommercial work | CLI `onetake` (designer registry; opt-in, project scope; PolyForm Noncommercial, client work needs onetake Pro). For client work the one-take technique is `wizz-video-effects` (one-take.md) in the HyperFrames → Remotion pipeline | 2 |
+| Hand-painted cartoon with Clawd, the Claude character (p5.js + p5.brush, 31 acted emotions), for a video where Claude itself appears | CLI `claude-animation-base` (designer registry; clone-and-run in the project). Without Claude as the character, the style is `wizz-video-styles` and the drawn scene is `hyperframes` | 2 |
 | Narration / voice / TTS / voice cloning for video | CLI `voicebox` (designer registry; local app with MCP endpoint) | 2 |
 | Research components compatible with the project | `wizz-ui-component-curator` (demos, code, and public registries with evidence) | 1 |
 
@@ -88,13 +92,15 @@ Use this table to map skills/CLIs/MCPs directly **outside a Wizz project** (no `
 | Tear down ONE viral Instagram post (Reel, carousel, caption) from its link: why it worked, which hook, a mould to do one like it | `wizz-hook-extractor` (social registry; reads the post itself) | 2 |
 | Audit and rewrite an Instagram PROFILE: bio, search NAME, link, highlights, pinned posts | `wizz-ig-profile-optimizer` (social registry) | 2 |
 | Actually PUBLISH/schedule to social networks (Instagram, TikTok, YouTube, LinkedIn and more), not write it | CLI `buffer` (social registry; needs `BUFFER_API_KEY`; media must be a public HTTPS URL). Separates "generate" (Wizz skills above) from "publish" | 2 |
+| VSL (video sales letter) script: expert interview, problem and solution mechanism, spoken offer, leads to test, production beat sheet | `wizz-vsl` (copy registry; the page around the player stays with `wizz-copywriting`) | 2 |
 | Cold email, B2B outbound, prospecting | `wizz-cold-email` | 2 |
 | Referral, referrals, affiliate program | `wizz-referral-program` | 2 |
 | Sales material, pitch, deck, proposal | `wizz-sales-enablement` | 2 |
 | Free lead-capture tool | `wizz-free-tool-strategy` | 2 |
 | A/B test, variations, conversion experiments | `wizz-ab-test-setup` + `wizz-analytics-tracking` | 2 |
 | Copywriting, copy, persuasion, sales text | `wizz-copywriting` + `wizz-humanizer` | 1 |
-| Offer audience research, VoC, angle matrix, info-product lexicon | `wizz-pesquisa-de-publico-do-piva` | 1 |
+| Offer audience research, VoC, angle matrix, info-product lexicon | `wizz-pesquisa-de-publico` | 1 |
+| Clone an expert's voice: a GPT/Project that answers students like them, from their lives, audios and posts | `wizz-clone-do-expert` (lowticket module). Persona of the buyer is `wizz-pesquisa-de-publico`; sales copy is `wizz-copywriting` | 1 |
 | Forge an offer, create an irresistible offer, unique mechanism, bonus, guarantee | `wizz-offer-forge` + `wizz-pricing-strategy` | 1 |
 | Market research, competitive intelligence | `deep-research` (external plugin — only if installed) | 2 |
 | Scrape/crawl the web for market research, lead prospecting or competitive intel (anti-bot bypass, adaptive parsing) | MCP `scrapling` (growth registry) — the collection layer under the research rows above | 2 |

package/src/skills-lib/wizz-seo-audit/SKILL.md

@@ -258,6 +258,9 @@ Reporting "no schema found" based solely on `web_fetch` or `curl` leads to false
 - No keyword cannibalization
 - Logical topical clusters
 
+**With Search Console access**
+- Pull the questions people typed with a regex filter on Queries, and check which ones no page answers. Patterns and the follow-up: [gsc-regex-perguntas](references/gsc-regex-perguntas.md)
+
 ---
 
 ## Content Quality Assessment
@@ -368,6 +371,7 @@ Same format as above
 ## References
 
 - [AI Writing Detection](references/ai-writing-detection.md): Common AI writing patterns to avoid (em dashes, overused phrases, filler words)
+- [Search Console regex](references/gsc-regex-perguntas.md): regex filters that surface the questions, buying-intent and problem queries people type, and what to do with them
 - For AI search optimization (AEO, GEO, LLMO, AI Overviews), see the **wizz-ai-seo** skill
 
 ---

package/src/skills-lib/wizz-seo-audit/references/gsc-regex-perguntas.md

@@ -0,0 +1,64 @@
+# Search Console: regex to find the questions people type
+
+The Queries report hides the most useful thing a site owner has: the exact questions people typed before landing on the site. A regex filter pulls them out in under a minute.
+
+## Where
+
+Search Console > Performance > Search results > **+ Add filter** > **Query** > **Custom (regex)** > "Matches regex". Set the date range to the last 3 or 6 months so low-volume questions show up.
+
+Rules of the filter (Google uses RE2):
+
+- Case-sensitive by default. Start with `(?i)` to ignore case.
+- `^` anchors at the start of the query; without it the word can appear anywhere.
+- Max 4096 characters. No lookahead/lookbehind.
+- "Doesn't match regex" is the inverse: use it to drop brand queries.
+
+## Patterns
+
+Questions, Portuguese:
+
+```text
+(?i)^(quem|que|o que|qual|quais|quando|onde|como|por que|porque|quanto|quantos|pode|posso|devo|vale a pena|é possível)\b
+```
+
+Questions, English:
+
+```text
+(?i)^(who|what|when|where|why|how|which|can|should|is|are|does|do|will)\b
+```
+
+Long queries (often conversational or from AI search surfaces):
+
+```text
+^(\S+\s){6,}\S+$
+```
+
+Buying intent:
+
+```text
+(?i)(comprar|preço|preco|valor|quanto custa|orçamento|orcamento|barato|melhor|vs|versus|alternativa|review|avaliação|price|cost|buy|best|alternative)
+```
+
+Problem and pain (good for top-of-funnel content):
+
+```text
+(?i)(não funciona|nao funciona|erro|problema|como resolver|como consertar|not working|error|fix|problem)
+```
+
+Drop the brand to see only non-branded demand (use with "Doesn't match regex"):
+
+```text
+(?i)(minhamarca|minha marca|mymarca)
+```
+
+## What to do with the result
+
+1. Export the list (top right > Export) and group the questions by theme.
+2. For each theme, check whether a page already answers it:
+   - Answered, but the page ranks below position 10: add the question as an H2/H3 with a direct answer in the first 40-60 words.
+   - Not answered: a new article or an FAQ block on the most relevant page.
+3. Questions with impressions and almost no clicks are the quick wins: the page shows up but the snippet does not answer.
+4. Feed buying-intent queries to the landing and pricing pages, not to the blog.
+5. Repeat every quarter: the list changes with the season and with AI search.
+
+FAQ schema helps the page be read correctly, but Google shows FAQ rich results only for a few authoritative sites; do not promise the rich result.

package/src/skills-lib/wizz-signup-flow-cro/SKILL.md

@@ -34,6 +34,7 @@ Before providing recommendations, understand:
 - `references/trust-and-post-submit.md` — trust copy near the form, error handling, microcopy, and the post-submit experience (success state, verification flows). Load when writing form-adjacent copy or designing what happens right after submit.
 - `references/measurement-output-patterns.md` — key metrics to track, the output format for an audit/redesign deliverable, and proven signup patterns by product type (B2B SaaS, B2C, waitlist, e-commerce). Load when instrumenting the flow, formatting a deliverable, or looking for a reference pattern.
 - `references/experiments.md` — a full experiment backlog (form design, copy/messaging, trial/commitment, post-submit) for A/B testing. Load when the deliverable needs a test plan.
+- `references/trial-abuse.md` — why "one trial per IP" blocks real users, and the risk score with three bands (let in / ask for a card or phone / deny) that replaces it. Load when the product has a free trial with a real per-user cost or the user mentions repeated trials, fake accounts or trial abuse.
 
 ## Task-Specific Questions
 

package/src/skills-lib/wizz-signup-flow-cro/references/trial-abuse.md

@@ -0,0 +1,40 @@
+# Free trial abuse: score the risk, don't block by IP
+
+## Why "one trial per IP" fails
+
+Four people share a house. One starts a free trial. The other three are blocked, because the server does not see four people: it sees one public IP. The same happens in offices, universities, hotels and on mobile networks, where carrier-grade NAT puts thousands of users behind a handful of addresses.
+
+Blocking by IP loses real signups (the most expensive kind of drop-off) and barely slows the abuser, who switches network or VPN in seconds.
+
+## What to do instead: a risk score with three bands
+
+Collect several weak signals at signup and at trial start, add them up, and route by band. No single signal decides.
+
+| Signal | Weight | Note |
+|---|---|---|
+| Disposable email domain | high | Keep a maintained list; update it |
+| Email already used with `+tag` or dot variations (Gmail) | high | Normalise before comparing |
+| Same device/browser fingerprint as a previous trial | high | Fingerprint libraries or the auth provider's device signal; disclose it in the privacy policy |
+| Same payment card fingerprint as a previous trial | very high | The payment provider exposes a card fingerprint without storing the card |
+| Many trials from the same IP **in a short window** | medium | Velocity, not the IP itself |
+| Datacenter/VPN/Tor IP | medium | Legit users use VPNs too; never block on this alone |
+| Phone number already verified on another account | high | Only if the flow already asks for a phone |
+| Bot-like behaviour (form filled in under a second, no mouse/touch events) | medium | Pair with an invisible challenge |
+
+Bands:
+
+1. **Low risk: let them in.** The normal flow, no extra field.
+2. **Medium risk: ask for more commitment.** Card upfront (not charged), phone verification, or a shorter trial. Say why in one line: "Para liberar o teste, confirme um cartão. Nada é cobrado agora."
+3. **High risk: deny the trial, keep the door open.** Offer the paid plan or a demo call. Never accuse; a generic "não foi possível liberar o teste para esta conta" is enough.
+
+## Rules
+
+- **Payment is the strongest signal.** A card fingerprint repeat is the one signal worth acting on alone.
+- **Tune with data.** Log the score and the band of every signup, then compare trial-to-paid and abuse rates per band after 30 days. Move the thresholds, not the signal list.
+- **Measure the cost of false positives.** Count how many real customers came through band 2. If band 2 converts well, the friction is fine; if it kills signups, lower the weights.
+- **Server side only.** The score is computed on the server; the client never sees the weights or the band logic.
+- **Privacy.** Fingerprinting and IP reputation are personal data processing: disclose them, keep only hashes where possible, and set a retention period.
+
+## When it is not worth it
+
+Low-cost products where a repeated trial costs little (no AI calls, SMS or heavy infra per user) are better served by a shorter trial or a freemium plan than by a scoring system. Build the score when each trial has a real per-user cost.

package/src/skills-lib/wizz-taste-skill/references/anti-slop-tells.md

@@ -91,6 +91,14 @@ These patterns came out of real LLM-generated landing-page tests. They are the s
 * **Scroll cues are banned.** `Scroll`, `↓ scroll`, `Scroll to explore`, `Scroll to walk through it`, animated mouse-wheel icons. If the user has not scrolled yet, they are looking at the hero. They know what scroll is. The bottom of the viewport does not need a label.
 * **ZERO decorative status dots by default.** A coloured dot before nav items, before list rows, before badges, before status labels is a Tell. Only acceptable when conveying real semantic state (a live indicator on actual server status, a live availability flag) and limited to one per page section.
 
+### 9.H Landing-page tells (Wizz addition, moved here from the landing Audit Protocol)
+* **NO identity-free hero formula.** Big headline + subtitle + two side-by-side CTAs, with nothing that could only belong to this brand.
+* **NO `rounded-3xl` on everything.** Radius is a scale with a reason per level, not one oversized value.
+* **NO card stacks on the default `shadow-xl`.** See Section 4.4 for tinted, purposeful elevation.
+* **NO generic testimonial card.** Round avatar + name + title + quoted sentence, repeated in a row. See Section 4.10 for quote formats.
+* **NO centered gradient "Most Popular" badge** on pricing cards.
+* **NO decorative emoji** anywhere other than status microcopy (policy in Section 3.D).
+
 ### 9.G EM-DASH BAN (the single most-violated Tell)
 
 **Em-dash (`—`) is COMPLETELY banned.** It is the LLM's signature stylistic crutch and it is the #1 visual Tell in production tests. There is no "limited use" allowance, no "natural language frequency" allowance, no "in body copy is fine" allowance. None.

package/src/skills-lib/wizz-ui-component-curator/SKILL.md

@@ -40,7 +40,7 @@ Do not ask the user to describe the style unless the project has no inspectable
 
 ## 2. Search and inspect public sources
 
-Start with existing project components. Then search the public sources. The full authorized list (React Bits, Cult UI, Watermelon, StyleUI, Skiper UI, Bklit UI, Componentry, shadcn/ui, Ali Imam for study only, plus the reference galleries) lives in one place: [component-sources](../wizz-premium-landing-ui-researcher/references/component-sources.md). Read it instead of relying on memory. Check which registries are healthy today in the live index (`https://ui.shadcn.com/r/registries.json`, see [source-first-protocol](../wizz-premium-landing-ui-researcher/references/source-first-protocol.md) Phase 3). Compare at least two suitable sources per need.
+Start with existing project components. Then search the public sources. The full authorized list (React Bits, Cult UI, Watermelon, StyleUI, Skiper UI, Bklit UI, Componentry, shadcn/ui, Ali Imam for study only, plus the reference galleries) lives in one place, as data: [design-sources.yaml](../wizz-premium-landing-ui-researcher/references/design-sources.yaml). Query it with `uv run --no-cache ../wizz-premium-landing-ui-researcher/scripts/design_sources.py list --need <tag>` instead of relying on memory; [component-sources](../wizz-premium-landing-ui-researcher/references/component-sources.md) holds the policy behind each row. Check which registries are healthy today in the live index (`https://ui.shadcn.com/r/registries.json`, see [source-first-protocol](../wizz-premium-landing-ui-researcher/references/source-first-protocol.md) Phase 3). Compare at least two suitable sources per need.
 
 Before the first query, open the access as described in [web-access-and-evidence](../wizz-premium-landing-ui-researcher/references/web-access-and-evidence.md): load the web tools (on Claude Code, WebSearch and WebFetch are deferred and need `ToolSearch`), then fall back to `curl`, `agent-browser` and the local source cache. Search with whatever that step opened: web search (Exa when configured, WebSearch otherwise), WebFetch, scrapling, and `agent-browser` to watch hover and motion live. A tool that errors or hangs is not the end of the research: record the failure, move to the next tool, and never stop without reporting what was and was not checked. With no web and no cache, return BLOCKED instead of recommending from memory.
 
@@ -53,20 +53,21 @@ Use the inferred style DNA as the search filter. Prefer:
 - components that can be integrated with minimal stylistic friction
 - effects that enhance the current direction rather than replace it
 
-## 3. Curate: show 1–3 candidates max
+## 3. Judge, select, stop
 
-Do not present unranked lists. Shortlist internally, then surface only the strongest matches.
+Judge every candidate with [mining-rubric](../wizz-premium-landing-ui-researcher/references/mining-rubric.md), in its order: evidence gate, dedup against what the project already selected, entry conditions, the 0-10 score with the cut at 6, the verdict. Select by its selection rule and close the need on its stop conditions (a 9 or more, the source budget, or 2 dry sources in a row). With a `design-state.yaml`, every candidate goes back as a discovery, rejected ones with their reason, so the next round does not open them again. Then run `uv run --no-cache ../wizz-design-needs/scripts/design_state.py validate {output_folder}/design-state.yaml` and fix its findings before handing off.
 
 Only candidates that pass the evidence gate in [web-access-and-evidence](../wizz-premium-landing-ui-researcher/references/web-access-and-evidence.md) can be shown here. The rest are UNVERIFIED and go to the evidence section.
 
-For each candidate, say briefly:
-- why it fits
+Show the selected one and at most two runners-up. For each, say briefly:
+- verdict and score
+- why it fits (the rubric's `por_que`)
 - what role it plays
 - any tradeoff
 
 ## 4. Plan before editing
 
-Provide a compact plan: what changes, which files, any dependency or styling adaptation needed.
+Write the adaptation in the rubric's order (pattern, why it works, invariant, variable, reimplementation), then a compact plan: what changes, which files, any dependency or styling adaptation needed. A visual reference gives structure and principle, never CSS.
 
 ## 5. Present evidence and proceed within scope
 
@@ -124,7 +125,7 @@ If the project is stylistically mixed: anchor to the direction already establish
 Short summary of inferred design language (3–5 lines max).
 
 ## Best fit
-Top recommendation + why it fits + role it plays.
+Top recommendation + verdict and score + why it fits + role it plays + which stop condition closed the need.
 
 ## Alternatives
 Up to 2 backup options only if genuinely different and useful.

package/src/skills-lib/wizz-ui-ux-pro-max/SKILL.md

@@ -45,4 +45,4 @@ Use one dominant intent and 2–5 meaningful terms per query. Verify the returne
 - `references/workflow-guide.md` — Python prerequisites + the complete 4-step workflow (analyze → generate design system with `--persist`/hierarchical page overrides → supplement with domain searches → stack guidelines) + a full worked example + tips. Load when actually executing a build/review, not just deciding whether to use the skill.
 - `references/rules-quick-reference.md` — the 8 priority rule categories (accessibility, touch, performance, layout, typography, animation, style, charts) with every rule ID inside each. Load when auditing existing code for UX issues.
 - `references/search-reference.md` — full table of the 10 search `--domain` values and 10 `--stack` values with example keywords, plus `--design-system` output format flags (ascii/markdown). Load when picking which domain/stack/format to search or output.
-- `references/common-rules-checklist.md` — commonly-missed "looks unprofessional" rules (icons, hover, light/dark contrast, spacing) as do/don't tables, plus the pre-delivery QA checklist. Load right before delivering UI code.
+- `references/common-rules-checklist.md` — commonly-missed "looks unprofessional" rules (icons, hover, light/dark contrast, spacing) as do/don't tables, plus the pre-delivery QA checklist and the design-system audit (list the failing items, fix 3, one at a time). Load right before delivering UI code or publishing.

package/src/skills-lib/wizz-ui-ux-pro-max/references/common-rules-checklist.md

@@ -74,3 +74,14 @@ Before delivering UI code, verify these items:
 - [ ] Form inputs have labels
 - [ ] Color is not the only indicator
 - [ ] `prefers-reduced-motion` respected
+
+## Design-System Audit (before publishing)
+
+Run this once the page or project is feature-complete, before publishing. It audits the system (tokens, components, states), not a single screen.
+
+1. Ask for the list: check the project against the Design System Checklist (https://www.designsystemchecklist.com/) and this file's checklist, and return **only the failing items**, each with the file or token where it fails. No fixes in this pass.
+2. Pick 3: the user chooses, or default to the 3 with the widest blast radius (a token or a shared component before a one-off screen).
+3. Fix one at a time: one item, show the diff, re-check that item, then the next. Never "fix everything" in one pass: it rewrites the project and breaks what already works.
+4. Repeat steps 2 and 3 only if the user asks; report the items left open.
+
+If the checklist site is unreachable, run the audit with this file's checklist alone and say so.