wizz-method 2.23.0 → 2.25.0

package/src/bmm-skills/1-analysis/wizz-document-project/scripts/test_dependencies.py

@@ -0,0 +1,148 @@
+"""Integration tests: WIZZ_DEPCRUISE=/absolute/path/to/depcruise python3 -m unittest discover ..."""
+import contextlib
+import importlib.util
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+SCRIPT = Path(__file__).with_name('dependencies.py')
+CRUISER = os.environ.get('WIZZ_DEPCRUISE')
+
+
+@unittest.skipUnless(CRUISER, 'Set WIZZ_DEPCRUISE to a real dependency-cruiser executable')
+class DependenciesTest(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name) / 'repo'
+        self.root.mkdir()
+        self.output = Path(self.temp.name) / 'output'
+        self.git('init', '-q')
+        self.git('config', 'user.email', 'fixture@example.invalid')
+        self.git('config', 'user.name', 'Dependency fixture')
+        self.write('tsconfig.json', json.dumps({'compilerOptions': {
+            'baseUrl': '.', 'paths': {'@/*': ['./src/*']}}}))
+        self.write('src/a.ts', 'import type { B } from "@/b";\nexport const load = () => import("./c");\n')
+        self.write('src/b.ts', 'export type B = number;\n')
+        self.write('src/c.ts', 'import "./b";\n')
+        self.git('add', '.')
+        self.git('commit', '-qm', 'test: fixture')
+
+    def write(self, name, text):
+        path = self.root / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text)
+
+    def git(self, *args):
+        return subprocess.check_output(['git', *args], cwd=self.root).decode()
+
+    def cli(self, command, *args):
+        return json.loads(subprocess.check_output([
+            sys.executable, str(SCRIPT), '--root', str(self.root),
+            '--output', str(self.output), command, *args]))
+
+    def scan(self):
+        return self.cli('scan', '--cruiser', CRUISER, '--tsconfig', 'tsconfig.json')
+
+    def graph(self):
+        return json.loads((self.output / 'graph.json').read_text())
+
+    def test_alias_type_dynamic_transitive_and_noop(self):
+        self.assertEqual(self.scan()['modules_parsed'], 3)
+        graph = self.graph()
+        self.assertEqual({d['resolved'] for d in graph['modules']['src/a.ts']},
+                         {'src/b.ts', 'src/c.ts'})
+        self.assertEqual(self.cli('refresh', '--cruiser', CRUISER, '--tsconfig', 'tsconfig.json'), dict(source_hash_reads=0, modules_parsed=0, source_count=3))
+        files = self.output / 'files.json'
+        files.write_text('["src/b.ts"]')
+        impact = self.cli('impact', '--files', str(files))
+        self.assertEqual(impact['direct'], ['src/a.ts', 'src/c.ts'])
+        self.assertEqual(impact['transitive'], [])
+
+    def test_noop_rejects_any_source_hash_read(self):
+        self.scan()
+        spec = importlib.util.spec_from_file_location('dependencies', SCRIPT)
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        original = Path.read_bytes
+
+        def guarded_read(path):
+            if path.suffix in module.EXTENSIONS:
+                self.fail('Unchanged source was reread: ' + str(path))
+            return original(path)
+
+        argv = [str(SCRIPT), '--root', str(self.root), '--output', str(self.output),
+                'scan', '--cruiser', CRUISER, '--tsconfig', 'tsconfig.json']
+        with patch.object(Path, 'read_bytes', guarded_read), patch.object(sys, 'argv', argv):
+            with contextlib.redirect_stdout(io.StringIO()) as stdout:
+                module.main()
+        self.assertEqual(json.loads(stdout.getvalue())['modules_parsed'], 0)
+
+    def test_incremental_commit_and_dirty_edits(self):
+        self.scan()
+        old_commit = self.graph()['commit']
+        self.write('src/b.ts', 'export type B = string;\n')
+        self.assertEqual(self.scan()['modules_parsed'], 1)
+        self.git('add', '.')
+        self.git('commit', '-qm', 'test: change type')
+        self.assertEqual(self.scan()['modules_parsed'], 0)
+        self.assertEqual(self.graph()['commit_changes'], ['src/b.ts'])
+        self.assertEqual(self.cli('impact', '--base', old_commit)['touched'], ['src/b.ts'])
+
+    def test_deleted_import_retains_previous_edges_after_noop(self):
+        self.scan()
+        self.write('src/c.ts', '')
+        self.scan()
+        self.scan()
+        files = self.output / 'files.json'
+        files.write_text('["src/b.ts"]')
+        self.assertIn('src/c.ts', self.cli('impact', '--files', str(files))['direct'])
+        (self.root / 'src/b.ts').unlink()
+        self.assertEqual(self.scan()['modules_parsed'], 2)
+        self.assertNotIn('src/b.ts', self.graph()['modules'])
+
+    def test_untracked_addition_and_config_invalidation(self):
+        self.scan()
+        self.write('src/new.ts', 'import "./a";\n')
+        self.assertEqual(self.scan()['modules_parsed'], 4)
+        self.write('tsconfig.json', '{"compilerOptions": {"baseUrl": "."}}')
+        self.assertEqual(self.scan()['modules_parsed'], 4)
+
+    def test_diff_paths_with_spaces_export_links_and_stale_cleanup(self):
+        self.write('src/has space.ts', 'import "./b"; import "external-test-module";\n')
+        self.git('add', '.')
+        self.git('commit', '-qm', 'test: spaces')
+        self.scan()
+        self.write('src/has space.ts', 'import "./c";\n')
+        diff = self.output / 'change.diff'
+        diff.write_text(self.git('diff', 'HEAD'))
+        self.assertEqual(self.cli('impact', '--diff', str(diff))['touched'], ['src/has space.ts'])
+        self.cli('export')
+        notes = self.output / 'obsidian'
+        self.assertEqual(len(list(notes.glob('*.md'))), 4)
+        self.assertTrue(any('[[' in p.read_text() for p in notes.glob('*.md')))
+        self.assertTrue(any('[[external-' in p.read_text() for p in notes.glob('*.md')))
+        (notes / 'module-stale.md').write_text('stale')
+        self.cli('export')
+        self.assertFalse((notes / 'module-stale.md').exists())
+
+    def test_cycle_and_diff_rename(self):
+        self.write('src/b.ts', 'import "./a"; export type B = number;\n')
+        self.scan()
+        files = self.output / 'files.json'
+        files.write_text('["src/b.ts"]')
+        self.assertEqual(self.cli('impact', '--files', str(files))['transitive'], [])
+        self.git('mv', 'src/c.ts', 'src/renamed.ts')
+        diff = self.output / 'rename.diff'
+        diff.write_text(self.git('diff', '--cached', '-M'))
+        self.assertEqual(self.cli('impact', '--diff', str(diff))['touched'], ['src/c.ts', 'src/renamed.ts'])
+
+
+if __name__ == '__main__':
+    unittest.main()

package/src/bmm-skills/1-analysis/wizz-document-project/scripts/test_dependencies_unit.py

@@ -0,0 +1,183 @@
+"""Always-run behavioral tests: Git fixtures and controlled scanner boundary, no npm tool."""
+import contextlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
+
+SPEC = importlib.util.spec_from_file_location('dependencies', Path(__file__).with_name('dependencies.py'))
+dep = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(dep)
+
+
+class DependencyUnitTest(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name) / 'repo'
+        self.root.mkdir()
+        self.output = Path(self.temp.name) / 'cache'
+        self.git('init', '-q')
+        self.git('config', 'user.email', 'fixture@example.invalid')
+        self.git('config', 'user.name', 'Fixture')
+        self.write('src/a.js', 'import "./b.js";\n')
+        self.write('src/b.js', 'export default 1;\n')
+        self.git('add', '.')
+        self.git('commit', '-qm', 'test: baseline')
+        self.edges = {'src/a.js': [{'module': './b.js', 'resolved': 'src/b.js'}], 'src/b.js': []}
+        self.args = SimpleNamespace(cruiser=sys.executable, tsconfig=None)
+
+    def git(self, *args):
+        return subprocess.check_output(['git', *args], cwd=self.root)
+
+    def write(self, name, text):
+        target = self.root / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(text)
+
+    def scan(self):
+        original = dep.run
+
+        def boundary(root, *args):
+            if args[0] == 'git':
+                return original(root, *args)
+            if args[-1] == '--version':
+                return 'fixture-version'
+            if args[-1] == '--info':
+                return 'typescript available'
+            batch = args[args.index('--') + 1:]
+            return json.dumps({'modules': [{'source': name, 'dependencies': self.edges.get(name, [])} for name in batch]})
+
+        with patch.object(dep, 'run', boundary), contextlib.redirect_stdout(io.StringIO()) as stdout:
+            dep.scan(self.args, self.root, self.output)
+        return json.loads(stdout.getvalue())
+
+    def impact(self, files):
+        selection = Path(self.temp.name) / 'files.json'
+        selection.write_text(json.dumps(files))
+        args = SimpleNamespace(base=None, files=str(selection))
+        with contextlib.redirect_stdout(io.StringIO()) as stdout:
+            dep.impact(args, self.root, self.output)
+        return json.loads(stdout.getvalue())
+
+    def test_deleted_edges_survive_multiple_changed_scans_and_commit(self):
+        self.scan()
+        baseline = dep.load_graph(self.output, self.root)['baseline_commit']
+        (self.root / 'src/b.js').unlink()
+        self.edges['src/a.js'] = []
+        self.scan()
+        for i in range(3):
+            self.write('src/unrelated.js', f'export default {i};\n')
+            self.scan()
+        self.git('add', '.')
+        self.git('commit', '-qm', 'test: remove')
+        self.scan()
+        self.assertEqual(self.impact(['src/b.js'])['direct'], ['src/a.js'])
+        self.assertEqual(dep.load_graph(self.output, self.root)['baseline_commit'], baseline)
+
+    def test_asset_create_delete_and_config_changes_invalidate_importer(self):
+        self.edges['src/a.js'] = [{'module': './data.json', 'couldNotResolve': True}]
+        self.scan()
+        self.write('src/data.json', '{}')
+        self.edges['src/a.js'] = [{'module': './data.json', 'resolved': 'src/data.json'}]
+        self.assertEqual(self.scan()['modules_parsed'], 2)
+        self.assertEqual(self.impact(['src/data.json'])['direct'], ['src/a.js'])
+        self.write('src/data.json', '{"resolve": 1}')
+        self.assertEqual(self.scan()['modules_parsed'], 2)
+        (self.root / 'src/data.json').unlink()
+        self.edges['src/a.js'] = [{'module': './data.json', 'couldNotResolve': True}]
+        self.assertEqual(self.scan()['modules_parsed'], 2)
+        self.assertTrue(dep.load_graph(self.output, self.root)['modules']['src/a.js'][0]['couldNotResolve'])
+
+    def test_noop_reuses_source_hashes(self):
+        self.scan()
+        original = dep.digest
+        def digest(target):
+            self.assertNotIn(target.suffix, dep.EXTENSIONS)
+            return original(target)
+        with patch.object(dep, 'digest', digest):
+            self.assertEqual(self.scan()['source_hash_reads'], 0)
+
+    def test_recovery_corruption_unknown_commit_and_unborn_repository(self):
+        self.scan()
+        (self.output / 'graph.json').write_text('{bad')
+        self.assertEqual(self.scan()['modules_parsed'], 2)
+        graph = dep.load_graph(self.output, self.root)
+        graph['commit'] = 'f' * 40
+        dep.save(self.output / 'graph.json', graph)
+        self.assertEqual(self.scan()['modules_parsed'], 2)
+        self.git('checkout', '--orphan', 'unborn')
+        self.assertEqual(self.scan()['modules_parsed'], 0)
+        self.assertIsNone(dep.load_graph(self.output, self.root)['commit'])
+
+    def test_cache_never_supplies_executable_and_repo_tool_is_rejected(self):
+        self.scan()
+        marker = self.root / 'executed'
+        tool = self.root / 'payload'
+        tool.write_text('#!/bin/sh\ntouch ' + str(marker) + '\n')
+        tool.chmod(0o700)
+        graph = dep.load_graph(self.output, self.root)
+        graph['config']['cruiser'] = str(tool)
+        dep.save(self.output / 'graph.json', graph)
+        argv = ['dependencies.py', '--root', str(self.root), '--output', str(self.output), 'refresh']
+        with patch.dict('os.environ', {}, clear=True), patch.object(sys, 'argv', argv):
+            with self.assertRaisesRegex(ValueError, 'trusted absolute'):
+                dep.main()
+        with self.assertRaisesRegex(ValueError, 'outside'):
+            dep.trusted_tool(self.root, str(tool))
+        self.assertFalse(marker.exists())
+        self.assertFalse(dep.canonical_output(self.root).is_relative_to(self.root))
+
+    def test_files_normalize_reject_invalid_and_distinguish_transitive(self):
+        self.edges['src/c.js'] = [{'module': './a.js', 'resolved': 'src/a.js'}]
+        self.write('src/c.js', 'import "./a.js";')
+        self.scan()
+        result = self.impact(['./src/b.js', str(self.root / 'src/b.js')])
+        self.assertEqual(result['touched'], ['src/b.js'])
+        self.assertEqual(result['direct'], ['src/a.js'])
+        self.assertEqual(result['transitive'], ['src/c.js'])
+        for value in ({}, 'src/b.js', [None], [5], [''], ['../outside'], ['/outside']):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                self.impact(value)
+
+    def test_diff_default_no_prefix_relative_rename_non_utf8_and_bad_input(self):
+        self.write('src/a.js', 'import "./b.js";\n// change\n')
+        diff = Path(self.temp.name) / 'changes.diff'
+        for flags in ([], ['--no-prefix']):
+            diff.write_bytes(self.git('diff', *flags))
+            self.assertEqual(dep.diff_files(self.root, diff), ['src/a.js'])
+        standard_diff = self.git('diff')
+        self.write('src/b.js', 'export default 2;\n')
+        no_prefix_diff = self.git('diff', '--no-prefix', '--', 'src/b.js')
+        diff.write_bytes(standard_diff + no_prefix_diff)
+        self.assertEqual(dep.diff_files(self.root, diff), ['src/a.js', 'src/b.js'])
+        self.git('checkout', '--', 'src/b.js')
+        diff.write_bytes(self.git('diff', '--relative=src', '--no-prefix'))
+        self.assertEqual(dep.diff_files(self.root, diff, 'src'), ['src/a.js'])
+        self.git('mv', 'src/b.js', 'src/new name.js')
+        diff.write_bytes(self.git('diff', '--cached', '-M'))
+        self.assertEqual(dep.diff_files(self.root, diff), ['src/b.js', 'src/new name.js'])
+        (self.root / 'src/a.js').write_bytes(b'// invalid utf8: \xff\n')
+        diff.write_bytes(self.git('diff'))
+        self.assertEqual(dep.diff_files(self.root, diff), ['src/a.js'])
+        self.write('a/old.js', 'export default 1;\n')
+        self.git('add', 'a/old.js')
+        self.git('commit', '-qm', 'test: no-prefix rename base')
+        (self.root / 'b').mkdir()
+        self.git('mv', 'a/old.js', 'b/new.js')
+        diff.write_bytes(self.git('diff', '--cached', '-M', '--no-prefix'))
+        self.assertEqual(dep.diff_files(self.root, diff), ['a/old.js', 'b/new.js'])
+        for data in (b'', b'garbage', b'diff --git a/x b/x\n@@ invalid'):
+            diff.write_bytes(data)
+            with self.assertRaises((ValueError, subprocess.CalledProcessError)):
+                dep.diff_files(self.root, diff)
+
+
+if __name__ == '__main__':
+    unittest.main()

package/src/bmm-skills/1-analysis/wizz-document-project/templates/deep-dive-template.md

@@ -14,6 +14,15 @@
 **Key Responsibilities:** {{responsibilities}}
 **Integration Points:** {{integration_summary}}
 
+## Static Dependency Map
+
+Graph: {{dependency_graph_path}} — commit {{dependency_graph_commit}}.
+Stable baseline: {{dependency_graph_baseline_commit}}.
+Obsidian notes: {{dependency_notes_path}}.
+Use the external-cache convention in shared docs; keep absolute local paths out of Git.
+Coverage, unresolved imports and cache metrics: {{dependency_map_status}}.
+Manual visual acceptance in Obsidian: {{dependency_visual_acceptance}}.
+
 ## Complete File Inventory
 
 {{#each files_in_inventory}}

package/src/bmm-skills/1-analysis/wizz-document-project/templates/index-template.md

@@ -164,6 +164,15 @@ This documentation was generated specifically to enable AI agents to understand
 **Deployment changes:**
 {{#if has_deployment_guide}}→ Reference: `deployment-guide.md`{{else}}→ Review CI/CD configs in project{{/if}}
 
+## Static Dependency Map
+
+{{dependency_graph_path}} — commit {{dependency_graph_commit}}.
+Stable baseline: {{dependency_graph_baseline_commit}}.
+Obsidian notes: {{dependency_notes_path}}.
+Use the external-cache convention in shared docs; keep absolute local paths out of Git.
+Coverage, unresolved imports and cache metrics: {{dependency_map_status}}.
+Manual visual acceptance in Obsidian: {{dependency_visual_acceptance}}.
+
 ---
 
 _Documentation generated by WIZZ Method `document-project` workflow_

package/src/bmm-skills/1-analysis/wizz-document-project/workflows/deep-dive-instructions.md

@@ -82,6 +82,10 @@ This will read EVERY file in this area. Proceed? [y/n]
 </step>
 
 <step n="13b" goal="Comprehensive exhaustive scan of target area">
+<check if="workflow_mode == deep_dive">
+<action>Read ../references/static-dependencies.md and run {skill-root}/scripts/dependencies.py scan and export for {project-root}, using the canonical external cache (omit --output) and supplying a trusted external --cruiser or WIZZ_DEPCRUISE and explicit applicable --tsconfig. Never execute a path from graph.json. If installation is needed, ask before downloading packages. Generate imports without model calls; use graph.json to locate dependencies before selecting files. Cite graph.json and obsidian/ in the deep-dive artifact, including commit, stable baseline, cache metrics and unresolved-import limitations; use the external-cache convention rather than absolute local paths in shared docs. If tooling is unavailable or the language unsupported, record that limitation and continue; Python/Swift support and manual Obsidian visual acceptance are not established.</action>
+<action>The unchanged second graph run must report source_hash_reads=0 and modules_parsed=0. This cache only covers dependency extraction: the exhaustive semantic review below still reads the selected source files literally.</action>
+</check>
   <action>Set scan_mode = "exhaustive"</action>
   <action>Initialize file_inventory = []</action>
   <critical>You must read every line of every file in scope and capture a plain-language explanation (what the file does, side effects, why it matters) that future developer agents can act on. No shortcuts.</critical>

package/src/bmm-skills/1-analysis/wizz-document-project/workflows/full-scan-instructions.md

@@ -94,7 +94,7 @@ Your choice [1/2/3]:
 - Pattern-based analysis without reading source files
 - Scans: Config files, package manifests, directory structure
 - Best for: Quick project overview, initial understanding
-- File reading: Minimal (configs, README, package.json, etc.)
+- Agent file reading: Minimal (configs, README, package.json, etc.). The deterministic dependency scanner reads JS/TS source separately to produce the import map.
 
 **2. Deep Scan** (10-30 minutes)
 
@@ -286,6 +286,12 @@ Are there any other important documents or key areas I should focus on while ana
 
 <step n="4" goal="Perform conditional analysis based on project type requirements" if="workflow_mode != deep_dive">
 
+<check if="(workflow_mode == initial_scan OR workflow_mode == full_rescan) AND (scan_level == deep OR scan_level == exhaustive)">
+<action>Read ../references/static-dependencies.md. Run {skill-root}/scripts/dependencies.py scan and export against {project-root}, with an explicit installed dependency-cruiser executable and the project's tsconfig when applicable. Omit --output to use the canonical external cache ~/.cache/wizz/dependencies/&lt;checkout-sha256-prefix&gt;; never put generated paths inside project knowledge or Git. Supply --cruiser from a trusted external installation or WIZZ_DEPCRUISE; never use the value in graph.json. If installation is needed, ask before downloading packages. Do not call a model to extract imports or infer unresolved edges.</action>
+<action>Read the resulting graph.json and record its external-cache convention, commit, stable baseline, source coverage, unresolved imports and cache metrics. Cite graph.json and obsidian/ in the generated index and architecture documentation. On an unchanged second run, require source_hash_reads=0 and modules_parsed=0; configuration/cache metadata may still be read.</action>
+<action>If prerequisites or supported JS/TS sources are unavailable, record the map as unavailable with the concrete reason; do not claim Python/Swift support or fabricate a graph. Continue the existing documentation workflow with that limitation. Export validation does not complete the pending manual Obsidian visual acceptance.</action>
+</check>
+
 <critical>BATCHING STRATEGY FOR DEEP/EXHAUSTIVE SCANS</critical>
 
 <check if="scan_level == deep OR scan_level == exhaustive">

package/src/bmm-skills/4-implementation/wizz-code-review/customize.toml

@@ -83,6 +83,25 @@ review_critical_paths = [
   "secrets, keys and .env files",
   "cryptography",
   "CI and deploy workflows",
+  "deletion of user or production data",
+  "external sends and publishing (e-mail, webhooks, posts, public pages)",
+  "personal data (PII) and user data handling",
+  "infrastructure and DNS",
+  "new or replaced dependencies",
+]
+
+# Fixed floor for the `critical` tier: git pathspec globs. Any changed file
+# matching one forces `critical` before the session judges anything; the
+# session's judgment can only raise from there, never lower. Model
+# confidence never lowers it either. See references/review-economy.md § 2.
+
+review_critical_globs = [
+  "**/migrations/**",
+  "**/*.sql",
+  ".github/workflows/**",
+  "**/.env*",
+  "**/middleware.*",
+  "**/Dockerfile*",
 ]
 
 # Review layers for the review step. `instruction` is the layer's whole

package/src/bmm-skills/4-implementation/wizz-code-review/references/review-economy.md

@@ -37,7 +37,11 @@ The session reads the file list (`git diff --name-status`) and, when unsure, the
 
 **Provided or pasted diffs, and no VCS.** There is no `git --numstat` to read. Count `files` from the diff's own `diff --git` (or, lacking that, `+++`) headers, and `changed_lines` from the `+`/`-` body lines (the `+++`/`---` header lines themselves don't count). The table above applies without exception in both workflows — `small` included.
 
-`{workflow.review_critical_paths}` is a plain-language list of sensitive areas, not a pattern list. Default: authentication, sessions, passwords and credentials, authorization, permissions and RLS, payments, billing and checkout, database migrations, schema and SQL, secrets, keys and `.env` files, cryptography, CI and deploy workflows. Judge by meaning, not by substring: a security check added inside an otherwise generic file counts as `critical`; a document that merely talks about auth does not.
+**Fixed floor first.** Before any judgment, match the changed file list against `{workflow.review_critical_globs}` (git pathspec globs; default: `**/migrations/**`, `**/*.sql`, `.github/workflows/**`, `**/.env*`, `**/middleware.*`, `**/Dockerfile*`). Any match sets the tier to `critical`, and nothing below can lower it. CI files sit on the floor because a change there can weaken the very checks that review relies on.
+
+`{workflow.review_critical_paths}` is a plain-language list of sensitive areas, not a pattern list. Default: authentication, sessions, passwords and credentials, authorization, permissions and RLS, payments, billing and checkout, database migrations, schema and SQL, secrets, keys and `.env` files, cryptography, CI and deploy workflows, deletion of user or production data, external sends and publishing (e-mail, webhooks, posts, public pages), personal data (PII) and user data handling, infrastructure and DNS, new or replaced dependencies. Judge by meaning, not by substring: a security check added inside an otherwise generic file counts as `critical`; a document that merely talks about auth does not.
+
+**Model confidence does not count.** A confidence the executor or a reviewer states about its own output never lowers the tier, never drops a layer, and never skips review: self-reported LLM confidence is poorly calibrated and runs high.
 
 Raise the tier when in doubt, never lower it — a change that clearly touches something the list above doesn't name (e.g. a data migration done in application code) still earns `critical`. State the tier, the reason and the resulting layer count to the user before launching any layer.
 

package/src/bmm-skills/4-implementation/wizz-code-review/steps/step-01-gather-context.md

@@ -15,7 +15,7 @@ story_key: '' # set at runtime when discovered from sprint status
 
 - YOU MUST ALWAYS SPEAK OUTPUT in your Agent communication style with the config `{communication_language}`
 - The prompt that triggered this workflow IS the intent — not a hint.
-- Writing `{diff_file}`, `{clean_diff_file}` and the claims file is the only change this step may make. Otherwise it is read-only.
+- Before CHECKPOINT, writing `{diff_file}`, `{clean_diff_file}` and the claims file is the only change this step may make. After confirmation, the optional static-impact refresh may update only its external cache and temporary metrics.
 
 ## INSTRUCTIONS
 
@@ -79,7 +79,7 @@ story_key: '' # set at runtime when discovered from sprint status
    - **Otherwise:** build `{clean_diff_file}` per § 1 — the identical git command that wrote `{diff_file}` for the chosen source, plus one `:(top,exclude,glob)<pattern>` pathspec per entry in `{workflow.review_exclude}`, appended after the positive pathspecs. For **uncommitted changes**, also append untracked files to `{clean_diff_file}` the same way they were appended to `{diff_file}`, but listed with the positive-plus-exclude pathspecs from § 1 so any excluded file is skipped. Get `files` and `changed_lines` from `git -C "$TOP" diff --no-ext-diff --no-color --no-textconv --numstat` with the same source args and pathspecs, plus per-file `git -C "$TOP" diff --no-index --numstat -- /dev/null <path>` for the untracked ones (§ 1).
    - If a git command in this instruction fails: delete any partially written `{clean_diff_file}` temp file, then set `{clean_diff_file}` = `{diff_file}` and `{tier}` = `critical`, say so, and continue.
    - If nothing is left after exclusions (`{clean_diff_file}` is empty, untracked files included, even though `{diff_file}` is non-empty): HALT, list the exclusions, and ask the user whether to review the raw diff anyway. If they do, set `{clean_diff_file}` = `{diff_file}` and pick the tier per § 2 from the raw diff. If they decline, delete `{diff_file}` (when `{diff_file_owned}` is true) and `{clean_diff_file}` per § 5 and end the workflow.
-   - Otherwise, pick the tier per § 2: read `git diff --name-status` for the same source (and the relevant hunks when unsure) and judge it against `{workflow.review_critical_paths}`.
+   - Otherwise, pick the tier per § 2: read `git diff --name-status` for the same source; if any changed path matches `{workflow.review_critical_globs}`, the tier is `critical` (fixed floor). Otherwise read the relevant hunks when unsure and judge it against `{workflow.review_critical_paths}`.
    - State the tier, the reason, and the resulting Forte subagent count to the user before launching any layer.
 
 5. **Stage the claims file.** Collect the change's own narrative: for a branch diff or commit range, the commit messages it covers (`git log <base>..<head>`); for other sources, whatever description of the change the user or conversation supplied. Write it verbatim to a uniquely-named file in the system temp directory and set `{claims_file}` to its path. If there is no narrative, set `{claims_file}` = `''`. Do not analyze or summarize the narrative — it is input for one review layer, staged as a file precisely so the other layers never see it.
@@ -103,6 +103,31 @@ story_key: '' # set at runtime when discovered from sprint status
 
 Present a summary before proceeding: diff stats (files changed, lines added/removed), the excluded files — the file paths present in `{diff_file}` but absent from `{clean_diff_file}`, each with the exclusion pattern that matched it — `{tier}` and how many Forte review subagents that tier will launch, `{review_mode}`, and loaded spec/context docs (if any). HALT and wait for user confirmation to proceed. If the user declines, delete `{diff_file}` (when `{diff_file_owned}` is true), `{clean_diff_file}`, and `{claims_file}` (when non-empty) per `references/review-economy.md` § 5, and end the workflow.
 
+### Static dependency impact — only after the confirmed CHECKPOINT
+
+Locate the installed `wizz-document-project` skill. Its canonical cache is
+`~/.cache/wizz/dependencies/<checkout-sha256-prefix>`: omit `--output` for both
+commands so the script computes the same directory from the resolved checkout
+root. Check for that cache without executing anything recorded inside it.
+
+After the checkpoint is confirmed, run `dependencies.py --root <root> refresh`
+with a trusted absolute external `--cruiser` (or `WIZZ_DEPCRUISE`) and explicit
+`--tsconfig` when applicable, then `dependencies.py --root <root> impact --diff
+{diff_file}`. Use the full selected diff, including manifests and lockfiles;
+`{clean_diff_file}` remains the review layers' input. For a supplied diff made
+with Git `--relative`, supply its known `--diff-relative <directory>` or report
+impact unavailable until its path base is known. Never guess the executable from
+`graph.json` or download/install a scanner implicitly. Keep refresh metrics in a
+temp file; read only touched/direct/transitive output for review context.
+
+Name the graph's commit and stable baseline, unresolved-import limits and the
+conservative union of all observed edges since that baseline. Multiple refreshes
+preserve removed edges; this can over-report impact. A cache created after the
+diff cannot recover historical edges it never observed. Without a trusted tool,
+valid cache or valid diff, state “static impact unavailable” and continue review.
+An empty list is never proof of no runtime impact. No additional review layer or
+model import extraction is introduced.
+
 ## NEXT
 
 Read fully and follow `./step-02-review.md`

package/src/bmm-skills/4-implementation/wizz-code-review/steps/step-02-review.md

@@ -14,6 +14,8 @@ layer_status: '' # set at runtime: every configured layer's id marked active or
 
 ## INSTRUCTIONS
 
+0. **Subagent guard.** Before anything else, check that you can launch subagents (in Claude Code, the `Agent` tool is in your tool list). If you can't because you are yourself running inside a subagent (a `wizz-exec-*` or any delegated agent), delete `{diff_file}`, `{clean_diff_file}` and any findings temp files per `references/review-economy.md` § 5, then HALT with status `blocked` and blocking condition `rodando dentro de subagente: wizz-code-review roda na sessão principal`. Return no verdict and no findings, and never fall back to reading the diff yourself in a single pass. The separate-session fallback in instruction 3 is only for a main session on a platform without subagents.
+
 1. The review layers are `{workflow.review_layers}`, resolved during activation. If `{tier}` is empty or not one of `small`/`normal`/`critical`, set it to `critical` now and tell the user why, per `references/review-economy.md` § 2.
 
 2. For each layer in `{workflow.review_layers}`, record the outcome in `{layer_status}` as you go:

package/src/bmm-skills/4-implementation/wizz-dev-story/SKILL.md

@@ -492,7 +492,7 @@ Activation is complete. If `activation_steps_prepend` or `activation_steps_appen
       - Review the implemented story and test the changes
       - Verify all acceptance criteria are met
       - Ensure deployment readiness if applicable
-      - Run `code-review` workflow for peer review
+      - Run `wizz-code-review` for peer review, in the main session (never delegated to a subagent, and never by the executor that implemented the story)
       - Optional: If Test Architect module installed, run the Test Architect `automate` workflow to expand guardrail tests
     </action>
 

package/src/bmm-skills/4-implementation/wizz-quick-dev/customize.toml

@@ -83,6 +83,25 @@ review_critical_paths = [
   "secrets, keys and .env files",
   "cryptography",
   "CI and deploy workflows",
+  "deletion of user or production data",
+  "external sends and publishing (e-mail, webhooks, posts, public pages)",
+  "personal data (PII) and user data handling",
+  "infrastructure and DNS",
+  "new or replaced dependencies",
+]
+
+# Fixed floor for the `critical` tier: git pathspec globs. Any changed file
+# matching one forces `critical` before the session judges anything; the
+# session's judgment can only raise from there, never lower. Model
+# confidence never lowers it either. See references/review-economy.md § 2.
+
+review_critical_globs = [
+  "**/migrations/**",
+  "**/*.sql",
+  ".github/workflows/**",
+  "**/.env*",
+  "**/middleware.*",
+  "**/Dockerfile*",
 ]
 
 # Review layers for the review step. `instruction` is the layer's whole

package/src/bmm-skills/4-implementation/wizz-quick-dev/references/review-economy.md

@@ -37,7 +37,11 @@ The session reads the file list (`git diff --name-status`) and, when unsure, the
 
 **Provided or pasted diffs, and no VCS.** There is no `git --numstat` to read. Count `files` from the diff's own `diff --git` (or, lacking that, `+++`) headers, and `changed_lines` from the `+`/`-` body lines (the `+++`/`---` header lines themselves don't count). The table above applies without exception in both workflows — `small` included.
 
-`{workflow.review_critical_paths}` is a plain-language list of sensitive areas, not a pattern list. Default: authentication, sessions, passwords and credentials, authorization, permissions and RLS, payments, billing and checkout, database migrations, schema and SQL, secrets, keys and `.env` files, cryptography, CI and deploy workflows. Judge by meaning, not by substring: a security check added inside an otherwise generic file counts as `critical`; a document that merely talks about auth does not.
+**Fixed floor first.** Before any judgment, match the changed file list against `{workflow.review_critical_globs}` (git pathspec globs; default: `**/migrations/**`, `**/*.sql`, `.github/workflows/**`, `**/.env*`, `**/middleware.*`, `**/Dockerfile*`). Any match sets the tier to `critical`, and nothing below can lower it. CI files sit on the floor because a change there can weaken the very checks that review relies on.
+
+`{workflow.review_critical_paths}` is a plain-language list of sensitive areas, not a pattern list. Default: authentication, sessions, passwords and credentials, authorization, permissions and RLS, payments, billing and checkout, database migrations, schema and SQL, secrets, keys and `.env` files, cryptography, CI and deploy workflows, deletion of user or production data, external sends and publishing (e-mail, webhooks, posts, public pages), personal data (PII) and user data handling, infrastructure and DNS, new or replaced dependencies. Judge by meaning, not by substring: a security check added inside an otherwise generic file counts as `critical`; a document that merely talks about auth does not.
+
+**Model confidence does not count.** A confidence the executor or a reviewer states about its own output never lowers the tier, never drops a layer, and never skips review: self-reported LLM confidence is poorly calibrated and runs high.
 
 Raise the tier when in doubt, never lower it — a change that clearly touches something the list above doesn't name (e.g. a data migration done in application code) still earns `critical`. State the tier, the reason and the resulting layer count to the user before launching any layer.
 

package/src/bmm-skills/4-implementation/wizz-quick-dev/step-04-review.md

@@ -38,7 +38,7 @@ Compute the spec's repo-relative path first — `git -C "$TOP" ls-files --full-n
 - If a git command in this section fails: set `{clean_diff_file}` = `{diff_file}` and `{tier}` = `critical`, say so, and continue.
 - If `{clean_diff_file}` is empty (untracked files included) and excluding only the spec pathspec — with none of the `review_exclude` globs applied — already empties it too: the spec's own edit was the only change. There is nothing to review: skip the Review section entirely (no layer launches, `{failed_layers}` stays empty) and go straight to Classify, which finds nothing against the empty diff. Do not fall back to the raw diff in this case.
 - Else if nothing is left after exclusions for any other reason (a `review_exclude` glob, not the spec exclude, accounts for the emptiness): review the raw diff per § 1 — `{clean_diff_file}` = `{diff_file}`, tier picked from the raw diff.
-- Otherwise, pick the tier per § 2 (`small` included, on equal footing with `normal`/`critical`) by reading `git -C "$TOP" diff --name-status {baseline_commit} -- ':(top)' ':(top,exclude,literal)<repo-relative spec path>'` and judging it against `{workflow.review_critical_paths}`.
+- Otherwise, pick the tier per § 2 (`small` included, on equal footing with `normal`/`critical`) by reading `git -C "$TOP" diff --name-status {baseline_commit} -- ':(top)' ':(top,exclude,literal)<repo-relative spec path>'`: any changed path matching `{workflow.review_critical_globs}` makes it `critical` (fixed floor); otherwise judge it against `{workflow.review_critical_paths}`.
 
 Announce the exclusions once, from this run only. Tell the user the tier, the exclusions, and the resulting Forte subagent count before launching any layer.
 

package/src/modules/wizz/_shared/approval-gate.md

@@ -0,0 +1,45 @@
+# Approval boundary unavailable: paid and publishing execution blocked
+
+The local `approval-gate.mjs` currently supports **estimates only**. Both `approve` and `run` fail closed, including with a matching receipt, a TTY or an imported function. There is no exported approval function. Local files, digests, TTYs and secrets accessible to the agent cannot authenticate human consent. Removing one command from an allow list does not establish that boundary.
+
+The source is [approval-gate.mjs](approval-gate.mjs). After installation, find it at `_wizz/wizz/_shared/approval-gate.mjs` relative to the project root. This implementation does **not** meet the requirement for a protected human approval command and must not be used to execute paid or publishing actions. Do not bypass the blocked wrapper by calling the underlying tool. A human may independently perform an action outside the agent workflow; this does not enable the wrapper.
+
+## Prepare and inspect an estimate
+
+Scope: a **paid action** incurs a provider charge or consumes a metered paid quota, including a paid quote/estimator. **Publishing** makes the reviewed deliverable available to an audience or updates its externally hosted state: deployment/release, posting/scheduling content, sending a campaign, uploading a public asset, or pushing deliverable commits/tags to a remote repository. Local edits, local commits, tests, builds/previews, free read-only queries, and internal coordinator status/report messages are outside this publishing scope unless they themselves trigger a charge or publication. Task authorization does not enable the blocked executor.
+
+Requests here describe local CLI actions. MCP actions have tool names and structured arguments rather than an absolute `argv[0]`; they cannot be represented or executed by this wrapper. Show their cost/scope as a blocked proposal and stop pending a protected host adapter. Never invent an executable to make an MCP action fit or call the underlying MCP/tool directly to bypass the gate.
+
+1. Write a new request per action with `action`, `kind` (`paid` or `publish`), absolute existing `cwd`, `argv` (absolute executable plus string arguments), `env` (explicit string values, `{}` for none), `artifacts` (nonempty list of reviewed input files relative to cwd), `expiresAt` (future ISO date, at most 24 hours away), and `estimate` with numeric `amount`, ISO `currency`, `basis` (units × price, scope, retries and uncertainty), and `source` (quote source and date). Unknown cost blocks the workflow: obtain a free quote first. A free publication may have amount zero; a paid action must be positive. Never call a paid estimator without its own protected approval.
+2. Run `node _wizz/wizz/_shared/approval-gate.mjs estimate <request.json>` from the project root. Show the estimate and its blocked status to the human. This reads local files and makes no provider call; supplied prices are never fetched or invented. Output lists environment names with `[REDACTED]` values; the actual values still affect the fingerprint. Keep secrets out of argv, action text, estimate text and paths, which are displayed. Malformed JSON errors do not echo request contents.
+3. Stop. `approve` and `run` discard any legacy receipt and return an error without executing the requested command. Even malformed, expired, changed or missing requests cannot preserve a receipt for later replay. No reapproval flow is available yet.
+
+Example preparation (replace executable, files, date and quote with actual values):
+
+```json
+{
+  "action": "Prepare the approved batch estimate",
+  "kind": "paid",
+  "cwd": "/absolute/project",
+  "argv": ["/absolute/node", "scripts/generate.mjs", "brief.json"],
+  "env": {},
+  "artifacts": ["brief.json", "scripts/generate.mjs"],
+  "expiresAt": "2026-10-31T12:00:00Z",
+  "estimate": {
+    "amount": 2.5,
+    "currency": "USD",
+    "basis": "10 units × USD 0.25; one attempt, excluding tax",
+    "source": "Provider quote, retrieved 2026-10-30"
+  }
+}
+```
+
+The estimate fingerprint includes the request (including explicit environment), executable bytes, reviewed artifact bytes and existing file arguments (including `--option=file`), with resolved symlink targets. Changing these invalidates the fingerprint. Ambient `PATH` or `NODE_OPTIONS` does not authorize anything. The fingerprint is public and is not an approval credential; it does not capture imported dependencies, directory contents, remote state or eliminate time-of-check/time-of-use races.
+
+Artifacts use strict relative paths: no absolute/drive paths, backslashes, empty segments, `.` or `..`; resolved artifact targets must remain inside the real cwd. Missing/nonregular files fail with a labeled error. Preparation reads at most 1 MiB of request JSON, 64 MiB per executable/artifact/argument file and 128 MiB total for those files. Oversized inputs fail before hashing; these bounds and fingerprints do not create an approval boundary.
+
+## Required before enabling execution
+
+Implement and test a host-owned consent boundary outside the agent's control, bound to the exact action, cost, environment, executable and reviewed input snapshot. It must issue and atomically consume single-use authorization, reject changes and expiry, and handle failures and uncertain provider outcomes without automatic retries. The execution path must use the reviewed snapshot and explicit environment. No shared secret in this repository, prompt, process environment or agent-readable file supplies that boundary. No protected host API is integrated here, so execution remains blocked.
+
+Keep preparation files under the project-local ignored `_wizz-output/approval-gate/` directory (verify that the project ignores it). Do not store credentials in requests. Estimates and overall project consent do not approve an action, and an estimate does not enforce a provider spending cap.