wizz-method 2.23.0 → 2.25.0

package/src/modules/wizz/_shared/approval-gate.mjs

@@ -0,0 +1,184 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { createHash } from 'node:crypto';
+import { pathToFileURL } from 'node:url';
+
+// No host-owned approval boundary is available in this implementation.
+// Local digests/receipts and TTYs cannot authenticate consent from an agent.
+const unavailable = 'Paid/publishing execution blocked: no protected host approval boundary is implemented';
+const MAX_REQUEST_BYTES = 1024 * 1024;
+const MAX_FILE_BYTES = 64 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 128 * 1024 * 1024;
+
+// Inspect regular files before reading and cap the actual read too, in case a
+// file grows after fstat. Never include input contents in diagnostics.
+function readBounded(file, label, limit) {
+  let fd;
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile()) throw new Error('not a regular file');
+    if (stat.size > limit) throw new Error(`exceeds ${limit} byte read limit`);
+    const bytes = Buffer.alloc(stat.size + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const read = fs.readSync(fd, bytes, length, bytes.length - length, null);
+      if (read === 0) return bytes.subarray(0, length);
+      length += read;
+    }
+    throw new Error('file changed size during read');
+  } catch (error) {
+    const reason = error.code === 'ENOENT' ? 'file not found' : error.code || error.message;
+    throw new Error(`${label}: ${reason}`);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+function discardReceipt(file) {
+  fs.rmSync(`${file}.approval.json`, { force: true });
+}
+export function inspectRequest(file) {
+  const content = readBounded(file, 'request', MAX_REQUEST_BYTES);
+  let request;
+  try {
+    request = JSON.parse(content.toString('utf8'));
+  } catch {
+    throw new Error('request must contain valid JSON');
+  }
+  if (!request || typeof request !== 'object' || Array.isArray(request)) throw new Error('request must be an object');
+  const { action, kind, cwd, argv, estimate, artifacts, expiresAt, env } = request;
+  if (typeof action !== 'string' || !action.trim() || !['paid', 'publish'].includes(kind)) {
+    throw new Error('action and kind (paid|publish) are required');
+  }
+  if (typeof cwd !== 'string' || !path.isAbsolute(cwd) || !fs.existsSync(cwd) || !fs.statSync(cwd).isDirectory()) {
+    throw new Error('cwd must be an existing absolute directory');
+  }
+  if (!Array.isArray(argv) || argv.length === 0 || argv.some((arg) => typeof arg !== 'string') || !argv[0]) {
+    throw new Error('argv must contain an executable and string arguments');
+  }
+  if (!path.isAbsolute(argv[0]) || !fs.existsSync(argv[0]) || !fs.statSync(argv[0]).isFile()) {
+    throw new Error('executable must be an existing absolute file');
+  }
+  fs.accessSync(argv[0], fs.constants.X_OK);
+  if (!env || typeof env !== 'object' || Array.isArray(env) || Object.values(env).some((value) => typeof value !== 'string')) {
+    throw new Error('env must be an explicit object of string values; ambient environment is not inherited');
+  }
+  if (
+    !estimate ||
+    !Number.isFinite(estimate.amount) ||
+    estimate.amount < 0 ||
+    (kind === 'paid' && estimate.amount === 0) ||
+    typeof estimate.currency !== 'string' ||
+    !/^[A-Z]{3}$/.test(estimate.currency) ||
+    typeof estimate.basis !== 'string' ||
+    !estimate.basis.trim() ||
+    typeof estimate.source !== 'string' ||
+    !estimate.source.trim()
+  ) {
+    throw new Error('estimate requires positive paid amount, currency, basis and source');
+  }
+  if (!Number.isFinite(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now() || Date.parse(expiresAt) > Date.now() + 86_400_000) {
+    throw new Error('request expired, expiresAt missing or more than 24 hours away');
+  }
+  if (!Array.isArray(artifacts) || artifacts.length === 0 || artifacts.some((item) => typeof item !== 'string')) {
+    throw new Error('artifacts must list at least one reviewed file');
+  }
+  if (
+    artifacts.some(
+      (item) =>
+        path.isAbsolute(item) ||
+        item.includes('\\') ||
+        item.includes('\0') ||
+        item.split('/').some((part) => !part || part === '.' || part === '..') ||
+        /^[A-Za-z]:/.test(item),
+    )
+  ) {
+    throw new Error('artifacts must use strict relative paths within cwd (no absolute paths, empty segments, . or ..)');
+  }
+  // Bind the executable and file arguments automatically, including symlink targets.
+  // This is an estimate fingerprint, not proof of authorization or a full dependency closure.
+  const files = new Map([[argv[0], 'executable']]);
+  const root = fs.realpathSync(cwd);
+  for (const artifact of artifacts) {
+    const absolute = path.resolve(cwd, artifact);
+    // Diagnose missing files and directories through the bounded reader below.
+    if (fs.existsSync(absolute)) {
+      const relative = path.relative(root, fs.realpathSync(absolute));
+      if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new Error('artifact resolves outside cwd');
+      }
+    }
+    files.set(absolute, 'artifact');
+  }
+  for (const argument of argv.slice(1)) {
+    const candidate = path.resolve(cwd, argument.includes('=') ? argument.slice(argument.indexOf('=') + 1) : argument);
+    if (fs.existsSync(candidate) && fs.statSync(candidate).isFile() && !files.has(candidate)) files.set(candidate, 'argument file');
+  }
+  let remaining = MAX_TOTAL_BYTES;
+  const hashes = [...files.keys()].sort().map((absolute) => {
+    const bytes = readBounded(absolute, files.get(absolute), Math.min(MAX_FILE_BYTES, remaining));
+    remaining -= bytes.length;
+    return [absolute, fs.realpathSync(absolute), createHash('sha256').update(bytes).digest('hex')];
+  });
+  const digest = createHash('sha256').update(JSON.stringify({ request, hashes })).digest('hex');
+  return { request, digest, hashes };
+}
+
+export function describe({ request, digest }) {
+  return JSON.stringify(
+    {
+      action: request.action,
+      kind: request.kind,
+      cwd: request.cwd,
+      argv: request.argv,
+      env: Object.fromEntries(Object.keys(request.env).map((name) => [name, '[REDACTED]'])),
+      artifacts: request.artifacts,
+      expiresAt: request.expiresAt,
+      estimate: request.estimate,
+      digest,
+      warning: `${unavailable}. Estimate only; digest is not approval and billing may differ.`,
+    },
+    null,
+    2,
+  );
+}
+
+// Legacy receipts are untrusted. Invalidate them even when the request is
+// malformed, missing, expired or changed, so restoring old inputs cannot replay it.
+export function run(file) {
+  discardReceipt(file);
+  throw new Error(unavailable);
+}
+
+async function main() {
+  const [operation, input, ...extra] = process.argv.slice(2);
+  if (!input || extra.length > 0 || !['estimate', 'approve', 'run'].includes(operation)) {
+    throw new Error('Usage: node approval-gate.mjs estimate|approve|run request.json');
+  }
+  const file = path.resolve(input);
+  switch (operation) {
+    case 'estimate': {
+      console.log(describe(inspectRequest(file)));
+      break;
+    }
+    case 'approve': {
+      discardReceipt(file);
+      throw new Error(unavailable);
+    }
+    case 'run': {
+      run(file);
+      break;
+    }
+  }
+}
+
+if (process.argv[1] && fs.existsSync(process.argv[1]) && import.meta.url === pathToFileURL(fs.realpathSync(process.argv[1])).href) {
+  try {
+    await main();
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}

package/src/modules/wizz/_shared/communication-rules.md

@@ -18,3 +18,5 @@ WIZZ COMMUNICATION: don't narrate the step-by-step while working, it wastes toke
 WIZZ CLOSING: finish every task in this format (labels shown in Portuguese; write them in `{communication_language}`, keeping the emojis): '✅ O que fiz' (1-2 simple sentences) + '➡️ Próximo passo' (recommended agent or action) + '🎯 Comando: /<exact-skill-name>' (lowercase with hyphen, e.g. `/wizz-maestro`; never `/wizz:maestro`). If something important was decided during the task, add '💾 Quer que eu salve no cerebro?'.
 
 RTK: RTK (Rust Token Killer) already rewrites shell commands automatically via hook. No need to invoke anything separately. If a command fails with "rtk not found", warn the user and continue without it.
+
+WIZZ PAID/PUBLISHING GATE: before an action that incurs a charge/consumes paid quota or publishes the deliverable (deploy/release, content post/schedule, campaign send, public asset upload, remote push of deliverable commits/tags), read the shared approval-gate.md beside this file (installed at `_wizz/wizz/_shared/approval-gate.md` relative to the project root). Local edits/commits, tests, builds/previews, free read-only queries and internal coordinator status/report messages remain available unless they themselves charge or publish. For a supported CLI action, prepare and show an explicit estimate with `approval-gate.mjs estimate`, then stop: `approve` and `run` are blocked because no protected host approval boundary is implemented. MCP actions have no CLI argv and remain blocked proposals pending a protected host adapter. Never manufacture receipts or bypass the wrapper; TTYs, local digests and command allow lists do not authenticate human consent. Unknown cost also blocks the action. This implementation does not satisfy the protected human approval requirement.

package/src/modules/wizz/_shared/model-ladder.md

@@ -46,6 +46,18 @@ A diff produced by mechanical, standard, strong, or ultra goes through `wizz-exe
 
 Review workflows (`wizz-code-review`, `wizz-quick-dev`) stay pinned to the Strong tier, but the number of layers scales with the size of the diff (1, 2, or up to 4); see `wizz-code-review/references/review-economy.md`.
 
+## Consequence
+
+Difficulty picks the executor's tier; size and sensitive area pick the review layers; consequence decides whether an output may skip extra review at all. This applies to every output, not only diffs: copy, research, client reports, e-mails, and posts included. An output passes with the minimum (for a diff, the `small` tier; for anything else, the agent's own check) only when all three are true:
+
+1. **A machine checks it:** tests, schema, build, lint, or a validator are green.
+2. **It is easy to undo:** no destructive migration, no deletion, no external send, no publishing.
+3. **Nobody acts on it before another step sees it.**
+
+If any one fails, the output goes through review on the Strong tier (in another vendor when one is available) and the boss gives the final verdict. An external or irreversible action never rests on an LLM reviewer: it stops for the user's explicit OK.
+
+Model confidence does not count: a confidence the executor or reviewer states about its own output never skips review, never drops a layer, and never lowers the tier. For diffs, the tier floor comes from `review_critical_globs` and the session's judgment can only raise it (`wizz-code-review/references/review-economy.md` § 2).
+
 ## Fan-out cap
 
 - Work that fits in 3 files or fewer: 1 subagent, or the session itself.

package/src/modules/wizz/agents/wizz-ads/SKILL.md

@@ -29,4 +29,5 @@ You are Wizz's Ads. It plans campaigns, generates creative variations, and track
 Index of situation → skill/reference, in order of use: `{skill-root}/knowledge/playbook.md`. Read it only when the request is ambiguous about which skill comes first or the path spans several skills; a request that already names one clear skill goes straight to it. It never replaces the registry.
 
 ## Closing
+Before delivering or publishing, run the consequence gate in `_shared/model-ladder.md` ("Consequence"): output that someone will act on, send or publish without another step seeing it goes to review first, and anything external or irreversible waits for the user's OK.
 Close in the format of `_shared/encerramento.md` (wizz module root). If the campaign needs new text or visuals, next is usually wizz-copy or wizz-designer.

package/src/modules/wizz/agents/wizz-copy/SKILL.md

@@ -33,4 +33,5 @@ Always deliver 2-3 variations and say which one you recommend.
 Index of situation → skill/reference, in order of use: `{skill-root}/knowledge/playbook.md`. Read it only when the request is ambiguous about which skill comes first or the path spans several skills; a request that already names one clear skill goes straight to it. It never replaces the registry.
 
 ## Closing
+Before delivering or publishing, run the consequence gate in `_shared/model-ladder.md` ("Consequence"): output that someone will act on, send or publish without another step seeing it goes to review first, and anything external or irreversible waits for the user's OK.
 Close in the format of `_shared/encerramento.md` (wizz module root). Next is usually wizz-designer, to lay it out.

package/src/modules/wizz/agents/wizz-growth/SKILL.md

@@ -35,4 +35,5 @@ Always bring concrete actions and the expected impact of each one.
 Index of situation → skill/reference, in order of use: `{skill-root}/knowledge/playbook.md`. Read it only when the request is ambiguous about which skill comes first or the path spans several skills; a request that already names one clear skill goes straight to it. It never replaces the registry.
 
 ## Closing
+Before delivering or publishing, run the consequence gate in `_shared/model-ladder.md` ("Consequence"): output that someone will act on, send or publish without another step seeing it goes to review first, and anything external or irreversible waits for the user's OK.
 Close in the format of `_shared/encerramento.md` (wizz module root). If it turns into an ad, point to **wizz-ads**; if it turns into text, **wizz-copy**.

package/src/modules/wizz/agents/wizz-maestro/SKILL.md

@@ -135,4 +135,6 @@ When invoking the area agent, declare the brief in the format of the [shared han
 
 Close in the format of `_shared/encerramento.md`, saying which agent you called and which comes next. When the sequence closes a feature's delivery, follow that file's feature closing checklist (`verificar`, then `encerrar --cerebro`).
 
-If an area agent reports `⚠️ Não coberto` on dev/code work, dispatch `wizz-exec-review` (or `wizz-qa` for a functional check) before closing the sequence.
+**Code review of a story, diff or PR:** run `Skill(skill="wizz-code-review")` in the current session, never inside a subagent. The skill is an orchestrator: it launches its own `wizz-exec-review` layers (1, 2 or 4 by tier), and a subagent can't launch subagents, so a delegated run collapses into one pass dressed up as the full review. The executor that implemented the story never reviews its own work; its closing hands back to the session for this review.
+
+If an area agent reports `⚠️ Não coberto` on dev/code work, run `wizz-code-review` the same way (or dispatch `wizz-qa` for a functional check) before closing the sequence. A bare `wizz-exec-review` dispatch is for checking one executor's result, not for reviewing a story.

package/src/modules/wizz/agents/wizz-seo/SKILL.md

@@ -33,4 +33,5 @@ Always deliver the list of fixes **in order of impact** (what to tackle first).
 Index of situation → skill/reference, in order of use: `{skill-root}/knowledge/playbook.md`. Read it only when the request is ambiguous about which skill comes first or the path spans several skills; a request that already names one clear skill goes straight to it. It never replaces the registry.
 
 ## Closing
+Before delivering or publishing, run the consequence gate in `_shared/model-ladder.md` ("Consequence"): output that someone will act on, send or publish without another step seeing it goes to review first, and anything external or irreversible waits for the user's OK.
 Close in the format of `_shared/encerramento.md` (wizz module root). If it turns into text, next is usually wizz-copy.

package/src/modules/wizz/agents/wizz-social/SKILL.md

@@ -19,7 +19,7 @@ You don't reinvent the wheel: you route to the global social/content skills via
 3. Adopt the persona: `{agent.role}`, `{agent.identity}`, `{agent.communication_style}`, `{agent.principles}`.
 4. Load `{agent.persistent_facts}` (includes the viral blueprint at `{skill-root}/knowledge/blueprint-roteiro-viral.md`).
 5. Config: `{project-root}/_wizz/bmm/config.yaml` → `{user_name}`, `{communication_language}`.
-6. Greet `{user_name}` in `{communication_language}` starting with `{agent.icon}`.
+6. Apply the Musical Reel check below before greeting or briefing. Greet `{user_name}` in `{communication_language}` starting with `{agent.icon}` for every request, including a musical handoff; adapt the introduction to the request. Collect the briefing only for script requests that remain in the usual pipeline.
 7. Run `{agent.activation_steps_append}`.
 8. Menu/dispatch.
 
@@ -34,6 +34,11 @@ Supporting knowledge for the production pipeline:
 - `{skill-root}/knowledge/analise-imagem-referencia.md`: a style reference image becomes a prompt to recreate it (reverse engineering).
 - `{skill-root}/knowledge/biblioteca-prompts-imagem.md`: catalog of 11 template categories to create, transform, and edit images with AI (Sora, Gemini, Midjourney, Grok).
 
+## Musical Reel check (before the greeting, briefing or script)
+A request for a **reel de música**, **vídeo de música**, **lyric video**, **vídeo com a letra** or **edição no ritmo da música**, with music and typography, no face and no narration, belongs to `skill:wizz-video-styles`, style **tipografia-cinetica** (designer area). The request "quero fazer um reel de musica, pra mostrar o poder da edicao com o claude. quero uma musica em alta" is this case: Claude names the editing tool, not a character or a narrated tutorial. Consult the designer registry entry and offer that capability before collecting a viral-script briefing; follow the cross-area handoff protocol below. Never substitute the external music-to-video skill. The style recipe precedes assembly in `skill:wizz-remotion-best-practices`.
+
+A **narrated Reel with b-roll**, an existing script to turn into a video, or a request only for supporting footage keeps the usual pipeline: script → voice → timing → footage/screens → Remotion. "Música em alta" as a backing track alone does not select kinetic typography; a request only for footage is `get-brolls` (designer). Do not turn these requests into lyric videos.
+
 ## Briefing protocol (MANDATORY before any script)
 Before writing, ALWAYS collect the full briefing. Ask the questions in a single message, conversational and light, never like a cold form.
 
@@ -90,4 +95,5 @@ A viral script names things out loud ("the CEO said", "this app's screen", "the
 The canonical rules live in `agent.principles` (briefing before anything, hook on the first word, right formula justified, specific numbers, diagnosis + 2 variations, never generic). Execution detail only for the 3D format: fast pacing in the tutorial (short sentences, action verbs), mandatory visual result (if missing, flag that it loses impact), Triple CTA in the right order.
 
 ## Closing
+Before delivering or publishing, run the consequence gate in `_shared/model-ladder.md` ("Consequence"): output that someone will act on, send or publish without another step seeing it goes to review first, and anything external or irreversible waits for the user's OK.
 Close in the format of `_shared/encerramento.md` (wizz module root). Next is usually wizz-designer (to turn it into a video) or saving to cerebro.

package/src/modules/wizz/agents/wizz-social/customize.toml

@@ -15,7 +15,8 @@ activation_steps_prepend = [
 include = ["../../_shared/communication-rules.md", "../../_shared/despacho-barato.md"]
 
 activation_steps_append = [
-  "INTRODUCTION: on the session's first message, use a variation of 'E aí! Sou o Rafa, teu parceiro de viralização haha. Me fala o tema e a gente monta um roteiro que vai parar o scroll. Mas antes de escrever qualquer coisa, preciso de algumas infos, me responde aí:' followed by the briefing questions.",
+  "MUSICAL REEL CHECK: before greeting or briefing, apply the Musical Reel check in SKILL.md. Music-only Reel / lyric video with no face or narration goes to wizz-video-styles, style tipografia-cinetica (designer), before any script; never external music-to-video. A narrated Reel with b-roll or music only as a backing track keeps the usual pipeline.",
+  "INTRODUCTION: on the session's first message, greet for every request (including musical handoffs), adapting the introduction to the selected task without script questions for posts, carousels, prompts or profile work. Only for script requests remaining after the Musical Reel check, use a variation of 'E aí! Sou o Rafa, teu parceiro de viralização haha. Me fala o tema e a gente monta um roteiro que vai parar o scroll. Mas antes de escrever qualquer coisa, preciso de algumas infos, me responde aí:' followed by the briefing questions.",
   "CEREBRO: at closing, if a niche, tone, or CTA keywords were defined, remember to offer to save it to cerebro.",
 ]
 
@@ -46,7 +47,7 @@ principles = [
 [[agent.menu]]
 code = "RT"
 description = "Viral Reel/Short script (hook, body, CTA)"
-prompt = "Run the BRIEFING PROTOCOL first (topic, goal, CTA, audience, tone, visual result, duration). Only then apply the Viral Script Blueprint (knowledge/blueprint-roteiro-viral.md): pick the right formula and justify it, deliver the script in the full format with diagnosis + 2 hook variations."
+prompt = "Apply the Musical Reel check in SKILL.md before any briefing. For script requests, run the BRIEFING PROTOCOL first (topic, goal, CTA, audience, tone, visual result, duration). Only then apply the Viral Script Blueprint (knowledge/blueprint-roteiro-viral.md): pick the right formula and justify it, deliver the script in the full format with diagnosis + 2 hook variations."
 
 [[agent.menu]]
 code = "PROMPT"
@@ -81,4 +82,4 @@ prompt = "Invoke the GLOBAL skill 'wizz-ig-profile-optimizer' via the Skill tool
 [[agent.menu]]
 code = "VID"
 description = "Turn the script into a video (voice, render, cut)"
-prompt = "Route to the registry's video CLIs (designer area): 'voicebox' (narration/TTS), 'hyperframes' (HTML→MP4 render), 'get-brolls' (source real B-roll/inserts for what the script names; macOS; ends in a Storyboard the human approves), 'buttercut' (edit/cut, Apple Silicon only), 'claude-video' (analyze reference). Run the check for each one; if missing, show the install (opt-in). The heavy video build work is done by wizz-designer."
+prompt = "First apply the Musical Reel check in SKILL.md: music-only Reel / lyric video goes to wizz-video-styles, style tipografia-cinetica (designer), never external music-to-video. Narrated Reel with b-roll keeps the usual pipeline. Route to the registry's video CLIs (designer area): 'voicebox' (narration/TTS), 'hyperframes' (HTML→MP4 render), 'get-brolls' (source real B-roll/inserts for what the script names; macOS; ends in a Storyboard the human approves), 'buttercut' (edit/cut, Apple Silicon only), 'claude-video' (analyze reference). Run the check for each one; if missing, show the install (opt-in). The heavy video build work is done by wizz-designer."

package/src/modules/wizz/subagents/codex/wizz-exec-review.toml

@@ -1,7 +1,7 @@
 # Gerado por tools/generate-subagents.mjs a partir de src/modules/wizz/subagents/spec.yaml. Não edite este arquivo direto: edite o spec.yaml e rode `npm run generate:subagents`.
 name = "wizz-exec-review"
 description = """
-Wizz Method reviewer pinned to the Strong tier (gpt-6-sol, effort high), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Doesn't implement: returns a verdict and a list of issues with file:line.
+Wizz Method reviewer pinned to the Strong tier (gpt-6-sol, effort high), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Inside wizz-code-review it runs ONE layer; it never replaces that skill, which orchestrates the layers from the main session. Doesn't implement: returns a verdict and a list of issues with file:line.
 """
 model = "gpt-6-sol"
 model_reasoning_effort = "high"
@@ -24,6 +24,7 @@ Regras:
 - DIFF vs. NARRATIVE: compare what the diff actually does with what the executor's report says it did; any divergence is a finding.
 - If the brief carries `max_calls`, that's the tool-call ceiling: on hitting it, stop and deliver the partial result with explicit pending items; don't escalate on your own.
 - NO NESTING: never dispatch subagents; review what you received.
+- If the brief asks you to load or run `wizz-code-review` (the whole skill, not one of its `review-prompts/` layers), don't: reply `blocked: wizz-code-review roda na sessão principal` and stop. A single pass here would pose as the layered review.
 - Table of frauds to hunt for:
   - a weakened or skipped test
   - false completion (the report says "done" with no proof)

package/src/modules/wizz/subagents/gemini/wizz-exec-review.md

@@ -2,7 +2,7 @@
 # Gerado por tools/generate-subagents.mjs a partir de src/modules/wizz/subagents/spec.yaml. Não edite este arquivo direto: edite o spec.yaml e rode `npm run generate:subagents`.
 name: wizz-exec-review
 description: >-
-  Wizz Method reviewer pinned to the Strong tier (gemini-3.1-pro-preview), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Doesn't implement: returns a verdict and a list of issues with file:line.
+  Wizz Method reviewer pinned to the Strong tier (gemini-3.1-pro-preview), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Inside wizz-code-review it runs ONE layer; it never replaces that skill, which orchestrates the layers from the main session. Doesn't implement: returns a verdict and a list of issues with file:line.
 kind: local
 model: gemini-3.1-pro-preview
 max_turns: 60
@@ -25,6 +25,7 @@ Regras:
 - DIFF vs. NARRATIVE: compare what the diff actually does with what the executor's report says it did; any divergence is a finding.
 - If the brief carries `max_calls`, that's the tool-call ceiling: on hitting it, stop and deliver the partial result with explicit pending items; don't escalate on your own.
 - NO NESTING: never dispatch subagents; review what you received.
+- If the brief asks you to load or run `wizz-code-review` (the whole skill, not one of its `review-prompts/` layers), don't: reply `blocked: wizz-code-review roda na sessão principal` and stop. A single pass here would pose as the layered review.
 - Table of frauds to hunt for:
   - a weakened or skipped test
   - false completion (the report says "done" with no proof)

package/src/modules/wizz/subagents/opencode/wizz-exec-review.md

@@ -1,7 +1,7 @@
 ---
 # Gerado por tools/generate-subagents.mjs a partir de src/modules/wizz/subagents/spec.yaml. Não edite este arquivo direto: edite o spec.yaml e rode `npm run generate:subagents`.
 description: >-
-  Wizz Method reviewer pinned to the Strong tier (anthropic/claude-opus-5-5), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Doesn't implement: returns a verdict and a list of issues with file:line.
+  Wizz Method reviewer pinned to the Strong tier (anthropic/claude-opus-5-5), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Inside wizz-code-review it runs ONE layer; it never replaces that skill, which orchestrates the layers from the main session. Doesn't implement: returns a verdict and a list of issues with file:line.
 mode: subagent
 model: anthropic/claude-opus-5-5
 permission:
@@ -25,6 +25,7 @@ Regras:
 - DIFF vs. NARRATIVE: compare what the diff actually does with what the executor's report says it did; any divergence is a finding.
 - If the brief carries `max_calls`, that's the tool-call ceiling: on hitting it, stop and deliver the partial result with explicit pending items; don't escalate on your own.
 - NO NESTING: never dispatch subagents; review what you received.
+- If the brief asks you to load or run `wizz-code-review` (the whole skill, not one of its `review-prompts/` layers), don't: reply `blocked: wizz-code-review roda na sessão principal` and stop. A single pass here would pose as the layered review.
 - Table of frauds to hunt for:
   - a weakened or skipped test
   - false completion (the report says "done" with no proof)

package/src/modules/wizz/subagents/spec.yaml

@@ -133,6 +133,7 @@ tiers:
       - DIFF vs. NARRATIVE: compare what the diff actually does with what the executor's report says it did; any divergence is a finding.
       - If the brief carries `max_calls`, that's the tool-call ceiling: on hitting it, stop and deliver the partial result with explicit pending items; don't escalate on your own.
       - NO NESTING: never dispatch subagents; review what you received.
+      - If the brief asks you to load or run `wizz-code-review` (the whole skill, not one of its `review-prompts/` layers), don't: reply `blocked: wizz-code-review roda na sessão principal` and stop. A single pass here would pose as the layered review.
       - Table of frauds to hunt for:
         - a weakened or skipped test
         - false completion (the report says "done" with no proof)
@@ -141,11 +142,11 @@ tiers:
         - a commented-out or disabled check/test
     description:
       claude: >-
-        Wizz Method reviewer pinned to the Strong tier, never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Doesn't implement: returns a verdict and a list of issues with file:line.
+        Wizz Method reviewer pinned to the Strong tier, never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Inside wizz-code-review it runs ONE layer; it never replaces that skill, which orchestrates the layers from the main session. Doesn't implement: returns a verdict and a list of issues with file:line.
       ladder: >-
-        Wizz Method reviewer pinned to the Strong tier ({model}), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Doesn't implement: returns a verdict and a list of issues with file:line.
+        Wizz Method reviewer pinned to the Strong tier ({model}), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Inside wizz-code-review it runs ONE layer; it never replaces that skill, which orchestrates the layers from the main session. Doesn't implement: returns a verdict and a list of issues with file:line.
       codex: >-
-        Wizz Method reviewer pinned to the Strong tier ({model}, effort {effort}), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Doesn't implement: returns a verdict and a list of issues with file:line.
+        Wizz Method reviewer pinned to the Strong tier ({model}, effort {effort}), never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Inside wizz-code-review it runs ONE layer; it never replaces that skill, which orchestrates the layers from the main session. Doesn't implement: returns a verdict and a list of issues with file:line.
 
 # Model for each tier per platform. In Claude Code, haiku/sonnet/opus/fable
 # are runtime aliases; on the other platforms it's the platform's concrete

package/src/modules/wizz/subagents/wizz-exec-review.md

@@ -2,7 +2,7 @@
 # Gerado por tools/generate-subagents.mjs a partir de src/modules/wizz/subagents/spec.yaml. Não edite este arquivo direto: edite o spec.yaml e rode `npm run generate:subagents`.
 name: wizz-exec-review
 description: >-
-  Wizz Method reviewer pinned to the Strong tier, never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Doesn't implement: returns a verdict and a list of issues with file:line.
+  Wizz Method reviewer pinned to the Strong tier, never to the session's model. Receives a diff or an executor's result and reviews correctness, security, regressions, and scope adherence. Inside wizz-code-review it runs ONE layer; it never replaces that skill, which orchestrates the layers from the main session. Doesn't implement: returns a verdict and a list of issues with file:line.
 model: opus
 effort: high
 maxTurns: 60
@@ -25,6 +25,7 @@ Regras:
 - DIFF vs. NARRATIVE: compare what the diff actually does with what the executor's report says it did; any divergence is a finding.
 - If the brief carries `max_calls`, that's the tool-call ceiling: on hitting it, stop and deliver the partial result with explicit pending items; don't escalate on your own.
 - NO NESTING: never dispatch subagents; review what you received.
+- If the brief asks you to load or run `wizz-code-review` (the whole skill, not one of its `review-prompts/` layers), don't: reply `blocked: wizz-code-review roda na sessão principal` and stop. A single pass here would pose as the layered review.
 - Table of frauds to hunt for:
   - a weakened or skipped test
   - false completion (the report says "done" with no proof)

package/src/skills-lib/wizz-router/references/routing-table-flat.md

@@ -58,7 +58,7 @@ Use this table to map skills/CLIs/MCPs directly **outside a Wizz project** (no `
 | **Video with audio, narration, SFX, or synced captions** (film assembly) | `wizz-remotion-best-practices` (Remotion assembles; frame timing). Pipeline rule: HyperFrames draws the mute screens, Remotion assembles the film — don't use hyperframes to position audio/captions (~2.76s drift and CSS leaking between screens in production) | 1 |
 | Draw a video SCREEN/scene in HTML/CSS, mute visual (app mockup, animated chart, title, loop; HTML→MP4) | CLI `hyperframes` (designer registry; `npx skills add heygen-com/hyperframes`) — mute screens only; assembly with audio goes to Remotion (line above) | 2 |
 | Word-by-word timestamps for TTS narration (sync captions/cuts/animation with speech) | `wizz-ctc-align` (designer registry; single source of timing, replaces Whisper) | 2 |
-| Which short-video STYLE to copy, from the inventory of the material (real person, voice only, B-roll, screens, product), with the recipe measured on 110 real videos (lyric video, kinetic typography and the UI-only app video "ui-morph" included); "a video of my app moving", "edit it in the style of", "the video looks amateur" | `wizz-video-styles` (designer registry; picks the style before voice, timing, effects and assembly) | 2 |
+| Which short-video STYLE to copy, from the inventory of the material (real person, voice only, B-roll, screens, product), with the recipe measured on 110 real videos (reel de música, vídeo de música, lyric video, vídeo com a letra, edição no ritmo da música: music and typography without face or narration → style **tipografia-cinetica**, before any social script; música em alta as backing for a narrated Reel with B-roll keeps the usual pipeline; and the UI-only app video "ui-morph" included); "a video of my app moving", "edit it in the style of", "the video looks amateur" | `wizz-video-styles` (designer registry; picks the style before voice, timing, effects and assembly) | 2 |
 | Effects and sound of a short vertical video (ad or Reels): which effect goes where and when not, which SFX for each event and at what level, ducking, master loudness, safe-zone/density/excess/rhythm gates | `wizz-video-effects` (designer registry; decides the effects, Remotion assembles them) | 2 |
 | **Find B-roll / inserts / cutaways / supporting footage** for a video or Reel (real footage of the fact, person, product, news item or screen the script names; YouTube/Instagram/TikTok/Pexels/Pixabay/Commons/NASA) | CLI `get-brolls` (designer registry; **macOS**, global `skills add` + its own `install.sh`; needs ffmpeg with drawtext, Node 22+, Python 3.11+). Ends in a Storyboard the HUMAN approves — the agent never self-approves. Stock only when the user explicitly asks for stock | 1 |
 | **Edit/cut video** (cuts, selects, roughcut) | CLI `buttercut` (designer registry; **Apple Silicon only**, clone-and-run in the project, heavy deps) | 1 |

package/src/skills-lib/wizz-security-audit-pentest/SKILL.md

@@ -1,26 +1,30 @@
 ---
 name: wizz-security-audit-pentest
 description: >
-  Adversarial 5-stage security audit with standardized output (markdown table, cutoff ruler,
-  concrete payload per finding). Use when the request is to audit/pentest an entire app, review security
+  Adversarial security audit with standardized output (markdown table, cutoff ruler,
+  concrete payload per finding, Devil's Advocate review, and private report outside the audited project in
+  SEGURANCA-<data>/). Use when the request is to audit/pentest an entire app, review security
   before release, "security audit", "pentest", "find vulnerabilities", or run a
-  full sweep for mass assignment, IDOR/RLS, injection, rate limit/volume abuse, and response leakage.
-  Different from wizz-web-security/wizz-auth-and-secrets (which fix): this one HUNTS, with exploit proof, and at the end merges
-  the findings into a prioritized plan ("today's top three"). To fix an isolated flaw, use the
-  wizz-web-security and wizz-auth-and-secrets skills.
+  full sweep for mass assignment, IDOR/RLS, injection, rate limit/volume abuse, response leakage,
+  and secrets in working tree or git history. Different from wizz-web-security/wizz-auth-and-secrets
+  (which fix): this one HUNTS, challenges findings, and merges them into a prioritized plan
+  ("today's top three"). To fix an isolated flaw, invoke the wizz-web-security or
+  wizz-auth-and-secrets skill.
 ---
 
 # Security Audit (Adversarial Pentest)
 
-Five independent vulnerability-hunting stages, each with **concrete exploit proof** and a **cutoff ruler** (no real payload, the row doesn't make the cut). At the end, a sixth step merges the five reports into a single prioritized plan.
+Five independent vulnerability-hunting stages, each with **concrete exploit proof** and a **cutoff ruler** (no real payload, the row doesn't make the cut), followed by a sixth **Devil's Advocate** stage that challenges every finding against the repository code, and a seventh **Merge** stage that consolidates the surviving findings into a single prioritized plan saved outside the audited project in `SEGURANCA-<data>/RELATORIO.md`.
 
-Each stage is an agent with a closed prompt in `references/`. Run them in parallel (subagents), one per stage, then the merge step over the five results.
+Each stage is an agent with a closed prompt in `./references/`. Run Stages 1–5 in parallel (subagents), run Stage 6 (Devil's Advocate) over the five tables, and then run Stage 7 (Merge) to produce the final private report.
 
-## Premise shared by all stages
+## Premise shared by all hunting stages (Stages 1–5)
 
-Client-side validation doesn't count. The attacker talks directly to the API. Consider only server-side verification. The "How it's exploited" field of every finding must contain the **concrete payload** the attacker would send, not the vulnerability category. "Could be better" and "consider adding" are not findings. Ten real rows beat fifty rows of best practices. No finding that passes the ruler at a stage: answer only `NO FINDINGS AT THIS STAGE`.
+Client-side validation doesn't count. The attacker talks directly to the API. Consider only server-side verification. The "How it's exploited" field of every finding must contain the **concrete payload** or extraction action the attacker would execute, not the vulnerability category. "Could be better" and "consider adding" are not findings. Ten real rows beat fifty rows of best practices. No finding that passes the ruler at a stage: answer only `NO FINDINGS AT THIS STAGE`.
 
-Output format for each stage, markdown table, no text before or after:
+- **Zero secret exposure (ALL stages, including response/log inspection):** Never print, echo, or store raw secret values in terminal output, stage tables, or the final report. Use the marked executable blocks in `./references/stage-5-segredos-historico.md`: metadata-only history (`--format='%h %ad' --name-only`), file-name-only current scan, and root-aware key-file inventory. Commit messages, authors, notes and patches may themselves contain secrets; never dump them. Report only `<file>` / safe `<file>:<line>` or `commit <sha> (<file>)` and a redacted prefix (for example, `sk_live_[REDACTED]`).
+
+Output format for each hunting stage (Stages 1–5), markdown table, no text before or after:
 
 ```
 | # | Risk | Where (file:line) | How it's exploited | What prevents it | Severity |
@@ -28,26 +32,46 @@ Output format for each stage, markdown table, no text before or after:
 
 Severity: CRITICAL, HIGH, MEDIUM.
 
-## The 5 stages (run in parallel)
+## The 7 stages (5 parallel hunters + Devil's Advocate + Merge)
+
+| Stage | Role | Hunts for / Executes | Prompt |
+|---|---|------|--------|
+| 1 | Hunter (parallel) | **Input validation** — mass assignment (top priority), SQL/NoSQL/shell injection, unsafe rendering, missing schema / unbounded text | `./references/stage-1-validacao-entrada.md` |
+| 2 | Hunter (parallel) | **Authorization failure** — 3 layers: app (client identity vs. token; ownership in the query), database (RLS, permissive `USING(true)` policy, new table with no policy), machine (webhook with no signature, trusts status/money from the body) | `./references/stage-2-autorizacao.md` |
+| 3 | Hunter (parallel) | **Volume abuse** — rate limiting on auth (per IP **and** per account), cost per call (AI/SMS/email × 10k), extraction via pagination, IP origin behind proxy/CDN | `./references/stage-3-abuso-volume.md` |
+| 4 | Hunter (parallel) | **Response leakage** — technical detail in prod, divergence in auth (message/status/timing), resource existence (404 vs 403), secret in log | `./references/stage-4-vazamento-resposta.md` |
+| 5 | Hunter (parallel) | **Secret hunter (working tree & git history)** — the marked metadata-only history and file-name-only current scan commands across mandatory prefixes (`sk-`, `sk-ant-`, `sk_live_`, `ghp_`, `github_pat_`, `xox[bp]-`, `AKIA`, `AIza`, `eyJhbGciOi`) and tracked `.env`/key files, without ever exposing secret values | `./references/stage-5-segredos-historico.md` |
+| 6 | Challenger (sequential) | **Devil's Advocate (`Advogado do Diabo`)** — challenges every finding from Stages 1–5; assigns verdict `CONFIRMADO` / `DEPENDE DE CONFIGURAÇÃO` / `DERRUBADO`; can only lower severity with concrete in-repo mitigation | `./references/stage-6-advogado-do-diabo.md` |
+| 7 | Consolidator (sequential) | **Merge & private report** — merges `CONFIRMADO` and `DEPENDE DE CONFIGURAÇÃO` findings, deduplicates across stages, sorts by effort÷severity, identifies chains, closes with "today's top three", and writes `SEGURANCA-<data>/RELATORIO.md` outside the audited project, with `SEGURANCA-<data>/.gitignore` (`*`) as defense in depth | `./references/stage-7-fusao-plano.md` |
+
+> Stages 1–5 are independent hunting stages. Stage 6 reviews the five hunting tables. Stage 7 merges the verified findings and writes the git-ignored report.
+
+## Devil's Advocate safety rules (Stage 6)
+
+1. **Verdicts:** Every finding from Stages 1–5 receives one verdict: `CONFIRMADO`, `DEPENDE DE CONFIGURAÇÃO`, or `DERRUBADO`.
+2. **One-way severity ratchet:** Stage 6 may keep the original severity or **lower** it (`CRITICAL` → `HIGH`/`MEDIUM`, `HIGH` → `MEDIUM`) only when concrete in-repository code reduces impact or exploitability. It may **never** raise severity.
+3. **Absence of configuration never proves a false positive (safe divergence from naive "when in doubt, dismiss"):**
+   - Do **not** mark a finding `DERRUBADO` and do **not** lower its severity simply because an external control (live database RLS, WAF/CDN rate limit, proxy header config, prod environment variable, or provider-side key revocation) is absent from the repository or cannot be verified statically.
+   - Whenever safety depends on external or runtime configuration not proven in versioned files, classify the finding as `DEPENDE DE CONFIGURAÇÃO` and **preserve its original severity** until verified in the live environment.
+   - A finding with a concrete payload/location can only be marked `DERRUBADO` by citing concrete refuting evidence in the repository (`file:line`), or when the hunter row failed the cutoff ruler (vague best-practice advice with no concrete exploit).
+
+## Report isolation outside the audited project (`SEGURANCA-<data>/`)
 
-| Stage | Hunts for | Prompt |
-|---|------|--------|
-| 1 | **Input validation** — mass assignment (top priority), SQL/NoSQL/shell injection, unsafe rendering, missing schema / unbounded text | `references/stage-1-validacao-entrada.md` |
-| 2 | **Authorization failure** — 3 layers: app (client identity vs. token; ownership in the query), database (RLS, permissive `USING(true)` policy, new table with no policy), machine (webhook with no signature, trusts status/money from the body) | `references/stage-2-autorizacao.md` |
-| 3 | **Volume abuse** — rate limiting on auth (per IP **and** per account), cost per call (AI/SMS/email × 10k), extraction via pagination, IP origin behind proxy/CDN | `references/stage-3-abuso-volume.md` |
-| 4 | **Response leakage** — technical detail in prod, divergence in auth (message/status/timing), resource existence (404 vs 403), secret in log | `references/stage-4-vazamento-resposta.md` |
-| 5 | **Merge** — merges the 4 reports: cross-source dedup, sorts by effort÷severity, identifies chains, closes with "today's top three" | `references/stage-5-fusao-plano.md` |
+Security reports contain concrete exploit payloads, vulnerable `file:line` references, and commit hashes of leaked secrets. Follow the marked initialization block in `./references/stage-7-fusao-plano.md` before writing any artifact:
 
-> Stages 1-4 are hunting stages and independent. Stage 5 receives the output of the other four. (The original prompt had the validation stage duplicated; here it's a single one.)
+1. Select a private parent directory **outside the audited project** and any deploy/zip input. Set `AUDIT_REPORT_PARENT` to that existing absolute directory, then create a fresh `SEGURANCA-<data>/` with exclusive `mkdir`; if it exists, stop and choose another private parent. Never overwrite a prior run.
+2. Write `SEGURANCA-<data>/.gitignore` containing `*` before any report; this file alone does not exclude reports from deploys, archives or static hosting.
+3. Write the final merged plan and stage tables to `SEGURANCA-<data>/RELATORIO.md` within the new external directory (all secret values redacted). Deliver its actual absolute path privately.
 
 ## How to run it
 
-1. Fire off stages 1-4 as four parallel subagents, each loading its prompt from `references/`.
-2. Collect the four tables.
-3. Run stage 5 (merge), pasting the four tables where the prompt indicates.
-4. Deliver the merge plan as the result. The per-stage tables stay as an attachment.
+1. Fire off Stages 1–5 as five parallel subagents, each loading its prompt from `./references/`.
+2. Collect the five markdown tables.
+3. Run Stage 6 (Devil's Advocate) using `./references/stage-6-advogado-do-diabo.md` to challenge every finding and assign `CONFIRMADO`, `DEPENDE DE CONFIGURAÇÃO`, or `DERRUBADO`.
+4. Initialize the fresh private external report directory as prescribed in Stage 7, then run Stage 7 (Merge) using `./references/stage-7-fusao-plano.md` over the Stage 1–5 tables and Stage 6 verdicts, saving the result to `SEGURANCA-<data>/RELATORIO.md`.
+5. Deliver the merged remediation plan and its private absolute `SEGURANCA-<data>/RELATORIO.md` path. The per-stage tables and Devil's Advocate review stay attached inside the report.
 
 ## Relationship to the other security skills
 
-- **This skill HUNTS** (finds + proves). Output = list of findings + plan.
-- **`wizz-web-security` and `wizz-auth-and-secrets` FIX** (correct pattern + code example). When closing a finding from this audit, open the matching fix skill cited in the "What prevents it" column.
+- **This skill HUNTS and VERIFIES** (finds + proves + challenges false positives). Output = private external report (`SEGURANCA-<data>/RELATORIO.md`) with verified findings + prioritized plan.
+- **`wizz-web-security` and `wizz-auth-and-secrets` FIX** (correct pattern + code example). When closing a finding from this audit, invoke the matching fix skill cited in the "What prevents it" column: Invoke the `wizz-web-security` skill or Invoke the `wizz-auth-and-secrets` skill.