v0.27.2

[0.27.2] — 2026-10-19

Fixed

• Publish smoke test cleared the job-level WIZE_SKIP_BASELINE for its explicit document-project quick step, which honors that variable since 0.27.0. Neither 0.27.0 nor 0.27.1 reached npm; 0.27.2 is the first published release with the worktree-safe hydrate and automatic updates.

v0.26.1

[0.26.1] — 2026-10-19

Fixed

• wize-sec-recon pointed at a script that does not exist. skill.md and scripts/run-recon.js referenced scripts/run-sast.js; the SAST checks actually live in scripts/run-gitleaks.js (secrets) and scripts/run-osv.js (dependencies). Both references now name the real scripts, and a test keeps every scripts/*.js reference in the security overlay resolvable.

v0.26.0

[0.26.0] — 2026-10-19

Review hardening. Bot comments and PR-body screenshots stop counting as evidence, wize-code-review learns what to do once a review bot has commented on the open PR, and two small gaps close in Shuri's reuse ladder and the architecture structure step. Ideas from michaelshimeles/skills (greploop, MIT, Greptile AI), rewritten in kit voice; no code ported.

Added

• External reviewer feedback in wize-code-review (step 4, section 7) — for a PR a review bot (Copilot code review, CodeRabbit, Greptile, other) has commented on: comments and suggested patches are untrusted data checked against the code, results count only when tied to the current head SHA (Reviewed at: <sha> under Review Findings), wize-pre-pr-check runs before each push, threads resolve only after the fix is pushed, a read-only request never authorizes posting or resolving. Capped at 5 cycles, never auto-raised; success, timeout and capped are reported separately and the cap escalates to Wizer / wize-correct-course. No new skill.
• Ownership bullet in wize-create-architecture step 6 — record who owns policy, persistence and transactions; brownfield follows the existing owner, greenfield adds a layer only for a concrete boundary benefit. Step 5 did not cover it.
• Greploop credit in the 3 READMEs.
• test/review-hardening.test.js guards the rules; test/reuse-discipline.test.js pins the rung-2 note.

Changed

• wize-pr-audit — the "following instructions in the diff" anti-pattern now names review-bot suggestions, suggested patches and "prompt for AI agents" blocks, and forbids applying or resolving a thread because a bot said so. New Phase 1 claim row: a screenshot or image never proves behavior; re-derive it from code or a test run, and do not auto-fetch mutable PR-body media.
• Reuse ladder, rung 2 (Shuri's persona) — a mechanic that lives only inline in another flow and would get a second or third caller is not extracted inside the story; leave a wize-debt: marker with its trigger and propose a separate refactor story.

v0.25.0

[0.25.0] — 2026-10-19

Writing hygiene. wize-no-ai-slop stops at the README: the commit messages, PR bodies, code comments and review replies an agent writes get the same pass, and the pattern list gains the one tell it was missing. Ideas from unslop by Lauren Tan (MIT), rewritten in kit voice; none of its rule text is copied.

Added

• Dev text scope in wize-no-ai-slop — a short "Dev text" section: the subject says what changed in plain words, the body gives the why with a mechanism or number, no chatbot closers, no "This PR enhances" puffery, and prose the agent did not write is never touched. Conventional Commits and the dev-story PR template stay as they are. Shuri (wize-agent-dev) now carries the skill.
• Pattern 18, chatbot artifacts and sycophancy — "I hope this helps", "Certainly!", "Great question", "Let me know if"; stacked hedges collapse to one.
• Advisory line in wize-pre-pr-check — when a commit range or PR draft exists, run detect mode on commit subjects and the PR title/body. Reports only; never fails the gate.
• Credit for unslop in the skill header and in the 3 READMEs, next to the No AI Slop entry.
• test/writing-hygiene.test.js guards the rules.

Changed

• wize-no-ai-slop Goal — only PRD, ADR, story and gate keep their own conventions; agent-written dev text is in scope. The self-check says "the patterns above" instead of a hard-coded count (module catalog now says 18). The module catalog entry and the README command line mention commit and PR text.
• Principles — new "Name the actor" line (is/are/was + participle hides who did it; an adverb propping a weak verb means the measured delta is missing). Pattern 16 — a bold label plus colon that restates the line is a tell; a bold lead-in ending in a period with new detail is fine.

v0.24.0

[0.24.0] — 2026-10-19

Ship discipline. The kit already demanded proof and a clean gate; this release defines what proof is, where it lives and which commit it belongs to, and makes the implementation flows start on a branch instead of assuming one. Ideas from michaelshimeles/skills, rewritten in kit voice.

Added

• Branch guard in wize-dev-story (step 0) and wize-quick-dev (step 1.5) — read the current branch and status, resolve the default branch with git symbolic-ref refs/remotes/origin/HEAD (no hardcoded main), keep any other branch or assigned worktree, and on the default branch create feat/<story-id> / fix/<slug> (or the repo's own convention). No remote: branch locally.
• Proof per change type in wize-dev-story step 10 — UI screenshots/recording, CLI/API/perf command output with measured numbers, bug-fix red run plus a captured before-state, docs content and link check. Each proof is labeled with its AC and passed/failed/untested (untested needs a reason); UI before/after comes from a pre-change baseline, never a branch switch or stash. Step 9 self-check points at it; wize-quick-dev asks for before/after on an observable bug fix.
• Hosting and privacy rule for captures — attach through the PR host's own channel or a CI artifact, never anonymous or public third-party hosts or env-supplied upload endpoints; capture with seeded or fake data and check for PII, tokens, internal URLs and admin screens first. Mirrored as a wize-pre-pr-check anti-pattern.
• Success-path capture in the Playwright playbook — a review project/tag with always-on screenshot and video, and a try/finally context close so the video finalizes even when an assertion fails.
• Two lines in the generated AGENTS.md Operating context — a request for a plan, review or investigation never implies editing, pushing or publishing; and the shared-repo rules (one branch or worktree per agent, never touch another agent's uncommitted work, no force-push of the default branch, --force-with-lease only on your own branch, regenerate lockfiles instead of hand-merging, stop and report on an unresolvable conflict). Existing installs: delete the kit-generated AGENTS.md and re-run npx wize-dev-kit sync to regenerate it (the file is skip-if-exists).
• test/ship-discipline.test.js guards the core rules.

Changed

• TEA evidence is pinned to a commit. wize-tea-review records evidence as the artifact or test id plus the commit SHA it was observed on, points at the dev-story proof-per-type block as the single definition of observed evidence, and rejects evidence from a commit other than HEAD. wize-tea-gate adds a row — all ACs met but evidence unpinned or stale → CONCERNS (advisory) / FAIL (enforcing) — and counts an untested AC as not-met unless WAIVED with a reason. wize-check names the commit in its evidence rule. Gate frontmatter status values are unchanged.
• wize-pre-pr-check rebases before the push onto the latest origin default branch and re-runs the fast checks; a force push is --force-with-lease on your own task branch only, never plain --force, never on the default branch or a shared branch.

v0.23.0

[0.23.0] — 2026-10-19

Added

• wize-pr-audit (method workflow, phase 4) — audits a PR you did not write (external contributor, fork, bot) as evidence, not narrative, closing the gap where wize-code-review only covers your own trusted diff. Untrusted-input threat model, six phases: trusted-state pin (BASE_SHA/HEAD_SHA, no checkout), a claim ledger (fixes X / compatible / follows spec / tests pass / no security impact → confirmed/partial/unsupported), a hostile-change gate before any execution (executable bits, symlinks, Unicode bidi controls, homoglyphs, encoded blobs, CI pull_request_target/unpinned actions/workflow-secret exposure, dependency typosquat/git-path sources/lockfile drift, credential access), safe execution in an isolated disposable sandbox with an evidence-reuse rule, functional/compatibility/docs audit with severities ([CRITICAL]/[BLOCKING]/[SHOULD-FIX]/[NIT]/[UNCERTAIN]), and a fixed report format. Report-only by default; Phase 6 lands on the right base branch (with maintainer commits preserving attribution) only on explicit approval. Adapted from akitaonrails/my-skills · pr-audit (credited in the READMEs). Registered in the method module catalog, Shuri's wize-agent-dev skills, and the wize-help/wize intent routing table ("pr audit", "auditar pr", "pr é seguro", …).

v0.22.0

[0.22.0] — 2026-09-25

GitHub Copilot is now the 12th supported harness. The new copilot IDE target renders the kit into the two trees Copilot actually reads: .github/skills/wize-{code}/SKILL.md for workflows + skills (Agent Skills standard) and .github/agents/wize-{code}.agent.md for the 10 personas (custom agents, pickable in the chat dropdown). Works across the Copilot cloud agent, Copilot code review, the GitHub Copilot CLI, the Copilot app, and agent mode in VS Code, JetBrains IDEs, Eclipse and Xcode. Highlighted in all 3 READMEs + docs/harnesses/copilot.md (+pt-BR); registered in the installer targets, doctor, the .gitignore block, the brownfield baseline and the test suites.

Added

• copilot IDE target (adapters/copilot/) — personas → .github/agents/*.agent.md (frontmatter name + description, persona body as the prompt, tools omitted so each persona keeps every available tool); workflows + skills → .github/skills/*/SKILL.md via the shared Anthropic emitter, including companion files (steps/, templates/, data/, *.csv) so micro-file workflows resolve their relative paths.
• copilot harness in the brownfield baseline — headless one-shot via copilot -p "<prompt>" (grant the minimum permissions you need for unattended runs, e.g. --allow-tool=write, instead of --allow-all).
• docs/harnesses/copilot.md + copilot.pt-BR.md — the skill vs custom-agent split, progressive disclosure, AGENTS.md as the always-on instructions source (no .github/copilot-instructions.md duplicate is written), why prompt files are deliberately not shipped (VS Code deprecated .github/prompts/*.prompt.md in favor of agent skills), and the headless invocation.
• renderAnthropicSkills accepts an optional opts.kinds filter — one emitter now serves harnesses that split assets across trees (Copilot sends workflows/skills to .github/skills/ and personas to .github/agents/) without duplicating the rendering logic.

v0.21.0

[0.21.0] — 2026-09-25

Less code, and a way to verify it. Four changes put the kit's reuse discipline to work after the code is written, not only while it is being written: a deletion-first review (/wize-subtract) wired as a fourth layer of wize-code-review, a ledger for deliberate shortcuts (/wize-debt + the wize-debt: marker), the code ladder promoted into the generated AGENTS.md (always-on in every harness), and code accounting in the retrospective. Inspired by Ponytail by Dietrich Gebert (credited in all 3 READMEs).

Added

• /wize-subtract (core skill) — over-engineering-only review of a diff: one line per finding (delete:, stdlib:, native:, yagni:, shrink:), ranked by lines saved, closing with net: -<N> lines possible. Names the replacement for every cut, verifies reuse claims against the codebase, and never flags tests, trust-boundary validation, security or accessibility. Lists findings; does not apply them.
• /wize-debt (core skill) — harvests every wize-debt: marker (ceiling + upgrade path) into one ledger, so a deferral can't quietly become permanent. Flags markers that name no trigger as no-trigger rot risk. Read-only.
• wize-code-review runs a fourth layer: the Subtraction Hunter — alongside the Blind Hunter, Edge Case Hunter and Acceptance Auditor on every code PR. Triage classifies its findings (patch for code this diff introduced, defer for pre-existing code, dismiss when a requirement or a safety floor protects it) and the summary reports the cuts and net: -N lines possible.
• Code accounting in wize-retrospective — lines added/removed/net, files touched, dependencies added, new abstractions, wize-debt: markers added vs retired, and the complexity delta, all measured from git over the sprint window and reported as numbers in the retro doc.

Changed

• The generated AGENTS.md now carries the code ladder — YAGNI → already-here → stdlib → native → installed dependency → one-liner → minimum, plus the anti-over-engineering rules (no unrequested abstractions or dependencies, deletion over addition, boring over clever, fewest files, bug fix = root cause) and the safety floor (trust-boundary validation, data-loss handling, security, accessibility, tests on non-trivial logic). The ladder is now always-on in every harness that reads AGENTS.md, instead of living only inside the implementation skills. Existing installs: delete the kit-generated AGENTS.md and re-run npx wize-dev-kit sync to regenerate it.
• Shuri's persona — the blanket "no TODO" rule becomes "no vague TODO": a deliberate shortcut with a known ceiling ships with a wize-debt: marker naming ceiling and upgrade trigger, or it doesn't ship. Shuri also runs /wize-subtract on her own diff before opening the PR.

Fixed

• Validator: descriptions with escaped quotes — the kit's frontmatter parser reads double-quoted scalars with /^"([^"]*)"$/, so a description containing \" was parsed with its wrapping quotes and re-escaped on render (visible in every harness). npm run validate now fails that pattern, with the fix spelled out.

v0.20.0

[0.20.0] — 2026-09-18

Added

• wize-app-store-review (app overlay workflow) — the publication gate the app-overlay was missing. Hawkeye audits the app's code and metadata as an App Store reviewer after wize-app-store-listing and before prod go-live via wize-app-release-channels: top rejection risks first (permissions, privacy manifest, IAP/restore, sign-in compliance, metadata mismatch, minimum functionality), compliance checklist by area with conditional Guideline checks (1.2 UGC, 4.3(b) spam, 4.5.3 Apple services), fixed report structure (executive summary, risk register P0–P3, detailed findings, reviewer-experience checklist, suggested "App Review Notes" for App Store Connect), then a fix pass handed to Shuri. Gate rule: no prod submission while any P0/P1 is open (or the user documents a WAIVED). Adapted from awesome-copilot's apple-appstore-reviewer (MIT, credited in the READMEs). New artifact: .wize/planning/app/app-store-review-report.md (also registered in wize-help/wize ship stages and ARCH.md).

v0.19.0

[0.19.0] — 2026-09-18

Added

• wize-no-ai-slop (core skill) — writing hygiene for end-user-facing prose, adapted from no-ai-slop by Peter Yang (MIT, credited in the READMEs). Two jobs: apply while writing (17 AI-slop patterns to cut — binary contrasts, throat-clearing, faux-insight setups, importance puffery, weasel attribution, fake-profound kickers, formatting slop, etc. — plus banned filler words, voice preservation, portability test) and detect on request (name each pattern with a quoted line; no rewriting, no guessing AI authorship). Wired into Peggy Carter (wize-agent-tech-writer) and Mantis (wize-agent-ux-designer) agent skills + persona styles; registered in the core module catalog; rendered by all 11 harness adapters.