@brunosps00/dev-workflow 1.0.2 → 1.0.5

package/scaffold/pt-br/commands/dw-plan.md

@@ -38,6 +38,17 @@ Quando disponíveis em `./.agents/skills/`, use como suporte:
 - `dw-testing-discipline`: aplicado no estágio de tasks — toda task que adiciona teste nomeia seu invariant per placement doctrine.
 - `dw-council` (opt-in via `--council`): stress-test multi-conselheiro sobre a decisão arquitetural principal no estágio TechSpec.
 - `dw-codebase-intel`: consultado para convenções de API, padrões arquiteturais, naming ao desenhar TechSpec.
+- `dw-search-first`: **OBRIGATÓRIO** antes de adicionar nova dependency, integration, MCP server, helper reutilizavel ou abstracao de framework.
+- `dw-context-budget`: use quando o plano passar de 12 tasks, tocar 30+ arquivos, ou exigir carregar muitos docs/skills.
+
+## Agent Dispatch
+
+Quando agentes do projeto estiverem instalados, use:
+
+- `dw-code-explorer` antes de TechSpec e Tasks para rastrear fluxos existentes e padroes reutilizaveis.
+- `dw-planner` antes de finalizar Tasks para checar slices, dependencias, riscos e criterios de verificacao.
+
+Claude Code e OpenCode podem usar agentes nativos. Codex e Copilot usam `.agents/agents/` mais estas instrucoes como fallback.
 
 ## Constitution Gate
 

package/scaffold/pt-br/commands/dw-review.md

@@ -51,6 +51,18 @@ Quando disponíveis em `./.agents/skills/`, são invocadas como apoio analítico
 - `dw-llm-eval`: **OBRIGATÓRIO quando diff toca código de feature AI/LLM**. Reference dataset + ≥2 oracle rungs + judge calibration (se rung 4 usado) + eval run results DEVEM estar no PR. Faltando → REPROVADO.
 - `security-review`: use quando diff toca auth, autorização, input externo, upload, SQL, secrets, SSRF, XSS ou superfícies sensíveis.
 - `vercel-react-best-practices`: use quando diff toca React/Next.js.
+- `dw-silent-failure`: use quando diff toca error handling, fallbacks, retries, async jobs, queues, database writes ou APIs externas.
+
+## Agent Dispatch
+
+Quando agentes do projeto estiverem instalados, dispare:
+
+- `dw-code-reviewer` para o review geral Level 3.
+- `dw-security-reviewer` quando auth, authorization, secrets, SQL, uploads, input externo, SSRF ou XSS estiverem em escopo.
+- `dw-silent-failure-hunter` quando error handling, fallback behavior, queues ou background jobs forem tocados.
+- Reviewers de linguagem como `dw-typescript-reviewer`, `dw-python-reviewer`, `dw-csharp-reviewer` ou `dw-rust-reviewer` quando o modulo estiver instalado e o diff bater com a linguagem.
+
+Consolide todos os findings via `dw-review-rigor`; nunca cole relatorios de agentes sem de-duplication.
 
 ## Constitution Gate
 

package/scaffold/pt-br/commands/dw-skill-health.md

@@ -0,0 +1,29 @@
+<system_instructions>
+Voce e o auditor de saude de skills e agentes do dev-workflow.
+
+## Quando Usar
+- Use depois de adicionar skills de catalogos externos.
+- Use quando o contexto estiver pesado ou skills se sobrepuserem.
+- Use antes de promover um aprendizado para skill reutilizavel.
+
+## Processo
+1. Leia `scaffold/skill-registry.json` ao auditar o repo dev-workflow, ou `.dw/skill-registry.json` + `.agents/skills/` em projetos consumidores.
+2. Agrupe skills por `kind`: `protocol`, `domain-pack`, `recipe-pack`, `asset-pack`.
+3. Valide que toda skill tem trigger, output esperado, owner, load policy e limite de contexto.
+4. Aponte nomes duplicados, `SKILL.md` ausente, frontmatter ausente, `SKILL.md` grande demais, e references/assets lidos sem trigger especifico.
+5. Recomende manter, compactar entrypoint, mesclar, reclassificar, ou remover da visibilidade core.
+
+## Taxonomia
+
+- `protocol`: workflow/gate/checklist acionavel que muda a execucao.
+- `domain-pack`: expertise de dominio usada so quando a tarefa entra naquele dominio.
+- `recipe-pack`: receitas/snippets curados carregados por stack ou modo.
+- `asset-pack`: midia/exemplos/assets carregados so para tasks correspondentes.
+
+`SKILL.md` deve ser um roteador/protocolo curto. Regras longas, exemplos, paletas, receitas, services e assets ficam em references/assets/rules/recipes e sao carregados sob demanda.
+
+## Saida
+Retorne um relatorio conciso. Nao delete arquivos.
+
+Marcador final: `## SKILL-HEALTH COMPLETE`
+</system_instructions>

package/scaffold/pt-br/commands/dw-subtask-complete.md

@@ -0,0 +1,40 @@
+<system_instructions>
+Voce registra um handoff estruturado de subagente.
+
+## Quando Usar
+- Use dentro da sessao child/subagente quando a subtarefa atribuida estiver completa, bloqueada ou fora de budget.
+
+## Formato Obrigatorio
+
+```markdown
+## Objective
+
+## Result
+
+## Files Read
+
+## Files Changed
+
+## Decisions
+
+## Risks
+
+## Verification
+
+## Next Steps
+
+## Blocked Or Not Done
+```
+
+## Processo
+1. Escreva o handoff em um arquivo markdown local.
+2. Rode:
+
+```bash
+npx @brunosps00/dev-workflow subtask complete --slug=<slug> --file=<handoff.md>
+```
+
+Retorne apenas evidencia resumida. Nao inclua logs completos nem dumps de transcript.
+
+Final marker: `## SUBTASK HANDOFF RECORDED`
+</system_instructions>

package/scaffold/pt-br/commands/dw-subtask-resume.md

@@ -0,0 +1,21 @@
+<system_instructions>
+Voce consome handoffs completos de subagentes para a sessao parent.
+
+## Quando Usar
+- Use depois que uma ou mais sessoes child registraram `.dw/subtasks/pending/*/HANDOFF.md`.
+- Use antes de sintetizar decisoes finais do parent a partir de trabalho delegado.
+
+## Processo
+1. Rode:
+
+```bash
+npx @brunosps00/dev-workflow subtask consume
+```
+
+2. Leia o resumo impresso e, somente quando houver aprendizado duravel, promova manualmente para `.dw/STATE.md`, `.dw/rules/`, `.dw/intel/`, resumo de bugfix ou artefato de spec.
+3. Continue o workstream principal a partir dos return packets resumidos.
+
+Nao cole transcripts child no contexto principal. O parent continua sendo o unico sintetizador final.
+
+Final marker: `## SUBTASKS RESUMED`
+</system_instructions>

package/scaffold/pt-br/commands/dw-subtask-start.md

@@ -0,0 +1,22 @@
+<system_instructions>
+Voce cria input packets minimos para subagentes.
+
+## Quando Usar
+- Use quando uma subtarefa read-only, QA, review ou build-fix puder rodar separada do contexto principal.
+- Use quando o output seria volumoso: logs, grep amplo, evidencia de teste, QA em browser, review de seguranca.
+
+## Processo
+1. Escolha o agente instalado mais especifico em `.agents/agents/README.md` ou `scaffold/agent-registry.json`.
+2. Escreva objetivo estreito, arquivos/fontes permitidos, constraints, output esperado, budget de contexto e criterio de parada.
+3. Rode:
+
+```bash
+npx @brunosps00/dev-workflow subtask create --agent=<name> --goal="<goal>"
+```
+
+4. Preencha qualquer fronteira faltante no `.dw/subtasks/pending/<slug>/TASK.md` antes do dispatch.
+
+Nunca cole o transcript bruto do parent no task packet.
+
+Final marker: `## SUBTASK PACKET READY`
+</system_instructions>

package/scaffold/skill-registry.json

@@ -0,0 +1,258 @@
+{
+  "schema_version": "1.0",
+  "skills": [
+    {
+      "name": "api-testing-recipes",
+      "kind": "recipe-pack",
+      "tier": "specialty",
+      "owner": "dw-qa",
+      "trigger": "API QA, endpoint testing, HTTP recipe generation",
+      "expected_output": "A selected API testing recipe and evidence path for the active stack.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "docker-compose-recipes",
+      "kind": "recipe-pack",
+      "tier": "specialty",
+      "owner": "dw-new-project,dw-dockerize",
+      "trigger": "Docker Compose service selection or local infrastructure setup",
+      "expected_output": "A selected service recipe and composition guidance.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-codebase-intel",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-intel",
+      "trigger": "Codebase indexing or codebase intelligence query",
+      "expected_output": ".dw/intel index files or a cited answer from the index.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-context-budget",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-context-budget",
+      "trigger": "Context overhead, slow sessions, many agents/skills/MCPs",
+      "expected_output": "A context budget report with concrete savings.",
+      "load_policy": "always-small",
+      "context_limit": 6000,
+      "bundled": true
+    },
+    {
+      "name": "dw-council",
+      "kind": "protocol",
+      "tier": "specialty",
+      "owner": "dw-brainstorm,dw-plan",
+      "trigger": "Council mode or high-impact architectural debate",
+      "expected_output": "Advisor positions, tension synthesis, and decision recommendation.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-debug-protocol",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-bugfix,dw-qa",
+      "trigger": "Bugfix, QA fix loop, or non-reproducible failure",
+      "expected_output": "Six-step triage, root cause, guard, and verification path.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-execute-phase",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-run,dw-autopilot",
+      "trigger": "Task execution, plan-checking, waves, checkpoint recovery",
+      "expected_output": "Plan-check verdict, wave execution report, or checkpoint summary.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-git-discipline",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-commit,dw-generate-pr",
+      "trigger": "Commit creation, branch hygiene, PR generation",
+      "expected_output": "Atomic commit plan and git hygiene checks.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-incident-response",
+      "kind": "domain-pack",
+      "tier": "domain",
+      "owner": "dw-bugfix",
+      "trigger": "Production critical bug, outage, incident, SEV workflow",
+      "expected_output": "Incident triage, communication, resolution, and postmortem artifacts.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-llm-eval",
+      "kind": "domain-pack",
+      "tier": "domain",
+      "owner": "dw-plan,dw-review,dw-qa",
+      "trigger": "AI, LLM, RAG, classifier, agent, or tool-use feature",
+      "expected_output": "Eval strategy, oracle choice, dataset requirements, and result checks.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-memory",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-run,dw-autopilot",
+      "trigger": "Task execution memory, checkpointing, compaction",
+      "expected_output": "Updated workflow memory and task-local memory guidance.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-review-rigor",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-review",
+      "trigger": "Code review, implementation review, or review consolidation",
+      "expected_output": "Deduplicated findings ordered by defensible severity.",
+      "load_policy": "always-small",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-search-first",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-plan,dw-find-skills",
+      "trigger": "New dependency, integration, MCP server, helper, or abstraction",
+      "expected_output": "Adopt/wrap/compose/build decision with checked search channels.",
+      "load_policy": "always-small",
+      "context_limit": 6000,
+      "bundled": true
+    },
+    {
+      "name": "dw-silent-failure",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-review,dw-bugfix",
+      "trigger": "Swallowed errors, dangerous fallbacks, retries, async detachment",
+      "expected_output": "Concrete silent-failure findings or an explicit pass.",
+      "load_policy": "always-small",
+      "context_limit": 6000,
+      "bundled": true
+    },
+    {
+      "name": "dw-simplification",
+      "kind": "protocol",
+      "tier": "specialty",
+      "owner": "dw-review,dw-brainstorm",
+      "trigger": "Refactor analysis, code smells, complexity, or behavior-preserving simplification",
+      "expected_output": "Simplification target, risk, behavior-preserving checks, and recommendation.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-source-grounding",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-plan,dw-brainstorm",
+      "trigger": "Library/framework/API decision, technical research, dependency audit",
+      "expected_output": "Cited source-grounded decision with version and retrieval date.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-testing-discipline",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-run,dw-qa,dw-review",
+      "trigger": "Writing, reviewing, or debugging tests",
+      "expected_output": "Test placement, invariant, anti-pattern checks, and verification guidance.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-ui-discipline",
+      "kind": "protocol",
+      "tier": "specialty",
+      "owner": "dw-redesign-ui,dw-plan,dw-qa",
+      "trigger": "UI design, redesign, visual QA, accessibility, or frontend polish",
+      "expected_output": "Grounding answers, state matrix, accessibility checks, and visual risks.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "dw-verify",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-run,dw-review,dw-generate-pr",
+      "trigger": "Completion claim, commit, PR generation, or fixed bug status",
+      "expected_output": "Fresh verification report with cited command evidence.",
+      "load_policy": "always-small",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "humanizer",
+      "kind": "domain-pack",
+      "tier": "domain",
+      "owner": "manual,docs",
+      "trigger": "Editing AI-generated prose, README, docs, captions, marketing copy",
+      "expected_output": "Rewritten prose with AI-writing tells removed and voice preserved.",
+      "load_policy": "lazy-references",
+      "context_limit": 6000,
+      "bundled": true
+    },
+    {
+      "name": "remotion-best-practices",
+      "kind": "asset-pack",
+      "tier": "media",
+      "owner": "manual,remotion",
+      "trigger": "Remotion video composition, captions, rendering, transitions, media assets",
+      "expected_output": "Selected Remotion rule references and implementation guidance.",
+      "load_policy": "lazy-references",
+      "context_limit": 8000,
+      "bundled": true
+    },
+    {
+      "name": "security-review",
+      "kind": "domain-pack",
+      "tier": "domain",
+      "owner": "dw-secure-audit,dw-review",
+      "trigger": "Security review, sensitive code, OWASP checks, auth/payment/input surfaces",
+      "expected_output": "High-confidence security findings or explicit pass.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    },
+    {
+      "name": "vercel-react-best-practices",
+      "kind": "recipe-pack",
+      "tier": "specialty",
+      "owner": "dw-review,dw-redesign-ui,dw-plan",
+      "trigger": "React/Next.js performance, hydration, data fetching, bundle or render issues",
+      "expected_output": "Selected performance rule references and metric-driven recommendations.",
+      "load_policy": "lazy-references",
+      "context_limit": 12000,
+      "bundled": true
+    }
+  ]
+}

package/scaffold/skills/dw-codebase-intel/SKILL.md

@@ -46,6 +46,7 @@ The intel directory is the contract. Every file is machine-parseable and referen
 | `deps.json` | Dependencies: version, type, used_by, invocation | JSON |
 | `bugfixes.json` | Historical bugfix index aggregated from `.dw/bugfixes/*/SUMMARY.md` (slug, date, modules touched, related concerns, by_module map). Optional — present only if `.dw/bugfixes/` is non-empty. | JSON |
 | `arch.md` | Human-readable architecture overview + key components + data flow | Markdown |
+| `codemaps/*.md` | Token-lean architecture maps for architecture/backend/frontend/data/dependencies. Optional but recommended for large repos. | Markdown |
 | `.last-refresh.json` | Timestamps + content hashes for incremental detection (now includes `bugfixes_indexed` count) | JSON |
 
 Schemas are documented in `references/intel-format.md`.
@@ -62,10 +63,11 @@ This skill ships ONE agent — `intel-updater` — which produces machine-readab
 
 1. **`/dw-intel --build`** is invoked.
 2. The command spawns `intel-updater` with `focus: full` (first run) or `focus: partial --files <paths>` (incremental).
-3. The agent reads source files (using Glob/Read/Grep; no Bash file listing for cross-platform safety) and writes the intel files (`stack.json`, `files.json`, `apis.json`, `deps.json`, `arch.md`).
-4. If `.dw/bugfixes/` exists and contains at least one `SUMMARY.md`, the agent additionally scans every SUMMARY frontmatter + Files Touched section and writes `bugfixes.json`. SUMMARY files with invalid frontmatter are logged and skipped.
-5. The agent writes `.last-refresh.json` with timestamps + hashes for incremental change detection on the next run, including a `bugfixes_indexed` count.
-6. `/dw-intel --build` reports completion and invites the user to query via `/dw-intel "<question>"`.
+3. The agent reads source files using iterative retrieval: broad search, relevance evaluation, refined search, then final read set. Use Glob/Read/Grep; no Bash file listing for cross-platform safety.
+4. The agent writes the intel files (`stack.json`, `files.json`, `apis.json`, `deps.json`, `arch.md`) plus token-lean codemaps in `.dw/intel/codemaps/` when enough structure exists.
+5. If `.dw/bugfixes/` exists and contains at least one `SUMMARY.md`, the agent additionally scans every SUMMARY frontmatter + Files Touched section and writes `bugfixes.json`. SUMMARY files with invalid frontmatter are logged and skipped.
+6. The agent writes `.last-refresh.json` with timestamps + hashes for incremental change detection on the next run, including a `bugfixes_indexed` count.
+7. `/dw-intel --build` reports completion and invites the user to query via `/dw-intel "<question>"`.
 
 For human-readable analysis (architecture overview, module conventions, anti-patterns), run `/dw-analyze-project` after `/dw-intel --build` — it reads `.dw/intel/` as input and produces `.dw/rules/`.
 
@@ -90,7 +92,7 @@ If no `.dw/intel/` exists at all, `/dw-intel` falls back to `.dw/rules/` (seeded
 - **Cross-platform**: use Glob/Read/Grep; never Bash `ls`/`find`/`cat` (those break on Windows).
 - **Forbidden files**: never read `.env*` (except `.env.example`/`.env.template`), `*.key`, `*.pem`, `*.pfx`, `*.p12`, `*.keystore`, `*.jks`, `id_rsa`, `id_ed25519`, or files matching `*credential*`/`*secret*` in name. Skip silently if encountered.
 - **Excluded directories**: `node_modules/`, `.git/`, `dist/`, `build/`, `.dw/` (planning docs, not project code).
-- **Output budget**: `files.json` ≤2K tokens, `apis.json` ≤1.5K, `deps.json` ≤1K, `stack.json` ≤500, `arch.md` ≤1.5K, `bugfixes.json` ≤1K. For large repos, prioritize coverage of key files over exhaustive listing. For `bugfixes.json`, keep one-line symptom/root-cause summaries; do not embed full SUMMARY.md content.
+- **Output budget**: `files.json` ≤2K tokens, `apis.json` ≤1.5K, `deps.json` ≤1K, `stack.json` ≤500, `arch.md` ≤1.5K, each `codemaps/*.md` ≤1K, `bugfixes.json` ≤1K. For large repos, prioritize coverage of key files over exhaustive listing. For `bugfixes.json`, keep one-line symptom/root-cause summaries; do not embed full SUMMARY.md content.
 
 ## References
 
@@ -99,6 +101,11 @@ If no `.dw/intel/` exists at all, `/dw-intel` falls back to `.dw/rules/` (seeded
 - `references/query-patterns.md` — how `/dw-intel` answers different question shapes (where-is, what-uses, architecture-of, dependency-of).
 - `references/api-design-discipline.md` — Hyrum's Law, contract-first design, error semantics, boundary validation, versioning. Use when intel feeds techspec authoring (`/dw-plan techspec`) for endpoints — design must respect existing project conventions surfaced in `apis.json`. Adapted from [`addyosmani/agent-skills/api-design`](https://github.com/addyosmani/agent-skills/tree/main/api-design) (MIT).
 
+## ECC-Inspired Additions
+
+- **Iterative retrieval**: subagents should not load broad file sets blindly. They perform at most three search/evaluate/refine cycles, then read only high-relevance files.
+- **Codemaps**: `.dw/intel/codemaps/*.md` stores short maps optimized for agent context instead of forcing repeated source reads.
+
 ## Inspired by
 
 Adapted from [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) (`gsd-intel-updater`) by gsd-build (MIT license). Core schemas (`files.json`, `apis.json`, `deps.json`, `stack.json`, `arch.md`) and incremental update protocol preserved. Path conventions changed from `.planning/intel/` to `.dw/intel/`. CLI tooling (`gsd-sdk query intel.*`) replaced by agent-driven inline operations (no separate runtime). The companion `gsd-codebase-mapper` agent (human-readable analysis docs) was NOT ported — its scope overlaps with the existing `/dw-analyze-project` command which writes to `.dw/rules/`.

package/scaffold/skills/dw-context-budget/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: dw-context-budget
+description: Audit context overhead from commands, skills, agents, MCPs, and instruction files before sessions degrade.
+allowed-tools:
+  - Read
+  - Grep
+  - Glob
+  - Bash
+---
+
+# dw-context-budget
+
+Use when a project has many commands, skills, agents, MCP servers, or long instruction files.
+
+## Audit Targets
+
+- `CLAUDE.md` and `AGENTS.md`
+- `.dw/commands/*.md`
+- `.agents/skills/*/SKILL.md`
+- `.agents/agents/*.md`
+- `.claude/agents/*.md`
+- `.opencode/agent/*.md`
+- `.claude/settings.json`
+
+## Heuristics
+
+- Prose estimate: `word count * 1.3`
+- JSON/code estimate: `character count / 4`
+- Flag command files over 20KB
+- Flag `SKILL.md` files over 12KB
+- Flag agent files over 8KB
+- Flag more than 10 configured MCP servers
+- Flag duplicate copies loaded by more than one platform when a fallback would be enough
+
+## Report
+
+Return:
+
+1. Estimated overhead by category.
+2. Top 10 largest files.
+3. Duplicate or overlapping components.
+4. Top 5 concrete savings.
+5. What must remain loaded because commands depend on it.
+
+Inspired by ECC's `context-budget` and `strategic-compact` patterns; adapted for dev-workflow's `.dw/` scaffold and cross-platform wrappers.

package/scaffold/skills/dw-search-first/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: dw-search-first
+description: Research-before-building protocol for dependencies, integrations, MCP servers, libraries, and reusable skills.
+allowed-tools:
+  - Read
+  - Grep
+  - Glob
+  - Bash
+---
+
+# dw-search-first
+
+Use before writing custom infrastructure, adding an integration, choosing a dependency, or inventing a reusable helper.
+
+## Protocol
+
+1. Define the capability needed and the project constraints.
+2. Search the existing repo first.
+3. Check installed skills and `.dw/intel/` for a local pattern.
+4. Check package registries or official docs when network/tools are available.
+5. Compare adopt, wrap, compose, or build custom.
+6. Record the decision in the TechSpec or ADR when it affects architecture.
+
+## Decision Rules
+
+- Adopt if there is a maintained exact match with acceptable license and dependency cost.
+- Wrap if the package is strong but needs a thin local adapter.
+- Compose if two small tools beat one large dependency.
+- Build custom only after search channels were checked or explicitly unavailable.
+
+Inspired by ECC's `search-first`; adapted to compose with `dw-source-grounding`, `/dw-plan`, and `/dw-find-skills`.

package/scaffold/skills/dw-silent-failure/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: dw-silent-failure
+description: Checklist for finding swallowed errors, dangerous fallbacks, and lost failure context during review or bugfixes.
+allowed-tools:
+  - Read
+  - Grep
+  - Glob
+  - Bash
+---
+
+# dw-silent-failure
+
+Use during `/dw-review`, `/dw-bugfix`, and `/dw-qa --fix` when failures may be hidden instead of surfaced.
+
+## Hunt List
+
+- Empty `catch` blocks.
+- Fallbacks such as `catch(() => null)` or `catch(() => [])`.
+- Log-only handling where callers need the failure.
+- Generic rethrows that lose stack or input context.
+- Async work launched without awaiting, tracking, or explicit detachment.
+- Network/database/filesystem calls without timeout or rollback where the project requires it.
+
+## Reporting Standard
+
+Only flag a finding when you can name:
+
+- the exact location,
+- the trigger,
+- the hidden bad outcome,
+- the minimal fix.
+
+Inspired by ECC's `silent-failure-hunter`; adapted as both a skill and a dispatchable `dw-silent-failure-hunter` agent.

package/scaffold/skills/dw-verify/SKILL.md

@@ -158,33 +158,6 @@ Verification failure is information, not a dead end. Protocol:
 
 ## Project-Specific Verification Commands
 
-dev-workflow does not hardcode a verification command. Discover it from the project:
+Discover the project gate before claiming success. Prefer documented gates in `.dw/rules/`, then package scripts such as `verify`, `check`, `ci`, or `test`, then Makefile/just/pyproject equivalents. If no verification command exists, state that explicitly in the Verification Report and avoid completion language.
 
-1. Check `.dw/rules/` for a documented verify command.
-2. Read `package.json` scripts: prefer `verify`, `check`, `ci`, `test`, in that order.
-3. Check for `Makefile`/`make verify`, `pyproject.toml`/`just verify`, etc.
-4. If none is explicit, run the documented test + lint + build sequence.
-
-If no verification command exists for the project, state that explicitly in the Verification Report and avoid completion language.
-
-## Integration With Other dev-workflow Commands
-
-This skill is invoked transparently from:
-
-- `/dw-run` — before committing the task's changes
-- `/dw-run` — before Level 2 review and before declaring the plan complete
-- `/dw-qa --fix` — before marking a bug as resolved in `QA/bugs.md`
-- `/dw-bugfix` — before claiming the bug is fixed (original symptom no longer reproduces)
-- `/dw-review --code-only` — before emitting an APPROVED verdict
-- `/dw-generate-pr` — blocks PR creation if the session has no passing VERIFICATION REPORT post-last-edit
-
-Callers should mention this skill in their "Skills Complementares" section so the user sees the dependency.
-
-## Inspired by
-
-Ported from Compozy's `cy-final-verify` skill (`/tmp/compozy/.agents/skills/cy-final-verify/SKILL.md`). Adapted for the dev-workflow context:
-
-- Project-agnostic verification discovery (Compozy assumes `make verify`; dev-workflow scans `package.json`/Makefile/`.dw/rules/`).
-- Integration table maps to dev-workflow command names instead of Compozy phases.
-
-Credit: Compozy project (https://github.com/compozy/compozy).
+Load `references/verification-discovery-and-attribution.md` when you need the full discovery checklist, command integration table, or attribution notes.

package/scaffold/skills/dw-verify/references/verification-discovery-and-attribution.md

@@ -0,0 +1,32 @@
+## Project-Specific Verification Commands
+
+dev-workflow does not hardcode a verification command. Discover it from the project:
+
+1. Check `.dw/rules/` for a documented verify command.
+2. Read `package.json` scripts: prefer `verify`, `check`, `ci`, `test`, in that order.
+3. Check for `Makefile`/`make verify`, `pyproject.toml`/`just verify`, etc.
+4. If none is explicit, run the documented test + lint + build sequence.
+
+If no verification command exists for the project, state that explicitly in the Verification Report and avoid completion language.
+
+## Integration With Other dev-workflow Commands
+
+This skill is invoked transparently from:
+
+- `/dw-run` — before committing the task's changes
+- `/dw-run` — before Level 2 review and before declaring the plan complete
+- `/dw-qa --fix` — before marking a bug as resolved in `QA/bugs.md`
+- `/dw-bugfix` — before claiming the bug is fixed (original symptom no longer reproduces)
+- `/dw-review --code-only` — before emitting an APPROVED verdict
+- `/dw-generate-pr` — blocks PR creation if the session has no passing VERIFICATION REPORT post-last-edit
+
+Callers should mention this skill in their "Skills Complementares" section so the user sees the dependency.
+
+## Inspired by
+
+Ported from Compozy's `cy-final-verify` skill (`/tmp/compozy/.agents/skills/cy-final-verify/SKILL.md`). Adapted for the dev-workflow context:
+
+- Project-agnostic verification discovery (Compozy assumes `make verify`; dev-workflow scans `package.json`/Makefile/`.dw/rules/`).
+- Integration table maps to dev-workflow command names instead of Compozy phases.
+
+Credit: Compozy project (https://github.com/compozy/compozy).