@brunosps00/dev-workflow 1.1.0 → 1.1.1

package/README.md

@@ -19,24 +19,24 @@ This will:
 
 > **Compozy-inspired disciplines.** Since 0.5.0, dev-workflow bundles three primitives — `dw-verify`, `dw-memory`, `dw-review-rigor` — adapted from the [Compozy](https://github.com/compozy/compozy) project and invoked internally by existing commands. See [docs/compozy-integration.md](docs/compozy-integration.md) for what was ported and what was not.
 
-Optional dependencies (Playwright browsers, react-doctor, Trivy, Semgrep, gitleaks, Docker):
+Optional dependencies (Playwright browsers, react-doctor, Trivy, Semgrep, gitleaks, syft, Docker):
 ```bash
 npx @brunosps00/dev-workflow install-deps
 ```
 
 ## Commands
 
-dev-workflow v1.0.6 ships **31 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
+dev-workflow v1.1.1 ships **31 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
 
 ### Tier 1 — Gateway (3)
 
 | Command | When |
 |---------|------|
-| **`/dw-autopilot "wish"`** | Default entry point in two invocations. First run completes PRD → TechSpec → Tasks and stops. Second run resumes from state, executes `/dw-goal --from-autopilot <slug>` for Run → Review → QA/Fix → Review, then Commit → PR. |
+| **`/dw-autopilot "wish"`** | Default entry point in two invocations. First run completes PRD → TechSpec → Tasks and stops. Second run resumes from state, executes `/dw-goal --from-autopilot <slug>` for Run → Review → QA/Fix → Review, then Security Gate → Commit → PR. |
 | **`/dw-bugfix "description"`** | A bug report or pasted error. Triages bug-vs-feature-vs-scope, surgical fix or routes to a PRD. |
 | **`/dw-help [keyword]`** | Discover commands. Pass a keyword for shortcuts; `--advanced` reveals internal commands. |
 
-### Tier 2 — Pipeline granular (7)
+### Tier 2 — Pipeline granular (9)
 
 Use these when you want step-by-step control instead of `/dw-autopilot`.
 
@@ -52,13 +52,13 @@ Use these when you want step-by-step control instead of `/dw-autopilot`.
 | **`/dw-commit`** | Atomic Conventional Commits for pending changes. Applies `dw-git-discipline` (one intent per commit, lint+tests+build green before). |
 | **`/dw-generate-pr [target]`** | Push the branch, draft a PR body with summary + test plan, open the browser. Hard gates: dw-verify PASS + secure-audit. |
 
-### Tier 3 — Specialty (8)
+### Tier 3 — Specialty (10)
 
 | Command | What |
 |---------|------|
-| **`/dw-analyze-project`** | Scans the repo, writes `.dw/rules/` (per-module conventions, anti-patterns, naming). Step 8 offers to generate `.dw/constitution.md` (declarative principles the team commits to). Step 9 generates `.dw/rules/concerns.md` (risk map: hot spots, fragile integrations, hostile code, bug history). Run once per project; refresh after major refactors. |
-| **`/dw-redesign-ui "target"`** | Audits a frontend page, runs the `dw-ui-discipline` 4-question grounding, proposes 2-3 design directions, ships the redesign. WCAG 2.2 AA accessibility floor is non-negotiable. |
-| **`/dw-functional-doc`** | Maps screens + user flows into a functional doc, validated end-to-end with Playwright. |
+| **`/dw-analyze-project`** | Scans the repo, writes `.dw/rules/` (per-module conventions, anti-patterns, naming). Step 8 offers `.dw/constitution.md`; Step 9 writes `.dw/rules/concerns.md`; Step 10 can synthesize a frontend `DESIGN.md` from existing tokens. Run once per project; refresh after major refactors. |
+| **`/dw-redesign-ui "target"`** | Audits a frontend page, runs the `dw-ui-discipline` 4-question grounding, proposes 2-3 design directions, ships the redesign. WCAG 2.2 AA accessibility floor is non-negotiable; UI diffs can also run the deterministic impeccable slop detector. |
+| **`/dw-functional-doc`** | Maps screens + user flows into a functional doc, validated end-to-end with Playwright. Uses the WSL-resilient browser resolver and can capture guided functional video evidence. |
 | **`/dw-context-budget`** | Audits context overhead from commands, skills, agents, instruction files, and MCPs. |
 | **`/dw-harness-audit`** | Deterministic health scorecard for the dev-workflow install, agents, wrappers, MCPs, and gates. |
 | **`/dw-skill-health`** | Audits installed skills and agents for bloat, duplication, and missing references. |
@@ -75,7 +75,7 @@ These are auto-invoked by Tier 1-3 commands. Available standalone via `/dw-help
 |---------|------|------------|
 | **`/dw-adr "decision"`** | Records an Architecture Decision Record at `.dw/spec/<prd>/adrs/`. | `/dw-plan techspec --council`; deviations from constitution |
 | **`/dw-intel "question"`** | Query codebase intelligence (`.dw/intel/`). `--build` (re)creates the index. | `/dw-plan`, `/dw-review`, `/dw-bugfix` |
-| **`/dw-secure-audit`** | **Security Gate** (phase after review/QA, before commit/PR): OWASP + Semgrep SAST (diff/generated code) + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain + outdated. Rigoroso: secrets/CRITICAL/HIGH block (secrets have no ADR escape). Flags: `--scan-only`, `--plan`, `--execute`. See [docs/security-gate.md](docs/security-gate.md). | `/dw-autopilot` (explicit step), enforced by `/dw-generate-pr` |
+| **`/dw-secure-audit`** | **Security Gate** (phase after review/QA, before commit/PR): OWASP + Semgrep SAST (diff/generated code) + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain + outdated. Rigoroso: secrets/CRITICAL/HIGH block (secrets have no ADR escape). Flags: `--scan-only`, `--plan`, `--execute`. See [docs/security-gate.md](docs/security-gate.md). | `/dw-review`, `/dw-autopilot` (explicit step), enforced by `/dw-generate-pr` |
 | **`/dw-goal "<objective>"`** | Durable objective contract. Uses Codex native `/goal` when available and `.dw/goals/` everywhere for Codex, Copilot, Claude Code, and OpenCode. | `/dw-autopilot` after planning |
 | **`/dw-find-skills "query"`** | Searches `npx skills` ecosystem, vets, installs. | manual when extending the bundle |
 | **`/dw-update`** | Updates dev-workflow to latest npm release with rollback snapshot. | manual maintenance |
@@ -87,17 +87,17 @@ These are auto-invoked by Tier 1-3 commands. Available standalone via `/dw-help
 
 ```
 /dw-autopilot "wish"  ------>  First invocation: PRD → TechSpec → Tasks → STOP
-/dw-autopilot          ------>  Second invocation: /dw-goal → Commit → PR
+/dw-autopilot          ------>  Second invocation: /dw-goal → Security Gate → Commit → PR
     --- OR step-by-step ---
 
 /dw-brainstorm  -->  /dw-plan           -->  .dw/spec/prd-{name}/{prd,techspec,tasks}.md
                           |
-                    /dw-goal             -->  /dw-run → /dw-review → /dw-qa → /dw-review
+                    /dw-goal             -->  /dw-run → /dw-review → /dw-qa → /dw-review → /dw-secure-audit
                           |
                     /dw-commit + /dw-generate-pr
 
 Manual alternative after /dw-plan:
-  /dw-run → /dw-review → /dw-qa → /dw-review → /dw-commit → /dw-generate-pr
+  /dw-run → /dw-review → /dw-qa → /dw-review → /dw-secure-audit → /dw-commit → /dw-generate-pr
 
 Shortcuts:
   /dw-intel "question"         Query codebase intelligence
@@ -116,19 +116,30 @@ A **constitution** is a declarative list of principles your team commits to (e.g
 **How it works:**
 
 - `/dw-analyze-project` offers three paths: synthesize from observed patterns (with your approval), install canonical defaults, or skip.
-- If `/dw-create-prd`, `/dw-create-techspec`, or `/dw-code-review` run **without** a constitution, they auto-install the defaults template (10 canonical principles at `severity: info`), notify in chat, and continue. Ausência nunca bloqueia.
+- If `/dw-plan` or `/dw-review` run **without** a constitution, they auto-install the defaults template (10 canonical principles at `severity: info`), notify in chat, and continue. Ausência nunca bloqueia.
 - Once principles exist:
   - `severity: info` → reported, never blocks.
   - `severity: high` → blocks PR/techspec when violated, unless an ADR justifies the deviation.
   - `severity: critical` → blocks plus requires reviewer sign-off in the ADR.
 - Defaults start at `info`; you promote severities as your team trusts enforcement.
 
-**Tasks consistency check.** At the end of `/dw-create-tasks`, a 5-dimension consistency check validates PRD ↔ TechSpec ↔ Tasks alignment (FR coverage, task grounding, test coverage, dependency DAG, constitution alignment) and writes `.dw/spec/prd-<feature>/tasks-validation.md`. Any FAIL blocks user approval until resolved or explicitly overridden.
+**Tasks consistency check.** At the end of `/dw-plan tasks`, a 5-dimension consistency check validates PRD ↔ TechSpec ↔ Tasks alignment (FR coverage, task grounding, test coverage, dependency DAG, constitution alignment) and writes `.dw/spec/prd-<feature>/tasks-validation.md`. Any FAIL blocks user approval until resolved or explicitly overridden.
 
 ## Template Overrides
 
 Customize templates locally without losing dev-workflow updates. Drop a file at `.dw/templates/overrides/<name>.md`; the override is used in place of the bundled core template on every `update`. Subdirectories work too (e.g., `.dw/templates/overrides/functional-doc/e2e-runbook.md`). See `.dw/templates/overrides/README.md` (created on init) for the workflow and `diff` cadence guidance.
 
+## Post-Update Actions
+
+`dev-workflow update` refreshes managed files only: commands, templates, references, scripts, bundled skills, wrappers, agents, and MCP config. It does **not** overwrite project-derived docs such as `.dw/rules/`, `.dw/constitution.md`, `.dw/rules/concerns.md`, `.dw/intel/`, or frontend `DESIGN.md`.
+
+After an update, the CLI prints **Post-update agent actions**. When `/dw-update` runs inside an agent, it should execute the listed commands in order:
+
+1. `/dw-analyze-project` when project-derived docs are missing or need refresh; this owns `.dw/rules/`, constitution, concerns map, and frontend `DESIGN.md`.
+2. `/dw-intel --build` when the codebase index is missing or stale.
+3. `/dw-harness-audit` to validate the install after managed files changed.
+4. `/dw-skill-health` to inspect refreshed skills and agents.
+
 ## Auto-Trigger (CLAUDE.md / AGENTS.md)
 
 `dev-workflow init` seeds two files at the project root with the same content: `CLAUDE.md` (read by Claude Code) and `AGENTS.md` (read by Codex CLI, Copilot CLI, and OpenCode). Together they tell the agent **when to invoke each `dw-*` command without being explicitly asked**.
@@ -188,6 +199,8 @@ your-project/
 │   ├── scripts/           # Utility scripts
 │   ├── spec/              # PRD directories — each contains tasks-validation.md
 │   ├── bugfixes/          # Persistent bugfix records: NNN-<slug>/{TASK.md, SUMMARY.md, fix-report.md} + review/, QA/
+│   ├── goals/             # Durable goal state used by /dw-goal and /dw-autopilot
+│   ├── secure-audit/      # Security Gate summaries and per-layer reports
 │   ├── subtasks/          # Local ephemeral subagent input packets and handoffs (pending/archive ignored by Git)
 │   └── STATE.md           # Session state: Decisions, Blockers, Todos, Open Loops, Deferred Ideas, Lessons, Preferences (managed by /dw-pause + /dw-resume)
 ├── CLAUDE.md              # Auto-trigger decision tree for Claude Code (merge-aware, includes Auto-Sizing Matrix)
@@ -224,6 +237,7 @@ Subagent handoffs use local packets under `.dw/subtasks/`:
 npx @brunosps00/dev-workflow subtask create --agent=dw-code-explorer --goal="Map the auth flow"
 npx @brunosps00/dev-workflow subtask complete --slug=<slug> --file=<handoff.md>
 npx @brunosps00/dev-workflow subtask consume
+npx @brunosps00/dev-workflow subtask list
 ```
 
 ## Bundled Skills
@@ -245,15 +259,15 @@ These are not slash commands — they are primitives other commands call to enfo
 
 | Skill | Description | Invoked by | Inspired by |
 |-------|-------------|------------|-------------|
-| **dw-verify** | Enforces fresh verification evidence before any completion, commit, or PR claim — with Iron Law, gate function, and Verification Report template | `dw-run-task`, `dw-run-plan`, `dw-fix-qa`, `dw-bugfix`, `dw-code-review`, `dw-generate-pr` | [Compozy](https://github.com/compozy/compozy) `cy-final-verify` |
-| **dw-memory** | Two-tier workflow memory (shared `MEMORY.md` + per-task `<N>_memory.md`) with promotion test and compaction rules, so cross-task context persists cleanly | `dw-run-task`, `dw-run-plan`, `dw-autopilot` | [Compozy](https://github.com/compozy/compozy) `cy-workflow-memory` |
-| **dw-review-rigor** | Review discipline: de-duplication, severity ordering, verify-intent-before-flagging, skip-linter-issues, signal-over-volume | `dw-code-review`, `dw-review-implementation`, `dw-refactoring-analysis` | [Compozy](https://github.com/compozy/compozy) `cy-review-round` |
-| **dw-council** | Multi-advisor debate (3-5 archetypes) with steel-manning, concession tracking, and dissent-preserving synthesis. Opt-in only. | `dw-brainstorm --council`, `dw-create-techspec --council` | [Compozy](https://github.com/compozy/compozy) `cy-idea-factory` |
-| **dw-codebase-intel** | Codebase intelligence (`stack.json`, `files.json`, `apis.json`, `deps.json`, `arch.md`) with incremental updates and query patterns. Cross-cutting reference: `api-design-discipline` (Hyrum's Law, contract-first, error semantics) used when techspecs design API endpoints. | `/dw-intel`, `/dw-map-codebase`, `dw-create-techspec` | [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) (MIT) + [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
-| **dw-execute-phase** | Goal-backward 6-dimension plan verification (`plan-checker`) and wave-based parallel task execution (`executor`) with atomic commit, deviation handling, and checkpoint recovery | `dw-run-plan`, `dw-autopilot` | [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) (MIT) |
-| **dw-source-grounding** | Detect → Fetch → Implement → Cite protocol with `[source: <url>, version: X.Y, retrieved: YYYY-MM-DD]` citations. Strict source-priority hierarchy (Tier 1 official docs > Tier 2 maintainer blogs > Tier 3 Stack Overflow as discovery only). | `dw-create-techspec`, `dw-deps-audit`, `dw-deep-research` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
-| **dw-simplification** | Chesterton's Fence (understand WHY before changing), behavior-preserving refactor protocol (test gate before/after), complexity metrics (cyclomatic, cognitive, depth, fan-out), Rule of 500 for large refactors | `dw-code-review`, `dw-refactoring-analysis` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
-| **dw-debug-protocol** | Stop-the-line discipline plus six-step triage (Reproduce → Localize → Reduce → Fix Root Cause → Guard → Verify End-to-End). Error categorization matrix; instrument-first non-reproducible-bug strategy. | `dw-bugfix`, `dw-fix-qa` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
+| **dw-verify** | Enforces fresh verification evidence before any completion, commit, or PR claim — with Iron Law, gate function, and Verification Report template | `/dw-run`, `/dw-goal`, `/dw-qa --fix`, `/dw-bugfix`, `/dw-review`, `/dw-generate-pr` | [Compozy](https://github.com/compozy/compozy) `cy-final-verify` |
+| **dw-memory** | Two-tier workflow memory (shared `MEMORY.md` + per-task `<N>_memory.md`) with promotion test and compaction rules, so cross-task context persists cleanly | `/dw-run`, `/dw-goal`, `/dw-autopilot`, `/dw-pause`, `/dw-resume` | [Compozy](https://github.com/compozy/compozy) `cy-workflow-memory` |
+| **dw-review-rigor** | Review discipline: de-duplication, severity ordering, verify-intent-before-flagging, skip-linter-issues, signal-over-volume | `/dw-review`, `/dw-brainstorm --refactor` | [Compozy](https://github.com/compozy/compozy) `cy-review-round` |
+| **dw-council** | Multi-advisor debate (3-5 archetypes) with steel-manning, concession tracking, and dissent-preserving synthesis. Opt-in only. | `/dw-brainstorm --council`, `/dw-plan techspec --council` | [Compozy](https://github.com/compozy/compozy) `cy-idea-factory` |
+| **dw-codebase-intel** | Codebase intelligence (`stack.json`, `files.json`, `apis.json`, `deps.json`, `arch.md`) with incremental updates and query patterns. Cross-cutting reference: `api-design-discipline` (Hyrum's Law, contract-first, error semantics) used when techspecs design API endpoints. | `/dw-intel`, `/dw-intel --build`, `/dw-plan techspec` | [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) (MIT) + [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
+| **dw-execute-phase** | Goal-backward 6-dimension plan verification (`plan-checker`) and wave-based parallel task execution (`executor`) with atomic commit, deviation handling, and checkpoint recovery | `/dw-run`, `/dw-goal`, `/dw-autopilot` | [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) (MIT) |
+| **dw-source-grounding** | Detect → Fetch → Implement → Cite protocol with `[source: <url>, version: X.Y, retrieved: YYYY-MM-DD]` citations. Strict source-priority hierarchy (Tier 1 official docs > Tier 2 maintainer blogs > Tier 3 Stack Overflow as discovery only). | `/dw-plan techspec`, `/dw-secure-audit --plan`, `/dw-brainstorm --research` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
+| **dw-simplification** | Chesterton's Fence (understand WHY before changing), behavior-preserving refactor protocol (test gate before/after), complexity metrics (cyclomatic, cognitive, depth, fan-out), Rule of 500 for large refactors | `/dw-review`, `/dw-brainstorm --refactor` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
+| **dw-debug-protocol** | Stop-the-line discipline plus six-step triage (Reproduce → Localize → Reduce → Fix Root Cause → Guard → Verify End-to-End). Error categorization matrix; instrument-first non-reproducible-bug strategy. | `/dw-bugfix`, `/dw-qa --fix` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 | **dw-git-discipline** | Trunk-based pattern (1-3 day branches, daily rebase, feature flags), atomic commit discipline (one intent per commit; refactor separate from feature), Conventional Commits, branch hygiene | `dw-commit`, `dw-generate-pr` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 
 ### Domain expertise
@@ -278,7 +292,10 @@ Installed via `npx @brunosps00/dev-workflow install-deps`:
 | **Playwright** | Browser automation for QA, E2E tests, and visual validation | [playwright.dev](https://playwright.dev/) |
 | **Context7 MCP** | Contextual documentation lookup for AI assistants | [upstash/context7-mcp](https://github.com/upstash/context7-mcp) |
 | **react-doctor** | Health score and diagnostics for React projects | [react.doctor](https://www.react.doctor/) |
-| **Trivy** | Native binary scanner used by `/dw-security-check` for CVE, secret, and IaC scanning. `install-deps` detects presence and prints OS-specific install instructions (brew / curl script / choco / Docker) — does not install automatically. | [aquasecurity.github.io/trivy](https://aquasecurity.github.io/trivy/) |
+| **Trivy** | Native binary scanner used by `/dw-secure-audit` for CVE, secret, and IaC scanning. `install-deps` detects presence and prints OS-specific install instructions (brew / curl script / choco / Docker) — does not install automatically. | [aquasecurity.github.io/trivy](https://aquasecurity.github.io/trivy/) |
+| **Semgrep** | SAST layer for `/dw-secure-audit`, focused on generated-code diffs with pinned security rulesets. `install-deps` detects presence and prints OS-specific install instructions. | [semgrep.dev](https://semgrep.dev/) |
+| **gitleaks** | Dedicated secret scanner for `/dw-secure-audit`; any confirmed secret blocks without ADR exception. `install-deps` detects presence and prints OS-specific install instructions. | [github.com/gitleaks/gitleaks](https://github.com/gitleaks/gitleaks) |
+| **syft** | Optional SBOM/license inventory layer for `/dw-secure-audit`; advisory and non-blocking. `install-deps` detects presence and prints OS-specific install instructions. | [github.com/anchore/syft](https://github.com/anchore/syft) |
 | **Docker + Docker Compose** | Required by `/dw-new-project` and `/dw-dockerize` for dev dependency seeding and image generation. `install-deps` detects presence and prints OS-specific install instructions — does not install automatically. | [docs.docker.com](https://docs.docker.com/engine/install/) |
 
 ## Options
@@ -288,12 +305,17 @@ npx @brunosps00/dev-workflow init                          # Interactive languag
 npx @brunosps00/dev-workflow init --lang=en                # English, skip prompt
 npx @brunosps00/dev-workflow init --lang=pt-br             # Portuguese, skip prompt
 npx @brunosps00/dev-workflow init --force                  # Overwrite existing files
-npx @brunosps00/dev-workflow update                        # Update commands/templates only
-npx @brunosps00/dev-workflow install-deps                  # Install Playwright, react-doctor; check Trivy, Docker
+npx @brunosps00/dev-workflow update                        # Update managed files + print post-update agent actions
+npx @brunosps00/dev-workflow list-installed                # Show managed install state
+npx @brunosps00/dev-workflow doctor                        # Check wrappers, agents, skills, MCPs, gates
+npx @brunosps00/dev-workflow repair                        # Reconcile managed files from recorded install state
+npx @brunosps00/dev-workflow install-deps                  # Install Playwright, react-doctor; check security scanners + Docker
+npx @brunosps00/dev-workflow setup-wsl-browser             # WSL NAT: build CDP relay + add Hyper-V firewall rule
 npx @brunosps00/dev-workflow install-azure-skills          # Opt-in: Azure skills + Microsoft Learn MCP
 npx @brunosps00/dev-workflow install-azure-skills --products=azure-aks,azure-openai  # Subset override
 npx @brunosps00/dev-workflow install-aws-skills            # Opt-in: AWS skills + AWS MCP Server (needs uv + aws cli + creds)
 npx @brunosps00/dev-workflow install-aws-skills --region=eu-central-1  # Region override
+npx @brunosps00/dev-workflow uninstall                     # Remove managed files while preserving user data
 npx @brunosps00/dev-workflow help                          # Show help
 ```
 
@@ -304,12 +326,12 @@ After running `npx @brunosps00/dev-workflow init`:
 1. **Run `/dw-analyze-project`** in your AI assistant to generate project rules
 2. **Run `/dw-brainstorm`** to start planning a new feature
 3. **Run `/dw-help`** to see all available commands and workflows
-4. **(Optional) Run `npx @brunosps00/dev-workflow install-deps`** to install Playwright + react-doctor and check Trivy + Docker
-5. **Run `/dw-map-codebase`** once your project has source files to build the queryable index in `.dw/intel/`
+4. **(Optional) Run `npx @brunosps00/dev-workflow install-deps`** to install Playwright + react-doctor and check Trivy/Semgrep/gitleaks/syft + Docker
+5. **Run `/dw-intel --build`** once your project has source files to build the queryable index in `.dw/intel/`
 
 ## Acknowledgements
 
-Codebase intelligence (`/dw-intel`, `/dw-map-codebase`, the `dw-codebase-intel` bundled skill) and phase execution patterns (the `dw-execute-phase` bundled skill, with its `plan-checker` and `executor` agents) were adapted from [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) by gsd-build (MIT). Schemas (`stack.json`, `files.json`, `apis.json`, `deps.json`, `arch.md`), the goal-backward verification protocol, and the wave-based parallel execution pattern come from there. dev-workflow specifics: `.dw/` namespace instead of `.planning/`, agent-driven runtime instead of `gsd-sdk` CLI, integration with the rest of the `dw-*` command surface.
+Codebase intelligence (`/dw-intel`, `/dw-intel --build`, the `dw-codebase-intel` bundled skill) and phase execution patterns (the `dw-execute-phase` bundled skill, with its `plan-checker` and `executor` agents) were adapted from [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) by gsd-build (MIT). Schemas (`stack.json`, `files.json`, `apis.json`, `deps.json`, `arch.md`), the goal-backward verification protocol, and the wave-based parallel execution pattern come from there. dev-workflow specifics: `.dw/` namespace instead of `.planning/`, agent-driven runtime instead of `gsd-sdk` CLI, integration with the rest of the `dw-*` command surface.
 
 Source-driven development, code simplification, debugging discipline, and git workflow patterns adapted from [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) by Addy Osmani (MIT) into the bundled `dw-source-grounding`, `dw-simplification`, `dw-debug-protocol`, and `dw-git-discipline` skills. Performance-optimization workflow (`vercel-react-best-practices/references/perf-discipline.md`) and API-design discipline (`dw-codebase-intel/references/api-design-discipline.md`) also incorporated as enhancements to existing bundled skills. Browser security-boundary and three-workflow-patterns (originally from `addyosmani/agent-skills/browser-devtools`) now live inside `dw-testing-discipline/references/`.
 

package/bin/dev-workflow.js

@@ -40,6 +40,7 @@ const HELP_TEXT = `
   Commands:
     init                   Scaffold .dw/ (commands, templates, references, scripts, skills, rules, MCPs)
     update                 Update managed files (commands, templates, references, scripts, skills, wrappers, MCPs)
+                           and print post-update agent actions for project-derived docs/health checks
                            Preserves: .dw/rules/, .dw/spec/, .dw/bugfixes/, .dw/STATE.md, .agents/skills/azure/, user data
     list-installed         Show dev-workflow install state for this project
     doctor                 Check managed files, wrappers, agents, and MCP configuration

package/lib/init.js

@@ -10,6 +10,7 @@ const { migrate: migrateSkills } = require('./migrate-skills');
 const { hasExistingInstall, readInstallState, writeInstallState, listManagedFiles } = require('./install-state');
 const { resolveInstallSelection } = require('./profiles');
 const { ensureSubtaskLayout } = require('./subtasks');
+const { printPostUpdateActions } = require('./post-update');
 
 const SCAFFOLD_DIR = path.join(__dirname, '..', 'scaffold');
 
@@ -315,10 +316,19 @@ async function run({ force = false, lang = null, mode = 'init', profile = null,
   console.log(`  ${'='.repeat(40)}`);
   console.log(`  Done! ${totalCreated} created, ${totalSkipped} skipped, ${totalOverwritten} overwritten`);
   console.log();
+  if (isUpdate) {
+    printPostUpdateActions(projectRoot);
+  }
   console.log('  Next steps:');
-  console.log('    1. Run /dw-analyze-project to generate project rules');
-  console.log('    2. Run /dw-brainstorm to start a new feature');
-  console.log('    3. Run /dw-help to see all available commands');
+  if (isUpdate) {
+    console.log('    1. If running inside an agent, run the post-update actions now');
+    console.log('    2. Otherwise reload/restart the agent session before invoking them');
+    console.log('    3. Run /dw-help to see all available commands');
+  } else {
+    console.log('    1. Run /dw-analyze-project to generate project rules');
+    console.log('    2. Run /dw-brainstorm to start a new feature');
+    console.log('    3. Run /dw-help to see all available commands');
+  }
   console.log();
 }
 

package/lib/migrate-gsd.js

@@ -124,7 +124,7 @@ function migrate(projectRoot) {
   if (stats.agents_removed) console.log(`    - .claude/agents/gsd-*.md      (${stats.agents_removed} files removed; native dw-* agents bundled in skills)`);
   if (stats.hooks_removed) console.log(`    - .claude/hooks/gsd-*.js       (${stats.hooks_removed} files removed; not used by dev-workflow)`);
   if (stats.manifest_removed) console.log('    - .claude/gsd-file-manifest.json (removed)');
-  console.log('  Done. Native /dw-intel, /dw-map-codebase, /dw-run-plan (with bundled phase-execution agents) now provide what GSD provided.');
+  console.log('  Done. Native /dw-intel, /dw-intel --build, and /dw-run (with bundled phase-execution agents) now provide what GSD provided.');
   console.log();
 
   return stats;

package/lib/post-update.js

@@ -0,0 +1,153 @@
+const fs = require('fs');
+const path = require('path');
+
+const SKIP_DIRS = new Set([
+  '.git',
+  '.dw',
+  '.agents',
+  '.claude',
+  '.codex',
+  '.github',
+  '.opencode',
+  'node_modules',
+  'dist',
+  'build',
+  'coverage',
+  '.next',
+  'out',
+]);
+
+const FRONTEND_DEPS = [
+  '@angular/core',
+  '@remix-run/react',
+  'astro',
+  'next',
+  'nuxt',
+  'react',
+  'solid-js',
+  'svelte',
+  'vue',
+];
+
+function listPostUpdateActions(projectRoot) {
+  const actions = [];
+  const analysisReasons = [];
+
+  if (!exists(projectRoot, '.dw/rules/index.md')) {
+    analysisReasons.push('missing .dw/rules/index.md');
+  }
+  if (!exists(projectRoot, '.dw/rules/concerns.md')) {
+    analysisReasons.push('missing .dw/rules/concerns.md');
+  }
+  if (!exists(projectRoot, '.dw/constitution.md')) {
+    analysisReasons.push('missing .dw/constitution.md');
+  }
+
+  const frontendProjects = findFrontendProjects(projectRoot);
+  const missingDesignAuthority = frontendProjects.filter((dir) => !hasDesignAuthority(dir));
+  if (missingDesignAuthority.length) {
+    analysisReasons.push(
+      `frontend design authority missing for ${formatPaths(projectRoot, missingDesignAuthority)}`,
+    );
+  }
+
+  if (analysisReasons.length) {
+    actions.push({
+      command: '/dw-analyze-project',
+      reason: `refresh project-derived docs (${analysisReasons.join('; ')})`,
+    });
+  }
+
+  if (!hasCodebaseIntel(projectRoot)) {
+    actions.push({
+      command: '/dw-intel --build',
+      reason: 'build .dw/intel/ codebase index for the refreshed command surface',
+    });
+  }
+
+  actions.push({
+    command: '/dw-harness-audit',
+    reason: 'validate commands, wrappers, agents, MCPs, and gates after update',
+  });
+  actions.push({
+    command: '/dw-skill-health',
+    reason: 'audit refreshed bundled skills and agents for bloat, duplication, and stale references',
+  });
+
+  return actions;
+}
+
+function printPostUpdateActions(projectRoot) {
+  const actions = listPostUpdateActions(projectRoot);
+  console.log('  Post-update agent actions:');
+  console.log('    The CLI refreshed managed files. Project-derived docs require the agent to run commands:');
+  for (const action of actions) {
+    console.log(`    - ${action.command} - ${action.reason}`);
+  }
+  console.log('    /dw-update consumes this list and runs the applicable commands after the update.');
+  console.log();
+}
+
+function hasCodebaseIntel(projectRoot) {
+  return ['.dw/intel/stack.json', '.dw/intel/files.json', '.dw/intel/arch.md'].every((rel) =>
+    exists(projectRoot, rel),
+  );
+}
+
+function findFrontendProjects(projectRoot) {
+  const projects = [];
+  walk(projectRoot, (dir) => {
+    const pkgPath = path.join(dir, 'package.json');
+    if (!fs.existsSync(pkgPath)) return;
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+      const deps = {
+        ...(pkg.dependencies || {}),
+        ...(pkg.devDependencies || {}),
+        ...(pkg.peerDependencies || {}),
+      };
+      if (FRONTEND_DEPS.some((dep) => Object.prototype.hasOwnProperty.call(deps, dep))) {
+        projects.push(dir);
+      }
+    } catch {
+      // Ignore malformed package.json here; doctor handles managed-file validation.
+    }
+  });
+  return projects;
+}
+
+function walk(dir, visit) {
+  if (!fs.existsSync(dir)) return;
+  visit(dir);
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory() || SKIP_DIRS.has(entry.name)) continue;
+    walk(path.join(dir, entry.name), visit);
+  }
+}
+
+function hasDesignAuthority(projectDir) {
+  return ['DESIGN.md', 'BRAND.md', 'STYLE_GUIDE.md'].some((name) =>
+    fs.existsSync(path.join(projectDir, name)),
+  );
+}
+
+function exists(projectRoot, relativePath) {
+  return fs.existsSync(path.join(projectRoot, relativePath));
+}
+
+function formatPaths(projectRoot, dirs) {
+  const formatted = dirs.slice(0, 3).map((dir) => path.relative(projectRoot, dir) || '.');
+  if (dirs.length > formatted.length) formatted.push(`+${dirs.length - formatted.length} more`);
+  return formatted.join(', ');
+}
+
+module.exports = {
+  listPostUpdateActions,
+  printPostUpdateActions,
+};

package/lib/uninstall.js

@@ -117,7 +117,7 @@ function run() {
   console.log('  Preserved (user data):');
   console.log('    .dw/rules/    (project rules)');
   console.log('    .dw/spec/     (PRDs and specs)');
-  console.log('    .dw/intel/    (codebase index from /dw-map-codebase)');
+  console.log('    .dw/intel/    (codebase index from /dw-intel --build)');
   console.log();
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"

package/scaffold/en/agent-instructions.md

@@ -72,7 +72,7 @@ Before picking a command from the Trigger Map, gauge the change's actual scope.
 - **`.dw/constitution.md`**: principles with `severity: high` or `critical` block PRs / techspecs without an ADR justifying the deviation. Missing constitution? Commands auto-install defaults at `severity: info` (non-blocking) and continue — never blocks on absence.
 - **`.dw/spec/<prd>/tasks-validation.md`**: auto-generated at the end of `/dw-plan tasks`. Any FAIL dimension blocks user approval until resolved or explicitly overridden.
 - **Verification**: `/dw-generate-pr` requires a fresh `dw-verify` PASS (tests + lint + build) after the last edit.
-- **Security**: TS / Python / C# / Rust projects must pass `/dw-secure-audit` (Trivy + OWASP + lockfile audit) before the PR opens.
+- **Security**: TS / Python / C# / Rust projects must pass `/dw-secure-audit` (OWASP + Semgrep + gitleaks + Trivy + lockfile audit) before the PR opens.
 
 ## Escape Hatches — do NOT auto-trigger
 

package/scaffold/en/commands/dw-help.md

@@ -19,41 +19,45 @@ Use `/dw-autopilot "wish"` as the gateway for most feature work. The granular co
 
 | Command | When |
 |---------|------|
-| `/dw-autopilot "wish"` | Default entry point in two invocations. First run plans and stops; second run resumes through `/dw-goal`, commit, and PR. |
+| `/dw-autopilot "wish"` | Default entry point in two invocations. First run plans and stops; second run resumes through `/dw-goal`, Security Gate, commit, and PR. |
 | `/dw-bugfix "description"` | A bug or error report. Surgical fix or PRD route. |
 | `/dw-help [keyword]` | This screen. Pass a keyword for shortcuts. `--advanced` reveals internal commands. |
 
-## Tier 2 — Pipeline granular (7)
+## Tier 2 — Pipeline granular (9)
 
 | Command | What |
 |---------|------|
 | `/dw-brainstorm "idea"` | Refine an idea before PRD. Flags: `--onepager`, `--council`, `--research`, `--refactor`. |
 | `/dw-plan "feature"` | PRD → TechSpec → Tasks sequentially with checkpoints. Stages: `prd`, `techspec`, `tasks`. |
 | `/dw-run [task-id]` | Execute all pending tasks or a single one. Flag `--resume`. |
-| `/dw-review` | Level 2 (PRD coverage) + Level 3 (code quality). Flags: `--coverage-only`, `--code-only`. |
-| `/dw-qa` | Mode-aware QA (UI / API auto-detect). Flags: `--fix`, `--api`, `--ai`. |
+| `/dw-review` | Level 2 (PRD coverage) + Level 3 (code quality/security). Flags: `--coverage-only`, `--code-only`, `--bugfix <slug>`. |
+| `/dw-qa` | Mode-aware QA (UI / API auto-detect). Flags: `--fix`, `--api`, `--ai`, `--uat`, `--bugfix <slug>`. |
+| `/dw-pause` | Save session state, decisions, blockers, todos, and open loops into `.dw/STATE.md`. |
+| `/dw-resume` | Read `.dw/STATE.md`, show a TLDR, and suggest the next `dw-*` command. |
 | `/dw-commit` | Atomic Conventional Commits for pending work. |
 | `/dw-generate-pr [target]` | Push branch, draft PR body, open browser. |
 
-## Tier 3 — Specialty (8)
+## Tier 3 — Specialty (10)
 
 | Command | What |
 |---------|------|
-| `/dw-analyze-project` | Scan the repo, write `.dw/rules/` + offer to generate `.dw/constitution.md`. |
-| `/dw-redesign-ui "target"` | Audit, propose 2-3 design directions, ship. Enforces UI grounding + WCAG. |
-| `/dw-functional-doc` | Map screens + flows into a functional doc validated with Playwright. |
+| `/dw-analyze-project` | Scan the repo, write `.dw/rules/`, offer `.dw/constitution.md`, generate `.dw/rules/concerns.md`, and synthesize frontend `DESIGN.md` when tokens exist. |
+| `/dw-redesign-ui "target"` | Audit, propose 2-3 design directions, ship. Enforces UI grounding + WCAG; can run the deterministic impeccable slop detector. |
+| `/dw-functional-doc` | Map screens + flows into a functional doc validated with Playwright; uses WSL-resilient browser resolution. |
 | `/dw-context-budget` | Audit context overhead from commands, skills, agents, instructions, and MCPs. |
 | `/dw-harness-audit` | Score dev-workflow install health: wrappers, agents, MCPs, gates. |
 | `/dw-skill-health` | Audit skills and agents for bloat, duplication, and missing references. |
 | `/dw-new-project` | Interview-driven bootstrap (stack + infra + docker-compose + CI). |
 | `/dw-dockerize` | Detect stack, propose Dockerfile + docker-compose for dev/prod. |
+| `/dw-install-azure-skills` | Opt-in Azure skills + Microsoft Learn MCP setup. Interactive category selection. |
+| `/dw-install-aws-skills` | Opt-in AWS skills + AWS MCP Server setup. Requires `uv`, AWS CLI, and credentials. |
 
 ## Workflow at a glance
 
-`/dw-autopilot "wish"` runs planning first and stops. Reinvoke it to resume through `/dw-goal`, commit, and PR. Step-by-step:
+`/dw-autopilot "wish"` runs planning first and stops. Reinvoke it to resume through `/dw-goal`, Security Gate, commit, and PR. Step-by-step:
 
 ```
-/dw-brainstorm → /dw-plan → /dw-goal → /dw-commit → /dw-generate-pr
+/dw-brainstorm → /dw-plan → /dw-goal → /dw-secure-audit → /dw-commit → /dw-generate-pr
 ```
 
 ## Advanced / internal commands
@@ -76,10 +80,10 @@ These are auto-invoked by primary commands but available standalone.
 |---------|------|------------|
 | `/dw-adr "decision"` | Record an Architecture Decision Record at `.dw/spec/<prd>/adrs/`. | `/dw-plan techspec --council`, deviations from constitution |
 | `/dw-intel "question"` | Query codebase intelligence; `--build` (re)indexes `.dw/intel/`. | `/dw-plan`, `/dw-review`, `/dw-bugfix` |
-| `/dw-secure-audit` | OWASP + Trivy + lockfile + supply-chain scan. Hard gate. Flags: `--scan-only`, `--plan`, `--execute`. | `/dw-review`, `/dw-generate-pr` |
+| `/dw-secure-audit` | OWASP + Semgrep SAST + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain scan. Hard gate. Flags: `--scan-only`, `--plan`, `--execute`. | `/dw-review`, `/dw-autopilot`, `/dw-generate-pr` |
 | `/dw-goal "<objective>"` | Durable objective contract with `.dw/goals/`; bridges to Codex native `/goal` when available. | `/dw-autopilot` after planning |
 | `/dw-find-skills "query"` | Search npx skills ecosystem, vet, install. | manual when extending the bundle |
-| `/dw-update` | Update dev-workflow to latest npm release with rollback snapshot. | manual maintenance |
+| `/dw-update` | Update dev-workflow to latest npm release with rollback snapshot, then run listed post-update actions (`/dw-analyze-project`, `/dw-intel --build`, `/dw-harness-audit`, `/dw-skill-health`) when applicable. | manual maintenance |
 | `/dw-subtask-start "goal"` | Create a minimal input packet for a subagent. | parent agent before delegation |
 | `/dw-subtask-complete <slug>` | Record a structured child-session handoff. | subagent / child session |
 | `/dw-subtask-resume` | Consume and archive pending handoffs for parent synthesis. | parent agent after delegation |
@@ -95,6 +99,8 @@ Match the keyword and suggest:
 | `bug`, `error`, `broken`, `fix` | `/dw-bugfix` |
 | `run`, `execute`, `implement` | `/dw-run` |
 | `goal`, `objective`, `long-running`, `resume autopilot` | `/dw-goal` or `/dw-autopilot` if `autopilot-state.json` exists |
+| `pause`, `save state`, `end session` | `/dw-pause` |
+| `resume`, `continue`, `where did we stop` | `/dw-resume` |
 | `review`, `quality`, `audit code` | `/dw-review` |
 | `qa`, `test plan`, `e2e` | `/dw-qa` |
 | `commit`, `git` | `/dw-commit` |
@@ -106,15 +112,21 @@ Match the keyword and suggest:
 | `intel`, `where is`, `what uses` | `/dw-intel` (or `--build` to (re)create the index) |
 | `context`, `tokens`, `slow agent` | `/dw-context-budget` |
 | `harness`, `install`, `wrappers`, `agents` | `/dw-harness-audit` |
+| `update`, `upgrade`, `latest`, `post-update` | `/dw-update` |
+| `design.md`, `design authority`, `concerns map` | `/dw-analyze-project` (also listed as a post-update action when missing) |
 | `subagent`, `subtask`, `handoff`, `delegate` | `/dw-subtask-start` or `/dw-subtask-resume` |
 | `skills`, `skill health`, `bloat` | `/dw-skill-health` |
 | `analyze`, `rules`, `conventions` | `/dw-analyze-project` |
 | `constitution`, `principles` | `/dw-analyze-project` (Step 8 generates the constitution) |
 | `security`, `vulnerabilities`, `cve`, `deps`, `audit deps` | `/dw-secure-audit` |
+| `secret`, `sast`, `semgrep`, `gitleaks`, `trivy` | `/dw-secure-audit` |
 | `adr`, `decision` | `/dw-adr` (also auto-invoked from `/dw-plan --council`) |
 | `docker`, `compose`, `container` | `/dw-dockerize` |
 | `new project`, `bootstrap`, `scaffold` | `/dw-new-project` |
 | `functional doc`, `screen map`, `e2e doc` | `/dw-functional-doc` |
+| `wsl`, `browser`, `playwright browser`, `cdp` | `npx @brunosps00/dev-workflow setup-wsl-browser` when WSL NAT must drive the real Windows browser |
+| `azure`, `microsoft learn`, `azure skills` | `/dw-install-azure-skills` |
+| `aws`, `aws mcp`, `aws skills` | `/dw-install-aws-skills` |
 | `incident`, `outage`, `postmortem`, `sev-1`, `sev-2` | (Skill `dw-incident-response` auto-invoked from `/dw-bugfix` for prod-critical) |
 | `eval`, `llm`, `ai feature`, `rag` | (Skill `dw-llm-eval` invoked from `/dw-plan tasks`, `/dw-review`, `/dw-qa --ai`) |
 
@@ -123,10 +135,10 @@ If no keyword matches, show the default surface and a note: "Keyword `<word>` no
 ## FAQ
 
 **Q: I'm not sure where to start with a new feature.**
-- Use `/dw-autopilot "what you want"`. First invocation runs PRD → TechSpec → Tasks and stops; second invocation resumes through `/dw-goal`, commit, and PR.
+- Use `/dw-autopilot "what you want"`. First invocation runs PRD → TechSpec → Tasks and stops; second invocation resumes through `/dw-goal`, Security Gate, commit, and PR.
 
 **Q: Do I have to use `/dw-autopilot`?**
-- No. The granular pipeline (`/dw-brainstorm` → `/dw-plan` → `/dw-goal` or `/dw-run`/`/dw-qa`/`/dw-review` → `/dw-commit` → `/dw-generate-pr`) gives you control at each step.
+- No. The granular pipeline (`/dw-brainstorm` → `/dw-plan` → `/dw-goal` or `/dw-run`/`/dw-qa`/`/dw-review` → `/dw-secure-audit` → `/dw-commit` → `/dw-generate-pr`) gives you control at each step.
 
 **Q: I just want to fix a bug.**
 - `/dw-bugfix "<bug description>"`. It triages (bug vs feature vs scope), asks 3 questions, then fixes or routes to a PRD if scope is large.
@@ -134,6 +146,9 @@ If no keyword matches, show the default surface and a note: "Keyword `<word>` no
 **Q: How do I check if my project follows good patterns?**
 - `/dw-analyze-project` writes `.dw/rules/`. Then any command reads those rules for compliance.
 
+**Q: Where does security fit?**
+- `/dw-review` auto-invokes `/dw-secure-audit` for supported stacks; `/dw-autopilot` treats it as the named gate before commit/PR; `/dw-generate-pr` enforces the latest approved summary.
+
 **Q: How do I get more flow recommendations during ideation?**
 - `/dw-brainstorm "idea" --council` adds a multi-advisor stress-test debate.
 - `/dw-brainstorm "topic" --research` runs a deep multi-source citation pipeline.

package/scaffold/en/commands/dw-update.md

@@ -79,6 +79,7 @@ The `update` command overwrites managed files and PRESERVES:
 - `.dw/rules/` (user rules)
 - `.dw/spec/` (in-progress PRDs and tasks)
 - `.dw/intel/` (codebase index from `/dw-intel --build`)
+- project-derived docs such as `.dw/constitution.md`, `.dw/rules/concerns.md`, and frontend `DESIGN.md`
 
 The `update` command also runs the GSD migration step automatically — if a project has legacy `.planning/` (from prior GSD usage), the contents are migrated to `.dw/intel/`, `.dw/spec/active-session.md`, `.dw/spec/quick/`, etc., and `.planning/` is renamed to `.planning.gsd-archive-<DATE>/` for inspection. The `.claude/commands/gsd/`, `.claude/agents/gsd-*.md`, `.claude/hooks/gsd-*.js`, and `.claude/gsd-file-manifest.json` files are removed during the migration.
 
@@ -96,9 +97,23 @@ Present to the user:
 - Detected language (`DETECTED_LANG`)
 - Previous version → new version
 - Summary of what the `update` output showed (files copied, wrappers generated, MCPs configured)
+- The `Post-update agent actions` printed by the CLI
 - Any warnings or errors
 
-### 6. Suggest Next Step
+### 6. Run Post-Update Agent Actions (Required)
+
+<critical>The CLI cannot execute slash commands or inspect product-specific design authority by itself. When the update output prints `Post-update agent actions`, treat that list as work for this agent to run now, unless the user explicitly asked for "update files only".</critical>
+
+Run listed commands in this order:
+
+1. `/dw-analyze-project` when listed — refreshes project-derived docs. This is the command that creates or refreshes `.dw/rules/`, offers `.dw/constitution.md`, writes `.dw/rules/concerns.md`, and for frontend projects synthesizes `DESIGN.md` from existing design tokens when no design authority exists.
+2. `/dw-intel --build` when listed — rebuilds the queryable codebase index after rules/docs refresh.
+3. `/dw-harness-audit` — validates commands, wrappers, agents, MCPs, and gates after managed files changed.
+4. `/dw-skill-health` — audits refreshed bundled skills and agents for bloat, overlap, and stale references.
+
+If `/dw-analyze-project` asks clarification or approval questions, ask them and continue. Do not fabricate `DESIGN.md`, `concerns.md`, or constitution content directly inside `/dw-update`; delegate to the command that owns those artifacts.
+
+### 7. Suggest Next Step
 
 If commands/skills were updated, remind the user:
 - Restart the agent session (or reload skills) so the new instructions take effect — skills are usually loaded at session start

package/scaffold/pt-br/agent-instructions.md

@@ -72,7 +72,7 @@ Antes de escolher um comando da Trigger Map, dimensione o escopo real da mudanç
 - **`.dw/constitution.md`**: princípios com `severity: high` ou `critical` bloqueiam PRs / techspecs sem um ADR justificando o desvio. Constitution ausente? Os comandos auto-instalam defaults em `severity: info` (não-bloqueante) e seguem — ausência nunca bloqueia.
 - **`.dw/spec/<prd>/tasks-validation.md`**: auto-gerado no fim do `/dw-plan tasks`. Qualquer dimensão FAIL bloqueia approval do usuário até resolver ou override explícito.
 - **Verification**: `/dw-generate-pr` exige `dw-verify` PASS fresco (testes + lint + build) depois do último edit.
-- **Segurança**: projetos TS / Python / C# / Rust precisam passar `/dw-secure-audit` (Trivy + OWASP + lockfile audit) antes do PR abrir.
+- **Segurança**: projetos TS / Python / C# / Rust precisam passar `/dw-secure-audit` (OWASP + Semgrep + gitleaks + Trivy + lockfile audit) antes do PR abrir.
 
 ## Escape Hatches — NÃO auto-trigger
 

package/scaffold/pt-br/commands/dw-help.md

@@ -17,41 +17,45 @@ Use `/dw-autopilot "desejo"` como gateway pra maior parte do trabalho. Comandos
 
 | Comando | Quando |
 |---------|--------|
-| `/dw-autopilot "desejo"` | Entry point padrão em duas invocações. Primeira roda plan e para; segunda retoma via `/dw-goal`, commit e PR. |
+| `/dw-autopilot "desejo"` | Entry point padrão em duas invocações. Primeira roda plan e para; segunda retoma via `/dw-goal`, Security Gate, commit e PR. |
 | `/dw-bugfix "descrição"` | Bug ou error report. Fix cirúrgico ou rota pra PRD. |
 | `/dw-help [palavra-chave]` | Esta tela. Passe palavra-chave pra atalhos. `--advanced` revela comandos internos. |
 
-## Tier 2 — Pipeline granular (7)
+## Tier 2 — Pipeline granular (9)
 
 | Comando | O que |
 |---------|-------|
 | `/dw-brainstorm "ideia"` | Refina ideia antes do PRD. Flags: `--onepager`, `--council`, `--research`, `--refactor`. |
 | `/dw-plan "feature"` | PRD → TechSpec → Tasks sequencial com checkpoints. Stages: `prd`, `techspec`, `tasks`. |
 | `/dw-run [task-id]` | Executa todas tasks pendentes ou uma específica. Flag `--resume`. |
-| `/dw-review` | Level 2 (cobertura PRD) + Level 3 (qualidade). Flags: `--coverage-only`, `--code-only`. |
-| `/dw-qa` | QA mode-aware (UI / API auto-detect). Flags: `--fix`, `--api`, `--ai`. |
+| `/dw-review` | Level 2 (cobertura PRD) + Level 3 (qualidade/segurança). Flags: `--coverage-only`, `--code-only`, `--bugfix <slug>`. |
+| `/dw-qa` | QA mode-aware (UI / API auto-detect). Flags: `--fix`, `--api`, `--ai`, `--uat`, `--bugfix <slug>`. |
+| `/dw-pause` | Salva estado da sessão, decisões, bloqueios, todos e open loops em `.dw/STATE.md`. |
+| `/dw-resume` | Lê `.dw/STATE.md`, mostra um TLDR e sugere o próximo comando `dw-*`. |
 | `/dw-commit` | Commits atômicos Conventional pra trabalho pendente. |
 | `/dw-generate-pr [target]` | Push branch, draft do PR body, abre browser. |
 
-## Tier 3 — Especialidade (8)
+## Tier 3 — Especialidade (10)
 
 | Comando | O que |
 |---------|-------|
-| `/dw-analyze-project` | Scan do repo, escreve `.dw/rules/` + oferece gerar `.dw/constitution.md`. |
-| `/dw-redesign-ui "target"` | Audit, propõe 2-3 direções, entrega. Enforça UI grounding + WCAG. |
-| `/dw-functional-doc` | Mapeia screens + flows em doc funcional validado com Playwright. |
+| `/dw-analyze-project` | Scan do repo, escreve `.dw/rules/`, oferece `.dw/constitution.md`, gera `.dw/rules/concerns.md` e sintetiza `DESIGN.md` em frontend quando há tokens. |
+| `/dw-redesign-ui "target"` | Audit, propõe 2-3 direções, entrega. Enforça UI grounding + WCAG; pode rodar o detector determinístico do impeccable. |
+| `/dw-functional-doc` | Mapeia screens + flows em doc funcional validado com Playwright; usa resolução de browser resiliente no WSL. |
 | `/dw-context-budget` | Audita contexto de commands, skills, agentes, instrucoes e MCPs. |
 | `/dw-harness-audit` | Pontua saude da instalacao: wrappers, agentes, MCPs e gates. |
 | `/dw-skill-health` | Audita skills e agentes por bloat, duplicacao e referencias quebradas. |
 | `/dw-new-project` | Bootstrap por entrevista (stack + infra + docker-compose + CI). |
 | `/dw-dockerize` | Detecta stack, propõe Dockerfile + docker-compose pra dev/prod. |
+| `/dw-install-azure-skills` | Opt-in: skills Azure + Microsoft Learn MCP. Seleção interativa de categorias. |
+| `/dw-install-aws-skills` | Opt-in: skills AWS + AWS MCP Server. Requer `uv`, AWS CLI e credenciais. |
 
 ## Workflow em resumo
 
-`/dw-autopilot "desejo"` roda planejamento primeiro e para. Reinvoque para retomar via `/dw-goal`, commit e PR. Passo a passo:
+`/dw-autopilot "desejo"` roda planejamento primeiro e para. Reinvoque para retomar via `/dw-goal`, Security Gate, commit e PR. Passo a passo:
 
 ```
-/dw-brainstorm → /dw-plan → /dw-goal → /dw-commit → /dw-generate-pr
+/dw-brainstorm → /dw-plan → /dw-goal → /dw-secure-audit → /dw-commit → /dw-generate-pr
 ```
 
 ## Comandos avançados / internos
@@ -74,10 +78,10 @@ Auto-invocados por comandos primários mas disponíveis standalone.
 |---------|-------|--------------|
 | `/dw-adr "decisão"` | Registra um ADR em `.dw/spec/<prd>/adrs/`. | `/dw-plan techspec --council`, desvios de constitution |
 | `/dw-intel "pergunta"` | Query de codebase intel; `--build` (re)indexa `.dw/intel/`. | `/dw-plan`, `/dw-review`, `/dw-bugfix` |
-| `/dw-secure-audit` | OWASP + Trivy + lockfile + supply-chain scan. Hard gate. Flags: `--scan-only`, `--plan`, `--execute`. | `/dw-review`, `/dw-generate-pr` |
+| `/dw-secure-audit` | OWASP + Semgrep SAST + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain scan. Hard gate. Flags: `--scan-only`, `--plan`, `--execute`. | `/dw-review`, `/dw-autopilot`, `/dw-generate-pr` |
 | `/dw-goal "<objetivo>"` | Contrato de objetivo duravel com `.dw/goals/`; faz ponte com `/goal` nativo do Codex quando disponivel. | `/dw-autopilot` apos planejamento |
 | `/dw-find-skills "query"` | Busca npx skills ecosystem, valida, instala. | manual ao estender bundle |
-| `/dw-update` | Atualiza dev-workflow pro último release npm com snapshot rollback. | manutenção manual |
+| `/dw-update` | Atualiza dev-workflow pro último release npm com snapshot rollback, depois roda ações pós-update listadas (`/dw-analyze-project`, `/dw-intel --build`, `/dw-harness-audit`, `/dw-skill-health`) quando aplicável. | manutenção manual |
 | `/dw-subtask-start "goal"` | Cria um input packet minimo para subagente. | parent antes de delegar |
 | `/dw-subtask-complete <slug>` | Registra handoff estruturado da sessao child. | subagente / sessao child |
 | `/dw-subtask-resume` | Consome e arquiva handoffs pendentes para sintese do parent. | parent apos delegacao |
@@ -91,6 +95,8 @@ Auto-invocados por comandos primários mas disponíveis standalone.
 | `bug`, `erro`, `quebrado`, `fix` | `/dw-bugfix` |
 | `run`, `executa`, `implementa` | `/dw-run` |
 | `goal`, `objetivo`, `long-running`, `retomar autopilot` | `/dw-goal` ou `/dw-autopilot` se `autopilot-state.json` existir |
+| `pausa`, `salvar estado`, `encerrar sessão` | `/dw-pause` |
+| `retomar`, `continuar`, `onde paramos` | `/dw-resume` |
 | `review`, `qualidade`, `audit code` | `/dw-review` |
 | `qa`, `test plan`, `e2e` | `/dw-qa` |
 | `commit`, `git` | `/dw-commit` |
@@ -102,15 +108,21 @@ Auto-invocados por comandos primários mas disponíveis standalone.
 | `intel`, `onde está`, `o que usa` | `/dw-intel` (ou `--build`) |
 | `contexto`, `tokens`, `agente lento` | `/dw-context-budget` |
 | `harness`, `install`, `wrappers`, `agentes` | `/dw-harness-audit` |
+| `update`, `upgrade`, `latest`, `pós-update` | `/dw-update` |
+| `design.md`, `autoridade de design`, `mapa de concerns` | `/dw-analyze-project` (também listado como ação pós-update quando ausente) |
 | `subagent`, `subtask`, `handoff`, `delegate`, `delegar` | `/dw-subtask-start` ou `/dw-subtask-resume` |
 | `skills`, `skill health`, `bloat` | `/dw-skill-health` |
 | `analyze`, `rules`, `convenções` | `/dw-analyze-project` |
 | `constitution`, `princípios` | `/dw-analyze-project` (Step 8) |
 | `security`, `vulnerabilidades`, `cve`, `deps` | `/dw-secure-audit` |
+| `secret`, `sast`, `semgrep`, `gitleaks`, `trivy` | `/dw-secure-audit` |
 | `adr`, `decisão` | `/dw-adr` |
 | `docker`, `compose`, `container` | `/dw-dockerize` |
 | `new project`, `bootstrap`, `scaffold` | `/dw-new-project` |
 | `functional doc`, `screen map` | `/dw-functional-doc` |
+| `wsl`, `browser`, `playwright browser`, `cdp` | `npx @brunosps00/dev-workflow setup-wsl-browser` quando WSL NAT precisa dirigir o browser real do Windows |
+| `azure`, `microsoft learn`, `azure skills` | `/dw-install-azure-skills` |
+| `aws`, `aws mcp`, `aws skills` | `/dw-install-aws-skills` |
 | `incident`, `outage`, `postmortem`, `sev-1` | (Skill `dw-incident-response` auto-invocada de `/dw-bugfix`) |
 | `eval`, `llm`, `ai feature`, `rag` | (Skill `dw-llm-eval` invocada de `/dw-plan`, `/dw-review`, `/dw-qa --ai`) |
 
@@ -119,10 +131,10 @@ Sem match: surface padrão + nota.
 ## FAQ
 
 **P: Onde começo com uma nova feature?**
-- `/dw-autopilot "o que voce quer"`. Primeira invocacao roda PRD → TechSpec → Tasks e para; segunda invocacao retoma via `/dw-goal`, commit e PR.
+- `/dw-autopilot "o que voce quer"`. Primeira invocacao roda PRD → TechSpec → Tasks e para; segunda invocacao retoma via `/dw-goal`, Security Gate, commit e PR.
 
 **P: Tenho que usar `/dw-autopilot`?**
-- Não. Pipeline granular dá controle a cada step, com `/dw-goal` quando quiser executar run/review/QA/review como objetivo duravel.
+- Não. Pipeline granular dá controle a cada step, com `/dw-goal` quando quiser executar run/review/QA/review como objetivo duravel, seguido por `/dw-secure-audit`, `/dw-commit` e `/dw-generate-pr`.
 
 **P: Só quero corrigir um bug.**
 - `/dw-bugfix "<descrição>"`. Tria, 3 perguntas, fixa ou roteia.
@@ -133,6 +145,9 @@ Sem match: surface padrão + nota.
 **P: Onde features AI são avaliadas?**
 - Skill `dw-llm-eval` auto-invocada de `/dw-plan tasks`, `/dw-review`, `/dw-qa --ai`.
 
+**P: Onde entra segurança?**
+- `/dw-review` auto-invoca `/dw-secure-audit` para stacks suportadas; `/dw-autopilot` trata como gate nomeado antes de commit/PR; `/dw-generate-pr` reforça o summary aprovado mais recente.
+
 **P: O que aconteceu com outros comandos?**
 - v1.0.0 consolidou a surface antiga de comandos. Mergers: create-prd/techspec/tasks → `/dw-plan`; run-task/run-plan → `/dw-run`; code-review/review-implementation → `/dw-review`; run-qa/fix-qa → `/dw-qa`; security-check/deps-audit → `/dw-secure-audit`; map-codebase → `/dw-intel --build`; deep-research e refactoring-analysis → `/dw-brainstorm --research/--refactor`. Removidos: revert-task (use `git revert` direto).
 

package/scaffold/pt-br/commands/dw-update.md

@@ -80,6 +80,7 @@ O comando `update` sobrescreve arquivos gerenciados e PRESERVA:
 - `.dw/rules/` (rules do usuário)
 - `.dw/spec/` (PRDs e tasks em andamento)
 - `.dw/intel/` (índice de codebase do `/dw-intel --build`)
+- docs derivados do projeto como `.dw/constitution.md`, `.dw/rules/concerns.md` e `DESIGN.md` em frontend
 
 O comando `update` também roda o passo de migração GSD automaticamente — se o projeto tem `.planning/` legado (de uso prévio do GSD), o conteúdo é migrado para `.dw/intel/`, `.dw/spec/active-session.md`, `.dw/spec/quick/`, etc., e `.planning/` é renomeado para `.planning.gsd-archive-<DATA>/` para inspeção. Os arquivos `.claude/commands/gsd/`, `.claude/agents/gsd-*.md`, `.claude/hooks/gsd-*.js` e `.claude/gsd-file-manifest.json` são removidos durante a migração.
 
@@ -97,9 +98,23 @@ Apresente ao usuário:
 - Idioma detectado (`DETECTED_LANG`)
 - Versão anterior → nova versão
 - Resumo do que o output do `update` mostrou (arquivos copiados, wrappers gerados, MCPs configurados)
+- As `Post-update agent actions` impressas pelo CLI
 - Quaisquer avisos ou erros
 
-### 6. Sugerir Próximo Passo
+### 6. Executar Ações de Agente Pós-Update (Obrigatório)
+
+<critical>O CLI não consegue executar slash commands nem inspecionar sozinho a autoridade de design específica do produto. Quando o output do update imprimir `Post-update agent actions`, trate essa lista como trabalho para este agente executar agora, exceto se o usuário pediu explicitamente "só atualize os arquivos".</critical>
+
+Rode os comandos listados nesta ordem:
+
+1. `/dw-analyze-project` quando listado — refresca docs derivados do projeto. Este é o comando que cria ou atualiza `.dw/rules/`, oferece `.dw/constitution.md`, escreve `.dw/rules/concerns.md` e, em projetos frontend, sintetiza `DESIGN.md` a partir dos tokens existentes quando não há autoridade de design.
+2. `/dw-intel --build` quando listado — reconstrói o índice queryable do codebase depois do refresh de rules/docs.
+3. `/dw-harness-audit` — valida commands, wrappers, agentes, MCPs e gates depois que arquivos gerenciados mudaram.
+4. `/dw-skill-health` — audita bundled skills e agentes atualizados por bloat, sobreposição e referências antigas.
+
+Se `/dw-analyze-project` fizer perguntas de esclarecimento ou aprovação, faça-as e continue. Não fabrique `DESIGN.md`, `concerns.md` ou constitution diretamente dentro de `/dw-update`; delegue para o comando dono desses artefatos.
+
+### 7. Sugerir Próximo Passo
 
 Se comandos/skills foram atualizados, lembre o usuário:
 - Reinicie a sessão do agente (ou recarregue skills) para que as instruções novas tenham efeito — skills costumam ser carregadas no início da sessão