@brunosps00/dev-workflow 1.3.0 → 1.4.0

package/.claude-plugin/marketplace.json

@@ -0,0 +1,13 @@
+{
+  "name": "brunosps00-dev-workflow",
+  "owner": {
+    "name": "Bruno Santos"
+  },
+  "plugins": [
+    {
+      "name": "dev-workflow",
+      "source": "./",
+      "description": "Standalone, à-la-carte skills from the dev-workflow pipeline: minimalism, search-first, simplification, verification, security review, and more."
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -0,0 +1,31 @@
+{
+  "name": "dev-workflow",
+  "description": "Standalone, à-la-carte skills from the dev-workflow pipeline: minimalism, search-first, simplification, verification, security review, and more.",
+  "version": "1.4.0",
+  "author": {
+    "name": "Bruno Santos"
+  },
+  "homepage": "https://github.com/brunosantos/dev-workflow",
+  "license": "MIT",
+  "keywords": [
+    "ai",
+    "workflow",
+    "skills",
+    "claude",
+    "minimalism",
+    "verification",
+    "security"
+  ],
+  "skills": [
+    "./scaffold/skills/api-testing-recipes",
+    "./scaffold/skills/docker-compose-recipes",
+    "./scaffold/skills/dw-minimalism",
+    "./scaffold/skills/dw-search-first",
+    "./scaffold/skills/dw-simplification",
+    "./scaffold/skills/dw-verify",
+    "./scaffold/skills/humanizer",
+    "./scaffold/skills/remotion-best-practices",
+    "./scaffold/skills/security-review",
+    "./scaffold/skills/vercel-react-best-practices"
+  ]
+}

package/README.md

@@ -16,6 +16,7 @@ This will:
 5. Install bundled skills (`dw-verify`, `dw-memory`, `dw-review-rigor`, `dw-ui-discipline`, `dw-testing-discipline`, `security-review`, etc.) to `.agents/skills/`
 6. Generate skill wrappers and project agents for Claude Code, Codex, Copilot, and OpenCode
 7. Configure MCP servers (Context7 + Playwright)
+8. Install enforcement hooks (git guardrails) + a statusline into `.claude/settings.json` (merge-aware — your own hooks/statusline are never overwritten)
 
 > **Compozy-inspired disciplines.** Since 0.5.0, dev-workflow bundles three primitives — `dw-verify`, `dw-memory`, `dw-review-rigor` — adapted from the [Compozy](https://github.com/compozy/compozy) project and invoked internally by existing commands. See [docs/compozy-integration.md](docs/compozy-integration.md) for what was ported and what was not.
 
@@ -24,9 +25,24 @@ Optional dependencies (Playwright browsers, react-doctor, Trivy, Semgrep, gitlea
 npx @brunosps00/dev-workflow install-deps
 ```
 
+### Install individual skills (à-la-carte)
+
+Beyond the full pipeline, the standalone disciplines are also published as a Claude Code plugin, so you can adopt one skill without scaffolding the whole workflow:
+
+```bash
+# Claude Code: add the marketplace, then install the plugin
+/plugin marketplace add brunosps00/dev-workflow
+/plugin install dev-workflow@brunosps00-dev-workflow
+
+# or via the skills ecosystem
+npx skills add brunosps00/dev-workflow
+```
+
+Exportable skills (no `.dw/` pipeline required): `dw-minimalism`, `dw-search-first`, `dw-simplification`, `dw-verify`, `humanizer`, `security-review`, `vercel-react-best-practices`, `remotion-best-practices`, `api-testing-recipes`, `docker-compose-recipes`. The plugin manifest is generated from the skill registry (`npm run build:plugin`); pipeline-bound skills (`dw-execute-phase`, `dw-memory`, `dw-codebase-intel`, `dw-cli-run`) are intentionally not exported.
+
 ## Commands
 
-dev-workflow v1.3.0 ships **36 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
+dev-workflow v1.4.0 ships **36 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
 
 ### Tier 1 — Gateway (3)
 
@@ -249,7 +265,7 @@ npx @brunosps00/dev-workflow subtask list
 
 ## Bundled Skills
 
-Skills installed to `.agents/skills/` for use by all commands. The bundle is governed by `scaffold/skill-registry.json`, which records each skill's kind, tier, owner, trigger, expected output, load policy, and context limit.
+Skills installed to `.agents/skills/` for use by all commands. The bundle is governed by `scaffold/skill-registry.json`, which records each skill's kind, tier, owner, trigger, expected output, load policy, context limit, invocation control (`model` vs `explicit`), and à-la-carte `exportable` flag.
 
 Skill kinds:
 
@@ -274,6 +290,7 @@ These are not slash commands — they are primitives other commands call to enfo
 | **dw-execute-phase** | Goal-backward 6-dimension plan verification (`plan-checker`) and wave-based parallel task execution (`executor`) with atomic commit, deviation handling, and checkpoint recovery | `/dw-run`, `/dw-goal`, `/dw-autopilot` | [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) (MIT) |
 | **dw-source-grounding** | Detect → Fetch → Implement → Cite protocol with `[source: <url>, version: X.Y, retrieved: YYYY-MM-DD]` citations. Strict source-priority hierarchy (Tier 1 official docs > Tier 2 maintainer blogs > Tier 3 Stack Overflow as discovery only). | `/dw-plan techspec`, `/dw-secure-audit --plan`, `/dw-opportunities --research`, `/dw-brainstorm --research` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 | **dw-simplification** | Chesterton's Fence (understand WHY before changing), behavior-preserving refactor protocol (test gate before/after), complexity metrics (cyclomatic, cognitive, depth, fan-out), Rule of 500 for large refactors | `/dw-review`, `/dw-refactor`, `/dw-brainstorm --mode=refactor-audit` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
+| **dw-minimalism** | Pre-generation YAGNI decision ladder (need it? reuse? stdlib? native? installed dep? one line?) with `lite`/`full`/`ultra` intensity. The missing rung between `dw-search-first` (dependencies) and `dw-simplification` (post-hoc cleanup). | `/dw-run`, `/dw-plan`, `/dw-review` | [`DietrichGebert/ponytail`](https://github.com/DietrichGebert/ponytail) (MIT) |
 | **dw-debug-protocol** | Stop-the-line discipline plus six-step triage (Reproduce → Localize → Reduce → Fix Root Cause → Guard → Verify End-to-End). Error categorization matrix; instrument-first non-reproducible-bug strategy. | `/dw-bugfix`, `/dw-qa --fix` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 | **dw-git-discipline** | Trunk-based pattern (1-3 day branches, daily rebase, feature flags), atomic commit discipline (one intent per commit; refactor separate from feature), Conventional Commits, branch hygiene | `dw-commit`, `dw-generate-pr` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 
@@ -347,6 +364,8 @@ Spec-Driven Development patterns — declarative constitution (`.dw/constitution
 
 UI discipline (`dw-ui-discipline`) and testing doctrine (`dw-testing-discipline`) are original works in this repository. Earlier dev-workflow versions (≤0.13.x) drew on `pedronauck/skills` `ui-craft` and `testing-boss` as inspiration, but in v0.14.0 those skills were rewritten clean-room after a license audit confirmed that the upstream repo has no explicit LICENSE file at root — the README's MIT claim is unverified. The underlying ideas (grounding before design; behavior over mocks; mutation over coverage) are widely-documented general software engineering principles available in many sources (Beck, Fowler, Meszaros, Feathers, Google SRE Book, WCAG specifications). Browser-DevTools patterns from [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) live inside `dw-testing-discipline/references/` (`security-boundary.md`, `three-workflow-patterns.md`).
 
+Minimalism discipline (`dw-minimalism`), per-skill invocation control (`disable-model-invocation` on hidden/internal command wrappers), the git-guardrails enforcement hook, and à-la-carte plugin distribution were adapted from [`DietrichGebert/ponytail`](https://github.com/DietrichGebert/ponytail) (MIT — the "lazy senior" decision ladder, intensity modes, and statusline) and [`mattpocock/skills`](https://github.com/mattpocock/skills) (MIT — user-vs-model invocation and `git-guardrails-claude-code`). See [docs/skills-ecosystem-comparison.md](docs/skills-ecosystem-comparison.md) for the full gap analysis and what was and was not adopted.
+
 Incident response (`dw-incident-response`) adapted from [`wilsto/claude-code-starter-kit/incident-response`](https://github.com/wilsto/claude-code-starter-kit) (MIT). The 5-phase workflow structure and runbook templates come from there. wilsto credits the upstream `wshobson/agents` plugin `incident-response` (v1.3.0); attribution chain preserved. Additional reading cited in the skill: Google SRE Book, Etsy Debriefing Facilitation Guide, PagerDuty Incident Response Documentation.
 
 LLM evaluation (`dw-llm-eval`) trajectory-match modes (strict / unordered / subset / superset) and tool-argument matching strategies adapted from [`langchain-ai/agentevals`](https://github.com/langchain-ai/agentevals) (MIT). The broader oracle-ladder framing, judge-calibration discipline, and reference-dataset principle are distilled from the open evaluations literature (OpenAI evals cookbook, Anthropic evals guidance, the academic eval-of-LLM body of work) and rewritten in our voice.

package/lib/build-plugin.js

@@ -0,0 +1,79 @@
+const fs = require('fs');
+const path = require('path');
+const pkg = require('../package.json');
+const { readSkillRegistry } = require('./skill-registry');
+
+/**
+ * Generate the à-la-carte distribution manifests from the skill registry.
+ *
+ * Single source of truth: scaffold/skill-registry.json. Only skills marked
+ * `exportable: true` (standalone, no .dw/ pipeline dependency) are published.
+ * Re-run `npm run build:plugin` whenever the registry changes; CI validates
+ * that the committed manifests match.
+ *
+ * Writes:
+ *   .claude-plugin/plugin.json      — the dev-workflow skills plugin
+ *   .claude-plugin/marketplace.json — single-plugin marketplace listing
+ *
+ * This does NOT change the full-pipeline installer (`dev-workflow init`), which
+ * scaffolds all skills + commands into a project. The plugin is the parallel
+ * "install one skill" path.
+ */
+
+const REPO_ROOT = path.join(__dirname, '..');
+const PLUGIN_DIR = path.join(REPO_ROOT, '.claude-plugin');
+
+function buildManifests() {
+  const registry = readSkillRegistry();
+  const exportable = registry.skills
+    .filter((s) => s.exportable === true)
+    .map((s) => s.name)
+    .sort();
+
+  const author = typeof pkg.author === 'string' ? { name: pkg.author } : pkg.author || { name: 'Bruno Santos' };
+
+  const plugin = {
+    name: 'dev-workflow',
+    description:
+      'Standalone, à-la-carte skills from the dev-workflow pipeline: minimalism, search-first, simplification, verification, security review, and more.',
+    version: pkg.version,
+    author,
+    homepage: (pkg.repository && pkg.repository.url) || undefined,
+    license: pkg.license,
+    keywords: ['ai', 'workflow', 'skills', 'claude', 'minimalism', 'verification', 'security'],
+    skills: exportable.map((name) => `./scaffold/skills/${name}`),
+  };
+
+  const marketplace = {
+    name: 'brunosps00-dev-workflow',
+    owner: author,
+    plugins: [
+      {
+        name: 'dev-workflow',
+        source: './',
+        description: plugin.description,
+      },
+    ],
+  };
+
+  return { plugin, marketplace, exportable };
+}
+
+function writeJsonStable(filePath, obj) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(obj, null, 2) + '\n', 'utf-8');
+}
+
+function run() {
+  const { plugin, marketplace, exportable } = buildManifests();
+  writeJsonStable(path.join(PLUGIN_DIR, 'plugin.json'), plugin);
+  writeJsonStable(path.join(PLUGIN_DIR, 'marketplace.json'), marketplace);
+  console.log(`Wrote .claude-plugin/plugin.json + marketplace.json (${exportable.length} exportable skills):`);
+  for (const name of exportable) console.log(`  - ${name}`);
+}
+
+module.exports = { buildManifests, run };
+
+if (require.main === module) {
+  run();
+}

package/lib/constants.js

@@ -5,10 +5,10 @@ const COMMANDS = {
     { name: 'dw-autopilot', description: 'Trigger when user asks to implement, build, create, or add a feature non-trivially. First invocation plans and stops; second invocation resumes via dw-goal, then commit and PR.' },
     { name: 'dw-brainstorm', description: 'Refine a concrete idea against the product\'s existing features. Modes: ideation, --research, --onepager, --council. Use dw-opportunities before you have an idea and dw-refactor for code-health audits.' },
     { name: 'dw-bugfix', description: 'Trigger when user reports a bug, pastes an error, or describes broken behavior. Triages with three questions, then fixes or routes to PRD.' },
-    { name: 'dw-claude-run', description: 'Trigger when user asks to run/fire Claude (claude -p headless) in a dedicated worktree to implement a prepared prompt/spec. Claude adapter over the dw-cli-run protocol: durable audit log, resumable session via --session-id, 0-10 dual evaluation, STOP for the gate. Never the main checkout; never merges.' },
-    { name: 'dw-codex-run', description: 'Trigger when user asks to run/fire Codex (codex exec) in a dedicated worktree to implement a prepared prompt/spec. Codex adapter over the dw-cli-run protocol: durable audit log, resumable per-task session, 0-10 dual evaluation, STOP for the gate. Never the main checkout; never merges.' },
+    { name: 'dw-claude-run', userInvoked: true, description: 'Trigger when user asks to run/fire Claude (claude -p headless) in a dedicated worktree to implement a prepared prompt/spec. Claude adapter over the dw-cli-run protocol: durable audit log, resumable session via --session-id, 0-10 dual evaluation, STOP for the gate. Never the main checkout; never merges.' },
+    { name: 'dw-codex-run', userInvoked: true, description: 'Trigger when user asks to run/fire Codex (codex exec) in a dedicated worktree to implement a prepared prompt/spec. Codex adapter over the dw-cli-run protocol: durable audit log, resumable per-task session, 0-10 dual evaluation, STOP for the gate. Never the main checkout; never merges.' },
     { name: 'dw-commit', description: 'Trigger when implementation is complete and pending changes need to be committed. Atomic commits with Conventional Commits messages.' },
-    { name: 'dw-copilot-run', description: 'Trigger when user asks to run/fire GitHub Copilot CLI (copilot -p) in a dedicated worktree to implement a prepared prompt/spec. Copilot adapter over the dw-cli-run protocol: durable audit log, resumable session, 0-10 dual evaluation, STOP for the gate. Never the main checkout; never merges.' },
+    { name: 'dw-copilot-run', userInvoked: true, description: 'Trigger when user asks to run/fire GitHub Copilot CLI (copilot -p) in a dedicated worktree to implement a prepared prompt/spec. Copilot adapter over the dw-cli-run protocol: durable audit log, resumable session, 0-10 dual evaluation, STOP for the gate. Never the main checkout; never merges.' },
     { name: 'dw-dockerize', description: 'Reads a project, detects the stack and runtime deps, then proposes Dockerfile and docker-compose for dev and prod with explicit trade-offs.' },
     { name: 'dw-find-skills', description: 'Searches the npx skills ecosystem for a skill matching what you need, vets it, and installs it where you choose.' },
     { name: 'dw-functional-doc', description: 'Maps screens and user flows into a functional doc, validated end-to-end with Playwright.' },
@@ -32,9 +32,9 @@ const COMMANDS = {
     { name: 'dw-run', description: 'Trigger when user wants to execute tasks. Default runs all pending in dependency order; \'run <task-id>\' runs one; \'run --resume\' continues an interrupted plan.' },
     { name: 'dw-secure-audit', description: 'Security Gate: OWASP + Semgrep SAST (diff) + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain + outdated. Rigoroso: secrets/CRITICAL/HIGH block. Auto-invoked by /dw-review and /dw-generate-pr, explicit phase in /dw-autopilot, and runnable standalone.' },
     { name: 'dw-skill-health', description: 'Audits installed skills and agents for bloat, duplication, missing references, and stale or unused modules.' },
-    { name: 'dw-subtask-start', description: 'Creates a minimal input packet for a subagent without injecting the parent transcript.' },
-    { name: 'dw-subtask-complete', description: 'Records a structured subagent handoff with result, files, decisions, risks, verification, and blockers.' },
-    { name: 'dw-subtask-resume', description: 'Consumes pending subagent handoffs, summarizes them for the parent, and archives the local packets.' },
+    { name: 'dw-subtask-start', userInvoked: true, description: 'Creates a minimal input packet for a subagent without injecting the parent transcript.' },
+    { name: 'dw-subtask-complete', userInvoked: true, description: 'Records a structured subagent handoff with result, files, decisions, risks, verification, and blockers.' },
+    { name: 'dw-subtask-resume', userInvoked: true, description: 'Consumes pending subagent handoffs, summarizes them for the parent, and archives the local packets.' },
     { name: 'dw-update', description: 'Updates dev-workflow to the latest npm release in-place, with a snapshot you can roll back to.' },
   ],
   'pt-br': [
@@ -43,10 +43,10 @@ const COMMANDS = {
     { name: 'dw-autopilot', description: 'Trigger quando usuario pede pra implementar, criar ou adicionar uma feature nao-trivial. Primeira invocacao planeja e para; segunda retoma via dw-goal, depois commit e PR.' },
     { name: 'dw-brainstorm', description: 'Refina uma ideia concreta contra features existentes do produto. Modos: ideacao, --research, --onepager, --council. Use dw-opportunities antes de ter uma ideia e dw-refactor para auditoria de code health.' },
     { name: 'dw-bugfix', description: 'Trigger quando usuario reporta bug, cola erro ou descreve comportamento quebrado. Tria com tres perguntas, depois corrige ou roteia pra PRD.' },
-    { name: 'dw-claude-run', description: 'Trigger quando usuario pede pra rodar/disparar o Claude (claude -p headless) numa worktree dedicada pra implementar um prompt/spec preparado. Adapter Claude sobre o protocolo dw-cli-run: log de auditoria duravel, sessao resumivel via --session-id, dupla avaliacao 0-10, PARA pro gate. Nunca no checkout principal; nunca mergeia.' },
-    { name: 'dw-codex-run', description: 'Trigger quando usuario pede pra rodar/disparar o Codex (codex exec) numa worktree dedicada pra implementar um prompt/spec preparado. Adapter Codex sobre o protocolo dw-cli-run: log de auditoria duravel, sessao resumivel por tarefa, dupla avaliacao 0-10, PARA pro gate. Nunca no checkout principal; nunca mergeia.' },
+    { name: 'dw-claude-run', userInvoked: true, description: 'Trigger quando usuario pede pra rodar/disparar o Claude (claude -p headless) numa worktree dedicada pra implementar um prompt/spec preparado. Adapter Claude sobre o protocolo dw-cli-run: log de auditoria duravel, sessao resumivel via --session-id, dupla avaliacao 0-10, PARA pro gate. Nunca no checkout principal; nunca mergeia.' },
+    { name: 'dw-codex-run', userInvoked: true, description: 'Trigger quando usuario pede pra rodar/disparar o Codex (codex exec) numa worktree dedicada pra implementar um prompt/spec preparado. Adapter Codex sobre o protocolo dw-cli-run: log de auditoria duravel, sessao resumivel por tarefa, dupla avaliacao 0-10, PARA pro gate. Nunca no checkout principal; nunca mergeia.' },
     { name: 'dw-commit', description: 'Trigger quando implementacao esta completa e ha mudancas pendentes pra commit. Commits atomicos com mensagens Conventional Commits.' },
-    { name: 'dw-copilot-run', description: 'Trigger quando usuario pede pra rodar/disparar o GitHub Copilot CLI (copilot -p) numa worktree dedicada pra implementar um prompt/spec preparado. Adapter Copilot sobre o protocolo dw-cli-run: log de auditoria duravel, sessao resumivel, dupla avaliacao 0-10, PARA pro gate. Nunca no checkout principal; nunca mergeia.' },
+    { name: 'dw-copilot-run', userInvoked: true, description: 'Trigger quando usuario pede pra rodar/disparar o GitHub Copilot CLI (copilot -p) numa worktree dedicada pra implementar um prompt/spec preparado. Adapter Copilot sobre o protocolo dw-cli-run: log de auditoria duravel, sessao resumivel, dupla avaliacao 0-10, PARA pro gate. Nunca no checkout principal; nunca mergeia.' },
     { name: 'dw-dockerize', description: 'Le um projeto, detecta stack e deps de runtime, e propoe Dockerfile e docker-compose para dev e prod com trade-offs explicitos.' },
     { name: 'dw-find-skills', description: 'Busca no ecossistema npx skills uma skill que resolva o que voce precisa, valida e instala onde voce escolher.' },
     { name: 'dw-functional-doc', description: 'Mapeia telas e fluxos em um dossie funcional, validado E2E com Playwright.' },
@@ -70,9 +70,9 @@ const COMMANDS = {
     { name: 'dw-run', description: 'Trigger quando usuario quer executar tasks. Default roda todas pendentes em ordem de dependencia; \'run <task-id>\' roda uma; \'run --resume\' continua plan interrompido.' },
     { name: 'dw-secure-audit', description: 'Security Gate: OWASP + Semgrep SAST (diff) + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain + outdated. Rigoroso: secrets/CRITICAL/HIGH bloqueiam. Auto-invocado por /dw-review e /dw-generate-pr, fase explicita no /dw-autopilot, e executavel standalone.' },
     { name: 'dw-skill-health', description: 'Audita skills e agentes instalados por bloat, duplicacao, referencias quebradas e modulos sem uso.' },
-    { name: 'dw-subtask-start', description: 'Cria um input packet minimo para subagente sem injetar transcript bruto do parent.' },
-    { name: 'dw-subtask-complete', description: 'Registra handoff estruturado do subagente com resultado, arquivos, decisoes, riscos, verificacao e bloqueios.' },
-    { name: 'dw-subtask-resume', description: 'Consome handoffs pendentes de subagentes, resume para o parent e arquiva os pacotes locais.' },
+    { name: 'dw-subtask-start', userInvoked: true, description: 'Cria um input packet minimo para subagente sem injetar transcript bruto do parent.' },
+    { name: 'dw-subtask-complete', userInvoked: true, description: 'Registra handoff estruturado do subagente com resultado, arquivos, decisoes, riscos, verificacao e bloqueios.' },
+    { name: 'dw-subtask-resume', userInvoked: true, description: 'Consome handoffs pendentes de subagentes, resume para o parent e arquiva os pacotes locais.' },
     { name: 'dw-update', description: 'Atualiza o dev-workflow para o release mais recente no npm, com snapshot para rollback.' },
   ],
 };
@@ -80,9 +80,12 @@ const COMMANDS = {
 const PLATFORMS = {
   claude: {
     dir: '.claude/skills',
-    wrapperTemplate: (name, description) => `---
+    // opts.userInvoked → emit disable-model-invocation: true so Claude Code never
+    // auto-fires hidden/internal commands (e.g. the worktree runners); the user
+    // still invokes them explicitly with /<name>.
+    wrapperTemplate: (name, description, opts = {}) => `---
 name: ${name}
-description: "${description.replace(/"/g, '\\"')}"
+description: "${description.replace(/"/g, '\\"')}"${opts.userInvoked ? '\ndisable-model-invocation: true' : ''}
 ---
 
 Read and follow ALL instructions in \`.dw/commands/${name}.md\`.

package/lib/doctor.js

@@ -10,6 +10,7 @@ const {
 } = require('./agents');
 const { readInstallState, STATE_RELATIVE_PATH } = require('./install-state');
 const { validateSkillRegistry, readSkillRegistry, validateSkillStructuredReturn } = require('./skill-registry');
+const { GIT_GUARDRAILS_CMD, STATUSLINE_CMD, HOOKS_DIR_MARKER } = require('./hooks');
 const removedCommands = require('./removed-commands');
 
 function run() {
@@ -33,6 +34,7 @@ function run() {
   checkSubtaskLayout(projectRoot, issues);
   checkSkillRegistry(projectRoot, issues, warnings);
   checkMcp(projectRoot, issues);
+  checkHooks(projectRoot, issues, warnings);
   checkLegacyCommands(projectRoot, warnings);
 
   console.log('dev-workflow doctor\n');
@@ -203,6 +205,37 @@ function checkMcp(projectRoot, issues) {
   }
 }
 
+function checkHooks(projectRoot, issues, warnings) {
+  // Hook scripts (copied from scaffold/scripts/ into .dw/scripts/).
+  for (const script of ['git-guardrails.mjs', 'statusline.mjs']) {
+    const file = path.join(projectRoot, '.dw', 'scripts', 'hooks', script);
+    if (!fs.existsSync(file)) issues.push(`Missing hook script: ${path.relative(projectRoot, file)}`);
+  }
+
+  const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
+  if (!fs.existsSync(settingsPath)) return; // checkMcp already reports this
+
+  let settings;
+  try {
+    settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+  } catch {
+    return; // checkMcp already reports malformed settings
+  }
+
+  const preToolUse = (settings.hooks && settings.hooks.PreToolUse) || [];
+  const guardrailWired = preToolUse.some(
+    (g) => g && Array.isArray(g.hooks) && g.hooks.some((h) => h && h.command === GIT_GUARDRAILS_CMD),
+  );
+  if (!guardrailWired) issues.push('Missing git-guardrails PreToolUse hook in .claude/settings.json');
+
+  const statusLine = settings.statusLine;
+  if (!statusLine) {
+    issues.push('Missing statusLine in .claude/settings.json');
+  } else if (statusLine.command !== STATUSLINE_CMD && !String(statusLine.command || '').includes(HOOKS_DIR_MARKER)) {
+    warnings.push('Custom statusLine set; dev-workflow statusline is not active (add `node .dw/scripts/hooks/statusline.mjs`).');
+  }
+}
+
 function checkLegacyCommands(projectRoot, warnings) {
   for (const entry of removedCommands) {
     const file = path.join(projectRoot, '.dw', 'commands', `${entry.name}.md`);

package/lib/hooks.js

@@ -0,0 +1,137 @@
+const { readSettings, writeSettings } = require('./mcp');
+
+// dev-workflow-owned hook/statusline scripts live under this path. The substring
+// is the marker used to identify OUR entries in .claude/settings.json so we can
+// add/refresh them on update without ever touching the user's own hooks.
+const HOOKS_DIR_MARKER = '.dw/scripts/hooks/';
+const GIT_GUARDRAILS_CMD = 'node .dw/scripts/hooks/git-guardrails.mjs';
+const STATUSLINE_CMD = 'node .dw/scripts/hooks/statusline.mjs';
+const GIT_GUARDRAILS_SCRIPT = 'git-guardrails.mjs';
+
+function isOurs(command) {
+  return typeof command === 'string' && command.includes(HOOKS_DIR_MARKER);
+}
+
+/**
+ * Reconcile dev-workflow hooks + statusLine into .claude/settings.json.
+ *
+ * Marker-based and merge-aware (unlike installMCPs' add-if-missing):
+ *  - adds our entries when absent;
+ *  - refreshes our entries in place when the script path/shape changed (so an
+ *    update actually updates);
+ *  - never removes or rewrites hooks/statusLine the user added;
+ *  - leaves a user-defined statusLine untouched (reports it so the caller can
+ *    surface a post-update note).
+ *
+ * Returns { hooks, statusLine } where each is 'added' | 'updated' | 'unchanged'
+ * (statusLine may also be 'skipped-user').
+ */
+function installHooks(projectRoot) {
+  const settings = readSettings(projectRoot);
+  const before = JSON.stringify(settings);
+
+  const hooksResult = reconcilePreToolUseGitGuardrails(settings);
+  const statusLineResult = reconcileStatusLine(settings);
+
+  if (JSON.stringify(settings) !== before) {
+    writeSettings(projectRoot, settings);
+  }
+
+  return { hooks: hooksResult, statusLine: statusLineResult };
+}
+
+function reconcilePreToolUseGitGuardrails(settings) {
+  if (!settings.hooks || typeof settings.hooks !== 'object') settings.hooks = {};
+  if (!Array.isArray(settings.hooks.PreToolUse)) settings.hooks.PreToolUse = [];
+
+  const groups = settings.hooks.PreToolUse;
+
+  // Was our guardrail already wired (anywhere, any shape)?
+  const existed = groups.some(
+    (g) =>
+      g && Array.isArray(g.hooks) && g.hooks.some((h) => h && typeof h.command === 'string' && h.command.includes(GIT_GUARDRAILS_SCRIPT)),
+  );
+  // Already wired with the exact canonical command in a Bash group?
+  const exactPresent = groups.some(
+    (g) =>
+      g && g.matcher === 'Bash' && Array.isArray(g.hooks) && g.hooks.some((h) => h && h.command === GIT_GUARDRAILS_CMD),
+  );
+
+  if (exactPresent) return 'unchanged';
+
+  // Drop any stale/relocated copies of OUR guardrail, preserving user hooks.
+  for (const group of groups) {
+    if (!group || !Array.isArray(group.hooks)) continue;
+    group.hooks = group.hooks.filter(
+      (h) => !(h && typeof h.command === 'string' && h.command.includes(GIT_GUARDRAILS_SCRIPT)),
+    );
+  }
+  // Prune groups we just emptied (only those left with zero hooks).
+  settings.hooks.PreToolUse = groups.filter((g) => g && Array.isArray(g.hooks) && g.hooks.length > 0);
+
+  // Re-add the canonical entry: into an existing Bash group if present, else new.
+  const bashGroup = settings.hooks.PreToolUse.find((g) => g && g.matcher === 'Bash' && Array.isArray(g.hooks));
+  if (bashGroup) {
+    bashGroup.hooks.push({ type: 'command', command: GIT_GUARDRAILS_CMD });
+  } else {
+    settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: [{ type: 'command', command: GIT_GUARDRAILS_CMD }] });
+  }
+
+  return existed ? 'updated' : 'added';
+}
+
+function reconcileStatusLine(settings) {
+  const desired = { type: 'command', command: STATUSLINE_CMD };
+  const current = settings.statusLine;
+
+  if (!current) {
+    settings.statusLine = desired;
+    return 'added';
+  }
+  // Only manage a statusLine we own; never clobber a user's custom one.
+  if (current.command === STATUSLINE_CMD) return 'unchanged';
+  if (isOurs(current.command)) {
+    settings.statusLine = desired; // our script moved/renamed — refresh
+    return 'updated';
+  }
+  return 'skipped-user';
+}
+
+/**
+ * Remove ONLY dev-workflow-owned hook + statusLine entries (used by uninstall).
+ * Returns the number of entries removed.
+ */
+function removeHooks(projectRoot) {
+  const settings = readSettings(projectRoot);
+  let removed = 0;
+
+  if (settings.hooks && Array.isArray(settings.hooks.PreToolUse)) {
+    for (const group of settings.hooks.PreToolUse) {
+      if (!group || !Array.isArray(group.hooks)) continue;
+      const kept = group.hooks.filter((h) => !(h && isOurs(h.command)));
+      removed += group.hooks.length - kept.length;
+      group.hooks = kept;
+    }
+    settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter(
+      (g) => g && Array.isArray(g.hooks) && g.hooks.length > 0,
+    );
+    if (settings.hooks.PreToolUse.length === 0) delete settings.hooks.PreToolUse;
+    if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
+  }
+
+  if (settings.statusLine && isOurs(settings.statusLine.command)) {
+    delete settings.statusLine;
+    removed++;
+  }
+
+  if (removed > 0) writeSettings(projectRoot, settings);
+  return removed;
+}
+
+module.exports = {
+  installHooks,
+  removeHooks,
+  HOOKS_DIR_MARKER,
+  GIT_GUARDRAILS_CMD,
+  STATUSLINE_CMD,
+};

package/lib/init.js

@@ -4,6 +4,7 @@ const { ensureDir, copyDir, writeFile, upsertDelimitedBlock, log, listFilesRecur
 const { selectLanguage } = require('./prompts');
 const { generateWrappers } = require('./wrappers');
 const { installMCPs } = require('./mcp');
+const { installHooks } = require('./hooks');
 const { generateAgents } = require('./agents');
 const { migrate: migrateGsd } = require('./migrate-gsd');
 const { migrate: migrateSkills } = require('./migrate-skills');
@@ -211,6 +212,16 @@ async function run({ force = false, lang = null, mode = 'init', profile = null,
     console.log();
   }
 
+  // 5.15. Seed .dw/minimalism.json (init only; preserved on update). Holds the
+  // dw-minimalism intensity mode read by the skill and the statusline hook.
+  if (!isUpdate) {
+    const minimalismPath = path.join(projectRoot, '.dw', 'minimalism.json');
+    const minimalismStatus = writeFile(minimalismPath, JSON.stringify({ mode: 'full' }, null, 2) + '\n', false);
+    if (minimalismStatus === 'created') totalCreated++;
+    else totalSkipped++;
+    touchedFiles.push(minimalismPath);
+  }
+
   // 5.2. Create .dw/bugfixes/ with .gitkeep (init only; preserved on update)
   if (!isUpdate) {
     const bugfixesDir = path.join(projectRoot, '.dw', 'bugfixes');
@@ -302,6 +313,15 @@ async function run({ force = false, lang = null, mode = 'init', profile = null,
   const mcpResults = installMCPs(projectRoot);
   console.log(`    ${mcpResults.added} configured, ${mcpResults.skipped} already present\n`);
 
+  // 9.2. Reconcile dev-workflow hooks + statusline (marker-based, merge-aware:
+  // refreshes our entries, never touches user-defined hooks/statusLine).
+  console.log('  Hooks & statusline:');
+  const hookResults = installHooks(projectRoot);
+  console.log(`    git-guardrails: ${hookResults.hooks}, statusline: ${hookResults.statusLine}\n`);
+  if (hookResults.statusLine === 'skipped-user') {
+    console.log('    Note: a custom statusLine is set; to show dev-workflow state add `node .dw/scripts/hooks/statusline.mjs`.\n');
+  }
+
   // 9.5. Persist install state for diagnostics and repair.
   const installState = writeInstallState(projectRoot, {
     lang: selectedLang,

package/lib/skill-registry.js

@@ -9,6 +9,10 @@ const SKILLS_DIR = path.join(SCAFFOLD_DIR, 'skills');
 
 const VALID_KINDS = new Set(['protocol', 'domain-pack', 'recipe-pack', 'asset-pack']);
 const VALID_LOAD_POLICIES = new Set(['always-small', 'lazy-references', 'opt-in-runtime']);
+// Optional invocation control (mattpocock/skills). Bundled skills live under
+// .agents/skills/ (read by path from command prose), so this is documental for
+// them and feeds the à-la-carte plugin manifest. Default when absent: 'model'.
+const VALID_INVOCATIONS = new Set(['model', 'explicit']);
 const REQUIRED_STRUCTURED_RETURN_FIELDS = [
   '**Status:**',
   '**Scope:**',
@@ -106,6 +110,15 @@ function validateEntry(entry, issues) {
   if (typeof entry.context_limit !== 'number' || entry.context_limit <= 0) {
     issues.push(`Skill registry entry ${entry.name} must set a positive numeric context_limit`);
   }
+
+  // Optional fields (back-compat: absent is valid; defaults applied by consumers).
+  if (entry.invocation !== undefined && !VALID_INVOCATIONS.has(entry.invocation)) {
+    issues.push(`Skill registry entry ${entry.name} has invalid invocation: ${entry.invocation}`);
+  }
+
+  if (entry.exportable !== undefined && typeof entry.exportable !== 'boolean') {
+    issues.push(`Skill registry entry ${entry.name} exportable must be a boolean`);
+  }
 }
 
 function validateSkillStructuredReturn(skillName, skillPath, issues, label = `Skill ${skillName}`) {

package/lib/uninstall.js

@@ -2,6 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const { COMMANDS, PLATFORMS, MCP_SERVERS } = require('./constants');
 const { AGENT_TARGETS, LEGACY_AGENT_TARGETS, readAgentRegistry } = require('./agents');
+const { removeHooks } = require('./hooks');
 
 function run() {
   const projectRoot = process.cwd();
@@ -103,6 +104,23 @@ function run() {
   }
   console.log();
 
+  // 4.5. Remove dev-workflow hooks + statusline from .claude/settings.json
+  // (marker-based; user-defined hooks/statusLine are left intact). The hook
+  // scripts themselves were removed with .dw/scripts/ above.
+  console.log('  Hooks & statusline:');
+  try {
+    const removedHooks = removeHooks(projectRoot);
+    if (removedHooks > 0) {
+      console.log(`  \x1b[31m-\x1b[0m ${removedHooks} dev-workflow hook/statusline entr${removedHooks === 1 ? 'y' : 'ies'} [removed]`);
+      removed += removedHooks;
+    } else {
+      skipped++;
+    }
+  } catch {
+    console.log('    Could not parse .claude/settings.json, skipping hook cleanup');
+  }
+  console.log();
+
   // 5. Remove .opencode/package.json
   removeFile(path.join(projectRoot, '.opencode', 'package.json'));
   removeFile(path.join(projectRoot, '.dw', 'install-state.json'));
@@ -115,9 +133,10 @@ function run() {
   console.log(`  Done! ${removed} removed, ${skipped} already absent`);
   console.log();
   console.log('  Preserved (user data):');
-  console.log('    .dw/rules/    (project rules)');
-  console.log('    .dw/spec/     (PRDs and specs)');
-  console.log('    .dw/intel/    (codebase index from /dw-intel --build)');
+  console.log('    .dw/rules/           (project rules)');
+  console.log('    .dw/spec/            (PRDs and specs)');
+  console.log('    .dw/intel/           (codebase index from /dw-intel --build)');
+  console.log('    .dw/minimalism.json  (dw-minimalism intensity preference)');
   console.log();
 }
 

package/lib/validate.js

@@ -0,0 +1,62 @@
+const fs = require('fs');
+const path = require('path');
+const { validateSkillRegistry } = require('./skill-registry');
+const { validateAgentRegistry, readAgentRegistry } = require('./agents');
+const { buildManifests } = require('./build-plugin');
+
+/**
+ * Repo quality gate (npm run validate). Validates the skill + agent registries
+ * and confirms the committed .claude-plugin/ manifests match what the registry
+ * would generate (no drift). Exits non-zero on any issue.
+ */
+function run() {
+  const issues = [];
+  const warnings = [];
+
+  const skill = validateSkillRegistry();
+  issues.push(...skill.issues);
+  warnings.push(...skill.warnings);
+
+  const agent = validateAgentRegistry(readAgentRegistry());
+  issues.push(...agent.issues);
+  warnings.push(...agent.warnings);
+
+  // Plugin manifest drift check.
+  const { plugin, marketplace } = buildManifests();
+  checkManifestDrift('.claude-plugin/plugin.json', plugin, issues);
+  checkManifestDrift('.claude-plugin/marketplace.json', marketplace, issues);
+
+  console.log('dev-workflow validate\n');
+  if (warnings.length) {
+    console.log('Warnings:');
+    for (const w of warnings) console.log(`- ${w}`);
+    console.log();
+  }
+  if (issues.length) {
+    console.log('Issues:');
+    for (const i of issues) console.log(`- ${i}`);
+    console.log();
+    console.log('FAIL');
+    process.exit(1);
+  }
+  console.log('PASS: skill + agent registries valid; plugin manifests in sync.');
+}
+
+function checkManifestDrift(relPath, expected, issues) {
+  const file = path.join(__dirname, '..', relPath);
+  if (!fs.existsSync(file)) {
+    issues.push(`Missing ${relPath}; run \`npm run build:plugin\`.`);
+    return;
+  }
+  const onDisk = fs.readFileSync(file, 'utf-8');
+  const want = JSON.stringify(expected, null, 2) + '\n';
+  if (onDisk !== want) {
+    issues.push(`${relPath} is out of sync with the registry; run \`npm run build:plugin\`.`);
+  }
+}
+
+module.exports = { run };
+
+if (require.main === module) {
+  run();
+}

package/lib/wrappers.js

@@ -15,7 +15,7 @@ function generateWrappers(projectRoot, commands, force = false) {
         // Directory format: .claude/skills/dw-brainstorm/SKILL.md
         skillFile = path.join(projectRoot, platform.dir, cmd.name, 'SKILL.md');
       }
-      const content = platform.wrapperTemplate(cmd.name, cmd.description);
+      const content = platform.wrapperTemplate(cmd.name, cmd.description, cmd);
       const status = writeFile(skillFile, content, force);
       results[status]++;
       results.files.push(skillFile);

package/package.json

@@ -1,14 +1,19 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"
   },
+  "scripts": {
+    "validate": "node lib/validate.js",
+    "build:plugin": "node lib/build-plugin.js"
+  },
   "files": [
     "bin/",
     "lib/",
     "scaffold/",
+    ".claude-plugin/",
     "README.md",
     "LICENSE"
   ],

package/scaffold/en/commands/dw-plan.md

@@ -39,6 +39,7 @@ When available under `./.agents/skills/`, use these as planning support:
 - `dw-council` (opt-in via `--council`): multi-advisor stress-test on the major architectural decision during TechSpec stage.
 - `dw-codebase-intel`: consulted for API conventions, architecture patterns, naming when designing the TechSpec.
 - `dw-search-first`: **REQUIRED** before adding a new dependency, integration, MCP server, reusable helper, or framework-level abstraction.
+- `dw-minimalism`: **REQUIRED** before specifying new modules/services — pressure-tests scope with the YAGNI ladder so the TechSpec doesn't over-build; composes with `dw-search-first`.
 - `dw-context-budget`: use when the plan exceeds 12 tasks, touches 30+ files, or requires loading many docs/skills.
 
 ## Agent Dispatch

package/scaffold/en/commands/dw-review.md

@@ -47,6 +47,7 @@ When available under `./.agents/skills/`, these are invoked as analytical suppor
 - `dw-secure-audit` (**Security Gate**): **ALWAYS for TS/Python/C#/Rust projects** — triggered here and the verdict is enforced. If the project's language is supported and a fresh `.dw/secure-audit/audit-summary.md` is missing OR has REJECTED status, the review verdict is **REJECTED** — no exception. The same gate is also a standalone command (`/dw-secure-audit`) and an explicit phase in `/dw-autopilot`. It now adds Semgrep SAST (diff) + gitleaks secrets on top of OWASP/Trivy/SCA.
 - `security-review`: the OWASP diff-level skill the gate uses (injection, authz, secrets, SSRF, crypto — HIGH CONFIDENCE only).
 - `dw-simplification`: use when the diff touches dense or twisty code — applies Chesterton's Fence, behavior-preserving refactor protocol, complexity metrics.
+- `dw-minimalism`: use when the diff adds code that may be over-built — flags speculative generality, single-caller helpers, premature abstraction, and YAGNI violations (the pre-generation counterpart to `dw-simplification`).
 - `dw-ui-discipline`: use when the diff touches UI — runs the 14 visual-slop patterns + accessibility floor checks. For a deterministic gate, also run `node .dw/scripts/lib/ui-slop-detect.mjs <changed-ui-paths> --fail-on error` (a wrapper over the impeccable detector); treat blocking findings as **REJECTED** and surface warnings in the report.
 - `dw-testing-discipline`: use when the diff touches tests — applies the 25 anti-patterns catalog + 6 agent guardrails (when tests were agent-authored).
 - `dw-llm-eval`: **REQUIRED when the diff touches AI/LLM feature code paths**. Reference dataset + ≥2 oracle rungs + judge calibration (if rung 4 used) + eval run results MUST be in the PR. Missing → REJECTED.

package/scaffold/en/commands/dw-run.md

@@ -35,6 +35,7 @@ When available under `./.agents/skills/`, these skills are invoked per task:
 - `dw-testing-discipline`: applies the placement doctrine, 6 agent guardrails, and 25 anti-patterns when adding tests during the task.
 - `dw-ui-discipline`: when the task touches UI, the 4 grounding questions must be answered before any visual decision lands.
 - `dw-llm-eval`: when the task touches AI feature code paths, the reference dataset + oracle ladder rules apply.
+- `dw-minimalism`: **before writing new code** — climb the YAGNI decision ladder (need it? reuse? stdlib? native? installed dep? one line?) at the active intensity, then write the minimum. Hands new dependencies to `dw-search-first`.
 - `vercel-react-best-practices`: when the task touches React/Next.js performance.
 
 ## Constitution Gate

package/scaffold/en/commands/dw-update.md

@@ -26,6 +26,8 @@ SNAPSHOT_DIR=".dw/.backup/$(date -u +%Y%m%dT%H%M%SZ)"
 mkdir -p "$SNAPSHOT_DIR"
 cp -r .dw/commands .dw/templates .dw/references .dw/scripts "$SNAPSHOT_DIR/" 2>/dev/null
 [ -d .agents/skills ] && cp -r .agents/skills "$SNAPSHOT_DIR/agents-skills" 2>/dev/null
+# .claude/settings.json is now mutated by update (MCPs + hooks + statusLine)
+[ -f .claude/settings.json ] && mkdir -p "$SNAPSHOT_DIR/claude" && cp .claude/settings.json "$SNAPSHOT_DIR/claude/settings.json" 2>/dev/null
 echo "Snapshot saved to $SNAPSHOT_DIR"
 ```
 
@@ -127,7 +129,7 @@ If invoked with `--rollback`:
 1. List snapshots in `.dw/.backup/`
 2. If none exist: STOP and report "No snapshot available"
 3. If more than one exists: ask the user which to restore (default: most recent)
-4. Confirm with the user: "Restore snapshot `<path>`? This OVERWRITES `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/`, and `.agents/skills/`. Proceed? [y/N]"
+4. Confirm with the user: "Restore snapshot `<path>`? This OVERWRITES `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/`, `.agents/skills/`, and `.claude/settings.json`. Proceed? [y/N]"
 5. Only after `y`: copy back
 
 ```bash
@@ -136,6 +138,7 @@ cp -r "$SNAPSHOT_DIR/templates"  .dw/
 cp -r "$SNAPSHOT_DIR/references" .dw/ 2>/dev/null
 cp -r "$SNAPSHOT_DIR/scripts"    .dw/ 2>/dev/null
 [ -d "$SNAPSHOT_DIR/agents-skills" ] && cp -r "$SNAPSHOT_DIR/agents-skills" .agents/skills 2>/dev/null
+[ -f "$SNAPSHOT_DIR/claude/settings.json" ] && cp "$SNAPSHOT_DIR/claude/settings.json" .claude/settings.json 2>/dev/null
 ```
 
 6. Report: snapshot restored, version likely recovered (read from `.dw/commands/dw-help.md` or metadata if present)

package/scaffold/pt-br/commands/dw-plan.md

@@ -39,6 +39,7 @@ Quando disponíveis em `./.agents/skills/`, use como suporte:
 - `dw-council` (opt-in via `--council`): stress-test multi-conselheiro sobre a decisão arquitetural principal no estágio TechSpec.
 - `dw-codebase-intel`: consultado para convenções de API, padrões arquiteturais, naming ao desenhar TechSpec.
 - `dw-search-first`: **OBRIGATÓRIO** antes de adicionar nova dependency, integration, MCP server, helper reutilizavel ou abstracao de framework.
+- `dw-minimalism`: **OBRIGATÓRIO** antes de especificar novos módulos/serviços — pressiona o escopo com o ladder YAGNI pro TechSpec não over-buildar; compõe com `dw-search-first`.
 - `dw-context-budget`: use quando o plano passar de 12 tasks, tocar 30+ arquivos, ou exigir carregar muitos docs/skills.
 
 ## Agent Dispatch

package/scaffold/pt-br/commands/dw-review.md

@@ -47,6 +47,7 @@ Quando disponíveis em `./.agents/skills/`, são invocadas como apoio analítico
 - `dw-secure-audit` (**Security Gate**): **SEMPRE para projetos TS/Python/C#/Rust** — acionado aqui e o verdict é enforced. Se a linguagem é suportada e `.dw/secure-audit/audit-summary.md` fresco está ausente OU REPROVADO, o verdict do review é **REPROVADO** — sem exceção. O mesmo gate também é comando standalone (`/dw-secure-audit`) e fase explícita no `/dw-autopilot`. Agora soma Semgrep SAST (diff) + gitleaks secrets sobre OWASP/Trivy/SCA.
 - `security-review`: a skill OWASP nível-diff que o gate usa (injection, authz, secrets, SSRF, crypto — só HIGH CONFIDENCE).
 - `dw-simplification`: use quando diff toca código denso — aplica Chesterton's Fence, protocolo de refactor preservando comportamento, métricas de complexidade.
+- `dw-minimalism`: use quando o diff adiciona código que pode estar over-built — flagra generalidade especulativa, helpers de um único caller, abstração prematura e violações de YAGNI (a contraparte pré-geração do `dw-simplification`).
 - `dw-ui-discipline`: use quando diff toca UI — roda os 14 visual-slop patterns + accessibility floor. Para um gate determinístico, rode também `node .dw/scripts/lib/ui-slop-detect.mjs <paths-ui-alterados> --fail-on error` (wrapper sobre o detector do impeccable); trate findings bloqueantes como **REJECTED** e reporte os warnings.
 - `dw-testing-discipline`: use quando diff toca testes — aplica catálogo de 25 anti-patterns + 6 agent guardrails (quando testes foram agent-authored).
 - `dw-llm-eval`: **OBRIGATÓRIO quando diff toca código de feature AI/LLM**. Reference dataset + ≥2 oracle rungs + judge calibration (se rung 4 usado) + eval run results DEVEM estar no PR. Faltando → REPROVADO.

package/scaffold/pt-br/commands/dw-run.md

@@ -35,6 +35,7 @@ Quando disponíveis em `./.agents/skills/`, estas skills são invocadas por task
 - `dw-testing-discipline`: aplica placement doctrine, 6 agent guardrails e 25 anti-patterns ao adicionar testes.
 - `dw-ui-discipline`: quando task toca UI, as 4 grounding questions precisam ser respondidas antes de qualquer decisão visual.
 - `dw-llm-eval`: quando task toca código de feature AI, regras de reference dataset + oracle ladder se aplicam.
+- `dw-minimalism`: **antes de escrever código novo** — sobe o decision ladder YAGNI (precisa existir? reusar? stdlib? nativo? dep instalada? uma linha?) na intensidade ativa, depois escreve o mínimo. Passa novas dependências pro `dw-search-first`.
 - `vercel-react-best-practices`: quando task toca performance React/Next.js.
 
 ## Constitution Gate

package/scaffold/pt-br/commands/dw-update.md

@@ -27,6 +27,8 @@ mkdir -p "$SNAPSHOT_DIR"
 cp -r .dw/commands .dw/templates .dw/references .dw/scripts "$SNAPSHOT_DIR/" 2>/dev/null
 # agents/skills (bundled) tambem fazem parte do update
 [ -d .agents/skills ] && cp -r .agents/skills "$SNAPSHOT_DIR/agents-skills" 2>/dev/null
+# .claude/settings.json agora e mutado pelo update (MCPs + hooks + statusLine)
+[ -f .claude/settings.json ] && mkdir -p "$SNAPSHOT_DIR/claude" && cp .claude/settings.json "$SNAPSHOT_DIR/claude/settings.json" 2>/dev/null
 echo "Snapshot salvo em $SNAPSHOT_DIR"
 ```
 
@@ -128,7 +130,7 @@ Se invocado com `--rollback`:
 1. Listar snapshots em `.dw/.backup/`
 2. Se nenhum existir: PARAR e reportar "Nenhum snapshot disponível"
 3. Se mais de um existir: perguntar ao usuário qual restaurar (padrão: mais recente)
-4. Confirmar com o usuário: "Restaurar snapshot `<path>`? Isso SOBRESCREVE `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/` e `.agents/skills/`. Prosseguir? [s/N]"
+4. Confirmar com o usuário: "Restaurar snapshot `<path>`? Isso SOBRESCREVE `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/`, `.agents/skills/` e `.claude/settings.json`. Prosseguir? [s/N]"
 5. Somente após `s`: copiar de volta
 
 ```bash
@@ -137,6 +139,7 @@ cp -r "$SNAPSHOT_DIR/templates"  .dw/
 cp -r "$SNAPSHOT_DIR/references" .dw/ 2>/dev/null
 cp -r "$SNAPSHOT_DIR/scripts"    .dw/ 2>/dev/null
 [ -d "$SNAPSHOT_DIR/agents-skills" ] && cp -r "$SNAPSHOT_DIR/agents-skills" .agents/skills 2>/dev/null
+[ -f "$SNAPSHOT_DIR/claude/settings.json" ] && cp "$SNAPSHOT_DIR/claude/settings.json" .claude/settings.json 2>/dev/null
 ```
 
 6. Reportar: snapshot restaurado, versão provavelmente recuperada (ler de `.dw/commands/dw-help.md` ou metadata se houver)

package/scaffold/scripts/hooks/git-guardrails.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+/**
+ * dev-workflow git guardrails — Claude Code PreToolUse hook (matcher: Bash).
+ *
+ * Blocks irreversible git commands (force push, hard reset, clean -f, branch
+ * deletion, remote branch deletion). Everything else is allowed.
+ *
+ * Enforces the destructive-command rules from the `dw-git-discipline` skill at
+ * the harness level instead of relying on prose. Inspired by mattpocock/skills
+ * `git-guardrails-claude-code` (MIT).
+ *
+ * Contract: reads the PreToolUse payload as JSON on stdin, emits a
+ * permissionDecision via hookSpecificOutput. Fails OPEN — any parsing/runtime
+ * error allows the command, so a hook bug never blocks the user.
+ */
+
+const DANGEROUS = [
+  { re: /\bgit\s+push\b[^\n|&;]*(--force\b|--force-with-lease\b|\s-f\b)/, why: 'force push rewrites remote history' },
+  { re: /\bgit\s+push\b[^\n|&;]*(--delete\b|\s-d\b|\s:\S)/, why: 'deletes a remote branch' },
+  { re: /\bgit\s+reset\b[^\n|&;]*--hard\b/, why: 'hard reset discards uncommitted work and rewrites the branch' },
+  { re: /\bgit\s+clean\b[^\n|&;]*-[a-z]*f/, why: 'git clean -f permanently deletes untracked files' },
+  { re: /\bgit\s+branch\b[^\n|&;]*\s-D\b/, why: 'force-deletes a branch that may be unmerged' },
+  { re: /\bgit\s+checkout\b[^\n|&;]*\s(--\s+\.|\.\s*$)/, why: 'discards all local changes in the working tree' },
+];
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let data = '';
+    if (process.stdin.isTTY) return resolve('');
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (chunk) => (data += chunk));
+    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('error', () => resolve(''));
+  });
+}
+
+function allow() {
+  process.exit(0);
+}
+
+function deny(reason) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: reason,
+      },
+    }) + '\n',
+  );
+  process.exit(0);
+}
+
+async function main() {
+  let payload;
+  try {
+    payload = JSON.parse(await readStdin());
+  } catch {
+    return allow(); // fail open
+  }
+
+  const command = payload && payload.tool_input && typeof payload.tool_input.command === 'string'
+    ? payload.tool_input.command
+    : '';
+  if (!command) return allow();
+
+  for (const rule of DANGEROUS) {
+    if (rule.re.test(command)) {
+      return deny(
+        `Blocked by dev-workflow git guardrails: ${rule.why}. ` +
+          `If this is intentional, run it yourself outside the agent, or adjust .claude/settings.json hooks.`,
+      );
+    }
+  }
+
+  return allow();
+}
+
+main().catch(() => allow());

package/scaffold/scripts/hooks/statusline.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/**
+ * dev-workflow statusline — Claude Code statusLine command.
+ *
+ * Prints one line: git branch · dev-workflow active spec (if any) · minimalism
+ * mode. Reads the session payload (JSON on stdin) for the working dir; falls
+ * back to process.cwd(). Fails SAFE — any error prints a minimal line so the
+ * statusline never breaks the session.
+ *
+ * Minimalism mode is read from .dw/minimalism.json (see the dw-minimalism skill).
+ */
+
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { execSync } from 'node:child_process';
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let data = '';
+    if (process.stdin.isTTY) return resolve('');
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (c) => (data += c));
+    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('error', () => resolve(''));
+  });
+}
+
+function gitBranch(cwd) {
+  try {
+    return execSync('git rev-parse --abbrev-ref HEAD', {
+      cwd,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+      .toString()
+      .trim();
+  } catch {
+    return '';
+  }
+}
+
+function minimalismMode(cwd) {
+  try {
+    const file = join(cwd, '.dw', 'minimalism.json');
+    if (!existsSync(file)) return 'full';
+    const mode = JSON.parse(readFileSync(file, 'utf-8')).mode;
+    return typeof mode === 'string' ? mode : 'full';
+  } catch {
+    return 'full';
+  }
+}
+
+function activeSpec(cwd) {
+  try {
+    const specDir = join(cwd, '.dw', 'spec');
+    if (!existsSync(specDir)) return '';
+    const dirs = readdirSync(specDir, { withFileTypes: true })
+      .filter((e) => e.isDirectory())
+      .map((e) => e.name);
+    return dirs.length ? `spec:${dirs.length}` : '';
+  } catch {
+    return '';
+  }
+}
+
+async function main() {
+  let cwd = process.cwd();
+  try {
+    const payload = JSON.parse(await readStdin());
+    cwd =
+      (payload && payload.workspace && payload.workspace.current_dir) ||
+      (payload && payload.cwd) ||
+      cwd;
+  } catch {
+    /* use process.cwd() */
+  }
+
+  const parts = [];
+  const branch = gitBranch(cwd);
+  if (branch) parts.push(`⎇ ${branch}`);
+  const spec = activeSpec(cwd);
+  if (spec) parts.push(spec);
+  parts.push(`min:${minimalismMode(cwd)}`);
+
+  process.stdout.write(`dw · ${parts.join(' · ')}`);
+}
+
+main().catch(() => process.stdout.write('dw'));

package/scaffold/skill-registry.json

@@ -10,6 +10,8 @@
       "expected_output": "A selected API testing recipe and evidence path for the active stack.",
       "load_policy": "lazy-references",
       "context_limit": 12000,
+      "invocation": "explicit",
+      "exportable": true,
       "bundled": true
     },
     {
@@ -21,6 +23,8 @@
       "expected_output": "A selected service recipe and composition guidance.",
       "load_policy": "lazy-references",
       "context_limit": 12000,
+      "invocation": "explicit",
+      "exportable": true,
       "bundled": true
     },
     {
@@ -122,6 +126,19 @@
       "context_limit": 12000,
       "bundled": true
     },
+    {
+      "name": "dw-minimalism",
+      "kind": "protocol",
+      "tier": "core",
+      "owner": "dw-run,dw-plan,dw-review",
+      "trigger": "Before writing new code, infrastructure, or abstractions: YAGNI decision ladder and lite/full/ultra intensity",
+      "expected_output": "A minimalism verdict (build/reuse/inline/skip) with the ladder rung that justified it.",
+      "load_policy": "always-small",
+      "context_limit": 8000,
+      "invocation": "model",
+      "exportable": true,
+      "bundled": true
+    },
     {
       "name": "dw-review-rigor",
       "kind": "protocol",
@@ -142,6 +159,7 @@
       "expected_output": "Adopt/wrap/compose/build decision with checked search channels.",
       "load_policy": "always-small",
       "context_limit": 6000,
+      "exportable": true,
       "bundled": true
     },
     {
@@ -164,6 +182,7 @@
       "expected_output": "Simplification target, risk, behavior-preserving checks, and recommendation.",
       "load_policy": "lazy-references",
       "context_limit": 12000,
+      "exportable": true,
       "bundled": true
     },
     {
@@ -208,6 +227,7 @@
       "expected_output": "Fresh verification report with cited command evidence.",
       "load_policy": "always-small",
       "context_limit": 12000,
+      "exportable": true,
       "bundled": true
     },
     {
@@ -219,6 +239,8 @@
       "expected_output": "Rewritten prose with AI-writing tells removed and voice preserved.",
       "load_policy": "lazy-references",
       "context_limit": 6000,
+      "invocation": "explicit",
+      "exportable": true,
       "bundled": true
     },
     {
@@ -230,6 +252,8 @@
       "expected_output": "Selected Remotion rule references and implementation guidance.",
       "load_policy": "lazy-references",
       "context_limit": 8000,
+      "invocation": "explicit",
+      "exportable": true,
       "bundled": true
     },
     {
@@ -241,6 +265,7 @@
       "expected_output": "High-confidence security findings or explicit pass.",
       "load_policy": "lazy-references",
       "context_limit": 14000,
+      "exportable": true,
       "bundled": true
     },
     {
@@ -252,6 +277,8 @@
       "expected_output": "Selected performance rule references and metric-driven recommendations.",
       "load_policy": "lazy-references",
       "context_limit": 12000,
+      "invocation": "explicit",
+      "exportable": true,
       "bundled": true
     }
   ]

package/scaffold/skills/dw-minimalism/SKILL.md

@@ -0,0 +1,98 @@
+---
+name: dw-minimalism
+description: Pre-generation YAGNI gate. Before writing new code, infra, or abstractions, climb the decision ladder (need it? reuse? stdlib? native? installed dep? one line?) at the active lite/full/ultra intensity. Triggers from /dw-run, /dw-plan, /dw-review and any "add X / build Y" intent.
+allowed-tools:
+  - Read
+  - Grep
+  - Glob
+  - Bash
+---
+
+# dw-minimalism — Write the Least Code That Solves the Problem
+
+The cheapest code to maintain is the code you never wrote. This skill runs a
+**pre-generation gate**: before producing a new function, file, dependency, or
+abstraction, justify it against a decision ladder. It is the missing rung
+between `dw-search-first` (which evaluates *external dependencies*) and
+`dw-simplification` (which cleans up code *after* it exists).
+
+## When to Use
+
+Read this skill when:
+
+- `/dw-plan` is about to specify new modules/services — pressure-test scope before tasks are written.
+- `/dw-run` is about to implement — climb the ladder before the first line of new code.
+- `/dw-review` flags over-engineering (speculative generality, premature abstraction, unused options).
+- The user (or a task) says "add X", "build Y", "create a helper/wrapper/abstraction for Z".
+
+Do NOT use to:
+
+- Block code that is genuinely required by an accepted PRD/TechSpec acceptance criterion.
+- Strip safety, validation, accessibility, security, or error handling — minimalism is about *necessity*, never about cutting correctness. Removing a guard is not minimalism.
+- Re-litigate existing code you are not touching (that is `dw-simplification`'s scope discipline).
+
+## The Decision Ladder
+
+Evaluate **in order** and stop at the first rung that resolves the need. Record which rung justified the decision.
+
+1. **Does it need to exist? (YAGNI)** — Is there a current, concrete requirement, or is this for an imagined future? No requirement → don't build it. Defer to a task/ADR instead.
+2. **Already in the codebase?** — Search first (`grep`/`glob`/`.dw/intel/`). Reuse an existing function, type, or pattern over a new one.
+3. **Standard library / language built-in?** — Prefer the platform's own primitives over hand-rolled equivalents.
+4. **Native framework feature?** — The framework/runtime already in use may cover it (routing, validation, caching, etc.).
+5. **An already-installed dependency?** — Use a package the project already depends on before adding a new one. (New dependency → hand off to `dw-search-first` for the adopt/wrap/compose/build decision.)
+6. **Can it be one line / inlined?** — A small inline expression often beats a new helper, indirection layer, or config knob. Don't extract until there are real, repeated call sites.
+7. **Only then: the minimum viable implementation** — the smallest change that satisfies the requirement, no speculative parameters, hooks, or generality.
+
+If you cannot name the rung that justifies the code, you are not ready to write it.
+
+## Intensity Modes
+
+The active mode is read from `.dw/minimalism.json` (`{"mode":"full"}`); default `full` when absent.
+
+| Mode | Behavior |
+|------|----------|
+| `off` | Skill is dormant; no minimalism gate applied. |
+| `lite` | Apply rungs 1–2 only (YAGNI + reuse). Light touch; flags only obvious over-build. |
+| `full` | **Default.** Apply the full ladder; flag speculative generality and premature abstraction. |
+| `ultra` | Aggressive. Prefer inlining over any new helper/file; demand explicit justification for every new module, dependency, parameter, and config option. |
+
+Stricter modes raise the bar for "this needs to exist"; none of them authorize cutting correctness, validation, or security.
+
+## Anti-patterns this gate catches
+
+- A new utility/wrapper with a single caller (rung 6 — inline it).
+- A config flag, strategy interface, or plugin point with exactly one implementation (rung 1 — YAGNI).
+- A hand-rolled debounce/clone/group-by/date-format when stdlib or an installed dep already has it (rungs 3–5).
+- A new dependency for a few lines of logic (rung 5 → `dw-search-first`).
+- "Future-proofing" abstractions for requirements that do not exist yet (rung 1).
+
+## Red Flags (stop and climb the ladder)
+
+"we'll probably need", "to be safe", "make it generic", "for flexibility",
+"in case we want to", a base class / interface with one subclass, an options
+object where every caller passes the same value.
+
+## Composition
+
+- **New external dependency?** → hand off to `dw-search-first` (adopt / wrap / compose / build).
+- **Code already exists and is too complex?** → that is `dw-simplification` (Chesterton's Fence, behavior-preserving).
+- This skill sits *before* both: it decides whether the code should be written at all.
+
+## Structured Return
+
+When invoked directly or by a harness, return or merge this block:
+
+- **Status:** `PASS` when the proposed code is the minimum justified by a ladder rung, `FINDINGS` when over-build is detected and a leaner alternative exists, `BLOCKED` when the requirement is too unclear to judge necessity, `NOT_APPLICABLE` when no new code/dependency/abstraction is being introduced.
+- **Scope:** the proposed code, the requirement it serves, and the active intensity mode.
+- **Evidence:** the ladder rung that justified (or failed) the code, search hits for existing reuse, stdlib/native/installed-dep alternatives checked.
+- **Artifacts:** the leaner alternative, a deferral task/ADR for speculative work, or the minimal implementation sketch.
+- **Decisions:** build / reuse / inline / use-existing-dep / defer / skip — with the rejected heavier option.
+- **Risks:** correctness or safety that must NOT be cut, hidden requirement that could justify more, future cost of the deferral.
+- **Next Step:** write the minimal version, reuse the found code, or hand off to `dw-search-first`/`dw-simplification`.
+
+## Inspired by
+
+Adapted from [`DietrichGebert/ponytail`](https://github.com/DietrichGebert/ponytail)
+(MIT) — the "lazy senior developer" decision ladder and lite/full/ultra intensity
+modes. Rebased on dev-workflow conventions and wired to compose with
+`dw-search-first` and `dw-simplification`.