@brunosps00/dev-workflow 1.3.0 → 1.5.0

package/lib/skill-registry.js

@@ -9,6 +9,10 @@ const SKILLS_DIR = path.join(SCAFFOLD_DIR, 'skills');
 
 const VALID_KINDS = new Set(['protocol', 'domain-pack', 'recipe-pack', 'asset-pack']);
 const VALID_LOAD_POLICIES = new Set(['always-small', 'lazy-references', 'opt-in-runtime']);
+// Optional invocation control (mattpocock/skills). Bundled skills live under
+// .agents/skills/ (read by path from command prose), so this is documental for
+// them and feeds the à-la-carte plugin manifest. Default when absent: 'model'.
+const VALID_INVOCATIONS = new Set(['model', 'explicit']);
 const REQUIRED_STRUCTURED_RETURN_FIELDS = [
   '**Status:**',
   '**Scope:**',
@@ -106,6 +110,15 @@ function validateEntry(entry, issues) {
   if (typeof entry.context_limit !== 'number' || entry.context_limit <= 0) {
     issues.push(`Skill registry entry ${entry.name} must set a positive numeric context_limit`);
   }
+
+  // Optional fields (back-compat: absent is valid; defaults applied by consumers).
+  if (entry.invocation !== undefined && !VALID_INVOCATIONS.has(entry.invocation)) {
+    issues.push(`Skill registry entry ${entry.name} has invalid invocation: ${entry.invocation}`);
+  }
+
+  if (entry.exportable !== undefined && typeof entry.exportable !== 'boolean') {
+    issues.push(`Skill registry entry ${entry.name} exportable must be a boolean`);
+  }
 }
 
 function validateSkillStructuredReturn(skillName, skillPath, issues, label = `Skill ${skillName}`) {

package/lib/uninstall.js

@@ -2,6 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const { COMMANDS, PLATFORMS, MCP_SERVERS } = require('./constants');
 const { AGENT_TARGETS, LEGACY_AGENT_TARGETS, readAgentRegistry } = require('./agents');
+const { removeHooks } = require('./hooks');
 
 function run() {
   const projectRoot = process.cwd();
@@ -103,6 +104,23 @@ function run() {
   }
   console.log();
 
+  // 4.5. Remove dev-workflow hooks + statusline from .claude/settings.json
+  // (marker-based; user-defined hooks/statusLine are left intact). The hook
+  // scripts themselves were removed with .dw/scripts/ above.
+  console.log('  Hooks & statusline:');
+  try {
+    const removedHooks = removeHooks(projectRoot);
+    if (removedHooks > 0) {
+      console.log(`  \x1b[31m-\x1b[0m ${removedHooks} dev-workflow hook/statusline entr${removedHooks === 1 ? 'y' : 'ies'} [removed]`);
+      removed += removedHooks;
+    } else {
+      skipped++;
+    }
+  } catch {
+    console.log('    Could not parse .claude/settings.json, skipping hook cleanup');
+  }
+  console.log();
+
   // 5. Remove .opencode/package.json
   removeFile(path.join(projectRoot, '.opencode', 'package.json'));
   removeFile(path.join(projectRoot, '.dw', 'install-state.json'));
@@ -115,9 +133,10 @@ function run() {
   console.log(`  Done! ${removed} removed, ${skipped} already absent`);
   console.log();
   console.log('  Preserved (user data):');
-  console.log('    .dw/rules/    (project rules)');
-  console.log('    .dw/spec/     (PRDs and specs)');
-  console.log('    .dw/intel/    (codebase index from /dw-intel --build)');
+  console.log('    .dw/rules/           (project rules)');
+  console.log('    .dw/spec/            (PRDs and specs)');
+  console.log('    .dw/intel/           (codebase index from /dw-intel --build)');
+  console.log('    .dw/minimalism.json  (dw-minimalism intensity preference)');
   console.log();
 }
 

package/lib/validate.js

@@ -0,0 +1,62 @@
+const fs = require('fs');
+const path = require('path');
+const { validateSkillRegistry } = require('./skill-registry');
+const { validateAgentRegistry, readAgentRegistry } = require('./agents');
+const { buildManifests } = require('./build-plugin');
+
+/**
+ * Repo quality gate (npm run validate). Validates the skill + agent registries
+ * and confirms the committed .claude-plugin/ manifests match what the registry
+ * would generate (no drift). Exits non-zero on any issue.
+ */
+function run() {
+  const issues = [];
+  const warnings = [];
+
+  const skill = validateSkillRegistry();
+  issues.push(...skill.issues);
+  warnings.push(...skill.warnings);
+
+  const agent = validateAgentRegistry(readAgentRegistry());
+  issues.push(...agent.issues);
+  warnings.push(...agent.warnings);
+
+  // Plugin manifest drift check.
+  const { plugin, marketplace } = buildManifests();
+  checkManifestDrift('.claude-plugin/plugin.json', plugin, issues);
+  checkManifestDrift('.claude-plugin/marketplace.json', marketplace, issues);
+
+  console.log('dev-workflow validate\n');
+  if (warnings.length) {
+    console.log('Warnings:');
+    for (const w of warnings) console.log(`- ${w}`);
+    console.log();
+  }
+  if (issues.length) {
+    console.log('Issues:');
+    for (const i of issues) console.log(`- ${i}`);
+    console.log();
+    console.log('FAIL');
+    process.exit(1);
+  }
+  console.log('PASS: skill + agent registries valid; plugin manifests in sync.');
+}
+
+function checkManifestDrift(relPath, expected, issues) {
+  const file = path.join(__dirname, '..', relPath);
+  if (!fs.existsSync(file)) {
+    issues.push(`Missing ${relPath}; run \`npm run build:plugin\`.`);
+    return;
+  }
+  const onDisk = fs.readFileSync(file, 'utf-8');
+  const want = JSON.stringify(expected, null, 2) + '\n';
+  if (onDisk !== want) {
+    issues.push(`${relPath} is out of sync with the registry; run \`npm run build:plugin\`.`);
+  }
+}
+
+module.exports = { run };
+
+if (require.main === module) {
+  run();
+}

package/lib/wrappers.js

@@ -15,7 +15,7 @@ function generateWrappers(projectRoot, commands, force = false) {
         // Directory format: .claude/skills/dw-brainstorm/SKILL.md
         skillFile = path.join(projectRoot, platform.dir, cmd.name, 'SKILL.md');
       }
-      const content = platform.wrapperTemplate(cmd.name, cmd.description);
+      const content = platform.wrapperTemplate(cmd.name, cmd.description, cmd);
       const status = writeFile(skillFile, content, force);
       results[status]++;
       results.files.push(skillFile);

package/package.json

@@ -1,14 +1,19 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"
   },
+  "scripts": {
+    "validate": "node lib/validate.js",
+    "build:plugin": "node lib/build-plugin.js"
+  },
   "files": [
     "bin/",
     "lib/",
     "scaffold/",
+    ".claude-plugin/",
     "README.md",
     "LICENSE"
   ],

package/scaffold/config/stack-mappings.json

@@ -0,0 +1,40 @@
+{
+  "_note": "Maps a detected stack to its curated baseline rule files (in .dw/rules-library/), relevant bundled skills, and safe default permissions. Consumed by /dw-analyze-project (detect + seed constitution) and /dw-review (declarative bar). Load ONLY the active stack's rules — never the whole library. Indicators: a bare filename means 'file exists'; 'file:substring' means the file contains the substring.",
+  "stacks": [
+    {
+      "id": "typescript",
+      "indicators": ["tsconfig.json", "package.json:typescript"],
+      "rules": ["common", "typescript"],
+      "skills": ["dw-testing-discipline", "dw-simplification"],
+      "permissions": { "allow": ["npx tsc", "npx eslint", "npm test", "pnpm test"], "deny": ["npm publish"] }
+    },
+    {
+      "id": "react",
+      "indicators": ["package.json:react"],
+      "rules": ["common", "typescript", "react"],
+      "skills": ["dw-ui-discipline", "vercel-react-best-practices", "dw-testing-discipline"],
+      "permissions": { "allow": ["npm test", "pnpm test", "npx vitest"], "deny": [] }
+    },
+    {
+      "id": "python",
+      "indicators": ["pyproject.toml", "requirements.txt", "setup.py"],
+      "rules": ["common", "python"],
+      "skills": ["dw-testing-discipline", "dw-silent-failure"],
+      "permissions": { "allow": ["pytest", "ruff", "mypy"], "deny": [] }
+    },
+    {
+      "id": "rust",
+      "indicators": ["Cargo.toml"],
+      "rules": ["common", "rust"],
+      "skills": ["dw-testing-discipline"],
+      "permissions": { "allow": ["cargo test", "cargo clippy", "cargo check"], "deny": [] }
+    },
+    {
+      "id": "csharp",
+      "indicators": [".csproj", ".sln"],
+      "rules": ["common", "csharp"],
+      "skills": ["dw-testing-discipline"],
+      "permissions": { "allow": ["dotnet test", "dotnet build"], "deny": [] }
+    }
+  ]
+}

package/scaffold/en/commands/dw-analyze-project.md

@@ -225,6 +225,10 @@ For each module/project detected, identify:
 | **Auth** | NextAuth, Passport, Keycloak, Auth0, etc. | Dependencies + auth-related files |
 | **API Style** | REST, GraphQL, tRPC, gRPC | Route definitions, schema files |
 
+#### Curated baseline (rules-library)
+
+After detecting the stack(s), consult `.dw/config/stack-mappings.json`: each matched stack points to its curated baseline in `.dw/rules-library/` (`common.md` + `<stack>.md`) — the declarative "what good code looks like here" default. **Reference** these files (do NOT copy them into `.dw/rules/`): the analytical rules you write describe what the code IS; the library describes what it SHOULD be. Load only the matched stacks' files to protect the context budget.
+
 #### Frontend Health Baseline
 
 When React is detected, run `npx react-doctor@latest --verbose` and include the health score in the generated rules as a baseline metric.
@@ -740,7 +744,7 @@ Three options:
 
 **Option A — Synthesize:**
 
-1. Read `.dw/rules/index.md` + each `.dw/rules/{module}.md`.
+1. Read `.dw/rules/index.md` + each `.dw/rules/{module}.md`, plus the curated baseline for the detected stack(s) in `.dw/rules-library/` (`common.md` + `<stack>.md`). A baseline principle the project already follows is a well-grounded proposal — cite the rules-library file as its evidence.
 2. Propose 5–8 principles. Each must:
    - Have a unique `P-NNN` ID.
    - Map to an observation in `.dw/rules/` (cite the rule file + section).

package/scaffold/en/commands/dw-context-budget.md

@@ -21,6 +21,15 @@ You are the context budget auditor for dev-workflow.
    - Claude/OpenCode agent files with provider-incompatible tool or permission fields.
 4. Recommend the top 5 savings with concrete paths.
 
+## Part B — Runtime spend (actual token cost)
+
+Static overhead (above) is what the harness *loads*; this part is what sessions actually *cost*. Report from `.dw/metrics/costs.jsonl` (appended by the `session-cost` SessionEnd hook — one row per session with per-model token usage + estimated USD):
+
+1. Read `.dw/metrics/costs.jsonl` if present. If absent, note "no runtime cost data yet (hook disabled or no session has ended)" and skip this part — never fail.
+2. Dedupe by `session_id` (latest row per session wins).
+3. Report: estimated spend today and over the last 7 days; the 3 most expensive sessions; and the per-model split (which model burned the most).
+4. USD is a best-effort estimate from `.dw/scripts/lib/model-prices.json` — token counts are exact, prices may drift. Flag any model that resolved to `_default`/`_unknown` (missing price entry to add).
+
 ## Output
 Write a concise report in chat. If `.dw/reports/` exists, also write `.dw/reports/context-budget.md`.
 

package/scaffold/en/commands/dw-harness-audit.md

@@ -26,6 +26,9 @@ You are the dev-workflow harness auditor.
 4. Cite missing paths, broken references, stale managed files, and skills without a structured return.
 5. Recommend the top 3 fixes.
 
+## Runtime degradation triage (on-demand)
+The scorecard above is deterministic **install** health. If instead the *agent* is misbehaving at runtime (loops, objective drift, hallucinated edits, degraded reasoning), that is a different diagnosis: point the user to `.agents/skills/dw-debug-protocol/references/agent-degradation.md` (symptom→cause table + ordered recovery). Advisory only — it does not affect the scorecard.
+
 ## Output
 Return a scorecard and do not mutate files. Tell the user to run `dev-workflow repair` for managed-file drift.
 

package/scaffold/en/commands/dw-learn.md

@@ -0,0 +1,41 @@
+<system_instructions>
+You are the learning synthesizer for dev-workflow. You turn what this project's work has ALREADY recorded into atomic, confidence-weighted **instincts** the team can reuse — and you NEVER write anything without explicit approval.
+
+## When to Use
+- After a run of related work (a few tasks, a bugfix batch) to capture what was learned.
+- When the user says "learn from this", "what patterns emerged", or "promote what we learned".
+- Periodically, to propose constitution principles grounded in real, repeated practice.
+
+Do NOT invent best practices from nothing — every instinct must be grounded in this project's records.
+
+## Sources (read-only; there is NO always-on observer)
+Gather signals only from what is already persisted:
+1. `.dw/spec/*/MEMORY.md` — durable decisions, especially those tagged `[confidence: …]` (see the `dw-memory` skill).
+2. `.dw/bugfixes/*/SUMMARY.md` — recurring root causes and the guards added.
+3. `.dw/spec/*/deviations.md` — where the plan met reality.
+4. Recent git history — `git log --oneline -50` and commit-message patterns.
+5. Existing `.dw/memory/instincts/*.md` — to UPDATE confidence, not duplicate.
+
+## Process
+1. **Cluster** repeated signals into candidate instincts. A candidate needs **≥2 independent confirmations** (two tasks, a decision + a bugfix, a repeated commit pattern). A one-off is NOT an instinct.
+2. **Score** each candidate's confidence (0.3–0.9) using the `dw-memory` confidence rule; name the evidence.
+3. **Classify** `domain` (code-style / testing / error-handling / git / workflow / security) and `scope` (project by default).
+4. **Present** candidates in chat as a markdown list — id, trigger, action, confidence, evidence. Do NOT write yet.
+5. **Ask**: "Approve which to store? (ids, or 'all', or 'none'). Any to promote to a constitution principle?"
+6. On approval:
+   - Write each approved instinct to `.dw/memory/instincts/<slug>.md` in the format from `.agents/skills/dw-memory/references/instincts.md` (create or update; never duplicate an existing id).
+   - For any the user chooses to promote, hand off to the constitution flow — propose a `P-NNN` principle at `severity: info` for `/dw-analyze-project` Step 8. Do NOT edit `.dw/constitution.md` directly without the user re-confirming.
+7. Update confidence on existing instincts that new evidence reconfirms or contradicts.
+
+## Rules
+- Never write an instinct or a constitution change without explicit approval (mirrors constitution + STATE handling).
+- Ground every instinct in cited evidence; drop candidates you cannot ground in ≥2 confirmations.
+- Keep instincts atomic — one trigger, one action. Split compound learnings.
+- Project scope by default; mark `global` only when the pattern is seen across projects.
+- This command reads and proposes; it NEVER modifies source code.
+
+## Output
+A list of proposed/updated instincts (id, trigger, action, confidence, evidence); then, after approval, the files written under `.dw/memory/instincts/` and any constitution proposals handed off.
+
+Final marker: `## LEARN COMPLETE`
+</system_instructions>

package/scaffold/en/commands/dw-plan.md

@@ -39,6 +39,7 @@ When available under `./.agents/skills/`, use these as planning support:
 - `dw-council` (opt-in via `--council`): multi-advisor stress-test on the major architectural decision during TechSpec stage.
 - `dw-codebase-intel`: consulted for API conventions, architecture patterns, naming when designing the TechSpec.
 - `dw-search-first`: **REQUIRED** before adding a new dependency, integration, MCP server, reusable helper, or framework-level abstraction.
+- `dw-minimalism`: **REQUIRED** before specifying new modules/services — pressure-tests scope with the YAGNI ladder so the TechSpec doesn't over-build; composes with `dw-search-first`.
 - `dw-context-budget`: use when the plan exceeds 12 tasks, touches 30+ files, or requires loading many docs/skills.
 
 ## Agent Dispatch
@@ -69,6 +70,8 @@ The tool is mandatory for planning because it preserves explicit user choices an
 
 If `.dw/intel/` doesn't exist, fall back to `.dw/rules/` and direct grep. Suggest `/dw-intel --build` to populate intel for richer downstream context.
 
+If `.dw/memory/instincts/` has entries, load any with confidence ≥0.7 whose `trigger` matches the feature (lazy, by trigger only) — they encode learned project conventions from `/dw-learn` worth respecting in the spec.
+
 ## Stage 1 — PRD generation
 
 Runs when default mode OR `plan prd`.

package/scaffold/en/commands/dw-review.md

@@ -47,6 +47,7 @@ When available under `./.agents/skills/`, these are invoked as analytical suppor
 - `dw-secure-audit` (**Security Gate**): **ALWAYS for TS/Python/C#/Rust projects** — triggered here and the verdict is enforced. If the project's language is supported and a fresh `.dw/secure-audit/audit-summary.md` is missing OR has REJECTED status, the review verdict is **REJECTED** — no exception. The same gate is also a standalone command (`/dw-secure-audit`) and an explicit phase in `/dw-autopilot`. It now adds Semgrep SAST (diff) + gitleaks secrets on top of OWASP/Trivy/SCA.
 - `security-review`: the OWASP diff-level skill the gate uses (injection, authz, secrets, SSRF, crypto — HIGH CONFIDENCE only).
 - `dw-simplification`: use when the diff touches dense or twisty code — applies Chesterton's Fence, behavior-preserving refactor protocol, complexity metrics.
+- `dw-minimalism`: use when the diff adds code that may be over-built — flags speculative generality, single-caller helpers, premature abstraction, and YAGNI violations (the pre-generation counterpart to `dw-simplification`).
 - `dw-ui-discipline`: use when the diff touches UI — runs the 14 visual-slop patterns + accessibility floor checks. For a deterministic gate, also run `node .dw/scripts/lib/ui-slop-detect.mjs <changed-ui-paths> --fail-on error` (a wrapper over the impeccable detector); treat blocking findings as **REJECTED** and surface warnings in the report.
 - `dw-testing-discipline`: use when the diff touches tests — applies the 25 anti-patterns catalog + 6 agent guardrails (when tests were agent-authored).
 - `dw-llm-eval`: **REQUIRED when the diff touches AI/LLM feature code paths**. Reference dataset + ≥2 oracle rungs + judge calibration (if rung 4 used) + eval run results MUST be in the PR. Missing → REJECTED.
@@ -138,6 +139,7 @@ If MISSING > 0, the verdict suggests revisiting `/dw-plan tasks` to scope or `/d
    - General patterns: no `any` types in TS, no `console.log` in prod, error handling, multi-tenancy.
    - Backend patterns from `.dw/rules/<backend>.md`: Clean Architecture, use-case return types, DTOs, parameterized queries.
    - Frontend patterns from `.dw/rules/<frontend>.md`: Server Components default, forms patterns, design system.
+   - Curated baseline: check the diff against the active stack's `.dw/rules-library/<stack>.md` (+ `common.md`) as the declarative bar. The project's own `.dw/rules/` and `.dw/constitution.md` override it where they differ.
 
 3. **Constitution compliance** (against `.dw/constitution.md`):
    - For each principle, check diff for violations per the principle's Enforcement line.

package/scaffold/en/commands/dw-run.md

@@ -31,10 +31,12 @@ When available under `./.agents/skills/`, these skills are invoked per task:
 
 - `dw-verify`: **ALWAYS** — before each task's commit, produces a Verification Report (test + lint + build all GREEN). Without PASS, no commit. The Iron Law of verification.
 - `dw-memory`: **ALWAYS** — reads workflow memory at task start; updates at task end with the promotion test (lessons that apply to next task get promoted to shared MEMORY.md).
+- Instincts (lazy): at task start, also load any high-confidence instinct (`.dw/memory/instincts/`, confidence ≥0.7) whose `trigger` matches the task — learned project conventions promoted by `/dw-learn`. Match by trigger only; never bulk-load the set.
 - `dw-execute-phase`: provides `plan-checker` (6-dimension goal-backward verification before any code is touched in plan mode) and `executor` (atomic commit + deviation handling) agents.
 - `dw-testing-discipline`: applies the placement doctrine, 6 agent guardrails, and 25 anti-patterns when adding tests during the task.
 - `dw-ui-discipline`: when the task touches UI, the 4 grounding questions must be answered before any visual decision lands.
 - `dw-llm-eval`: when the task touches AI feature code paths, the reference dataset + oracle ladder rules apply.
+- `dw-minimalism`: **before writing new code** — climb the YAGNI decision ladder (need it? reuse? stdlib? native? installed dep? one line?) at the active intensity, then write the minimum. Hands new dependencies to `dw-search-first`.
 - `vercel-react-best-practices`: when the task touches React/Next.js performance.
 
 ## Constitution Gate

package/scaffold/en/commands/dw-update.md

@@ -26,6 +26,8 @@ SNAPSHOT_DIR=".dw/.backup/$(date -u +%Y%m%dT%H%M%SZ)"
 mkdir -p "$SNAPSHOT_DIR"
 cp -r .dw/commands .dw/templates .dw/references .dw/scripts "$SNAPSHOT_DIR/" 2>/dev/null
 [ -d .agents/skills ] && cp -r .agents/skills "$SNAPSHOT_DIR/agents-skills" 2>/dev/null
+# .claude/settings.json is now mutated by update (MCPs + hooks + statusLine)
+[ -f .claude/settings.json ] && mkdir -p "$SNAPSHOT_DIR/claude" && cp .claude/settings.json "$SNAPSHOT_DIR/claude/settings.json" 2>/dev/null
 echo "Snapshot saved to $SNAPSHOT_DIR"
 ```
 
@@ -127,7 +129,7 @@ If invoked with `--rollback`:
 1. List snapshots in `.dw/.backup/`
 2. If none exist: STOP and report "No snapshot available"
 3. If more than one exists: ask the user which to restore (default: most recent)
-4. Confirm with the user: "Restore snapshot `<path>`? This OVERWRITES `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/`, and `.agents/skills/`. Proceed? [y/N]"
+4. Confirm with the user: "Restore snapshot `<path>`? This OVERWRITES `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/`, `.agents/skills/`, and `.claude/settings.json`. Proceed? [y/N]"
 5. Only after `y`: copy back
 
 ```bash
@@ -136,6 +138,7 @@ cp -r "$SNAPSHOT_DIR/templates"  .dw/
 cp -r "$SNAPSHOT_DIR/references" .dw/ 2>/dev/null
 cp -r "$SNAPSHOT_DIR/scripts"    .dw/ 2>/dev/null
 [ -d "$SNAPSHOT_DIR/agents-skills" ] && cp -r "$SNAPSHOT_DIR/agents-skills" .agents/skills 2>/dev/null
+[ -f "$SNAPSHOT_DIR/claude/settings.json" ] && cp "$SNAPSHOT_DIR/claude/settings.json" .claude/settings.json 2>/dev/null
 ```
 
 6. Report: snapshot restored, version likely recovered (read from `.dw/commands/dw-help.md` or metadata if present)

package/scaffold/pt-br/commands/dw-analyze-project.md

@@ -213,6 +213,10 @@ Para cada projeto/módulo detectado, identificar:
 | **Containerização** | Dockerfile, docker-compose.yml |
 | **Monorepo tools** | Turborepo, Nx, Lerna, pnpm workspaces |
 
+#### Baseline curada (rules-library)
+
+Após detectar a(s) stack(s), consulte `.dw/config/stack-mappings.json`: cada stack casada aponta para sua baseline curada em `.dw/rules-library/` (`common.md` + `<stack>.md`) — o default declarativo "como um bom código se parece aqui". **Referencie** esses arquivos (NÃO copie para `.dw/rules/`): as rules analíticas que você escreve descrevem o que o código É; a library descreve o que ele DEVERIA ser. Carregue só os arquivos das stacks casadas para proteger o budget de contexto.
+
 #### Baseline de Saúde do Frontend
 
 Quando React for detectado, execute `npx react-doctor@latest --verbose` e inclua o health score nas rules geradas como métrica baseline.
@@ -680,7 +684,7 @@ Três opções:
 
 **Opção A — Sintetizar:**
 
-1. Ler `.dw/rules/index.md` + cada `.dw/rules/{module}.md`.
+1. Ler `.dw/rules/index.md` + cada `.dw/rules/{module}.md`, mais a baseline curada da(s) stack(s) detectada(s) em `.dw/rules-library/` (`common.md` + `<stack>.md`). Um princípio da baseline que o projeto já segue é uma proposta bem-fundamentada — cite o arquivo da rules-library como evidência.
 2. Propor 5–8 princípios. Cada um deve:
    - Ter ID único `P-NNN`.
    - Mapear para uma observação em `.dw/rules/` (citar o arquivo + seção).

package/scaffold/pt-br/commands/dw-context-budget.md

@@ -21,6 +21,15 @@ Voce e o auditor de orcamento de contexto do dev-workflow.
    - agentes Claude/OpenCode com campos de tools ou permissions incompativeis com o provider.
 4. Recomende as 5 maiores economias com caminhos concretos.
 
+## Parte B — Gasto em runtime (custo real de token)
+
+O overhead estatico (acima) e o que o harness *carrega*; esta parte e o que as sessoes de fato *custam*. Reporte a partir de `.dw/metrics/costs.jsonl` (append pelo hook `session-cost` de SessionEnd — uma linha por sessao com uso de tokens por modelo + USD estimado):
+
+1. Leia `.dw/metrics/costs.jsonl` se existir. Se ausente, registre "sem dados de custo runtime ainda (hook desabilitado ou nenhuma sessao encerrada)" e pule esta parte — nunca falhe.
+2. Deduplique por `session_id` (a linha mais recente por sessao vence).
+3. Reporte: gasto estimado hoje e nos ultimos 7 dias; as 3 sessoes mais caras; e o split por modelo (qual modelo gastou mais).
+4. USD e estimativa best-effort de `.dw/scripts/lib/model-prices.json` — contagem de tokens e exata, precos podem defasar. Sinalize modelos que resolveram para `_default`/`_unknown` (falta entrada de preco).
+
 ## Saida
 Responda com um relatorio conciso. Se `.dw/reports/` existir, escreva tambem `.dw/reports/context-budget.md`.
 

package/scaffold/pt-br/commands/dw-harness-audit.md

@@ -26,6 +26,9 @@ Voce e o auditor do harness dev-workflow.
 4. Cite paths ausentes, referencias quebradas, arquivos gerenciados stale, e skills sem retorno estruturado.
 5. Recomende os 3 principais fixes.
 
+## Triagem de degradacao em runtime (sob demanda)
+O scorecard acima e saude deterministica da **instalacao**. Se o problema for o *agente* se comportando mal em runtime (loops, desvio do objetivo, edicoes alucinadas, raciocinio degradado), o diagnostico e outro: aponte o usuario para `.agents/skills/dw-debug-protocol/references/agent-degradation.md` (tabela sintoma→causa + recovery ordenado). Apenas informativo — nao afeta o scorecard.
+
 ## Saida
 Retorne um scorecard e nao altere arquivos. Para drift de arquivo gerenciado, indique `dev-workflow repair`.
 

package/scaffold/pt-br/commands/dw-learn.md

@@ -0,0 +1,41 @@
+<system_instructions>
+Voce e o sintetizador de aprendizado do dev-workflow. Voce transforma o que o trabalho deste projeto JA registrou em **instincts** atomicos e ponderados por confianca que o time pode reusar — e NUNCA escreve nada sem aprovacao explicita.
+
+## Quando Usar
+- Apos uma leva de trabalho relacionado (algumas tasks, um lote de bugfixes) para capturar o que foi aprendido.
+- Quando o usuario disser "aprenda com isso", "que padroes emergiram" ou "promova o que aprendemos".
+- Periodicamente, para propor principios de constitution fundamentados em pratica real e repetida.
+
+NAO invente boas praticas do nada — todo instinct precisa estar fundamentado nos registros deste projeto.
+
+## Fontes (somente leitura; NAO ha observador sempre-ligado)
+Colete sinais apenas do que ja esta persistido:
+1. `.dw/spec/*/MEMORY.md` — decisoes duraveis, especialmente as marcadas com `[confidence: …]` (veja a skill `dw-memory`).
+2. `.dw/bugfixes/*/SUMMARY.md` — causas-raiz recorrentes e os guards adicionados.
+3. `.dw/spec/*/deviations.md` — onde o plano encontrou a realidade.
+4. Historico git recente — `git log --oneline -50` e padroes de mensagem de commit.
+5. `.dw/memory/instincts/*.md` existentes — para ATUALIZAR confianca, nao duplicar.
+
+## Processo
+1. **Clusterize** sinais repetidos em candidatos a instinct. Um candidato precisa de **≥2 confirmacoes independentes** (duas tasks, uma decisao + um bugfix, um padrao de commit repetido). Um caso unico NAO e instinct.
+2. **Pontue** a confianca de cada candidato (0.3–0.9) pela regra de confianca do `dw-memory`; nomeie a evidencia.
+3. **Classifique** `domain` (code-style / testing / error-handling / git / workflow / security) e `scope` (project por padrao).
+4. **Apresente** os candidatos no chat como lista markdown — id, trigger, action, confidence, evidence. NAO escreva ainda.
+5. **Pergunte**: "Aprovar quais para armazenar? (ids, ou 'todos', ou 'nenhum'). Algum para promover a principio de constitution?"
+6. Na aprovacao:
+   - Grave cada instinct aprovado em `.dw/memory/instincts/<slug>.md` no formato de `.agents/skills/dw-memory/references/instincts.md` (crie ou atualize; nunca duplique um id existente).
+   - Para os que o usuario escolher promover, encaminhe ao fluxo de constitution — proponha um principio `P-NNN` em `severity: info` para o Step 8 do `/dw-analyze-project`. NAO edite `.dw/constitution.md` direto sem o usuario reconfirmar.
+7. Atualize a confianca de instincts existentes que a nova evidencia reconfirme ou contradiga.
+
+## Regras
+- Nunca escreva um instinct ou mudanca de constitution sem aprovacao explicita (espelha o tratamento de constitution + STATE).
+- Fundamente todo instinct em evidencia citada; descarte candidatos que nao consiga fundamentar em ≥2 confirmacoes.
+- Mantenha instincts atomicos — um trigger, uma action. Divida aprendizados compostos.
+- Scope `project` por padrao; marque `global` so quando o padrao aparece entre projetos.
+- Este comando le e propoe; NUNCA modifica codigo-fonte.
+
+## Saida
+Uma lista de instincts propostos/atualizados (id, trigger, action, confidence, evidence); depois, apos aprovacao, os arquivos gravados em `.dw/memory/instincts/` e quaisquer propostas de constitution encaminhadas.
+
+Marcador final: `## LEARN COMPLETE`
+</system_instructions>

package/scaffold/pt-br/commands/dw-plan.md

@@ -39,6 +39,7 @@ Quando disponíveis em `./.agents/skills/`, use como suporte:
 - `dw-council` (opt-in via `--council`): stress-test multi-conselheiro sobre a decisão arquitetural principal no estágio TechSpec.
 - `dw-codebase-intel`: consultado para convenções de API, padrões arquiteturais, naming ao desenhar TechSpec.
 - `dw-search-first`: **OBRIGATÓRIO** antes de adicionar nova dependency, integration, MCP server, helper reutilizavel ou abstracao de framework.
+- `dw-minimalism`: **OBRIGATÓRIO** antes de especificar novos módulos/serviços — pressiona o escopo com o ladder YAGNI pro TechSpec não over-buildar; compõe com `dw-search-first`.
 - `dw-context-budget`: use quando o plano passar de 12 tasks, tocar 30+ arquivos, ou exigir carregar muitos docs/skills.
 
 ## Agent Dispatch
@@ -69,6 +70,8 @@ A ferramenta e obrigatoria no planejamento porque preserva escolhas explicitas d
 
 Se `.dw/intel/` não existir, caia para `.dw/rules/` e grep direto. Sugira `/dw-intel --build` para popular o intel.
 
+Se `.dw/memory/instincts/` tiver entradas, carregue as de confidence ≥0.7 cujo `trigger` case com a feature (lazy, só por trigger) — codificam convenções aprendidas pelo `/dw-learn` que valem respeitar no spec.
+
 ## Estágio 1 — Geração de PRD
 
 Roda em modo padrão OU `plan prd`.

package/scaffold/pt-br/commands/dw-review.md

@@ -47,6 +47,7 @@ Quando disponíveis em `./.agents/skills/`, são invocadas como apoio analítico
 - `dw-secure-audit` (**Security Gate**): **SEMPRE para projetos TS/Python/C#/Rust** — acionado aqui e o verdict é enforced. Se a linguagem é suportada e `.dw/secure-audit/audit-summary.md` fresco está ausente OU REPROVADO, o verdict do review é **REPROVADO** — sem exceção. O mesmo gate também é comando standalone (`/dw-secure-audit`) e fase explícita no `/dw-autopilot`. Agora soma Semgrep SAST (diff) + gitleaks secrets sobre OWASP/Trivy/SCA.
 - `security-review`: a skill OWASP nível-diff que o gate usa (injection, authz, secrets, SSRF, crypto — só HIGH CONFIDENCE).
 - `dw-simplification`: use quando diff toca código denso — aplica Chesterton's Fence, protocolo de refactor preservando comportamento, métricas de complexidade.
+- `dw-minimalism`: use quando o diff adiciona código que pode estar over-built — flagra generalidade especulativa, helpers de um único caller, abstração prematura e violações de YAGNI (a contraparte pré-geração do `dw-simplification`).
 - `dw-ui-discipline`: use quando diff toca UI — roda os 14 visual-slop patterns + accessibility floor. Para um gate determinístico, rode também `node .dw/scripts/lib/ui-slop-detect.mjs <paths-ui-alterados> --fail-on error` (wrapper sobre o detector do impeccable); trate findings bloqueantes como **REJECTED** e reporte os warnings.
 - `dw-testing-discipline`: use quando diff toca testes — aplica catálogo de 25 anti-patterns + 6 agent guardrails (quando testes foram agent-authored).
 - `dw-llm-eval`: **OBRIGATÓRIO quando diff toca código de feature AI/LLM**. Reference dataset + ≥2 oracle rungs + judge calibration (se rung 4 usado) + eval run results DEVEM estar no PR. Faltando → REPROVADO.
@@ -138,6 +139,7 @@ Se FALTANDO > 0, o veredicto sugere revisitar `/dw-plan tasks` pra escopar ou `/
    - Padrões gerais: sem `any` em TS, sem `console.log` em prod, error handling, multi-tenancy.
    - Backend patterns de `.dw/rules/<backend>.md`: Clean Architecture, use-case return types, DTOs, queries parametrizadas.
    - Frontend patterns de `.dw/rules/<frontend>.md`: Server Components default, forms patterns, design system.
+   - Baseline curada: verifique o diff contra a `.dw/rules-library/<stack>.md` (+ `common.md`) da stack ativa como régua declarativa. As `.dw/rules/` do projeto e a `.dw/constitution.md` sobrepõem onde diferirem.
 
 3. **Constitution compliance** (contra `.dw/constitution.md`):
    - Para cada princípio, checar diff por violações conforme linha Enforcement do princípio.

package/scaffold/pt-br/commands/dw-run.md

@@ -31,10 +31,12 @@ Quando disponíveis em `./.agents/skills/`, estas skills são invocadas por task
 
 - `dw-verify`: **SEMPRE** — antes do commit de cada task, produz Verification Report (test + lint + build GREEN). Sem PASS, sem commit. Iron Law de verificação.
 - `dw-memory`: **SEMPRE** — lê workflow memory no início; atualiza no fim com promotion test (lições que valem pra próxima task são promovidas pra MEMORY.md compartilhada).
+- Instincts (lazy): no início da task, carregue também qualquer instinct de alta confiança (`.dw/memory/instincts/`, confidence ≥0.7) cujo `trigger` case com a task — convenções aprendidas promovidas pelo `/dw-learn`. Case por trigger; nunca carregue o conjunto inteiro.
 - `dw-execute-phase`: fornece agentes `plan-checker` (verificação goal-backward em 6 dimensões antes do código ser tocado) e `executor` (commit atômico + deviation handling).
 - `dw-testing-discipline`: aplica placement doctrine, 6 agent guardrails e 25 anti-patterns ao adicionar testes.
 - `dw-ui-discipline`: quando task toca UI, as 4 grounding questions precisam ser respondidas antes de qualquer decisão visual.
 - `dw-llm-eval`: quando task toca código de feature AI, regras de reference dataset + oracle ladder se aplicam.
+- `dw-minimalism`: **antes de escrever código novo** — sobe o decision ladder YAGNI (precisa existir? reusar? stdlib? nativo? dep instalada? uma linha?) na intensidade ativa, depois escreve o mínimo. Passa novas dependências pro `dw-search-first`.
 - `vercel-react-best-practices`: quando task toca performance React/Next.js.
 
 ## Constitution Gate

package/scaffold/pt-br/commands/dw-update.md

@@ -27,6 +27,8 @@ mkdir -p "$SNAPSHOT_DIR"
 cp -r .dw/commands .dw/templates .dw/references .dw/scripts "$SNAPSHOT_DIR/" 2>/dev/null
 # agents/skills (bundled) tambem fazem parte do update
 [ -d .agents/skills ] && cp -r .agents/skills "$SNAPSHOT_DIR/agents-skills" 2>/dev/null
+# .claude/settings.json agora e mutado pelo update (MCPs + hooks + statusLine)
+[ -f .claude/settings.json ] && mkdir -p "$SNAPSHOT_DIR/claude" && cp .claude/settings.json "$SNAPSHOT_DIR/claude/settings.json" 2>/dev/null
 echo "Snapshot salvo em $SNAPSHOT_DIR"
 ```
 
@@ -128,7 +130,7 @@ Se invocado com `--rollback`:
 1. Listar snapshots em `.dw/.backup/`
 2. Se nenhum existir: PARAR e reportar "Nenhum snapshot disponível"
 3. Se mais de um existir: perguntar ao usuário qual restaurar (padrão: mais recente)
-4. Confirmar com o usuário: "Restaurar snapshot `<path>`? Isso SOBRESCREVE `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/` e `.agents/skills/`. Prosseguir? [s/N]"
+4. Confirmar com o usuário: "Restaurar snapshot `<path>`? Isso SOBRESCREVE `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/`, `.agents/skills/` e `.claude/settings.json`. Prosseguir? [s/N]"
 5. Somente após `s`: copiar de volta
 
 ```bash
@@ -137,6 +139,7 @@ cp -r "$SNAPSHOT_DIR/templates"  .dw/
 cp -r "$SNAPSHOT_DIR/references" .dw/ 2>/dev/null
 cp -r "$SNAPSHOT_DIR/scripts"    .dw/ 2>/dev/null
 [ -d "$SNAPSHOT_DIR/agents-skills" ] && cp -r "$SNAPSHOT_DIR/agents-skills" .agents/skills 2>/dev/null
+[ -f "$SNAPSHOT_DIR/claude/settings.json" ] && cp "$SNAPSHOT_DIR/claude/settings.json" .claude/settings.json 2>/dev/null
 ```
 
 6. Reportar: snapshot restaurado, versão provavelmente recuperada (ler de `.dw/commands/dw-help.md` ou metadata se houver)

package/scaffold/rules/README.md

@@ -0,0 +1,22 @@
+# Rules library — curated declarative baseline
+
+Curated "what good code SHOULD look like" per stack, installed to `.dw/rules-library/`. This is the third
+leg of the rules model:
+
+| Source | Type | Answers | Authored by |
+|---|---|---|---|
+| `.dw/rules-library/` | Curated baseline (this) | what good code looks like in `<stack>` | dev-workflow (shipped) |
+| `.dw/rules/` | Analytical | what THIS code **is** (observed patterns) | `/dw-analyze-project` |
+| `.dw/constitution.md` | Declarative, committed | what THIS project **commits to** | `/dw-analyze-project` (Step 8) |
+
+## Precedence
+
+A language file overrides `common` where idioms differ. The project's own `.dw/rules/` and
+`.dw/constitution.md` override the library — they describe THIS project; the library is only the default a
+project starts from.
+
+## Loading (lazy — protect the context budget)
+
+Commands load ONLY the files for the **active stack**, resolved via `.dw/config/stack-mappings.json`
+(`common.md` + `<stack>.md`). Never load the whole library. `/dw-analyze-project` uses it to seed
+constitution proposals; `/dw-review` reads the active stack's baseline as the declarative bar.

package/scaffold/rules/common.md

@@ -0,0 +1,29 @@
+# Baseline rules — common (all languages)
+
+Declarative baseline: what code SHOULD be, regardless of stack. Language files override or specialize these
+where idioms differ. Complements `.dw/rules/` (observed) and `.dw/constitution.md` (committed).
+
+## Code style
+- Prefer immutability: return new values, don't mutate inputs. Mutate only in a measured hot path.
+- Name for intent: `overdueInvoices`, not `data`/`tmp`/`x`. A name that needs a comment is the wrong name.
+- Keep functions small and single-purpose; extract when a block needs its own comment to be understood.
+- No magic values: name constants (except self-evident ones like HTTP codes or `0`/`-1` indexes).
+
+## Error handling
+- Never swallow errors. Handle, propagate, or log with context — never an empty catch (see `dw-silent-failure`).
+- Validate untrusted input once, where it enters the system; fail loudly at boundaries.
+- Timeout on every network/IO call; rollback partial transactional work.
+
+## Testing
+- Test behavior, not implementation. A test that breaks on a rename tested the wrong thing.
+- Cover error and edge paths (empty, null, boundary, failure), not just the happy path.
+- New bug → regression test first, then fix (see `dw-testing-discipline`).
+
+## Security
+- No secrets in code or logs. Read from env/secret store; `.env` is gitignored.
+- Validate input at the boundary; encode output at the boundary.
+- Least privilege for every credential, token, and role.
+
+## Git
+- One intent per commit; Conventional Commits subject (see `dw-git-discipline`).
+- Never force-push shared history; rebase only local branches.

package/scaffold/rules/csharp.md

@@ -0,0 +1,18 @@
+# Baseline rules — C# / .NET (extends common)
+
+## Style
+- Nullable reference types enabled; warnings as errors. `record`/`readonly` for value types.
+- `async`/`await` end-to-end; never `.Result`/`.Wait()` (deadlocks). Thread `CancellationToken` through.
+- `using` declarations for `IDisposable`; dependency injection over `new` for services.
+
+## Errors
+- Catch specific exceptions; never empty catch. Don't use exceptions for normal control flow.
+- Validate arguments at public boundaries (`ArgumentNullException.ThrowIfNull`).
+
+## Testing
+- xUnit/NUnit; test public behavior. Mock owned boundaries, not the system under test itself.
+- Arrange-Act-Assert; one behavior per test.
+
+## Security
+- Parameterized queries / EF Core — never concatenate SQL. Validate/encode at boundaries.
+- Secrets via configuration / user-secrets / Key Vault, never in source.