@brunosps00/dev-workflow 1.4.0 → 1.5.0

package/scaffold/skills/dw-simplification/references/dead-code-tools.md

@@ -0,0 +1,23 @@
+# Dead-code detection tools (find candidates; then apply Chesterton's Fence)
+
+Detection tools surface **candidates** — they do not know about reflection, dynamic imports, framework
+entry points, or external consumers of a public API. Every hit is a SAFE-tier candidate to verify, not an
+automatic deletion. Run the gate (lint + tests + build) after each batch.
+
+## JavaScript / TypeScript
+- `npx knip` — unused files, exports, and dependencies in one pass (the broadest single tool).
+- `npx depcheck` — unused and missing npm dependencies.
+- `npx ts-prune` — unused TypeScript exports.
+- `npx eslint . --report-unused-disable-directives` — stale `eslint-disable` comments.
+
+## Other ecosystems
+- **Python:** `vulture`, `ruff` (`F401` unused imports), `deptry` (unused dependencies).
+- **Go:** `deadcode` (golang.org/x/tools/cmd/deadcode), `staticcheck` (`U1000`).
+- **Rust:** `cargo +nightly udeps` (unused deps), the compiler's own `dead_code` warnings.
+- **C# / .NET:** Roslyn analyzers (`IDE0051` unused private member, `IDE0059` unnecessary assignment).
+
+## Discipline
+1. Run the tool; treat every result as a **SAFE-tier candidate**, not a confirmed removal.
+2. For each candidate, apply Chesterton's Fence (Rule 1) — dynamic/reflective/plugin use won't appear in static analysis.
+3. Remove in batches by category (deps → exports → files); run the gate after each batch; commit per batch.
+4. Anything the tool flags that turns out to be load-bearing → add a comment explaining why, so the next pass doesn't re-flag it.

package/scaffold/skills/dw-testing-discipline/SKILL.md

@@ -38,6 +38,23 @@ Each rule has nuance read `references/core-rules.md` for the long version with e
 - Verifying browser-side trust boundaries (auth, CSRF, headers) → `references/security-boundary.md`.
 - Picking which test workflow applies (UI / network / perf) → `references/three-workflow-patterns.md`.
 
+## Step 0 — detect the runner before writing any test
+
+Do not assume `npm test`. The package manager and the test runner are different things — confirm both:
+
+1. Read `package.json` `scripts.test` (plus `test:watch` / `test:coverage`), or the language equivalent (`pyproject.toml`/`tox.ini`, `Cargo.toml`, `*.csproj`, `go.mod`).
+2. Identify the actual runner: jest / vitest / mocha / `node:test` / `bun:test` / pytest / `go test` / `cargo test` / `dotnet test`.
+3. Invoke it through the project's package manager, not a hardcoded `npm`:
+
+| Manager | test | watch | coverage |
+|---|---|---|---|
+| npm | `npm test` | `npm test -- --watch` | `npm run test:coverage` |
+| pnpm | `pnpm test` | `pnpm test --watch` | `pnpm test:coverage` |
+| yarn | `yarn test` | `yarn test --watch` | `yarn coverage` |
+| bun (native) | `bun test` | `bun test --watch` | `bun test --coverage` |
+
+**Bun gotcha:** `bun test` runs Bun's native runner (`bun:test`); `bun run test` runs whatever `scripts.test` is (often jest/vitest). They are not interchangeable — use the one the project actually configures. When unsure, confirm with `<runner> --help`.
+
 ## Reference router
 
 | Doing what | Read |

package/scaffold/skills/dw-ui-discipline/SKILL.md

@@ -34,7 +34,7 @@ Find the project's design source-of-truth in this order:
 4. Component library config — `components.json` for shadcn, theme exports.
 5. Storybook stories (implicit canonical components).
 
-If **at least one** exists: it wins. Defer to it. If a needed token is missing (e.g., a danger-secondary color), propose adding it to the authority FIRST, not inline.
+**Stop at the first match** in this list — that source is the authority; defer to it and do not override it with a lower rung or a training-data default. If a needed token is missing (e.g., a danger-secondary color), propose adding it to the authority FIRST, not inline.
 
 If **none exists**: read `references/curated-defaults.md` and pick one of the 10 neutral palettes + one of the 10 font pairings shipped there. Mark the choice in the techspec/PR description: "Design source: no project authority found; using curated default `<name>`; recommend establishing `DESIGN.md`."
 

package/scaffold/skills/dw-verify/SKILL.md

@@ -160,7 +160,7 @@ Verification failure is information, not a dead end. Protocol:
 
 Discover the project gate before claiming success. Prefer documented gates in `.dw/rules/`, then package scripts such as `verify`, `check`, `ci`, or `test`, then Makefile/just/pyproject equivalents. If no verification command exists, state that explicitly in the Verification Report and avoid completion language.
 
-Load `references/verification-discovery-and-attribution.md` when you need the full discovery checklist, command integration table, or attribution notes.
+Load `references/verification-discovery-and-attribution.md` for the discovery checklist and attribution notes, or `references/pre-check-and-status.md` for the cheap diff-hygiene grep and the compact polling status line.
 
 ## Structured Return
 

package/scaffold/skills/dw-verify/references/pre-check-and-status.md

@@ -0,0 +1,28 @@
+# Cheap pre-check + compact status
+
+Two lightweight companions to the full verification gate. Neither replaces the Verification Report — they
+run *around* it.
+
+## Diff hygiene (cheap pre-commit grep)
+
+Before running the full pipeline, one fast grep over the staged diff catches the most common "left it in"
+mistakes:
+
+```bash
+git diff --cached | grep -nE 'console\.(log|debug)|debugger|TODO: *remove|sk-[A-Za-z0-9]|api[_-]?key|password *='
+```
+
+Hits are a smell to clear, not a gate by themselves. This is **not** the security gate — `/dw-secure-audit`
+(gitleaks + Trivy + Semgrep) remains the authoritative secret/vuln check before commit/PR. Use this grep as a
+2-second sanity pass, then run the real pipeline.
+
+## Compact status (for real-time polling)
+
+When a runner (e.g. `dw-cli-run`) polls progress *between* full reports, a one-line form is enough:
+
+```
+Build: PASS | Lint: PASS | Tests: 42/42 | Verdict: READY
+```
+
+The compact line never replaces the full report — the final completion claim still requires the Verification
+Report Template with cited command output. Use the compact line for progress, the full template for the claim.