@brunosps00/dev-workflow 1.4.0 → 1.6.0

package/scaffold/skills/dw-silent-failure/SKILL.md

@@ -19,7 +19,8 @@ Use during `/dw-review`, `/dw-bugfix`, and `/dw-qa --fix` when failures may be h
 - Log-only handling where callers need the failure.
 - Generic rethrows that lose stack or input context.
 - Async work launched without awaiting, tracking, or explicit detachment.
-- Network/database/filesystem calls without timeout or rollback where the project requires it.
+- Network/database/filesystem calls without a **timeout** — the call can hang indefinitely and block everything waiting on it.
+- Transactional work (multi-step writes, DB mutations, chained external calls) without **rollback** on partial failure — leaves silently corrupted or half-written state.
 
 ## Reporting Standard
 
@@ -27,7 +28,8 @@ Only flag a finding when you can name:
 
 - the exact location,
 - the trigger,
-- the hidden bad outcome,
+- the severity (critical / high / medium),
+- the hidden bad outcome and its impact (what the user or system experiences when it fires),
 - the minimal fix.
 
 Inspired by ECC's `silent-failure-hunter`; adapted as both a skill and a dispatchable `dw-silent-failure-hunter` agent.

package/scaffold/skills/dw-simplification/SKILL.md

@@ -99,6 +99,18 @@ If a simplification touches >500 lines, **don't do it manually**. Use:
 
 Manual edits across hundreds of lines are how subtle bugs creep in.
 
+## Refactor risk levels
+
+Before removing or restructuring, categorize by blast radius and act in that order — never all at once:
+
+| Risk | Examples | Discipline |
+|------|----------|-----------|
+| **SAFE** | Unused exports, unused deps, unreachable branches | Batch-remove, run the gate after each batch, commit |
+| **CAREFUL** | Consolidate duplicates, extract/inline, rename symbol | One or two per commit; re-read callers first |
+| **RISKY** | Change a public API, alter a data structure, extract a layer | One per commit; regression tests first; pair review / ADR |
+
+Start with SAFE and graduate only after the gate is green. For finding SAFE candidates on JS/TS (and other ecosystems), see `references/dead-code-tools.md`. This composes with Chesterton's Fence (Rule 1) — a tool calling code "unused" still needs the WHY check before deletion (reflection, dynamic imports, and framework entry points are invisible to static analysis).
+
 ## Verification protocol
 
 Before committing the simplification:
@@ -139,6 +151,7 @@ In the formal Level 3 review (post-Level 2 chain from `dw-review-implementation`
 - `references/complexity-metrics.md` — when each metric (cyclomatic, cognitive, depth, fanout) actually matters; how to measure cheaply.
 - `references/behavior-preserving.md` — characterization tests, refactor with test gate, rollback patterns, codemod tooling per language.
 - `references/deep-modules.md` — high-leverage modules behind small interfaces; deletion test, locality, leverage, seam, adapter diagnostic; anti-patterns (shallow wrapper, god-module). Invoked by `/dw-refactor` and `/dw-brainstorm` refactor-audit mode.
+- `references/dead-code-tools.md` — per-ecosystem tools that surface SAFE-tier dead-code candidates (knip/depcheck/ts-prune for JS/TS; vulture/ruff for Python; deadcode/staticcheck for Go; cargo-udeps for Rust). Candidates still pass Chesterton's Fence before deletion.
 
 ## Inspired by
 

package/scaffold/skills/dw-simplification/references/dead-code-tools.md

@@ -0,0 +1,23 @@
+# Dead-code detection tools (find candidates; then apply Chesterton's Fence)
+
+Detection tools surface **candidates** — they do not know about reflection, dynamic imports, framework
+entry points, or external consumers of a public API. Every hit is a SAFE-tier candidate to verify, not an
+automatic deletion. Run the gate (lint + tests + build) after each batch.
+
+## JavaScript / TypeScript
+- `npx knip` — unused files, exports, and dependencies in one pass (the broadest single tool).
+- `npx depcheck` — unused and missing npm dependencies.
+- `npx ts-prune` — unused TypeScript exports.
+- `npx eslint . --report-unused-disable-directives` — stale `eslint-disable` comments.
+
+## Other ecosystems
+- **Python:** `vulture`, `ruff` (`F401` unused imports), `deptry` (unused dependencies).
+- **Go:** `deadcode` (golang.org/x/tools/cmd/deadcode), `staticcheck` (`U1000`).
+- **Rust:** `cargo +nightly udeps` (unused deps), the compiler's own `dead_code` warnings.
+- **C# / .NET:** Roslyn analyzers (`IDE0051` unused private member, `IDE0059` unnecessary assignment).
+
+## Discipline
+1. Run the tool; treat every result as a **SAFE-tier candidate**, not a confirmed removal.
+2. For each candidate, apply Chesterton's Fence (Rule 1) — dynamic/reflective/plugin use won't appear in static analysis.
+3. Remove in batches by category (deps → exports → files); run the gate after each batch; commit per batch.
+4. Anything the tool flags that turns out to be load-bearing → add a comment explaining why, so the next pass doesn't re-flag it.

package/scaffold/skills/dw-testing-discipline/SKILL.md

@@ -38,6 +38,23 @@ Each rule has nuance read `references/core-rules.md` for the long version with e
 - Verifying browser-side trust boundaries (auth, CSRF, headers) → `references/security-boundary.md`.
 - Picking which test workflow applies (UI / network / perf) → `references/three-workflow-patterns.md`.
 
+## Step 0 — detect the runner before writing any test
+
+Do not assume `npm test`. The package manager and the test runner are different things — confirm both:
+
+1. Read `package.json` `scripts.test` (plus `test:watch` / `test:coverage`), or the language equivalent (`pyproject.toml`/`tox.ini`, `Cargo.toml`, `*.csproj`, `go.mod`).
+2. Identify the actual runner: jest / vitest / mocha / `node:test` / `bun:test` / pytest / `go test` / `cargo test` / `dotnet test`.
+3. Invoke it through the project's package manager, not a hardcoded `npm`:
+
+| Manager | test | watch | coverage |
+|---|---|---|---|
+| npm | `npm test` | `npm test -- --watch` | `npm run test:coverage` |
+| pnpm | `pnpm test` | `pnpm test --watch` | `pnpm test:coverage` |
+| yarn | `yarn test` | `yarn test --watch` | `yarn coverage` |
+| bun (native) | `bun test` | `bun test --watch` | `bun test --coverage` |
+
+**Bun gotcha:** `bun test` runs Bun's native runner (`bun:test`); `bun run test` runs whatever `scripts.test` is (often jest/vitest). They are not interchangeable — use the one the project actually configures. When unsure, confirm with `<runner> --help`.
+
 ## Reference router
 
 | Doing what | Read |

package/scaffold/skills/dw-ui-discipline/SKILL.md

@@ -34,7 +34,7 @@ Find the project's design source-of-truth in this order:
 4. Component library config — `components.json` for shadcn, theme exports.
 5. Storybook stories (implicit canonical components).
 
-If **at least one** exists: it wins. Defer to it. If a needed token is missing (e.g., a danger-secondary color), propose adding it to the authority FIRST, not inline.
+**Stop at the first match** in this list — that source is the authority; defer to it and do not override it with a lower rung or a training-data default. If a needed token is missing (e.g., a danger-secondary color), propose adding it to the authority FIRST, not inline.
 
 If **none exists**: read `references/curated-defaults.md` and pick one of the 10 neutral palettes + one of the 10 font pairings shipped there. Mark the choice in the techspec/PR description: "Design source: no project authority found; using curated default `<name>`; recommend establishing `DESIGN.md`."
 

package/scaffold/skills/dw-verify/SKILL.md

@@ -160,7 +160,7 @@ Verification failure is information, not a dead end. Protocol:
 
 Discover the project gate before claiming success. Prefer documented gates in `.dw/rules/`, then package scripts such as `verify`, `check`, `ci`, or `test`, then Makefile/just/pyproject equivalents. If no verification command exists, state that explicitly in the Verification Report and avoid completion language.
 
-Load `references/verification-discovery-and-attribution.md` when you need the full discovery checklist, command integration table, or attribution notes.
+Load `references/verification-discovery-and-attribution.md` for the discovery checklist and attribution notes, or `references/pre-check-and-status.md` for the cheap diff-hygiene grep and the compact polling status line.
 
 ## Structured Return
 

package/scaffold/skills/dw-verify/references/pre-check-and-status.md

@@ -0,0 +1,28 @@
+# Cheap pre-check + compact status
+
+Two lightweight companions to the full verification gate. Neither replaces the Verification Report — they
+run *around* it.
+
+## Diff hygiene (cheap pre-commit grep)
+
+Before running the full pipeline, one fast grep over the staged diff catches the most common "left it in"
+mistakes:
+
+```bash
+git diff --cached | grep -nE 'console\.(log|debug)|debugger|TODO: *remove|sk-[A-Za-z0-9]|api[_-]?key|password *='
+```
+
+Hits are a smell to clear, not a gate by themselves. This is **not** the security gate — `/dw-secure-audit`
+(gitleaks + Trivy + Semgrep) remains the authoritative secret/vuln check before commit/PR. Use this grep as a
+2-second sanity pass, then run the real pipeline.
+
+## Compact status (for real-time polling)
+
+When a runner (e.g. `dw-cli-run`) polls progress *between* full reports, a one-line form is enough:
+
+```
+Build: PASS | Lint: PASS | Tests: 42/42 | Verdict: READY
+```
+
+The compact line never replaces the full report — the final completion claim still requires the Verification
+Report Template with cited command output. Use the compact line for progress, the full template for the claim.