@brunosps00/dev-workflow 1.7.0 → 2.0.0

package/.claude-plugin/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "dev-workflow",
   "description": "Standalone, à-la-carte skills from the dev-workflow pipeline: minimalism, search-first, simplification, verification, security review, and more.",
-  "version": "1.7.0",
+  "version": "2.0.0",
   "author": {
     "name": "Bruno Santos"
   },
-  "homepage": "https://github.com/brunosantos/dev-workflow",
+  "homepage": "https://github.com/brunosps/dev-workflow",
   "license": "MIT",
   "keywords": [
     "ai",

package/CHANGELOG.md

@@ -0,0 +1,201 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+> Entries for 2.0.0 are written from the change set itself. Entries before it were
+> reconstructed from commit history in August 2026 — this file did not exist while
+> those versions were released, so they are summaries of what shipped, not
+> contemporaneous release notes. `git log` remains the authoritative record.
+
+## [2.0.0] — 2026-08-02
+
+First release after a full security audit of the compose recipes. Two options were
+removed rather than shipped with vulnerabilities the project could not close.
+
+Versions 1.8.0, 1.9.0 and 1.10.0 exist as commits but were never published to npm;
+their contents are folded in here. The last published version was 1.7.1.
+
+### Removed
+
+- **`Postgres + pgvector` is no longer offered by `/dw-new-project`**, and
+  `services/postgres-pgvector.yml` is deleted. After repinning to the newest
+  available base the image still carried 18 CRITICAL, none of them actionable: 15
+  were Go `stdlib` inside a vendored binary (only a maintainer rebuild clears
+  those) and the rest have no upstream fix at all (`perl` 5.40, `libxml2`
+  `CVE-2026-6653`). Shipping a recipe whose CVEs the project cannot close was not
+  a defensible default for an optional capability. **Existing projects are
+  unaffected** — `/dw-dockerize` keeps whatever image the project already uses and
+  tells the user it needs its own review, rather than substituting one.
+- **MailHog is no longer offered as a dev email-capture option**, and
+  `services/mailhog.yml` is deleted. It reported 109 CRITICAL / 1250 HIGH with
+  1359 of those carrying a published fix — the profile of an image not rebuilt
+  since its upstream went quiet in 2020. Mailpit, already the documented default,
+  scans 0 CRITICAL / 0 HIGH for the same job.
+
+### Security
+
+- **Every credential in every compose recipe now uses `${VAR:?message}`** instead
+  of `${VAR:-default}`, so Compose refuses to start rather than falling back to a
+  value published in this repository. Applied to `postgres`, `mysql`,
+  `elasticsearch`, `meilisearch`, `minio`, `rabbitmq`, and `typesense`.
+- **Every authenticated service publishes on `127.0.0.1` only.** Docker's
+  `"HOST:CONTAINER"` short form binds every host interface, which turns a local
+  dev credential into a network-reachable one.
+- **`typesense` was pinned to `0.27.1`, a tag that does not exist** — the recipe
+  could never have worked (`MANIFEST_UNKNOWN`). Repinned to `30.2`. It also passed
+  its API key as a `command:` flag with a working default, which the first version
+  of the credential test missed because it only read `environment:` keys.
+- **`minio` moved off `minio/minio:latest`** to `RELEASE.2025-09-07T16-13-09Z`.
+  This does not reduce CVEs — MinIO stopped publishing to Docker Hub after that
+  release, so `latest` resolves to the same image — but it makes a scan result
+  describe what the next user runs rather than what was pulled that day.
+- **No recipe uses an image digest or a floating tag.** A digest freezes the base
+  image and accrues CVEs with no upgrade path; the previously pinned pgvector
+  digest went from 1 to 22 CRITICAL in three weeks without the image changing at
+  all, because only the vulnerability database moved.
+
+### Changed
+
+- **CLI dispatch is standardized on spawning a CLI with an explicit model and
+  effort**, for both Claude and Codex. Codex has no subagent primitive, so spawn
+  was already the only option there; standardizing removes the asymmetry. Every
+  dispatch now declares **WRITE** or **READ-ONLY** — the hard worktree rule binds
+  to WRITE only, since a read-only dispatch cannot edit, which is the entire
+  reason the rule exists.
+- **In-session subagents inherit the session model.** Every generated Claude
+  subagent previously carried `model: sonnet`, silently overriding an Opus or
+  Fable session for planning and review work with no way to see it from the
+  harness. Sizing now belongs to the dispatch, not to the agent definition.
+- **Requirement IDs are language-neutral in the shared skills.** `dw-execute-phase`
+  is shared by English and Portuguese projects but hard-coded the Portuguese token
+  `RF-XX`, so its `plan-checker` searched `tasks.md` for a string English projects
+  never generate (`FR-1.1`). Requirement-coverage verification could not match.
+- `tasks.md` gained a `Commit` column, giving `/dw-run` step 6 ("mark Done with
+  the commit SHA") somewhere to write. It previously had no destination.
+- `/dw-generate-pr` records the PR URL back into the PRD. Nothing on the `.dw/`
+  side previously recorded which PR delivered the work.
+
+### Added
+
+- `.dw/config/routing.json` — maps a task's Conventional-Commit type to a tier,
+  and a tier to a concrete model and effort per brand. Seeded once and never
+  reconciled on update, because model availability differs per account.
+- `references/dispatch-tuning.md` in `dw-cli-run`, which declared
+  `load_policy: lazy-references` but shipped none. The dual-evaluation protocol,
+  escalation ladder, and cold-start tuning moved there.
+- Per-dispatch MCP kill switches: `--strict-mcp-config` (Claude),
+  `-c mcp_servers='{}'` (Codex). A spawned CLI boots every configured MCP server
+  and shares no prompt cache, which can outweigh a small task.
+- `test/compose-recipe-safety.test.js` and `test/dispatch-routing.test.js`.
+
+### Fixed
+
+- `.claude-plugin/plugin.json` was stuck at `1.7.0` while `package.json` said
+  `1.7.1`, leaving `npm run validate` failing on `main`.
+- Managed-file manifest deduplication and pgvector dev defaults — both committed
+  on 2026-07-15 but never merged or published until now.
+
+### Notes
+
+The regression guards added here deliberately cover **classes**, not files. The
+July 2026 audit raised default credentials against one recipe; that fix was scoped
+to the file in the diff, and the August audit found the same defect in six
+siblings. `compose-recipe-safety.test.js` now fails on any credential default, any
+non-loopback published port on an authenticated service, any digest pin, and any
+floating tag — across every recipe.
+
+A full image sweep covered all 16 referenced images, up from 2. Results and the
+residual advisories live in `.dw/secure-audit/` (local, gitignored).
+
+## [1.7.1] — 2026-07-24
+
+### Fixed
+- `/dw-open-design` command, wrappers, and scripts are synced into the project by
+  `install-deps`.
+
+## [1.7.0] — 2026-07-15
+
+### Added
+- `/dw-open-design` command, with a refactor screenshot mode and a requirement
+  that briefs be refined before runs.
+- Docs-first NestJS bootstrap in `/dw-new-project` (Next.js + NestJS, pnpm
+  workspaces + Turborepo, pg-boss, Mailpit, dev topology).
+
+### Fixed
+- Managed instruction blocks stay idempotent across updates.
+
+## [1.6.0] — 2026-07-15
+
+Release commit exists; the change set is not cleanly separable from 1.7.0 in the
+history (a source restore commit sits between them). See `git log 28ccc36..af6b157`.
+
+## [1.5.0] — 2026-07-02
+
+### Added
+- ECC-inspired upgrades: additional skills, runtime cost tracking, a curated rules
+  library, and the instincts memory layer.
+
+## [1.4.0] — 2026-06-29
+
+### Added
+- Skills ecosystem comparison documentation and the README adoptions that followed.
+
+## [1.3.0] — 2026-06-23
+
+### Added
+- À-la-carte plugin distribution plus a repo `validate` gate.
+- `git-guardrails` and statusline enforcement hooks.
+- Per-skill invocation control via `disable-model-invocation`.
+- `dw-minimalism` (YAGNI decision ladder) and `dw-cli-run` (Claude/Codex/Copilot
+  runner protocol) skills.
+
+## [1.2.1] — 2026-05-27
+
+### Fixed
+- Context-budget wrapper name collision.
+
+## [1.2.0] — 2026-05-27
+
+### Added
+- Structured return contracts across skills.
+- `/dw-opportunities` and `/dw-refactor` workflows.
+
+## [1.1.0] – [1.1.4] — 2026-05-25
+
+### Added
+- WSL-resilient browser layer, Security Gate, and the `impeccable` absorption.
+- Portable `/dw-goal` autopilot flow and the subagent handoff workflow.
+- Post-update action guidance.
+
+### Fixed
+- Playwright browser selection prefers a real browser with CDP fallback; the
+  reverse CDP relay ships prebuilt and runs at user level.
+
+## [1.0.0] – [1.0.6] — 2026-05-13
+
+Surface consolidation release: 15 obsolete commands deleted and the remainder
+merged into a 20-command surface (later 38 with the tiers added).
+
+### Changed
+- `create-prd` + `create-techspec` + `create-tasks` → `/dw-plan`
+- `run-task` + `run-plan` → `/dw-run`
+- `review-implementation` + `code-review` → `/dw-review`
+- `run-qa` + `fix-qa` → `/dw-qa`
+- `security-check` + `deps-audit` → `/dw-secure-audit`
+- `map-codebase` folded into `/dw-intel --build`
+
+### Added
+- Removed-commands manifest with old-to-new mapping for migration.
+- Tiered `/dw-help` output with an `--advanced` flag.
+- Opt-in AWS and Azure skill installers with their respective MCP servers.
+
+## [0.1.0] – [0.15.0] — 2026-04-06 to 2026-05-13
+
+Pre-1.0 development. The CLI, the scaffold layout, the command set, and the
+multi-platform wrapper generation took shape across 35 releases in five weeks.
+See `git log 6cd61cb..d6953f4`.
+
+[2.0.0]: https://github.com/brunosps/dev-workflow/releases/tag/v2.0.0

package/README.md

@@ -42,7 +42,7 @@ Exportable skills (no `.dw/` pipeline required): `dw-minimalism`, `dw-search-fir
 
 ## Commands
 
-dev-workflow v1.7.0 ships **38 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
+dev-workflow v2.0.0 ships **38 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
 
 ### Tier 1 — Gateway (3)
 
@@ -81,7 +81,7 @@ Use these when you want step-by-step control instead of `/dw-autopilot`.
 | **`/dw-harness-audit`** | Deterministic health scorecard for the dev-workflow install, agents, wrappers, MCPs, and gates. |
 | **`/dw-skill-health`** | Audits installed skills and agents for bloat, duplication, and missing references. |
 | **`/dw-learn`** | Synthesizes durable decisions (confidence-tagged), bugfixes, deviations, and git history into atomic confidence-weighted **instincts** you approve at `.dw/memory/instincts/`; can propose constitution principles. On-demand and human-in-the-loop — **no always-on observer**. |
-| **`/dw-new-project`** | Bootstrap a new project from empty directory. Stack interview, wraps official `create-*` tools, composes docker-compose for dev, seeds `.env`, scripts, CI, `.dw/rules/`. |
+| **`/dw-new-project`** | Bootstrap a new project from an empty or docs-first directory while preserving existing documentation and prototypes. Stack interview includes Next.js + NestJS, Postgres, pg-boss, Mailpit, dev topology, and wraps official `create-*` tools before composing dev infrastructure, `.env`, scripts, CI, and `.dw/rules/`. |
 | **`/dw-dockerize`** | Reads existing project, detects stack + runtime deps, proposes Dockerfile + docker-compose for dev/prod with explicit trade-offs (Conservative/Balanced/Bold). |
 | **`/dw-install-azure-skills`** | **Opt-in.** Clones curated Azure skills from [`MicrosoftDocs/Agent-Skills`](https://github.com/MicrosoftDocs/Agent-Skills) (CC-BY-4.0) into `.agents/skills/azure/` and registers the [Microsoft Learn MCP Server](https://learn.microsoft.com/en-us/training/support/mcp-get-started) (HTTP, no-auth). Interactive category selection (Compute / Data & Storage / AI & ML / Networking / Identity & Security / DevOps / Observability / Integration / Architecture / All). Re-run to refresh from upstream. Also available as CLI: `npx @brunosps00/dev-workflow install-azure-skills`. |
 | **`/dw-install-aws-skills`** | **Opt-in.** Clones curated AWS skills from [`aws/agent-toolkit-for-aws`](https://github.com/aws/agent-toolkit-for-aws) (Apache 2.0) into `.agents/skills/aws/` and registers the unified [AWS MCP Server](https://docs.aws.amazon.com/aws-mcp/) (stdio via `uvx mcp-proxy-for-aws@latest`). **Requires `uv`, `aws cli ≥ 2.32.0`, and AWS credentials.** Interactive category selection (Core / Analytics / Database / EC2 / Migration / Networking / Operations / Security / Serverless / Storage / All). The agent gains `aws___call_aws` (executes 15,000+ AWS APIs) and `aws___run_script` (Python sandboxed) — review `.dw/references/aws-mcp-instructions.md` for the destructive-operations protocol. Also available as CLI: `npx @brunosps00/dev-workflow install-aws-skills [--region=<aws-region>]`. |

package/lib/agents.js

@@ -176,7 +176,12 @@ function renderClaudeAgent(agent, source) {
     `name: ${agent.name}`,
     `description: "${yamlString(agent.description)}"`,
     `tools: ${tools.join(', ')}`,
-    `model: ${source.metadata.model || 'sonnet'}`,
+    // `inherit` is Claude Code's documented default: the subagent runs on the
+    // session's model. Sizing happens at dispatch (the CLI runners pass an
+    // explicit --model/--effort per .dw/config/routing.json), so pinning a tier
+    // here would silently override the owner's session choice. A scaffold source
+    // agent may still opt out by declaring its own `model:`.
+    `model: ${source.metadata.model || 'inherit'}`,
     `permissionMode: ${agent.tool_policy === 'read-only' ? 'plan' : 'default'}`,
     `maxTurns: ${agent.max_turns}`,
     '---',

package/lib/init.js

@@ -194,6 +194,20 @@ async function run({ force = false, lang = null, mode = 'init', profile = null,
     touchedFiles.push(stackMapDest);
   }
 
+  // 3.95. Seed .dw/config/routing.json (dispatch tier/model/effort per brand for
+  // the CLI runners). Seeded once and NEVER reconciled: model availability differs
+  // per account, so the owner's edits must survive updates.
+  const routingSrc = path.join(SCAFFOLD_DIR, 'config', 'routing.json');
+  if (require('fs').existsSync(routingSrc)) {
+    const cfgDir = path.join(projectRoot, '.dw', 'config');
+    ensureDir(cfgDir);
+    const routingDest = path.join(cfgDir, 'routing.json');
+    const rtStatus = writeFile(routingDest, require('fs').readFileSync(routingSrc, 'utf-8'), false);
+    if (rtStatus === 'created') totalCreated++;
+    else totalSkipped++;
+    touchedFiles.push(routingDest);
+  }
+
   // 4. Create .dw/rules/ with README
   if (!isUpdate) {
     console.log('  Rules:');

package/lib/install-deps.js

@@ -90,6 +90,7 @@ function run() {
       check: openDesign.check,
       install: openDesign.install,
       instructions: openDesign.instructions(),
+      sync: openDesign.syncProjectAssets,
     },
   ];
 
@@ -122,6 +123,7 @@ function run() {
     try {
       if (typeof dep.check === 'function' && dep.check()) {
         console.log(' \x1b[32m✓ already installed\x1b[0m');
+        runDepSync(dep);
         installed++;
         continue;
       }
@@ -131,6 +133,7 @@ function run() {
         execSync(dep.install, { stdio: 'pipe', timeout: 300000 });
       }
       console.log(' \x1b[32m✓\x1b[0m');
+      runDepSync(dep);
       installed++;
     } catch (err) {
       console.log(' \x1b[31m✗\x1b[0m');
@@ -202,3 +205,15 @@ function printBrowserGuidance() {
 }
 
 module.exports = { run };
+
+function runDepSync(dep) {
+  if (typeof dep.sync !== 'function') return;
+  try {
+    const result = dep.sync();
+    if (result && result.synced === false && result.reason) {
+      console.log(`    (project assets not synced: ${result.reason})`);
+    }
+  } catch (err) {
+    console.log(`    (project asset sync failed: ${err.message})`);
+  }
+}

package/lib/install-open-design.js

@@ -2,6 +2,12 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { execFileSync } = require('child_process');
+const { COMMANDS } = require('./constants');
+const { copyDir, writeFile, log } = require('./utils');
+const { generateWrappers } = require('./wrappers');
+const { readInstallState } = require('./install-state');
+
+const SCAFFOLD_DIR = path.join(__dirname, '..', 'scaffold');
 
 const OPEN_DESIGN_REPO = 'https://github.com/nexu-io/open-design';
 const OPEN_DESIGN_REF = '1cb7eae';
@@ -35,6 +41,38 @@ function install() {
   }
 }
 
+/**
+ * Sync the dw-open-design command, scripts and harness wrappers into the
+ * current project. install-deps provisions the od CLI, but the skill lives in
+ * the project scaffold — without this, users only get the command after a
+ * manual `dev-workflow update` (the exact gap reported in the field).
+ */
+function syncProjectAssets(projectRoot = process.cwd()) {
+  const state = readInstallState(projectRoot);
+  if (!state) {
+    return { synced: false, reason: 'no dev-workflow install found in this project (run init/update first)' };
+  }
+  const lang = state.lang && COMMANDS[state.lang] ? state.lang : 'en';
+  const cmd = COMMANDS[lang].find((entry) => entry.name === 'dw-open-design')
+    || COMMANDS.en.find((entry) => entry.name === 'dw-open-design');
+  if (!cmd) {
+    return { synced: false, reason: 'dw-open-design missing from command registry' };
+  }
+
+  const commandSrc = path.join(SCAFFOLD_DIR, lang, 'commands', 'dw-open-design.md');
+  const commandDest = path.join(projectRoot, '.dw', 'commands', 'dw-open-design.md');
+  const status = writeFile(commandDest, fs.readFileSync(commandSrc, 'utf-8'), true);
+  log(status, commandDest);
+
+  const scriptsSrc = path.join(SCAFFOLD_DIR, 'scripts', 'open-design');
+  if (fs.existsSync(scriptsSrc)) {
+    copyDir(scriptsSrc, path.join(projectRoot, '.dw', 'scripts', 'open-design'), true);
+  }
+
+  generateWrappers(projectRoot, [cmd], true);
+  return { synced: true };
+}
+
 function instructions() {
   return [
     'Open Design CLI is provisioned by dev-workflow into a managed checkout:',
@@ -80,6 +118,7 @@ function isAtLeast(actual, minimum) {
 }
 
 module.exports = {
+  syncProjectAssets,
   OPEN_DESIGN_REF,
   OPEN_DESIGN_VENDOR_DIR,
   check,

package/lib/install-state.js

@@ -42,10 +42,14 @@ function writeInstallState(projectRoot, state) {
 }
 
 function listManagedFiles(projectRoot, relativeFiles) {
-  return relativeFiles
-    .filter(Boolean)
-    .map((filePath) => path.relative(projectRoot, filePath))
-    .sort();
+  return [
+    ...new Set(
+      relativeFiles
+        .filter(Boolean)
+        .map((filePath) => path.relative(projectRoot, filePath))
+        .sort()
+    ),
+  ];
 }
 
 module.exports = {

package/lib/utils.js

@@ -90,6 +90,20 @@ function writeJson(filePath, value) {
   fs.writeFileSync(filePath, JSON.stringify(value, null, 2) + '\n', 'utf-8');
 }
 
+function findStandaloneMarkers(content, marker) {
+  // Marker names also appear in explanatory prose, so only a full marker line delimits a block.
+  const escapedMarker = marker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const pattern = new RegExp(`^[\\t ]*${escapedMarker}[\\t ]*\\r?$`, 'gm');
+  const markers = [];
+  let match;
+
+  while ((match = pattern.exec(content)) !== null) {
+    const start = match.index + match[0].indexOf(marker);
+    markers.push({ start, end: start + marker.length });
+  }
+  return markers;
+}
+
 /**
  * Upsert a delimited block inside an existing file.
  *
@@ -105,8 +119,19 @@ function upsertDelimitedBlock(filePath, blockContent, startMarker, endMarker) {
 
   // The block content already includes its own start/end markers (so the scaffold
   // file can be read verbatim). Validate that.
-  if (!blockContent.includes(startMarker) || !blockContent.includes(endMarker)) {
-    throw new Error(`Block content for ${filePath} is missing its markers`);
+  const blockStarts = findStandaloneMarkers(blockContent, startMarker);
+  const blockEnds = findStandaloneMarkers(blockContent, endMarker);
+  if (blockStarts.length === 0 || blockEnds.length === 0) {
+    throw new Error(`Block content for ${filePath} is missing standalone markers`);
+  }
+  if (blockStarts.length > 1 || blockEnds.length > 1) {
+    throw new Error(`Block content for ${filePath} has duplicate standalone markers`);
+  }
+
+  const blockStart = blockStarts[0];
+  const blockEnd = blockEnds[0];
+  if (blockEnd.start < blockStart.end) {
+    throw new Error(`Block content for ${filePath} is missing standalone markers`);
   }
 
   if (!exists) {
@@ -115,17 +140,32 @@ function upsertDelimitedBlock(filePath, blockContent, startMarker, endMarker) {
   }
 
   const current = fs.readFileSync(filePath, 'utf-8');
-  const hasMarkers = current.includes(startMarker) && current.includes(endMarker);
+  const currentStarts = findStandaloneMarkers(current, startMarker);
+  const currentEnds = findStandaloneMarkers(current, endMarker);
 
-  if (!hasMarkers) {
+  if (currentStarts.length === 0 && currentEnds.length === 0) {
     const separator = current.endsWith('\n') ? '\n' : '\n\n';
     const next = current + separator + (blockContent.endsWith('\n') ? blockContent : blockContent + '\n');
     fs.writeFileSync(filePath, next, 'utf-8');
     return 'updated';
   }
 
-  const before = current.slice(0, current.indexOf(startMarker));
-  const after = current.slice(current.indexOf(endMarker) + endMarker.length);
+  if (currentStarts.length > 1 || currentEnds.length > 1) {
+    throw new Error(`Existing file ${filePath} has duplicate standalone markers`);
+  }
+
+  if (currentStarts.length !== 1 || currentEnds.length !== 1) {
+    throw new Error(`Existing file ${filePath} has unbalanced standalone markers`);
+  }
+
+  const currentStart = currentStarts[0];
+  const currentEnd = currentEnds[0];
+  if (currentEnd.start < currentStart.end) {
+    throw new Error(`Existing file ${filePath} has unbalanced standalone markers`);
+  }
+
+  const before = current.slice(0, currentStart.start);
+  const after = current.slice(currentEnd.end);
   const next = before + blockContent.trim() + after;
   if (next === current) return 'unchanged';
   fs.writeFileSync(filePath, next, 'utf-8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "1.7.0",
+  "version": "2.0.0",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"
@@ -17,6 +17,7 @@
     "scaffold/",
     ".claude-plugin/",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "keywords": [
@@ -42,7 +43,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/brunosantos/dev-workflow"
+    "url": "https://github.com/brunosps/dev-workflow"
   },
   "author": "Bruno Santos"
 }

package/scaffold/agents/core/dw-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-build-fixer
 description: Fix build, typecheck, and lint failures with minimal diffs and no architectural rewrites.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/core/dw-code-explorer.md

@@ -2,7 +2,6 @@
 name: dw-code-explorer
 description: Trace entry points, execution paths, dependencies, and local conventions before planning or fixing code.
 tools: Read, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/core/dw-code-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-code-reviewer
 description: Review changed code for correctness, maintainability, tests, and concrete failure modes.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/core/dw-planner.md

@@ -2,7 +2,6 @@
 name: dw-planner
 description: Convert requirements into implementation slices, dependency order, risks, and verification criteria.
 tools: Read, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/core/dw-test-author.md

@@ -2,7 +2,6 @@
 name: dw-test-author
 description: Add focused tests and regression coverage using project conventions and dw-testing-discipline.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/csharp/dw-csharp-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-csharp-reviewer
 description: Review C#/.NET code for API, async, dependency injection, and data-access risks.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/csharp/dw-dotnet-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-dotnet-build-fixer
 description: Fix .NET build, test, restore, and analyzer failures with minimal changes.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/frontend/dw-qa-runner.md

@@ -2,7 +2,6 @@
 name: dw-qa-runner
 description: Create and run UI/API QA scripts, evidence, and retest logs under QA folders.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/python/dw-python-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-python-build-fixer
 description: Fix Python test, import, typing, and packaging failures with minimal changes.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/python/dw-python-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-python-reviewer
 description: Review Python changes for correctness, typing, async behavior, and framework risks.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/rust/dw-rust-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-rust-build-fixer
 description: Fix Rust cargo check/test/clippy failures with minimal changes.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/rust/dw-rust-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-rust-reviewer
 description: Review Rust changes for ownership, error handling, concurrency, unsafe, and API design risks.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/security/dw-security-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-security-reviewer
 description: Review auth, authorization, secrets, input handling, uploads, SQL, SSRF, XSS, and supply-chain risk.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/security/dw-silent-failure-hunter.md

@@ -2,7 +2,6 @@
 name: dw-silent-failure-hunter
 description: Find swallowed errors, dangerous fallbacks, lost stack traces, and missing error propagation.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/typescript/dw-typescript-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-typescript-build-fixer
 description: Fix TypeScript and JavaScript build/type errors with minimal changes.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/typescript/dw-typescript-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-typescript-reviewer
 description: Review TypeScript and JavaScript changes for type safety, async correctness, and web or Node risks.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---