@brunosps00/dev-workflow 1.7.1 → 2.0.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "dev-workflow",
   "description": "Standalone, à-la-carte skills from the dev-workflow pipeline: minimalism, search-first, simplification, verification, security review, and more.",
-  "version": "1.7.0",
+  "version": "2.0.0",
   "author": {
     "name": "Bruno Santos"
   },

package/CHANGELOG.md

@@ -0,0 +1,201 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+> Entries for 2.0.0 are written from the change set itself. Entries before it were
+> reconstructed from commit history in August 2026 — this file did not exist while
+> those versions were released, so they are summaries of what shipped, not
+> contemporaneous release notes. `git log` remains the authoritative record.
+
+## [2.0.0] — 2026-08-02
+
+First release after a full security audit of the compose recipes. Two options were
+removed rather than shipped with vulnerabilities the project could not close.
+
+Versions 1.8.0, 1.9.0 and 1.10.0 exist as commits but were never published to npm;
+their contents are folded in here. The last published version was 1.7.1.
+
+### Removed
+
+- **`Postgres + pgvector` is no longer offered by `/dw-new-project`**, and
+  `services/postgres-pgvector.yml` is deleted. After repinning to the newest
+  available base the image still carried 18 CRITICAL, none of them actionable: 15
+  were Go `stdlib` inside a vendored binary (only a maintainer rebuild clears
+  those) and the rest have no upstream fix at all (`perl` 5.40, `libxml2`
+  `CVE-2026-6653`). Shipping a recipe whose CVEs the project cannot close was not
+  a defensible default for an optional capability. **Existing projects are
+  unaffected** — `/dw-dockerize` keeps whatever image the project already uses and
+  tells the user it needs its own review, rather than substituting one.
+- **MailHog is no longer offered as a dev email-capture option**, and
+  `services/mailhog.yml` is deleted. It reported 109 CRITICAL / 1250 HIGH with
+  1359 of those carrying a published fix — the profile of an image not rebuilt
+  since its upstream went quiet in 2020. Mailpit, already the documented default,
+  scans 0 CRITICAL / 0 HIGH for the same job.
+
+### Security
+
+- **Every credential in every compose recipe now uses `${VAR:?message}`** instead
+  of `${VAR:-default}`, so Compose refuses to start rather than falling back to a
+  value published in this repository. Applied to `postgres`, `mysql`,
+  `elasticsearch`, `meilisearch`, `minio`, `rabbitmq`, and `typesense`.
+- **Every authenticated service publishes on `127.0.0.1` only.** Docker's
+  `"HOST:CONTAINER"` short form binds every host interface, which turns a local
+  dev credential into a network-reachable one.
+- **`typesense` was pinned to `0.27.1`, a tag that does not exist** — the recipe
+  could never have worked (`MANIFEST_UNKNOWN`). Repinned to `30.2`. It also passed
+  its API key as a `command:` flag with a working default, which the first version
+  of the credential test missed because it only read `environment:` keys.
+- **`minio` moved off `minio/minio:latest`** to `RELEASE.2025-09-07T16-13-09Z`.
+  This does not reduce CVEs — MinIO stopped publishing to Docker Hub after that
+  release, so `latest` resolves to the same image — but it makes a scan result
+  describe what the next user runs rather than what was pulled that day.
+- **No recipe uses an image digest or a floating tag.** A digest freezes the base
+  image and accrues CVEs with no upgrade path; the previously pinned pgvector
+  digest went from 1 to 22 CRITICAL in three weeks without the image changing at
+  all, because only the vulnerability database moved.
+
+### Changed
+
+- **CLI dispatch is standardized on spawning a CLI with an explicit model and
+  effort**, for both Claude and Codex. Codex has no subagent primitive, so spawn
+  was already the only option there; standardizing removes the asymmetry. Every
+  dispatch now declares **WRITE** or **READ-ONLY** — the hard worktree rule binds
+  to WRITE only, since a read-only dispatch cannot edit, which is the entire
+  reason the rule exists.
+- **In-session subagents inherit the session model.** Every generated Claude
+  subagent previously carried `model: sonnet`, silently overriding an Opus or
+  Fable session for planning and review work with no way to see it from the
+  harness. Sizing now belongs to the dispatch, not to the agent definition.
+- **Requirement IDs are language-neutral in the shared skills.** `dw-execute-phase`
+  is shared by English and Portuguese projects but hard-coded the Portuguese token
+  `RF-XX`, so its `plan-checker` searched `tasks.md` for a string English projects
+  never generate (`FR-1.1`). Requirement-coverage verification could not match.
+- `tasks.md` gained a `Commit` column, giving `/dw-run` step 6 ("mark Done with
+  the commit SHA") somewhere to write. It previously had no destination.
+- `/dw-generate-pr` records the PR URL back into the PRD. Nothing on the `.dw/`
+  side previously recorded which PR delivered the work.
+
+### Added
+
+- `.dw/config/routing.json` — maps a task's Conventional-Commit type to a tier,
+  and a tier to a concrete model and effort per brand. Seeded once and never
+  reconciled on update, because model availability differs per account.
+- `references/dispatch-tuning.md` in `dw-cli-run`, which declared
+  `load_policy: lazy-references` but shipped none. The dual-evaluation protocol,
+  escalation ladder, and cold-start tuning moved there.
+- Per-dispatch MCP kill switches: `--strict-mcp-config` (Claude),
+  `-c mcp_servers='{}'` (Codex). A spawned CLI boots every configured MCP server
+  and shares no prompt cache, which can outweigh a small task.
+- `test/compose-recipe-safety.test.js` and `test/dispatch-routing.test.js`.
+
+### Fixed
+
+- `.claude-plugin/plugin.json` was stuck at `1.7.0` while `package.json` said
+  `1.7.1`, leaving `npm run validate` failing on `main`.
+- Managed-file manifest deduplication and pgvector dev defaults — both committed
+  on 2026-07-15 but never merged or published until now.
+
+### Notes
+
+The regression guards added here deliberately cover **classes**, not files. The
+July 2026 audit raised default credentials against one recipe; that fix was scoped
+to the file in the diff, and the August audit found the same defect in six
+siblings. `compose-recipe-safety.test.js` now fails on any credential default, any
+non-loopback published port on an authenticated service, any digest pin, and any
+floating tag — across every recipe.
+
+A full image sweep covered all 16 referenced images, up from 2. Results and the
+residual advisories live in `.dw/secure-audit/` (local, gitignored).
+
+## [1.7.1] — 2026-07-24
+
+### Fixed
+- `/dw-open-design` command, wrappers, and scripts are synced into the project by
+  `install-deps`.
+
+## [1.7.0] — 2026-07-15
+
+### Added
+- `/dw-open-design` command, with a refactor screenshot mode and a requirement
+  that briefs be refined before runs.
+- Docs-first NestJS bootstrap in `/dw-new-project` (Next.js + NestJS, pnpm
+  workspaces + Turborepo, pg-boss, Mailpit, dev topology).
+
+### Fixed
+- Managed instruction blocks stay idempotent across updates.
+
+## [1.6.0] — 2026-07-15
+
+Release commit exists; the change set is not cleanly separable from 1.7.0 in the
+history (a source restore commit sits between them). See `git log 28ccc36..af6b157`.
+
+## [1.5.0] — 2026-07-02
+
+### Added
+- ECC-inspired upgrades: additional skills, runtime cost tracking, a curated rules
+  library, and the instincts memory layer.
+
+## [1.4.0] — 2026-06-29
+
+### Added
+- Skills ecosystem comparison documentation and the README adoptions that followed.
+
+## [1.3.0] — 2026-06-23
+
+### Added
+- À-la-carte plugin distribution plus a repo `validate` gate.
+- `git-guardrails` and statusline enforcement hooks.
+- Per-skill invocation control via `disable-model-invocation`.
+- `dw-minimalism` (YAGNI decision ladder) and `dw-cli-run` (Claude/Codex/Copilot
+  runner protocol) skills.
+
+## [1.2.1] — 2026-05-27
+
+### Fixed
+- Context-budget wrapper name collision.
+
+## [1.2.0] — 2026-05-27
+
+### Added
+- Structured return contracts across skills.
+- `/dw-opportunities` and `/dw-refactor` workflows.
+
+## [1.1.0] – [1.1.4] — 2026-05-25
+
+### Added
+- WSL-resilient browser layer, Security Gate, and the `impeccable` absorption.
+- Portable `/dw-goal` autopilot flow and the subagent handoff workflow.
+- Post-update action guidance.
+
+### Fixed
+- Playwright browser selection prefers a real browser with CDP fallback; the
+  reverse CDP relay ships prebuilt and runs at user level.
+
+## [1.0.0] – [1.0.6] — 2026-05-13
+
+Surface consolidation release: 15 obsolete commands deleted and the remainder
+merged into a 20-command surface (later 38 with the tiers added).
+
+### Changed
+- `create-prd` + `create-techspec` + `create-tasks` → `/dw-plan`
+- `run-task` + `run-plan` → `/dw-run`
+- `review-implementation` + `code-review` → `/dw-review`
+- `run-qa` + `fix-qa` → `/dw-qa`
+- `security-check` + `deps-audit` → `/dw-secure-audit`
+- `map-codebase` folded into `/dw-intel --build`
+
+### Added
+- Removed-commands manifest with old-to-new mapping for migration.
+- Tiered `/dw-help` output with an `--advanced` flag.
+- Opt-in AWS and Azure skill installers with their respective MCP servers.
+
+## [0.1.0] – [0.15.0] — 2026-04-06 to 2026-05-13
+
+Pre-1.0 development. The CLI, the scaffold layout, the command set, and the
+multi-platform wrapper generation took shape across 35 releases in five weeks.
+See `git log 6cd61cb..d6953f4`.
+
+[2.0.0]: https://github.com/brunosps/dev-workflow/releases/tag/v2.0.0

package/README.md

@@ -42,7 +42,7 @@ Exportable skills (no `.dw/` pipeline required): `dw-minimalism`, `dw-search-fir
 
 ## Commands
 
-dev-workflow v1.7.0 ships **38 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
+dev-workflow v2.0.0 ships **38 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
 
 ### Tier 1 — Gateway (3)
 
@@ -81,7 +81,7 @@ Use these when you want step-by-step control instead of `/dw-autopilot`.
 | **`/dw-harness-audit`** | Deterministic health scorecard for the dev-workflow install, agents, wrappers, MCPs, and gates. |
 | **`/dw-skill-health`** | Audits installed skills and agents for bloat, duplication, and missing references. |
 | **`/dw-learn`** | Synthesizes durable decisions (confidence-tagged), bugfixes, deviations, and git history into atomic confidence-weighted **instincts** you approve at `.dw/memory/instincts/`; can propose constitution principles. On-demand and human-in-the-loop — **no always-on observer**. |
-| **`/dw-new-project`** | Bootstrap a new project from an empty or docs-first directory while preserving existing documentation and prototypes. Stack interview includes Next.js + NestJS, Postgres + pgvector, pg-boss, Mailpit, dev topology, and wraps official `create-*` tools before composing dev infrastructure, `.env`, scripts, CI, and `.dw/rules/`. |
+| **`/dw-new-project`** | Bootstrap a new project from an empty or docs-first directory while preserving existing documentation and prototypes. Stack interview includes Next.js + NestJS, Postgres, pg-boss, Mailpit, dev topology, and wraps official `create-*` tools before composing dev infrastructure, `.env`, scripts, CI, and `.dw/rules/`. |
 | **`/dw-dockerize`** | Reads existing project, detects stack + runtime deps, proposes Dockerfile + docker-compose for dev/prod with explicit trade-offs (Conservative/Balanced/Bold). |
 | **`/dw-install-azure-skills`** | **Opt-in.** Clones curated Azure skills from [`MicrosoftDocs/Agent-Skills`](https://github.com/MicrosoftDocs/Agent-Skills) (CC-BY-4.0) into `.agents/skills/azure/` and registers the [Microsoft Learn MCP Server](https://learn.microsoft.com/en-us/training/support/mcp-get-started) (HTTP, no-auth). Interactive category selection (Compute / Data & Storage / AI & ML / Networking / Identity & Security / DevOps / Observability / Integration / Architecture / All). Re-run to refresh from upstream. Also available as CLI: `npx @brunosps00/dev-workflow install-azure-skills`. |
 | **`/dw-install-aws-skills`** | **Opt-in.** Clones curated AWS skills from [`aws/agent-toolkit-for-aws`](https://github.com/aws/agent-toolkit-for-aws) (Apache 2.0) into `.agents/skills/aws/` and registers the unified [AWS MCP Server](https://docs.aws.amazon.com/aws-mcp/) (stdio via `uvx mcp-proxy-for-aws@latest`). **Requires `uv`, `aws cli ≥ 2.32.0`, and AWS credentials.** Interactive category selection (Core / Analytics / Database / EC2 / Migration / Networking / Operations / Security / Serverless / Storage / All). The agent gains `aws___call_aws` (executes 15,000+ AWS APIs) and `aws___run_script` (Python sandboxed) — review `.dw/references/aws-mcp-instructions.md` for the destructive-operations protocol. Also available as CLI: `npx @brunosps00/dev-workflow install-aws-skills [--region=<aws-region>]`. |

package/lib/agents.js

@@ -176,7 +176,12 @@ function renderClaudeAgent(agent, source) {
     `name: ${agent.name}`,
     `description: "${yamlString(agent.description)}"`,
     `tools: ${tools.join(', ')}`,
-    `model: ${source.metadata.model || 'sonnet'}`,
+    // `inherit` is Claude Code's documented default: the subagent runs on the
+    // session's model. Sizing happens at dispatch (the CLI runners pass an
+    // explicit --model/--effort per .dw/config/routing.json), so pinning a tier
+    // here would silently override the owner's session choice. A scaffold source
+    // agent may still opt out by declaring its own `model:`.
+    `model: ${source.metadata.model || 'inherit'}`,
     `permissionMode: ${agent.tool_policy === 'read-only' ? 'plan' : 'default'}`,
     `maxTurns: ${agent.max_turns}`,
     '---',

package/lib/init.js

@@ -194,6 +194,20 @@ async function run({ force = false, lang = null, mode = 'init', profile = null,
     touchedFiles.push(stackMapDest);
   }
 
+  // 3.95. Seed .dw/config/routing.json (dispatch tier/model/effort per brand for
+  // the CLI runners). Seeded once and NEVER reconciled: model availability differs
+  // per account, so the owner's edits must survive updates.
+  const routingSrc = path.join(SCAFFOLD_DIR, 'config', 'routing.json');
+  if (require('fs').existsSync(routingSrc)) {
+    const cfgDir = path.join(projectRoot, '.dw', 'config');
+    ensureDir(cfgDir);
+    const routingDest = path.join(cfgDir, 'routing.json');
+    const rtStatus = writeFile(routingDest, require('fs').readFileSync(routingSrc, 'utf-8'), false);
+    if (rtStatus === 'created') totalCreated++;
+    else totalSkipped++;
+    touchedFiles.push(routingDest);
+  }
+
   // 4. Create .dw/rules/ with README
   if (!isUpdate) {
     console.log('  Rules:');

package/lib/install-state.js

@@ -42,10 +42,14 @@ function writeInstallState(projectRoot, state) {
 }
 
 function listManagedFiles(projectRoot, relativeFiles) {
-  return relativeFiles
-    .filter(Boolean)
-    .map((filePath) => path.relative(projectRoot, filePath))
-    .sort();
+  return [
+    ...new Set(
+      relativeFiles
+        .filter(Boolean)
+        .map((filePath) => path.relative(projectRoot, filePath))
+        .sort()
+    ),
+  ];
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "1.7.1",
+  "version": "2.0.0",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"
@@ -17,6 +17,7 @@
     "scaffold/",
     ".claude-plugin/",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "keywords": [

package/scaffold/agents/core/dw-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-build-fixer
 description: Fix build, typecheck, and lint failures with minimal diffs and no architectural rewrites.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/core/dw-code-explorer.md

@@ -2,7 +2,6 @@
 name: dw-code-explorer
 description: Trace entry points, execution paths, dependencies, and local conventions before planning or fixing code.
 tools: Read, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/core/dw-code-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-code-reviewer
 description: Review changed code for correctness, maintainability, tests, and concrete failure modes.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/core/dw-planner.md

@@ -2,7 +2,6 @@
 name: dw-planner
 description: Convert requirements into implementation slices, dependency order, risks, and verification criteria.
 tools: Read, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/core/dw-test-author.md

@@ -2,7 +2,6 @@
 name: dw-test-author
 description: Add focused tests and regression coverage using project conventions and dw-testing-discipline.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/csharp/dw-csharp-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-csharp-reviewer
 description: Review C#/.NET code for API, async, dependency injection, and data-access risks.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/csharp/dw-dotnet-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-dotnet-build-fixer
 description: Fix .NET build, test, restore, and analyzer failures with minimal changes.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/frontend/dw-qa-runner.md

@@ -2,7 +2,6 @@
 name: dw-qa-runner
 description: Create and run UI/API QA scripts, evidence, and retest logs under QA folders.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/python/dw-python-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-python-build-fixer
 description: Fix Python test, import, typing, and packaging failures with minimal changes.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/python/dw-python-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-python-reviewer
 description: Review Python changes for correctness, typing, async behavior, and framework risks.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/rust/dw-rust-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-rust-build-fixer
 description: Fix Rust cargo check/test/clippy failures with minimal changes.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/rust/dw-rust-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-rust-reviewer
 description: Review Rust changes for ownership, error handling, concurrency, unsafe, and API design risks.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/security/dw-security-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-security-reviewer
 description: Review auth, authorization, secrets, input handling, uploads, SQL, SSRF, XSS, and supply-chain risk.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/security/dw-silent-failure-hunter.md

@@ -2,7 +2,6 @@
 name: dw-silent-failure-hunter
 description: Find swallowed errors, dangerous fallbacks, lost stack traces, and missing error propagation.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/typescript/dw-typescript-build-fixer.md

@@ -2,7 +2,6 @@
 name: dw-typescript-build-fixer
 description: Fix TypeScript and JavaScript build/type errors with minimal changes.
 tools: Read, Write, Edit, Bash, Grep, Glob
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/agents/typescript/dw-typescript-reviewer.md

@@ -2,7 +2,6 @@
 name: dw-typescript-reviewer
 description: Review TypeScript and JavaScript changes for type safety, async correctness, and web or Node risks.
 tools: Read, Grep, Glob, Bash
-model: sonnet
 mode: subagent
 ---
 

package/scaffold/config/routing.json

@@ -0,0 +1,60 @@
+{
+  "_note": "Dispatch routing for the CLI runners (/dw-claude-run, /dw-codex-run) via the dw-cli-run skill. Maps a task's Conventional-Commit type to a tier, and a tier to a concrete model + effort per brand. Seeded once on init and NEVER overwritten on update — model availability differs per account, so this file is yours to edit. Verify the model ids against `claude --help` / `codex --help` before trusting them; the shipped values are conservative defaults, not a guarantee that your account has access.",
+  "schema_version": "1.0",
+
+  "brands": {
+    "claude": { "detect": "claude --version" },
+    "codex": { "detect": "codex --version" }
+  },
+
+  "tiers": {
+    "light": {
+      "_use": "mechanical, low-ambiguity work; the answer is obvious and the diff is small",
+      "claude": { "model": "haiku", "effort": "low" },
+      "codex": { "model": "gpt-5.4-mini", "effort": "low" }
+    },
+    "standard": {
+      "_use": "normal feature and fix work",
+      "claude": { "model": "sonnet", "effort": "medium" },
+      "codex": { "model": "gpt-5.3-codex", "effort": "medium" }
+    },
+    "heavy": {
+      "_use": "architectural, security-sensitive, or wide-blast-radius work",
+      "claude": { "model": "opus", "effort": "high" },
+      "codex": { "model": "gpt-5.5", "effort": "high" }
+    }
+  },
+
+  "by_commit_type": {
+    "_note": "The task's type is already declared in tasks.md and in the atomic commit subject — no new inference needed.",
+    "chore": "light",
+    "docs": "light",
+    "style": "light",
+    "ci": "light",
+    "test": "standard",
+    "fix": "standard",
+    "feat": "standard",
+    "build": "standard",
+    "refactor": "standard",
+    "perf": "heavy"
+  },
+
+  "escalate_on_surface": {
+    "_note": "If the task's fence touches any of these, override the type-derived tier upward. Match against file paths and the task title.",
+    "tier": "heavy",
+    "patterns": ["auth", "session", "token", "credential", "migration", "payment", "billing", "invoice", "tenant", "crypto", "permission"]
+  },
+
+  "validation": {
+    "_note": "The worker never signs off on its own exam. Cross-brand is the default because a second vendor fails differently.",
+    "cross_brand": "preferred",
+    "degrade": "When only one brand is installed, validate in a SEPARATE dispatch at a different tier — never reuse the executing session.",
+    "acceptance_score": 9
+  },
+
+  "defaults": {
+    "_note": "Applied to every dispatch unless the prompt names a capability that needs otherwise.",
+    "no_mcp": true,
+    "read_only_skips_worktree": true
+  }
+}

package/scaffold/en/commands/dw-claude-run.md

@@ -13,7 +13,11 @@ session**, score the delivery 0–10, escalate on failure, and **STOP for the ga
 |---|---|
 | `DISPATCH` | `UUID=$(cat /proc/sys/kernel/random/uuid); cd <WORKTREE> && claude -p --session-id "$UUID" --model <MODEL> --effort <EFFORT> --output-format stream-json --include-partial-messages --verbose --dangerously-skip-permissions "$(cat <PROMPT>)" </dev/null > <AUDIT>/<slug>.log 2>&1` |
 | `STREAM` | `--output-format stream-json --include-partial-messages --verbose` (`--verbose` is **required** with `stream-json` in `-p` mode) |
-| `AUTO` | `--dangerously-skip-permissions` (headless auto-approve; justified because the worktree is isolated). Read-only/analysis: drop it and pass `--permission-mode plan` (or restrict `--allowedTools`). |
+| `MODEL` | `--model <MODEL>` — `opus` · `sonnet` · `haiku` · `fable`, or a full id (`claude-opus-5`) |
+| `EFFORT` | `--effort <EFFORT>` — `low` · `medium` · `high` · `xhigh` · `max` |
+| `AUTO` | `--dangerously-skip-permissions` (headless auto-approve for a **WRITE** dispatch; justified because the worktree is isolated) |
+| `AUTO_READONLY` | `--permission-mode plan` (optionally `--allowedTools <list>`). Never combine with `AUTO`. |
+| `NO_MCP` | `--strict-mcp-config` with no `--mcp-config` → boots zero MCP servers |
 | `RESUME <id>` | `cd <WORKTREE> && claude --resume "$UUID" -p --effort <EFFORT> --output-format stream-json --include-partial-messages --verbose --dangerously-skip-permissions "$(cat <FOLLOWUP_PROMPT>)" </dev/null >> <AUDIT>/<slug>.log 2>&1` |
 | `RESUME_LAST` | `claude -c -p …` (continue the most recent conversation in this cwd) |
 | `SESSION_ID` | **FIXED by you** — you pass `--session-id "$UUID"` on the first run, so the id is known up front. Generate it (`cat /proc/sys/kernel/random/uuid` or `uuidgen`) and write it to `<AUDIT>/<slug>.session` BEFORE/at dispatch. No stream-scraping needed — Claude is the easy case. |

package/scaffold/en/commands/dw-codex-run.md

@@ -13,7 +13,11 @@ the delivery 0–10, escalate on failure, and **STOP for the gate**.
 |---|---|
 | `DISPATCH` | `cd <WORKTREE> && codex exec --skip-git-repo-check -m <MODEL> --config model_reasoning_effort="<EFFORT>" --dangerously-bypass-approvals-and-sandbox --json -o <AUDIT>/<slug>.last.md "$(cat <PROMPT>)" </dev/null > <AUDIT>/<slug>.log 2>&1` |
 | `STREAM` | `--json` (JSONL events) |
-| `AUTO` | `--dangerously-bypass-approvals-and-sandbox` (no sandbox + no approvals = full access **with network** so the CLI can run the gate; justified because the worktree is isolated). Edits without a network gate: `--sandbox workspace-write --full-auto`. Read-only/analysis: `--sandbox read-only` (drop `--full-auto`). |
+| `MODEL` | `-m <MODEL>` — `gpt-5.5` · `gpt-5.3-codex` · `gpt-5.4` · `gpt-5.3-codex-spark` · `gpt-5.4-mini` |
+| `EFFORT` | `--config model_reasoning_effort="<EFFORT>"` — `low` · `medium` · `high` · `xhigh` |
+| `AUTO` | `--dangerously-bypass-approvals-and-sandbox` (no sandbox + no approvals = full access **with network** so the CLI can run the gate; **WRITE** dispatch only, justified because the worktree is isolated). Edits without a network gate: `--sandbox workspace-write --full-auto`. |
+| `AUTO_READONLY` | `--sandbox read-only` (drop `--full-auto`). Never combine with `AUTO`. |
+| `NO_MCP` | `-c mcp_servers='{}'` → boots zero MCP servers, keeps auth and the rest of `config.toml`. Blunter alternative: `--ignore-user-config` (also drops model defaults — then `MODEL` + `EFFORT` are mandatory). |
 | `RESUME <id>` | `cd <WORKTREE> && codex exec resume <THREAD_ID> --skip-git-repo-check --dangerously-bypass-approvals-and-sandbox --json "$(cat <FOLLOWUP_PROMPT>)" </dev/null >> <AUDIT>/<slug>.log 2>&1` |
 | `RESUME_LAST` | `codex exec resume --last …` (filters by cwd = the worktree) |
 | `SESSION_ID` | Codex has **no flag to fix** the id → **capture** the thread id from the first run's stream: `grep -oE '"thread_id":"[^"]*"' <AUDIT>/<slug>.log \| head -1` (from the `thread.started` event) → write to `<AUDIT>/<slug>.session`. |

package/scaffold/en/commands/dw-dockerize.md

@@ -129,10 +129,12 @@ Each option lists final-image-size estimate, attack-surface notes, debug-ability
 
 Present the services detected in Phase 0.3 as a checklist. The user can:
 - **Accept** — include all detected services in `docker-compose.dev.yml`
-- **Add** — include additional services they want for dev (e.g., MailHog if SMTP is used in app code, Jaeger if OTel is used)
+- **Add** — include additional services they want for dev (e.g., Mailpit if SMTP is used in app code, Jaeger if OTel is used)
 - **Remove** — drop a detected service (e.g., they have managed Postgres in dev too)
 
-Always offer MailHog if any email-sending library is detected and no email service is already in dev.
+Always offer Mailpit if any email-sending library is detected and no email service is already in dev.
+
+If pgvector is detected in the project, there is no bundled recipe to reach for — it was removed because the image carried CVEs with no upstream fix. Keep whatever image the project already uses, and tell the user plainly that it needs its own review: a rebuilt image, or a managed Postgres with the `vector` extension enabled. Do not substitute an image on the user's behalf.
 
 #### 1.4 File tree preview
 
@@ -163,8 +165,11 @@ Without approval: write report (Phase 3 with `status: PLANNED`) and stop.
 **`docker-compose.dev.yml`**:
 - Compose service blocks from `.agents/skills/docker-compose-recipes/services/*.yml` per `references/compose-composition.md`.
 - Add app service(s) at the end: `build: { context: ., dockerfile: Dockerfile.dev }`, `volumes` for hot reload (bind mount source, anonymous volume for `node_modules`/`__pycache__`), `env_file: .env`, `depends_on` with `condition: service_healthy` per `references/healthcheck-patterns.md`.
+- Preserve each recipe's image tag (do NOT convert any of them to a digest — a digest freezes the base and never picks up a security rebuild), the required credential vars, and the `127.0.0.1` binds. The loopback ports intentionally keep the `apps on host` topology working.
 - Header comment: `# Generated by /dw-dockerize on YYYY-MM-DD`.
 
+**`.env.example`**: emit every credential var with no working value (the recipes use `${VAR:?}`, so Compose refuses to start without one). After copying to `.env`, require the user to set unique generated local values before running Compose. Application URLs use `localhost` when apps run on the host and service DNS when they run in Compose.
+
 **`Dockerfile.dev`** (multi-stage NOT required for dev — single stage is fine):
 
 | Stack | Shape |
@@ -176,7 +181,7 @@ Without approval: write report (Phase 3 with `status: PLANNED`) and stop.
 
 **`.dockerignore`** for dev: exclude `.git`, `node_modules`, `target`, `dist`, `.dw`, `.agents`, `*.md` (except README.md).
 
-**README.md "Local Dev" section** (appended): port table for selected services, default credentials from `.env.example`, the four `dev:*` script commands.
+**README.md "Local Dev" section** (appended): port table for selected services, credential requirements from `.env.example` without working passwords, the four `dev:*` script commands.
 
 #### 2.2 `--prod` artifacts
 
@@ -217,7 +222,8 @@ Key requirements (apply to every language):
 - `restart: always`.
 - Internal network. NO public ports except via reverse proxy.
 - Secrets via `secrets:` block or external manager.
-- Drop dev-only services (no MailHog, Mailpit, smtp4dev, LocalStack, MinIO unless explicitly needed in prod).
+- Drop dev-only services (no Mailpit, smtp4dev, LocalStack, MinIO unless explicitly needed in prod).
+- For vector search, use a separately reviewed image or a managed Postgres service with the `vector` extension; this project ships no vetted pgvector image.
 
 **`.dockerignore`** for prod: stricter than dev. Exclude tests, `tests/`, `.github/`, `.dw/`, `.agents/`, all markdown except license.
 
@@ -234,6 +240,7 @@ Read existing `Dockerfile` and compose files. Apply `security-review/infrastruct
 - Compose: missing healthchecks on services? (flag)
 - Compose: services missing `restart` policy? (flag)
 - Compose: bind mounts in prod compose? (flag CRITICAL if `prod` in filename)
+- Compose: any image pinned by digest, or a credential with a working default? (flag CRITICAL — both block base-image rebuilds or ship a usable credential)
 
 Apply `dw-review-rigor`: dedup repeated patterns, signal-over-volume on style nits.
 
@@ -257,7 +264,7 @@ mode: <dev|prod|both|audit|dry-run>
 languages: [...]
 frameworks: { web: '...', api: '...' }
 services_detected: [postgres, redis, ...]
-services_added: [mailhog, ...]
+services_added: [mailpit, ...]
 base_image_strategy: <conservative|balanced|bold>
 ---
 ```
@@ -272,7 +279,7 @@ Sections:
 6. **Files Created** — table with path + bytes + role.
 7. **Audit Findings** (only `--audit` mode) — table of issues with severity, file:line, recommendation.
 8. **Next Steps:**
-   - For `--dev`: `cp .env.example .env` (if missing), `docker compose -f docker-compose.dev.yml up -d`, then smoke test the app.
+   - For `--dev`: `cp .env.example .env` (if missing), set every required secret such as `POSTGRES_PASSWORD` to a unique local value, run `docker compose -f docker-compose.dev.yml up -d`, then smoke test the app.
    - For `--prod`: build the image locally first (`docker build -t <name>:dev .`), run `/dw-secure-audit` on the Dockerfile and compose, then push to registry.
    - For `--audit`: apply suggested fixes manually or run with `--mode=force-overwrite`.
    - Always: run `/dw-secure-audit --plan` against the project before promoting the image to production.
@@ -293,7 +300,7 @@ Sections:
 - <critical>Never silently overwrite. If `Dockerfile`/`docker-compose.*.yml`/`.dockerignore` exists, default to `--audit`.</critical>
 - <critical>Prod images NEVER include secrets, dev SDK tooling, source code that wasn't compiled, or test fixtures.</critical>
 - <critical>Prod images ALWAYS run as a non-root user.</critical>
-- <critical>Prod compose files NEVER include MailHog, Mailpit, smtp4dev, LocalStack, or development-only services.</critical>
+- <critical>Prod compose files NEVER include Mailpit, smtp4dev, LocalStack, or development-only services.</critical>
 - <critical>If `--audit` finds CRITICAL severity issues (secrets in ENV, root user, public ports on data tier), the report's Next Steps must list the fix as REQUIRED before deploy.</critical>
 - Do NOT use `:latest` tags anywhere.
 - Do NOT exec compose commands from this command — produce files, the user runs `docker compose up`.