@brunosps00/dev-workflow 1.7.1 → 2.0.0

package/scaffold/en/commands/dw-generate-pr.md

@@ -109,6 +109,19 @@ Build the body following the template below, filling in with collected informati
 
 3. **Instruct the user** to paste the body (Ctrl+V) in the description field
 
+### 6. Record the PR back into the spec
+
+The PR URL only exists after the user clicks "Create". Once it does, write it back — otherwise nothing on the `.dw/` side ever records which PR delivered the work, and the trail ends at the branch.
+
+```bash
+# Fast path: resolves once the PR exists. Needs the GitHub CLI; skip silently if absent.
+gh pr view --json url -q .url 2>/dev/null
+```
+
+- If a URL resolves, append it to the PRD's `## Related` section as `- PR: <url>`.
+- If `gh` is unavailable or the PR isn't created yet, print the exact line for the user to paste and move on. **Never block the command on this** — it is a record, not a gate.
+- For bugfix branches, append the same line to `.dw/bugfixes/<NNN-slug>/SUMMARY.md` under `## Related` instead.
+
 ## PR Template (copy to clipboard)
 
 ```markdown

package/scaffold/en/commands/dw-new-project.md

@@ -79,10 +79,10 @@ Use `AskUserQuestion` when available; otherwise plain numbered prompts. Ask in *
 
 #### Layer B — Infra (only ask what fits the shape)
 
-6. **Database**: Postgres / Postgres + pgvector / MySQL / SQLite (file, no service) / MongoDB (out of scope for compose recipes — note and skip if chosen) / none. For Postgres + pgvector, select an explicit supported recipe/version.
+6. **Database**: Postgres / MySQL / SQLite (file, no service) / MongoDB (out of scope for compose recipes — note and skip if chosen) / none. There is no bundled pgvector recipe: the image carried unfixed upstream CVEs and no bundled artifact could clear them. If the project needs vector search, note it and let the user pick a separately reviewed image or a managed Postgres with the extension enabled.
 7. **Cache**: Redis / Memcached / none
 8. **Queue / message broker**: pg-boss (Node + Postgres, no extra service), BullMQ (Node + Redis), Celery (Python only), RabbitMQ (any), LocalStack SQS (any), none. If chosen, also ask whether the project will have async workers.
-9. **Email — dev capture** (default: **Mailpit**, ask only if user wants to override): Mailpit / MailHog / smtp4dev / skip
+9. **Email — dev capture** (default: **Mailpit**, ask only if user wants to override): Mailpit / smtp4dev / skip
 10. **Email — prod target** (only ask if user wants email at all): SMTP relay / SendGrid / Resend / Postmark / SES / skip
 11. **Object storage**: S3 (real, no service in compose) / MinIO (dev) / GCS (no service) / none
 12. **Search**: Meilisearch / Typesense / Elasticsearch / none
@@ -112,7 +112,7 @@ Save all answers in memory for Phase 2.
 
 ### Phase 2 — One-Pager + Plan + Approval Gate
 
-1. Render `.dw/spec/projects/{{PROJECT_NAME}}.md` from `.dw/templates/project-onepager.md`. Fill every section: shape, languages, frameworks, services table (name + port + default credentials), architecture diagram (ASCII), generated-files list, open questions.
+1. Render `.dw/spec/projects/{{PROJECT_NAME}}.md` from `.dw/templates/project-onepager.md`. Fill every section: shape, languages, frameworks, services table (name + port + credential requirements, never a working password), architecture diagram (ASCII), generated-files list, open questions.
 2. Build a plan:
    - Commands to run (in order, with arguments)
    - Files to create (with paths under `{{TARGET_DIR}}`)
@@ -163,11 +163,12 @@ If fullstack:
    - Aggregate named volumes under `volumes:`.
    - Resolve port collisions if any.
    - For `everything in Compose`, add the app service(s) at the end (build context = `apps/<name>` or root, Dockerfile.dev, env_file, volumes, depends_on with `condition: service_healthy`). For `apps on host`, compose infrastructure only and use `localhost` endpoints in app-facing environment variables.
+   - Preserve each recipe's image tag (do NOT convert any of them to a digest — a digest freezes the base image and never picks up a security rebuild), the required credential vars, and the `127.0.0.1` port binds. Those loopback mappings intentionally support `apps on host`; do not remove them from local dev.
 3. Add a header comment: `# Generated by /dw-new-project on YYYY-MM-DD`.
 
 #### 3.4 Generate `.env.example`
 
-Consolidate every env var referenced by selected services (per `references/env-conventions.md`). Group by service. Always include the application-side derived URLs (`DATABASE_URL`, `REDIS_URL`, `AMQP_URL`, `SMTP_HOST`/`SMTP_PORT`, `AWS_ENDPOINT_URL`, etc.).
+Consolidate every env var referenced by selected services (per `references/env-conventions.md`). Group by service. Always include the application-side derived URLs (`DATABASE_URL`, `REDIS_URL`, `AMQP_URL`, `SMTP_HOST`/`SMTP_PORT`, `AWS_ENDPOINT_URL`, etc.). Every credential var is emitted empty in `.env.example` (the recipes use `${VAR:?}`, so Compose refuses to start without a real value). Require the user to set unique generated values in the gitignored `.env` before running Compose. Never emit a reusable password.
 
 #### 3.5 Generate scripts
 
@@ -217,7 +218,7 @@ Minimal scaffold:
 | Database | <db or n/a> |
 | Cache | <cache or n/a> |
 | Queue | <queue or n/a> |
-| Email (dev) | <mailpit|mailhog|smtp4dev|none> |
+| Email (dev) | <mailpit|smtp4dev|none> |
 | Search | <search or n/a> |
 | Observability | <observability or n/a> |
 | Reverse proxy | <traefik|none> |
@@ -228,7 +229,7 @@ Minimal scaffold:
 
 ## Services in docker-compose.dev.yml
 
-(table of selected services with ports and default credentials)
+(table of selected services with ports and credential requirements; never include a working password)
 
 ## Conventions
 
@@ -241,8 +242,8 @@ Minimal scaffold:
 
 Generate a starter README with:
 - Project name + 1-line purpose
-- Quick Start (`cp .env.example .env && pnpm install && pnpm dev:up`)
-- Local Dev (port table for selected services + UI URLs + default credentials)
+- Quick Start (`cp .env.example .env`, set every required secret to a unique local value, then `pnpm install && pnpm dev:up`)
+- Local Dev (port table for selected services + UI URLs + credential requirements; never publish a working password)
 - Architecture diagram (ASCII from the one-pager)
 - Project layout (tree of top-level dirs)
 - Dev-workflow integration (mentions `/dw-plan prd`, `/dw-run`, `/dw-qa`, `/dw-secure-audit --plan`, `/dw-secure-audit`)
@@ -276,7 +277,7 @@ date: YYYY-MM-DD
 shape: <frontend|backend|fullstack>
 languages: [typescript, python, ...]
 frameworks: { web: '...', api: '...' }
-services: [postgres-pgvector, mailpit, minio, ...]
+services: [postgres, mailpit, minio, ...]
 package_manager: <pnpm|npm|yarn|poetry|uv|cargo|dotnet>
 monorepo: <pnpm-workspaces|turborepo|nx|none>
 ---
@@ -299,10 +300,10 @@ monorepo: <pnpm-workspaces|turborepo|nx|none>
 | ... | ... | ... |
 
 ## Services Composed
-<table of services with port + UI URL + default credentials, sourced from .agents/skills/docker-compose-recipes/>
+<table of services with port + UI URL + credential requirements, sourced from .agents/skills/docker-compose-recipes/>
 
 ## Next Steps
-1. `cp .env.example .env` and review credentials.
+1. `cp .env.example .env`, generate unique local secrets, and set every required value such as `POSTGRES_PASSWORD`.
 2. `pnpm install` (or your chosen package manager).
 3. `pnpm dev:up` to bring up all services. Wait for healthchecks.
 4. Open Mailpit UI at http://localhost:8025 to confirm email capture is wired.
@@ -323,10 +324,10 @@ monorepo: <pnpm-workspaces|turborepo|nx|none>
 
 - <critical>NEVER bypass the Phase 2 approval gate. If invoked in a non-interactive context, abort with: "/dw-new-project requires an interactive approval; rerun with --dry-run to plan-only."</critical>
 - <critical>NEVER run `create-*` tools outside `{{TARGET_DIR}}`. Each command's CWD is the target dir.</critical>
-- <critical>If MailHog/Mailpit/smtp4dev was selected, NEVER also wire a real SMTP into dev. The dev compose ALWAYS captures.</critical>
+- <critical>If Mailpit/smtp4dev was selected, NEVER also wire a real SMTP into dev. The dev compose ALWAYS captures.</critical>
 - <critical>If a `create-*` tool fails, STOP execution. Do not skip ahead to compose generation — partial scaffolds confuse later commands.</critical>
 - Do NOT pin Node/Python/.NET/Rust SDK versions inside the project unless the user asks; rely on `package.json` engines / `pyproject.toml` / `global.json` / `rust-toolchain.toml` to express intent without forcing.
-- Do NOT bake secrets into any generated file. `.env.example` has dev defaults only; real values live in untracked `.env`.
+- Do NOT bake secrets into any generated file. `.env.example` has non-secret dev defaults and empty required secret keys; real values live in untracked `.env`.
 
 ## Error Handling
 

package/scaffold/en/commands/dw-run.md

@@ -75,7 +75,7 @@ When available under `./.agents/skills/`, these skills are invoked per task:
    - Atomic commit message: `feat(<scope>): <task title> (#<task-id>)`.
    - Reference the FRs covered.
    - One task = one commit (unless the task explicitly has subtask milestones that earn separate commits).
-6. **Update tasks.md:** mark this task as `Done` with the commit SHA.
+6. **Update tasks.md:** set this task's `Status` to `Done` and write the short SHA (`git rev-parse --short HEAD`) into its `Commit` column. This is the only record linking a task to its diff — do not skip it.
 7. **Report:** what was done, what tests were added, what was validated.
 
 ### STOP CONDITIONS

package/scaffold/en/templates/project-onepager.md

@@ -24,10 +24,10 @@ services: []
 | Shape | frontend / backend / fullstack | [why this shape — single product surface, API for partners, etc.] |
 | Frontend | Next.js / Vite+React / n/a | [why this framework — SSR needs, SPA simplicity, etc.] |
 | Backend | NestJS / Fastify / FastAPI / ASP.NET Core minimal / Axum / n/a | [why this framework — team expertise, ecosystem, latency targets] |
-| Database | Postgres / Postgres+pgvector / MySQL / SQLite / MongoDB / none | [why this DB — relational, vector, transactional needs, etc.] |
+| Database | Postgres / MySQL / SQLite / MongoDB / none | [why this DB — relational, transactional needs, etc. Vector search has no bundled recipe; name the reviewed image or managed service if the project needs it] |
 | Cache | Redis / Memcached / none | [why or why not] |
 | Queue | pg-boss / BullMQ / Celery / RabbitMQ / LocalStack SQS / none | [why or why not + sync vs async workers] |
-| Email — dev | Mailpit (default) / MailHog / smtp4dev / none | [usually Mailpit — capture only, never sends real mail] |
+| Email — dev | Mailpit (default) / smtp4dev / none | [usually Mailpit — capture only, never sends real mail] |
 | Email — prod | SMTP / SendGrid / Resend / Postmark / SES / none | [why this provider — volume, deliverability, cost] |
 | Object storage | S3 / MinIO (dev) / GCS / none | [why or why not] |
 | Search | Meilisearch / Typesense / Elasticsearch / none | [why this engine — features, scale, simplicity] |
@@ -44,13 +44,14 @@ services: []
 
 [Generated services from the docker-compose-recipes skill. Filled by /dw-new-project.]
 
-| Service | Port (host) | UI | Default credentials |
-|---------|-------------|----|--------------------|
-| postgres | 5432 | — | POSTGRES_USER=app, POSTGRES_PASSWORD=app, POSTGRES_DB=app |
+| Service | Port (host) | UI | Credentials |
+|---------|-------------|----|-------------|
+| postgres | 127.0.0.1:5432 | — | POSTGRES_USER=app, POSTGRES_PASSWORD required in `.env` (no default), POSTGRES_DB=app |
 | redis | 6379 | — | (no auth in dev) |
 | mailpit | 1025 (smtp), 8025 (UI) | http://localhost:8025 | (no auth) |
 | ... | ... | ... | ... |
 
+
 ## Architecture Diagram
 
 ```

package/scaffold/en/templates/task-template.md

@@ -12,7 +12,7 @@ status: pending
 
 [Brief task description]
 
-**Functional Requirements covered**: FR[X.Y], FR[X.Z] (maximum 2 per task)
+**Functional Requirements covered**: FR-X.Y, FR-X.Z (maximum 2 per task)
 
 <requirements>
 [List of mandatory requirements]

package/scaffold/en/templates/tasks-template.md

@@ -19,11 +19,13 @@ feat/prd-[feature-name]
 
 ## Tasks
 
-| Task | Description | FRs | Status |
-|------|-------------|-----|--------|
-| 1.0 | [Title] | FR1.1, FR1.2 | Pending |
-| 2.0 | [Title] | FR2.1 | Pending |
-| 3.0 | [Title] | FR3.1, FR3.2 | Pending |
+| Task | Description | FRs | Status | Commit |
+|------|-------------|-----|--------|--------|
+| 1.0 | [Title] | FR-1.1, FR-1.2 | Pending | — |
+| 2.0 | [Title] | FR-2.1 | Pending | — |
+| 3.0 | [Title] | FR-3.1, FR-3.2 | Pending | — |
+
+`Commit` holds the short SHA written back by `/dw-run` when the task closes (step 6). It is what makes a task's diff findable later — leave `—` until the task commits.
 
 ## Progress
 

package/scaffold/pt-br/commands/dw-claude-run.md

@@ -13,7 +13,11 @@ para implementar um prompt/spec ja preparado, captura a execucao inteira num log
 |---|---|
 | `DISPATCH` | `UUID=$(cat /proc/sys/kernel/random/uuid); cd <WORKTREE> && claude -p --session-id "$UUID" --model <MODEL> --effort <EFFORT> --output-format stream-json --include-partial-messages --verbose --dangerously-skip-permissions "$(cat <PROMPT>)" </dev/null > <AUDIT>/<slug>.log 2>&1` |
 | `STREAM` | `--output-format stream-json --include-partial-messages --verbose` (`--verbose` e **obrigatorio** com `stream-json` no modo `-p`) |
-| `AUTO` | `--dangerously-skip-permissions` (auto-aprovacao headless; justificavel porque a worktree e isolada). Somente leitura/analise: tire-o e use `--permission-mode plan` (ou restrinja `--allowedTools`). |
+| `MODEL` | `--model <MODEL>` — `opus` · `sonnet` · `haiku` · `fable`, ou um id completo (`claude-opus-5`) |
+| `EFFORT` | `--effort <EFFORT>` — `low` · `medium` · `high` · `xhigh` · `max` |
+| `AUTO` | `--dangerously-skip-permissions` (auto-aprovacao headless para dispatch **WRITE**; justificavel porque a worktree e isolada) |
+| `AUTO_READONLY` | `--permission-mode plan` (opcionalmente `--allowedTools <lista>`). Nunca combine com `AUTO`. |
+| `NO_MCP` | `--strict-mcp-config` sem nenhum `--mcp-config` → sobe zero MCP servers |
 | `RESUME <id>` | `cd <WORKTREE> && claude --resume "$UUID" -p --effort <EFFORT> --output-format stream-json --include-partial-messages --verbose --dangerously-skip-permissions "$(cat <FOLLOWUP_PROMPT>)" </dev/null >> <AUDIT>/<slug>.log 2>&1` |
 | `RESUME_LAST` | `claude -c -p …` (continua a conversa mais recente nesta cwd) |
 | `SESSION_ID` | **FIXADO por voce** — voce passa `--session-id "$UUID"` na 1a run, entao o id e conhecido de antemao. Gere-o (`cat /proc/sys/kernel/random/uuid` ou `uuidgen`) e grave em `<AUDIT>/<slug>.session` ANTES/no dispatch. Sem scraping do stream — o Claude e o caso facil. |

package/scaffold/pt-br/commands/dw-codex-run.md

@@ -13,7 +13,11 @@ implementar um prompt/spec ja preparado, captura a execucao inteira num log de a
 |---|---|
 | `DISPATCH` | `cd <WORKTREE> && codex exec --skip-git-repo-check -m <MODEL> --config model_reasoning_effort="<EFFORT>" --dangerously-bypass-approvals-and-sandbox --json -o <AUDIT>/<slug>.last.md "$(cat <PROMPT>)" </dev/null > <AUDIT>/<slug>.log 2>&1` |
 | `STREAM` | `--json` (eventos JSONL) |
-| `AUTO` | `--dangerously-bypass-approvals-and-sandbox` (sem sandbox + sem approvals = full access **com rede**, p/ o CLI rodar o gate; justificavel porque a worktree e isolada). Edicao sem gate de rede: `--sandbox workspace-write --full-auto`. Somente leitura/analise: `--sandbox read-only` (sem `--full-auto`). |
+| `MODEL` | `-m <MODEL>` — `gpt-5.5` · `gpt-5.3-codex` · `gpt-5.4` · `gpt-5.3-codex-spark` · `gpt-5.4-mini` |
+| `EFFORT` | `--config model_reasoning_effort="<EFFORT>"` — `low` · `medium` · `high` · `xhigh` |
+| `AUTO` | `--dangerously-bypass-approvals-and-sandbox` (sem sandbox + sem approvals = full access **com rede**, p/ o CLI rodar o gate; **somente dispatch WRITE**, justificavel porque a worktree e isolada). Edicao sem gate de rede: `--sandbox workspace-write --full-auto`. |
+| `AUTO_READONLY` | `--sandbox read-only` (sem `--full-auto`). Nunca combine com `AUTO`. |
+| `NO_MCP` | `-c mcp_servers='{}'` → sobe zero MCP servers, preserva auth e o resto do `config.toml`. Alternativa mais bruta: `--ignore-user-config` (tambem derruba os defaults de modelo — ai `MODEL` + `EFFORT` viram obrigatorios). |
 | `RESUME <id>` | `cd <WORKTREE> && codex exec resume <THREAD_ID> --skip-git-repo-check --dangerously-bypass-approvals-and-sandbox --json "$(cat <FOLLOWUP_PROMPT>)" </dev/null >> <AUDIT>/<slug>.log 2>&1` |
 | `RESUME_LAST` | `codex exec resume --last …` (filtra por cwd = a worktree) |
 | `SESSION_ID` | Codex **nao tem flag pra fixar** o id → **capture** o thread id do stream da 1a run: `grep -oE '"thread_id":"[^"]*"' <AUDIT>/<slug>.log \| head -1` (do evento `thread.started`) → grave em `<AUDIT>/<slug>.session`. |

package/scaffold/pt-br/commands/dw-dockerize.md

@@ -129,10 +129,12 @@ Cada opcao lista estimativa de tamanho final, notas de attack surface, debug-abi
 
 Apresente os servicos detectados na Fase 0.3 como checklist. Usuario pode:
 - **Aceitar** — incluir todos os detectados no `docker-compose.dev.yml`
-- **Adicionar** — incluir extras (ex.: MailHog se SMTP usado em codigo, Jaeger se OTel)
+- **Adicionar** — incluir extras (ex.: Mailpit se SMTP usado em codigo, Jaeger se OTel)
 - **Remover** — dropar um detectado (ex.: Postgres gerenciado em dev tambem)
 
-Sempre ofereca MailHog se algum lib de envio de email foi detectada e nao tem servico de email no dev.
+Sempre ofereca Mailpit se algum lib de envio de email foi detectada e nao tem servico de email no dev.
+
+Se pgvector for detectado no projeto, nao ha recipe bundled a que recorrer — ela foi removida porque a imagem carregava CVEs sem correcao upstream. Mantenha a imagem que o projeto ja usa e diga claramente ao usuario que ela precisa de revisao propria: uma imagem reconstruida, ou um Postgres gerenciado com a extensao `vector` habilitada. Nao troque a imagem por conta propria.
 
 #### 1.4 Preview de arvore de arquivos
 
@@ -163,8 +165,11 @@ Sem aprovacao: escreve relatorio (Fase 3 com `status: PLANNED`) e para.
 **`docker-compose.dev.yml`**:
 - Componha blocos de `.agents/skills/docker-compose-recipes/services/*.yml` segundo `references/compose-composition.md`.
 - Adicione service(s) do app no fim: `build: { context: ., dockerfile: Dockerfile.dev }`, `volumes` para hot reload (bind mount do source, anonymous volume para `node_modules`/`__pycache__`), `env_file: .env`, `depends_on` com `condition: service_healthy` segundo `references/healthcheck-patterns.md`.
+- Preserve a tag da imagem de cada recipe (NAO converta nenhuma para digest — digest congela a base e nunca alcanca um rebuild de seguranca), as vars de credencial obrigatorias e os binds em `127.0.0.1`. As portas loopback mantem intencionalmente a topologia `apps no host` funcionando.
 - Header: `# Generated by /dw-dockerize on YYYY-MM-DD`.
 
+**`.env.example`**: emita toda var de credencial sem valor funcional (as recipes usam `${VAR:?}`, entao o Compose recusa subir sem valor). Depois da copia para `.env`, exija que o usuario defina valores locais unicos e gerados antes de rodar Compose. URLs das apps usam `localhost` quando apps rodam no host e DNS do servico quando rodam no Compose.
+
 **`Dockerfile.dev`** (multi-stage NAO obrigatorio em dev — single stage tudo bem):
 
 | Stack | Forma |
@@ -176,7 +181,7 @@ Sem aprovacao: escreve relatorio (Fase 3 com `status: PLANNED`) e para.
 
 **`.dockerignore`** dev: exclua `.git`, `node_modules`, `target`, `dist`, `.dw`, `.agents`, `*.md` (exceto README.md).
 
-**README.md secao "Local Dev"** (anexada): tabela de portas dos servicos, credenciais default do `.env.example`, os 4 comandos `dev:*`.
+**README.md secao "Local Dev"** (anexada): tabela de portas dos servicos, requisitos de credenciais do `.env.example` sem senhas funcionais, os 4 comandos `dev:*`.
 
 #### 2.2 Artefatos `--prod`
 
@@ -217,7 +222,8 @@ Requisitos chave (toda linguagem):
 - `restart: always`.
 - Network interna. SEM portas publicas exceto via reverse proxy.
 - Secrets via bloco `secrets:` ou manager externo.
-- Drope servicos so-de-dev (sem MailHog, Mailpit, smtp4dev, LocalStack, MinIO a menos que explicitamente preciso em prod).
+- Drope servicos so-de-dev (sem Mailpit, Mailpit, smtp4dev, LocalStack, MinIO a menos que explicitamente preciso em prod).
+- Para busca vetorial, use imagem revisada separadamente ou servico Postgres gerenciado com a extensao `vector`; este projeto nao distribui imagem pgvector validada.
 
 **`.dockerignore`** prod: mais restritivo que dev. Exclua testes, `tests/`, `.github/`, `.dw/`, `.agents/`, todo markdown exceto licenca.
 
@@ -234,6 +240,7 @@ Leia `Dockerfile` e composes existentes. Aplique checks de `security-review/infr
 - Compose: servicos sem healthcheck? (flag)
 - Compose: servicos sem `restart` policy? (flag)
 - Compose: bind mounts em compose prod? (flag CRITICAL se `prod` no nome do arquivo)
+- Compose: alguma imagem pinada por digest, ou credencial com default funcional? (flag CRITICAL — ambos bloqueiam rebuild da base ou distribuem credencial usavel)
 
 Aplique `dw-review-rigor`: dedupe padroes repetidos, signal-over-volume em nits de estilo.
 
@@ -257,7 +264,7 @@ mode: <dev|prod|both|audit|dry-run>
 languages: [...]
 frameworks: { web: '...', api: '...' }
 services_detected: [postgres, redis, ...]
-services_added: [mailhog, ...]
+services_added: [mailpit, ...]
 base_image_strategy: <conservative|balanced|bold>
 ---
 ```
@@ -272,7 +279,7 @@ Secoes:
 6. **Files Created** — tabela com path + bytes + papel.
 7. **Audit Findings** (so `--audit`) — tabela de issues com severidade, file:line, recomendacao.
 8. **Next Steps:**
-   - Para `--dev`: `cp .env.example .env` (se faltar), `docker compose -f docker-compose.dev.yml up -d`, depois smoke test do app.
+   - Para `--dev`: `cp .env.example .env` (se faltar), defina cada secret obrigatorio como `POSTGRES_PASSWORD` com valor local unico, rode `docker compose -f docker-compose.dev.yml up -d`, depois smoke test do app.
    - Para `--prod`: build local primeiro (`docker build -t <name>:dev .`), rode `/dw-secure-audit` no Dockerfile e compose, depois push pro registry.
    - Para `--audit`: aplique fixes manualmente ou rode com `--mode=force-overwrite`.
    - Sempre: rode `/dw-secure-audit --plan` antes de promover a imagem para prod.
@@ -293,7 +300,7 @@ Secoes:
 - <critical>Nunca sobrescreva em silencio. Se `Dockerfile`/`docker-compose.*.yml`/`.dockerignore` existe, default para `--audit`.</critical>
 - <critical>Imagens prod NUNCA incluem secrets, tooling SDK de dev, source nao compilado, ou fixtures de teste.</critical>
 - <critical>Imagens prod SEMPRE rodam como usuario nao-root.</critical>
-- <critical>Compose prod NUNCA inclui MailHog, Mailpit, smtp4dev, LocalStack, ou servicos so-de-dev.</critical>
+- <critical>Compose prod NUNCA inclui Mailpit, Mailpit, smtp4dev, LocalStack, ou servicos so-de-dev.</critical>
 - <critical>Se `--audit` acha CRITICAL (secrets em ENV, root user, portas publicas em data tier), Next Steps lista o fix como REQUIRED antes de deploy.</critical>
 - NAO use tag `:latest` em lugar nenhum.
 - NAO execute comandos compose deste comando — gere arquivos, o usuario roda `docker compose up`.

package/scaffold/pt-br/commands/dw-generate-pr.md

@@ -106,6 +106,19 @@
 
     3. **Instruir o usuário** a colar o body (Ctrl+V) no campo de descrição
 
+    ### 6. Registrar a PR de volta na spec
+
+    A URL da PR só existe depois que o usuário clica em "Create". Assim que existir, escreva de volta — senão nada do lado `.dw/` registra qual PR entregou o trabalho, e a trilha termina na branch.
+
+    ```bash
+    # Caminho rápido: resolve depois que a PR existe. Precisa do GitHub CLI; pule em silêncio se ausente.
+    gh pr view --json url -q .url 2>/dev/null
+    ```
+
+    - Se resolver uma URL, anexe na seção `## Related` do PRD como `- PR: <url>`.
+    - Se `gh` não existir ou a PR ainda não foi criada, imprima a linha exata para o usuário colar e siga. **Nunca bloqueie o comando nisso** — é registro, não gate.
+    - Para branches de bugfix, anexe a mesma linha em `.dw/bugfixes/<NNN-slug>/SUMMARY.md` sob `## Related`.
+
     ## Template da PR (copiar para clipboard)
 
     ```markdown

package/scaffold/pt-br/commands/dw-new-project.md

@@ -79,10 +79,10 @@ Use `AskUserQuestion` quando disponivel; senao prompts numerados. Pergunte em **
 
 #### Camada B — Infra (so pergunte o que cabe na forma)
 
-6. **Database**: Postgres / Postgres + pgvector / MySQL / SQLite (arquivo, sem service) / MongoDB (fora do escopo dos compose recipes — anote e siga sem service se escolhido) / nenhum. Para Postgres + pgvector, selecione explicitamente a recipe/version suportada.
+6. **Database**: Postgres / MySQL / SQLite (arquivo, sem service) / MongoDB (fora do escopo dos compose recipes — anote e siga sem service se escolhido) / nenhum. Nao ha recipe bundled de pgvector: a imagem carregava CVEs sem correcao upstream e nenhum artefato bundled conseguia limpa-las. Se o projeto precisar de busca vetorial, anote e deixe o usuario escolher uma imagem revisada separadamente ou um Postgres gerenciado com a extensao habilitada.
 7. **Cache**: Redis / Memcached / nenhum
 8. **Fila / message broker**: pg-boss (Node + Postgres, sem service extra), BullMQ (so Node + Redis), Celery (so Python), RabbitMQ (qualquer), LocalStack SQS (qualquer), nenhum. Se escolheu, pergunte tambem se vai ter workers async.
-9. **Email — captura em dev** (default: **Mailpit**, so pergunte se quer override): Mailpit / MailHog / smtp4dev / pular
+9. **Email — captura em dev** (default: **Mailpit**, so pergunte se quer override): Mailpit / smtp4dev / pular
 10. **Email — destino em prod** (so pergunte se quer email): SMTP relay / SendGrid / Resend / Postmark / SES / pular
 11. **Object storage**: S3 (real, sem service) / MinIO (dev) / GCS (sem service) / nenhum
 12. **Search**: Meilisearch / Typesense / Elasticsearch / nenhum
@@ -112,7 +112,7 @@ Guarde todas as respostas para a Fase 2.
 
 ### Fase 2 — One-Pager + Plano + Gate de Aprovacao
 
-1. Renderize `.dw/spec/projects/{{PROJECT_NAME}}.md` a partir de `.dw/templates/project-onepager.md`. Preencha tudo: forma, linguagens, frameworks, tabela de servicos (nome + porta + credencial default), diagrama da arquitetura (ASCII), lista de arquivos a gerar, perguntas em aberto.
+1. Renderize `.dw/spec/projects/{{PROJECT_NAME}}.md` a partir de `.dw/templates/project-onepager.md`. Preencha tudo: forma, linguagens, frameworks, tabela de servicos (nome + porta + requisitos de credenciais, nunca uma senha funcional), diagrama da arquitetura (ASCII), lista de arquivos a gerar, perguntas em aberto.
 2. Monte o plano:
    - Comandos a rodar (em ordem, com argumentos)
    - Arquivos a criar (paths sob `{{TARGET_DIR}}`)
@@ -163,11 +163,12 @@ Se fullstack:
    - Agregue volumes nomeados sob `volumes:`.
    - Resolva colisoes de porta se houver.
    - Se a topologia for `tudo no Compose`, adicione o(s) service(s) do app no fim (build context = `apps/<nome>` ou raiz, Dockerfile.dev, env_file, volumes, depends_on com `condition: service_healthy`). Se for `apps no host`, componha apenas infraestrutura e use endpoints `localhost` nas env vars consumidas pelas apps.
+   - Preserve a tag da imagem de cada recipe (NAO converta nenhuma para digest — digest congela a imagem base e nunca alcanca um rebuild de seguranca), as vars de credencial obrigatorias e os binds de porta em `127.0.0.1`. Esses mapeamentos loopback suportam intencionalmente `apps no host`; nao os remova do dev local.
 3. Adicione header: `# Generated by /dw-new-project on YYYY-MM-DD`.
 
 #### 3.4 Gerar `.env.example`
 
-Consolide cada env var referenciada pelos servicos selecionados (segundo `references/env-conventions.md`). Agrupe por servico. Sempre inclua as URLs derivadas do lado da app (`DATABASE_URL`, `REDIS_URL`, `AMQP_URL`, `SMTP_HOST`/`SMTP_PORT`, `AWS_ENDPOINT_URL`, etc.).
+Consolide cada env var referenciada pelos servicos selecionados (segundo `references/env-conventions.md`). Agrupe por servico. Sempre inclua as URLs derivadas do lado da app (`DATABASE_URL`, `REDIS_URL`, `AMQP_URL`, `SMTP_HOST`/`SMTP_PORT`, `AWS_ENDPOINT_URL`, etc.). Toda var de credencial e emitida vazia no `.env.example` (as recipes usam `${VAR:?}`, entao o Compose recusa subir sem valor real). Exija que o usuario defina valores unicos e gerados no `.env` gitignored antes de rodar Compose. Nunca emita uma senha reutilizavel.
 
 #### 3.5 Gerar scripts
 
@@ -217,7 +218,7 @@ Scaffold minimo:
 | Database | <db ou n/a> |
 | Cache | <cache ou n/a> |
 | Fila | <fila ou n/a> |
-| Email (dev) | <mailpit|mailhog|smtp4dev|nenhum> |
+| Email (dev) | <mailpit|smtp4dev|nenhum> |
 | Search | <search ou n/a> |
 | Observability | <observability ou n/a> |
 | Reverse proxy | <traefik|nenhum> |
@@ -228,7 +229,7 @@ Scaffold minimo:
 
 ## Servicos no docker-compose.dev.yml
 
-(tabela dos servicos selecionados com portas e credenciais default)
+(tabela dos servicos selecionados com portas e requisitos de credenciais; nunca inclua senha funcional)
 
 ## Convencoes
 
@@ -241,8 +242,8 @@ Scaffold minimo:
 
 Gere um README inicial:
 - Nome do projeto + 1 linha de proposito
-- Quick Start (`cp .env.example .env && pnpm install && pnpm dev:up`)
-- Local Dev (tabela de portas dos servicos selecionados + URLs das UIs + credenciais default)
+- Quick Start (`cp .env.example .env`, defina cada secret obrigatorio com valor local unico, depois `pnpm install && pnpm dev:up`)
+- Local Dev (tabela de portas dos servicos selecionados + URLs das UIs + requisitos de credenciais; nunca publique senha funcional)
 - Diagrama da arquitetura (ASCII do one-pager)
 - Layout do projeto (arvore dos diretorios top-level)
 - Integracao com dev-workflow (mencione `/dw-plan prd`, `/dw-run`, `/dw-qa`, `/dw-secure-audit --plan`, `/dw-secure-audit`)
@@ -276,7 +277,7 @@ date: YYYY-MM-DD
 shape: <frontend|backend|fullstack>
 languages: [typescript, python, ...]
 frameworks: { web: '...', api: '...' }
-services: [postgres-pgvector, mailpit, minio, ...]
+services: [postgres, mailpit, minio, ...]
 package_manager: <pnpm|npm|yarn|poetry|uv|cargo|dotnet>
 monorepo: <pnpm-workspaces|turborepo|nx|none>
 ---
@@ -299,10 +300,10 @@ monorepo: <pnpm-workspaces|turborepo|nx|none>
 | ... | ... | ... |
 
 ## Servicos Compostos
-<tabela de servicos com porta + URL UI + credenciais default, vinda de .agents/skills/docker-compose-recipes/>
+<tabela de servicos com porta + URL UI + requisitos de credenciais, vinda de .agents/skills/docker-compose-recipes/>
 
 ## Proximos Passos
-1. `cp .env.example .env` e revise credenciais.
+1. `cp .env.example .env`, gere secrets locais unicos e defina todo valor obrigatorio como `POSTGRES_PASSWORD`.
 2. `pnpm install` (ou seu package manager).
 3. `pnpm dev:up` para subir todos os servicos. Aguarde os healthchecks.
 4. Abra a UI do Mailpit em http://localhost:8025 para confirmar a captura de email.
@@ -323,10 +324,10 @@ monorepo: <pnpm-workspaces|turborepo|nx|none>
 
 - <critical>NUNCA pule o gate de aprovacao da Fase 2. Se rodando em contexto nao-interativo, aborte com: "/dw-new-project exige aprovacao interativa; rerode com --dry-run para so planejar."</critical>
 - <critical>NUNCA rode tools `create-*` fora de `{{TARGET_DIR}}`. CWD de cada comando e o target dir.</critical>
-- <critical>Se MailHog/Mailpit/smtp4dev foi selecionado, NUNCA tambem ligue um SMTP real em dev. O compose de dev SEMPRE captura.</critical>
+- <critical>Se Mailpit/smtp4dev foi selecionado, NUNCA tambem ligue um SMTP real em dev. O compose de dev SEMPRE captura.</critical>
 - <critical>Se uma tool `create-*` falha, PARE. Nao siga para gerar compose — scaffold parcial confunde os comandos seguintes.</critical>
 - NAO pin de versao SDK Node/Python/.NET/Rust dentro do projeto a nao ser que o usuario peca; use `package.json` engines / `pyproject.toml` / `global.json` / `rust-toolchain.toml` para indicar intencao sem forcar.
-- NAO baked secrets em arquivo gerado. `.env.example` so com defaults de dev; valor real fica em `.env` nao versionado.
+- NAO baked secrets em arquivo gerado. `.env.example` contem defaults nao secretos de dev e chaves secretas obrigatorias vazias; valores reais ficam em `.env` nao versionado.
 
 ## Tratamento de Erros
 

package/scaffold/pt-br/commands/dw-plan.md

@@ -113,7 +113,7 @@ Roda em modo padrão OU `plan prd`.
 
 1. **Coverage matrix sobre as dimensões do PRD** (objetivos, usuários-alvo, limites de escopo, métricas de sucesso, estratégia de rollout, pontos de integração, edge cases). Monte a matriz, credite evidência de handoff alinhado e fatos descobertos do repo, e pergunte SOMENTE as dimensões descobertas — uma decisão por vez, cada uma com resposta recomendada — usando a ferramenta de entrevista estruturada quando disponível (registre o fallback em chat caso contrário). Sem contagem fixa de perguntas; nunca re-pergunte uma decisão resolvida num one-pager alinhado.
 2. **Web search MÍNIMO 3 queries** para padrões de mercado, contexto regulatório, abordagens de competidores quando relevante.
-3. **Constitution alignment.** Cada requisito funcional (FR-N.M) inclui linha `Constitution Alignment: respects P-NNN, P-MMM` OU `no applicable principle: <motivo>`.
+3. **Constitution alignment.** Cada requisito funcional (RF-N.M) inclui linha `Constitution Alignment: respects P-NNN, P-MMM` OU `no applicable principle: <motivo>`.
 4. **Awareness multi-projeto.** Se feature cruza projetos do workspace, consulte `.dw/rules/integrations.md` e documente escopo na seção "Projetos Impactados".
 5. **Output:** `.dw/spec/prd-<feature-slug>/prd.md`.
 

package/scaffold/pt-br/commands/dw-run.md

@@ -75,7 +75,7 @@ Quando disponíveis em `./.agents/skills/`, estas skills são invocadas por task
    - Mensagem atômica: `feat(<scope>): <título da task> (#<task-id>)`.
    - Referencie FRs cobertos.
    - Uma task = um commit (exceto se task tem subtask milestones explícitos que ganham commits separados).
-6. **Atualizar tasks.md:** marcar task como `Done` com SHA do commit.
+6. **Atualizar tasks.md:** marcar `Status` da task como `Done` e escrever o SHA curto (`git rev-parse --short HEAD`) na coluna `Commit`. Esse é o único registro que liga a task ao seu diff — não pule.
 7. **Reportar:** o que foi feito, testes adicionados, o que foi validado.
 
 ### CONDIÇÕES DE PARADA

package/scaffold/pt-br/templates/project-onepager.md

@@ -24,10 +24,10 @@ services: []
 | Forma | frontend / backend / fullstack | [por que essa forma — superficie unica, API para parceiros, etc.] |
 | Frontend | Next.js / Vite+React / n/a | [por que esse framework — SSR, simplicidade SPA, etc.] |
 | Backend | NestJS / Fastify / FastAPI / ASP.NET Core minimal / Axum / n/a | [por que — expertise do time, ecosystem, alvo de latencia] |
-| Database | Postgres / Postgres+pgvector / MySQL / SQLite / MongoDB / nenhum | [por que esse DB — relacional, vetorial, transacional, etc.] |
+| Database | Postgres / MySQL / SQLite / MongoDB / nenhum | [por que esse DB — relacional, transacional, etc. Busca vetorial nao tem recipe bundled; nomeie a imagem revisada ou servico gerenciado se o projeto precisar] |
 | Cache | Redis / Memcached / nenhum | [por que ou por que nao] |
 | Fila | pg-boss / BullMQ / Celery / RabbitMQ / LocalStack SQS / nenhum | [por que ou nao + sync vs async workers] |
-| Email — dev | Mailpit (default) / MailHog / smtp4dev / nenhum | [normalmente Mailpit — captura only, nunca envia real] |
+| Email — dev | Mailpit (default) / smtp4dev / nenhum | [normalmente Mailpit — captura only, nunca envia real] |
 | Email — prod | SMTP / SendGrid / Resend / Postmark / SES / nenhum | [por que esse provider — volume, deliverability, custo] |
 | Object storage | S3 / MinIO (dev) / GCS / nenhum | [por que ou nao] |
 | Search | Meilisearch / Typesense / Elasticsearch / nenhum | [por que esse engine — features, escala, simplicidade] |
@@ -44,13 +44,14 @@ services: []
 
 [Servicos gerados a partir da skill docker-compose-recipes. Preenchido pelo /dw-new-project.]
 
-| Servico | Porta (host) | UI | Credenciais default |
-|---------|--------------|----|--------------------|
-| postgres | 5432 | — | POSTGRES_USER=app, POSTGRES_PASSWORD=app, POSTGRES_DB=app |
+| Servico | Porta (host) | UI | Credenciais |
+|---------|--------------|----|-------------|
+| postgres | 127.0.0.1:5432 | — | POSTGRES_USER=app, POSTGRES_PASSWORD obrigatoria no `.env` (sem default), POSTGRES_DB=app |
 | redis | 6379 | — | (sem auth em dev) |
 | mailpit | 1025 (smtp), 8025 (UI) | http://localhost:8025 | (sem auth) |
 | ... | ... | ... | ... |
 
+
 ## Diagrama da Arquitetura
 
 ```

package/scaffold/pt-br/templates/task-template.md

@@ -12,7 +12,7 @@ status: pending
 
 [Breve descrição da tarefa]
 
-**Requisitos Funcionais cobertos**: RF[X.Y], RF[X.Z] (máximo 2 por task)
+**Requisitos Funcionais cobertos**: RF-X.Y, RF-X.Z (máximo 2 por task)
 
 <requirements>
 [Lista de requisitos obrigatórios]

package/scaffold/pt-br/templates/tasks-template.md

@@ -19,11 +19,13 @@ feat/prd-[nome-funcionalidade]
 
 ## Tarefas
 
-| Task | Descrição | RFs | Status |
-|------|-----------|-----|--------|
-| 1.0 | [Título] | RF1.1, RF1.2 | Pendente |
-| 2.0 | [Título] | RF2.1 | Pendente |
-| 3.0 | [Título] | RF3.1, RF3.2 | Pendente |
+| Task | Descrição | RFs | Status | Commit |
+|------|-----------|-----|--------|--------|
+| 1.0 | [Título] | RF-1.1, RF-1.2 | Pendente | — |
+| 2.0 | [Título] | RF-2.1 | Pendente | — |
+| 3.0 | [Título] | RF-3.1, RF-3.2 | Pendente | — |
+
+`Commit` guarda o SHA curto escrito de volta pelo `/dw-run` quando a task fecha (passo 6). É o que torna o diff da task localizável depois — deixe `—` até a task commitar.
 
 ## Progresso
 

package/scaffold/skills/docker-compose-recipes/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: docker-compose-recipes
-description: Use for docker-compose service blocks (postgres, pgvector, redis, mailpit, minio, meilisearch, jaeger, traefik). Invoked by /dw-new-project, /dw-dockerize, or when composing dev/prod compose files.
+description: Use for docker-compose service blocks (postgres, redis, mailpit, minio, meilisearch, jaeger, traefik). Invoked by /dw-new-project, /dw-dockerize, or when composing dev/prod compose files.
 allowed-tools:
   - Read
   - Write
@@ -49,14 +49,12 @@ Each row points to `services/<name>.yml`.
 | Service | Use | Default port(s) | Recipe |
 |---------|-----|-----------------|--------|
 | Postgres 16 (alpine) | Relational DB | `5432` | `services/postgres.yml` |
-| PostgreSQL 18 + pgvector 0.8.2 | Relational + vector DB | `5432` | `services/postgres-pgvector.yml` |
 | MySQL 8 | Relational DB | `3306` | `services/mysql.yml` |
 | Redis 7 (alpine) | Cache, pub/sub, BullMQ backend | `6379` | `services/redis.yml` |
 | Memcached 1.6 (alpine) | Cache | `11211` | `services/memcached.yml` |
 | RabbitMQ 3 (management-alpine) | Message broker + UI | `5672`, UI `15672` | `services/rabbitmq.yml` |
 | LocalStack | AWS-compatible local (S3, SQS, SNS, DynamoDB) | `4566` | `services/localstack.yml` |
 | Mailpit | Default email-in-dev (capture only, never sends) | SMTP `1025`, UI `8025` | `services/mailpit.yml` |
-| MailHog | Legacy email capture alternative | SMTP `1025`, UI `8025` | `services/mailhog.yml` |
 | smtp4dev | Windows-friendly SMTP capture | SMTP `2525`, UI `5000` | `services/smtp4dev.yml` |
 | MinIO | S3-compatible local | API `9000`, UI `9001` | `services/minio.yml` |
 | Meilisearch | Search engine (lightweight) | `7700` | `services/meilisearch.yml` |
@@ -82,7 +80,7 @@ Each row points to `services/<name>.yml`.
 
 ## Inspired by
 
-Hand-curated by dev-workflow. Service defaults follow upstream documentation (Docker Hub `postgres`, `pgvector/pgvector`, `redis`, `axllent/mailpit`, `minio/minio`, `getmeili/meilisearch`, `jaegertracing/all-in-one`, `traefik`). Healthcheck patterns adapted from `docker-library/healthcheck` and the official compose docs.
+Hand-curated by dev-workflow. Service defaults follow upstream documentation (Docker Hub `postgres`, `redis`, `axllent/mailpit`, `minio/minio`, `getmeili/meilisearch`, `jaegertracing/all-in-one`, `traefik`). Healthcheck patterns adapted from `docker-library/healthcheck` and the official compose docs.
 
 ## Structured Return
 

package/scaffold/skills/docker-compose-recipes/references/compose-composition.md

@@ -4,7 +4,7 @@ This file describes how `/dw-new-project` and `/dw-dockerize` merge the standalo
 
 ## The merge algorithm
 
-1. **Pick the selected services.** From the interview answers (or from stack detection in `dw-dockerize`), get the list of services to include. Example: `[postgres-pgvector, mailpit, minio]`.
+1. **Pick the selected services.** From the interview answers (or from stack detection in `dw-dockerize`), get the list of services to include. Example: `[postgres, mailpit, minio]`.
 2. **Read each `services/<name>.yml`** as a standalone fragment. Each file declares ONE top-level service block (e.g., `postgres:`) plus comments at the bottom describing the volumes block to merge.
 3. **Concatenate under a single `services:` map.** Indent each block under `services:` in the final file. Order does not matter for compose, but for readability sort by tier: storage → cache/queue → search → email → observability → proxy.
 4. **Collect the volumes.** Each recipe's comments list the named volumes it needs. Aggregate them under a top-level `volumes:` block. Example:
@@ -42,7 +42,7 @@ This file describes how `/dw-new-project` and `/dw-dockerize` merge the standalo
 services:
   # --- storage tier ---
   postgres:
-    # ... contents from services/postgres-pgvector.yml
+    # ... contents from services/postgres.yml
 
   # --- cache tier ---
   redis: