@brunosps00/dev-workflow 2.6.0 → 2.7.0

package/lib/uninstall.js

@@ -3,6 +3,9 @@ const path = require('path');
 const { COMMANDS, PLATFORMS, MCP_SERVERS } = require('./constants');
 const { AGENT_TARGETS, LEGACY_AGENT_TARGETS, readAgentRegistry } = require('./agents');
 const { removeHooks } = require('./hooks');
+const { BUNDLED_SKILLS_REL, LEGACY_BUNDLED_SKILLS_REL } = require('./skill-registry');
+const { classifyLegacySkill, isDevWorkflowSkillCopy, managedSet, moveToBackup, timestamp, MIGRATED_REL } = require('./migrate-skills');
+const { readInstallState } = require('./install-state');
 
 function run() {
   const projectRoot = process.cwd();
@@ -36,7 +39,19 @@ function run() {
   // 1. Remove .dw/commands/, .dw/templates/, .dw/references/, .dw/scripts/
   console.log('  Managed files:');
   removeDir(path.join(projectRoot, '.dw', 'commands'), '.dw/commands/');
-  removeDir(path.join(projectRoot, '.dw', 'templates'), '.dw/templates/');
+  // .dw/templates/overrides/ is the owner's (it wins over the managed templates): keep it.
+  const templatesDir = path.join(projectRoot, '.dw', 'templates');
+  if (fs.existsSync(templatesDir)) {
+    for (const entry of fs.readdirSync(templatesDir)) {
+      if (entry === 'overrides') continue;
+      fs.rmSync(path.join(templatesDir, entry), { recursive: true, force: true });
+    }
+    if (fs.readdirSync(templatesDir).length === 0) fs.rmdirSync(templatesDir);
+    console.log(`  \x1b[31m-\x1b[0m .dw/templates [removed${fs.existsSync(templatesDir) ? ', overrides/ kept' : ''}]`);
+    removed++;
+  } else {
+    skipped++;
+  }
   removeDir(path.join(projectRoot, '.dw', 'references'), '.dw/references/');
   removeDir(path.join(projectRoot, '.dw', 'scripts'), '.dw/scripts/');
   removeFile(path.join(projectRoot, '.dw', 'agent-registry.json'));
@@ -57,14 +72,39 @@ function run() {
   }
   console.log();
 
-  // 3. Remove bundled skills from .agents/skills/
+  // 3. Remove bundled skills from .dw/skills/ (managed by this package). A legacy
+  //    copy left under .agents/skills/ by a release up to 2.6.0 is moved to
+  //    .dw/.migrated/<ts>/ — only when it is ours (classifyLegacySkill); a
+  //    same-named skill installed from elsewhere is kept and reported.
   console.log('  Bundled skills:');
   const skillsDir = path.join(__dirname, '..', 'scaffold', 'skills');
   const bundledSkills = fs.existsSync(skillsDir)
     ? fs.readdirSync(skillsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name)
     : [];
+  const managed = managedSet(readInstallState(projectRoot));
+  const stamp = timestamp();
+  let movedLegacy = 0;
   for (const skill of bundledSkills) {
-    removeDir(path.join(projectRoot, '.agents', 'skills', skill));
+    removeDir(path.join(projectRoot, BUNDLED_SKILLS_REL, skill));
+    const legacy = path.join(projectRoot, LEGACY_BUNDLED_SKILLS_REL, skill);
+    if (!fs.existsSync(legacy)) continue;
+    const verdict = classifyLegacySkill(projectRoot, skill, managed);
+    const rel = path.relative(projectRoot, legacy);
+    if (verdict.ours) {
+      moveToBackup(projectRoot, legacy, stamp);
+      console.log(`  \x1b[31m-\x1b[0m ${rel} [moved to ${path.join(MIGRATED_REL, stamp)}/]`);
+      removed++;
+      movedLegacy++;
+    } else {
+      console.log(`  \x1b[36m!\x1b[0m ${rel} [kept: not a dev-workflow copy (${verdict.reason})]`);
+    }
+  }
+  if (movedLegacy > 0) {
+    console.log(`    Legacy copies are in ${path.join(MIGRATED_REL, stamp)}/; delete that folder when you no longer need them.`);
+  }
+  const bundledRoot = path.join(projectRoot, BUNDLED_SKILLS_REL);
+  if (fs.existsSync(bundledRoot) && fs.readdirSync(bundledRoot).length === 0) {
+    fs.rmdirSync(bundledRoot);
   }
   console.log();
 
@@ -125,8 +165,22 @@ function run() {
   removeFile(path.join(projectRoot, '.opencode', 'package.json'));
   removeFile(path.join(projectRoot, '.dw', 'install-state.json'));
 
-  // 6. Remove legacy .codex/skills/
-  removeDir(path.join(projectRoot, '.codex', 'skills'));
+  // 6. Retire dev-workflow entries from legacy .codex/skills/ (dw-* wrappers and
+  //    bundled-skill copies that pass the contract check) by moving them to
+  //    .dw/.migrated/<ts>/; anything else there belongs to the user or another tool.
+  const codexSkills = path.join(projectRoot, '.codex', 'skills');
+  if (fs.existsSync(codexSkills)) {
+    for (const entry of fs.readdirSync(codexSkills, { withFileTypes: true })) {
+      const target = path.join(codexSkills, entry.name);
+      const isBundledCopy = bundledSkills.includes(entry.name) && isDevWorkflowSkillCopy(target);
+      if (entry.name.startsWith('dw-') || isBundledCopy) {
+        moveToBackup(projectRoot, target, stamp);
+        console.log(`  \x1b[31m-\x1b[0m ${path.relative(projectRoot, target)} [moved to ${path.join(MIGRATED_REL, stamp)}/]`);
+        removed++;
+      }
+    }
+    if (fs.readdirSync(codexSkills).length === 0) fs.rmdirSync(codexSkills);
+  }
 
   // Note: .dw/rules/, .dw/spec/, .dw/intel/ are USER DATA — never removed
   console.log(`\n  ${'='.repeat(40)}`);
@@ -137,6 +191,8 @@ function run() {
   console.log('    .dw/spec/            (PRDs and specs)');
   console.log('    .dw/intel/           (codebase index from /dw-intel --build)');
   console.log('    .dw/minimalism.json  (dw-minimalism intensity preference)');
+  console.log('    .dw/templates/overrides/ (your template overrides)');
+  console.log('    .dw/.migrated/       (anything uninstall or update retired; delete when no longer needed)');
   console.log();
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"

package/scaffold/en/agent-instructions.md

@@ -27,7 +27,7 @@ During task breakdown, propose local or cross-tool development and a model, effo
 
 Claude can delegate implementation through `/dw-codex-run`; Codex can use `/dw-claude-run`. The parent owns review, corrections, and continuation. Local agents inherit the session model unless the approved task overrides it. Delegate bounded independent work when it improves quality or time; keep tightly coupled or small work local. At most 3 workers per workstream, and never concurrent writers in the same worktree.
 
-Read relevant files first. Use `.dw/intel/` or a code-explorer for broad or unfamiliar flows when useful, checking index claims against current source. Load skill entrypoints only for matching tasks, and references only for the selected mode. Subagents receive a compact packet and return evidence and decisions, not full logs.
+Read relevant files first. Use `.dw/intel/` or a code-explorer for broad or unfamiliar flows when useful, checking index claims against current source. Load skill entrypoints only for matching tasks, and references only for the selected mode. dev-workflow skills live in `.dw/skills/<name>/`; when a command names one, read it from there. `.agents/skills/` and `.claude/skills/` also hold the user's and other tools' skills: outside `update`, delete nothing there without listing it and asking first. Subagents receive a compact packet and return evidence and decisions, not full logs.
 
 ## Completion and boundaries
 

package/scaffold/en/commands/dw-brainstorm.md

@@ -61,7 +61,7 @@ digraph brainstorm_decision {
 
 ## Complementary Skills
 
-When available in the project under `./.agents/skills/`, use these skills to enrich ideation:
+When available in the project under `./.dw/skills/`, use these skills to enrich ideation:
 
 - `dw-council`: invoked by the dispatcher's **council** mode — multi-advisor stress-test of the most promising options with mandatory steel-manning and concession tracking. The dispatcher fires it when 2+ paths tie OR consensus forms too quickly (false-consensus signal). Not invoked on every brainstorm — only when signals justify it.
 - `dw-simplification`: invoked by the dispatcher's **refactor-audit** mode — applies Chesterton's Fence + complexity metrics + the new **deep-modules** reference (deletion test, locality, leverage, interface depth) to every flagged smell.
@@ -345,7 +345,7 @@ turns and it writes files. Because it is stateful and mutating, it starts **only
 
 <critical>Ask exactly ONE unresolved decision per interaction, then wait. Never dump a list of questions.</critical>
 
-Grill is powered by two internal skills (loaded by path from `./.agents/skills/`, never exported):
+Grill is powered by two internal skills (loaded by path from `./.dw/skills/`, never exported):
 - **`dw-grilling`** — the decision-tree interview engine (dependency ordering, one decision per turn, a
   recommended answer for every question, facts discovered rather than asked, the shared-understanding gate).
 - **`dw-domain-modeling`** — the vocabulary engine (canonical terms, fuzzy/overloaded-term challenge, code

package/scaffold/en/commands/dw-bugfix.md

@@ -36,7 +36,7 @@
 
     ## Complementary Skills
 
-    When available in the project at `./.agents/skills/`, use these skills as contextual support without replacing this command:
+    When available in the project at `./.dw/skills/`, use these skills as contextual support without replacing this command:
 
     - `dw-debug-protocol`: **ALWAYS** — runs the bug through the six-step triage (Reproduce → Localize → Reduce → Fix Root Cause → Guard → Verify End-to-End). Stop-the-line discipline; root-cause over symptom; regression test committed in the same atomic commit. For non-trivial bugs, or after a first fix fails, Step 1 must establish a red-capable feedback loop before theorizing. Non-reproducible bugs follow the instrument-first sub-protocol — no guess fixes without explicit acknowledgement.
     - `dw-verify`: **ALWAYS** — in Direct mode, invoked before committing the fix. The VERIFICATION REPORT must show the original bug symptom no longer reproduces (not just that tests pass).

package/scaffold/en/commands/dw-commit.md

@@ -11,7 +11,7 @@
 
     ## Complementary Skills
 
-    When available in the project under `./.agents/skills/`, use these skills as operational support without replacing this command:
+    When available in the project under `./.dw/skills/`, use these skills as operational support without replacing this command:
 
     - `dw-git-discipline`: **ALWAYS** — enforces atomic commits (one logical intent per commit; refactor separate from feature), Conventional Commits format, lint+tests+build green BEFORE the commit, and bans bypassing pre-commit hooks (`--no-verify`) or amending pushed commits. When mixed changes are detected, splits via `git add -p`.
 

package/scaffold/en/commands/dw-dockerize.md

@@ -44,7 +44,7 @@ This command is **complementary** to `/dw-new-project`:
 - Audit/dockerize report: `.dw/audit/dockerize-<YYYY-MM-DD>.md` (PRD scope: `.dw/spec/prd-<slug>/dockerize.md`)
 - Generated dev artifacts: `<SCOPE>/docker-compose.dev.yml`, `<SCOPE>/Dockerfile.dev`, `<SCOPE>/.dockerignore`
 - Generated prod artifacts: `<SCOPE>/Dockerfile`, `<SCOPE>/docker-compose.prod.yml` (optional), `<SCOPE>/.dockerignore`
-- Recipe source: `.agents/skills/docker-compose-recipes/services/*.yml`
+- Recipe source: `.dw/skills/docker-compose-recipes/services/*.yml`
 
 ## Required Behavior — Pipeline
 
@@ -163,7 +163,7 @@ Without approval: write report (Phase 3 with `status: PLANNED`) and stop.
 #### 2.1 `--dev` artifacts
 
 **`docker-compose.dev.yml`**:
-- Compose service blocks from `.agents/skills/docker-compose-recipes/services/*.yml` per `references/compose-composition.md`.
+- Compose service blocks from `.dw/skills/docker-compose-recipes/services/*.yml` per `references/compose-composition.md`.
 - Add app service(s) at the end: `build: { context: ., dockerfile: Dockerfile.dev }`, `volumes` for hot reload (bind mount source, anonymous volume for `node_modules`/`__pycache__`), `env_file: .env`, `depends_on` with `condition: service_healthy` per `references/healthcheck-patterns.md`.
 - Preserve each recipe's image tag (do NOT convert any of them to a digest — a digest freezes the base and never picks up a security rebuild), the required credential vars, and the `127.0.0.1` binds. The loopback ports intentionally keep the `apps on host` topology working.
 - Header comment: `# Generated by /dw-dockerize on YYYY-MM-DD`.

package/scaffold/en/commands/dw-functional-doc.md

@@ -53,7 +53,7 @@ Works best with project analyzed by `/dw-analyze-project`
 
 ## Complementary Skills
 
-When available in the project under `./.agents/skills/`, use these skills as operational support without replacing this command as source of truth:
+When available in the project under `./.dw/skills/`, use these skills as operational support without replacing this command as source of truth:
 
 - `dw-testing-discipline`: support for structuring E2E flows (`references/playwright-recipes.md`), evidence collection patterns, and applying core rules + selector hierarchy to any test the doc references
 - `remotion-best-practices`: mandatory support when there is a final human video, captions, composition, transitions, FFmpeg, or Remotion

package/scaffold/en/commands/dw-harness-audit.md

@@ -29,7 +29,7 @@ You are the dev-workflow harness auditor.
 5. Recommend the top 3 fixes.
 
 ## Runtime degradation triage (on-demand)
-The scorecard above is deterministic **install** health. If instead the *agent* is misbehaving at runtime (loops, objective drift, hallucinated edits, degraded reasoning), that is a different diagnosis: point the user to `.agents/skills/dw-debug-protocol/references/agent-degradation.md` (symptom→cause table + ordered recovery). Advisory only — it does not affect the scorecard.
+The scorecard above is deterministic **install** health. If instead the *agent* is misbehaving at runtime (loops, objective drift, hallucinated edits, degraded reasoning), that is a different diagnosis: point the user to `.dw/skills/dw-debug-protocol/references/agent-degradation.md` (symptom→cause table + ordered recovery). Advisory only — it does not affect the scorecard.
 
 ## Output
 Return a scorecard and do not mutate files. Tell the user to run `dev-workflow repair` for managed-file drift.

package/scaffold/en/commands/dw-intel.md

@@ -64,7 +64,7 @@ Don't refuse to answer — return the best info available.
 
 ### 2. Query shape detection
 
-Classify the user's `{{QUERY}}` into one of the shapes documented in `.agents/skills/dw-codebase-intel/references/query-patterns.md`:
+Classify the user's `{{QUERY}}` into one of the shapes documented in `.dw/skills/dw-codebase-intel/references/query-patterns.md`:
 
 - **where-is** — primary: `files.json`, secondary: `apis.json`
 - **what-uses** — primary: `deps.json` (libs) or `files.json` (symbols)

package/scaffold/en/commands/dw-learn.md

@@ -23,7 +23,7 @@ Gather signals only from what is already persisted:
 4. **Present** candidates in chat as a markdown list — id, trigger, action, confidence, evidence. Do NOT write yet.
 5. **Ask**: "Approve which to store? (ids, or 'all', or 'none'). Any to promote to a constitution principle?"
 6. On approval:
-   - Write each approved instinct to `.dw/memory/instincts/<slug>.md` in the format from `.agents/skills/dw-memory/references/instincts.md` (create or update; never duplicate an existing id).
+   - Write each approved instinct to `.dw/memory/instincts/<slug>.md` in the format from `.dw/skills/dw-memory/references/instincts.md` (create or update; never duplicate an existing id).
    - For any the user chooses to promote, hand off to the constitution flow — propose a `P-NNN` principle at `severity: info` for `/dw-analyze-project` Step 8. Do NOT edit `.dw/constitution.md` directly without the user re-confirming.
 7. Update confidence on existing instincts that new evidence reconfirms or contradicts.
 

package/scaffold/en/commands/dw-new-project.md

@@ -39,7 +39,7 @@ You are a workspace bootstrap lead for the dev-workflow ecosystem. Your job is t
 - Project one-pager: `.dw/spec/projects/{{PROJECT_NAME}}.md` (uses `.dw/templates/project-onepager.md`)
 - Final report: `.dw/spec/projects/{{PROJECT_NAME}}-bootstrap.md`
 - Seeded rules: `.dw/rules/index.md` (minimal, replaceable later by `/dw-analyze-project`)
-- Compose recipes: `.agents/skills/docker-compose-recipes/services/*.yml`
+- Compose recipes: `.dw/skills/docker-compose-recipes/services/*.yml`
 
 ## Required Behavior — Pipeline
 
@@ -157,7 +157,7 @@ If fullstack:
 
 #### 3.3 Generate `docker-compose.dev.yml`
 
-1. Read `.agents/skills/docker-compose-recipes/SKILL.md` and the relevant `services/<name>.yml` files.
+1. Read `.dw/skills/docker-compose-recipes/SKILL.md` and the relevant `services/<name>.yml` files.
 2. Apply the merge algorithm in `references/compose-composition.md`:
    - Concatenate selected service blocks under `services:`.
    - Aggregate named volumes under `volumes:`.
@@ -300,7 +300,7 @@ monorepo: <pnpm-workspaces|turborepo|nx|none>
 | ... | ... | ... |
 
 ## Services Composed
-<table of services with port + UI URL + credential requirements, sourced from .agents/skills/docker-compose-recipes/>
+<table of services with port + UI URL + credential requirements, sourced from .dw/skills/docker-compose-recipes/>
 
 ## Next Steps
 1. `cp .env.example .env`, generate unique local secrets, and set every required value such as `POSTGRES_PASSWORD`.

package/scaffold/en/commands/dw-plan.md

@@ -30,7 +30,7 @@ You are a planning orchestrator that takes an idea through the full PRD → Tech
 
 ## Complementary Skills
 
-When available under `./.agents/skills/`, use these as planning support:
+When available under `./.dw/skills/`, use these as planning support:
 
 - `dw-source-grounding`: **ALWAYS** in TechSpec stage — every framework/library decision must cite official docs with version + retrieval date.
 - `dw-ui-discipline`: **REQUIRED** when the PRD has UI surfaces — runs the 4 grounding questions before any visual design lands in the TechSpec.
@@ -169,7 +169,7 @@ Runs when default mode (after TechSpec approval) OR `plan tasks`.
 3. **End-to-end coverage:** every user-facing flow has backend + frontend + functional UI subtasks if applicable.
 4. **Test placement (`dw-testing-discipline`):** every test-adding subtask names its invariant per the placement doctrine. Owning layer specified.
 5. **Constitution alignment:** every task lists `Constitution: respects P-NNN` or `Constitution: deviates P-NNN — ADR planned: <slug>` or `Constitution: n/a — reason: <one-liner>`.
-6. **LLM-eval subtask (when applicable):** if the PRD has an AI feature, one task must include an Eval Plan subtask (reference dataset path, oracle rungs, judge calibration, target metrics).
+6. **LLM-eval subtask (when applicable):** if the PRD has an AI feature, one task must include an Eval Plan subtask (reference dataset path, oracle rungs, judge calibration, target metrics), ordered before the implementation subtasks: behavior spec (when / does / must not / keeps working), cases, and a baseline run on the current code where the new-behavior cases fail.
 7. **Dependency declaration:** each task explicitly lists which previous tasks it depends on. Write the field as `Depends on: none` or `Depends on: 1.0, 2.0` in `tasks.md` and each `<N>_task.md`. Validation rejects cycles.
 8. **Output locations:**
    - Summary: `.dw/spec/prd-<feature-slug>/tasks.md`

package/scaffold/en/commands/dw-qa.md

@@ -48,14 +48,14 @@ Compute `<target>` ONCE at the start; substitute it wherever you see `<target>`
 
 ## Complementary Skills
 
-When available under `./.agents/skills/`, these are invoked operationally:
+When available under `./.dw/skills/`, these are invoked operationally:
 
 - `dw-testing-discipline`: **(UI mode — ALWAYS)** — core rules and 25 anti-patterns apply to every QA test authored. `references/playwright-recipes.md` for tactical patterns. `references/three-workflow-patterns.md` to pick the right verification mode (UI / network / perf). `references/security-boundary.md` for any flow that crosses an auth boundary.
 - `api-testing-recipes`: **(API mode — ALWAYS)** — validated snippets for `.http`, pytest+httpx, supertest, WebApplicationFactory, reqwest. Composes per-FR test files in `QA/scripts/api/` and JSONL logs in `QA/logs/api/`.
-- `dw-llm-eval`: **(AI mode — when invoked with `--ai`)** — runs reference dataset against current implementation. Computes precision@k / faithfulness / outcome accuracy. Logs JSONL to `QA/logs/ai/<feature>-<date>.jsonl`. Alerts on >10% metric regression vs prior run.
+- `dw-llm-eval`: **(AI mode — when invoked with `--ai`)** — runs reference dataset against current implementation. Computes precision@k / faithfulness / outcome accuracy. Logs JSONL to `QA/logs/ai/<feature>-<date>.jsonl`. Lists per-case pass → fail flips vs prior run (each is a bug) and alerts on >10% metric regression.
 - `dw-debug-protocol`: **(in `--fix` mode — ALWAYS)** — six-step triage (Reproduce → Localize → Reduce → Fix Root Cause → Guard → Verify End-to-End) for each detected bug. Stop-the-line discipline; root-cause over symptom; regression test in same atomic commit.
 - `vercel-react-best-practices`: (UI mode) when React/Next.js regression risk is suspected.
-- `dw-ui-discipline`: (UI mode) when validating design consistency — anti-slop catalog + WCAG accessibility floor check.
+- `dw-ui-discipline`: (UI mode) when validating design consistency — anti-slop catalog + WCAG accessibility floor check, plus the content-stress pass in `references/content-stress.md`.
 - `dw-chaos-engineering`: **(by name only)** — adversarial pass over a change whose normal tests already pass. Ask for it after QA is green when resilience matters more than coverage; it writes tests only, runs locally, and caps at 3 rounds. Never auto-invoked.
 - `dw-verify`: **(in `--fix` mode — ALWAYS)** — before marking any bug `Fixed` or `Closed`, requires VERIFICATION REPORT PASS (test + lint + build) AND retest evidence (screenshot in UI mode, JSONL log in API mode, eval-run delta in AI mode).
 
@@ -92,7 +92,8 @@ Read the affected module's quality baseline/TechSpec. Reuse valid required-check
    - Negative flows (unauthorized actions, malformed input).
    - Regressions (smoke check on adjacent surfaces).
    - WCAG 2.2 accessibility check per `dw-ui-discipline/references/accessibility-floor.md`.
-4. **Capture evidence**: screenshots at 375px mobile + 1440px desktop, console logs, network HARs.
+   - Content stress per `dw-ui-discipline/references/content-stress.md` for every surface that renders user or API data: map the rendered fields and their limits, build a realistic worst-case fixture (plus empty, one and 1,000+ rows), inject it at the data boundary — the project's own fixtures/mocks, or `page.route()` in the test; never by editing the component — and check it at the real container width, 320px, 200% zoom, and dark mode/RTL when the product supports them. Each break goes to `bugs.md` with the reference's severity mapping (Broken → high, Ugly → medium, Fragile → low). Mobile-platform behaviour (sticky hover, input zoom, safe areas) does not reproduce in emulation: list it in `qa-report.md` as needing a real device instead of marking it passed.
+4. **Capture evidence**: screenshots at 375px mobile + 1440px desktop, console logs, network HARs; for the content-stress pass, screenshots of the worst-case fixture at 320px and at 200% zoom.
 5. **Detect stub/placeholder pages**: any page that looks "TODO" or has obvious dummy content → flag as a bug.
 6. **Write `qa-report.md`**: test plan, execution log, evidence references, bug count by severity.
 7. **Write `bugs.md`**: one entry per bug found, with severity, repro steps, evidence link, status (`Open`).
@@ -117,7 +118,7 @@ Read the affected module's quality baseline/TechSpec. Reuse valid required-check
    - Agent: outcome assertion + trajectory match (per `--ai-mode` parameter or feature config).
    - Classification: exact match accuracy.
 3. Log JSONL to `QA/logs/ai/<feature>-<date>.jsonl`.
-4. Compare to prior run's JSONL — alert on >10% regression in any metric.
+4. Compare to the prior run's JSONL case by case: list every case that flipped pass → fail and file each one as a bug, whatever the averages say. Then alert on >10% regression in any metric. Run the `holdout` split too and report it apart from `dev`.
 5. Append AI-mode section to `qa-report.md`.
 
 ## Mode 1.5: Interactive UAT (`/dw-qa --uat`)

package/scaffold/en/commands/dw-redesign-ui.md

@@ -38,7 +38,7 @@ digraph redesign_decision {
 
 ## Complementary Skills
 
-When available in the project under `./.agents/skills/`, use these to guide the redesign:
+When available in the project under `./.dw/skills/`, use these to guide the redesign:
 
 - `dw-ui-discipline`: **REQUIRED** — runs the 4-checkpoint hard-gate (brand authorities OR curated defaults; surface job sentence; complete state matrix; scene sentence) BEFORE any design proposal. The 14 anti-slop patterns are checked against each proposed direction. The WCAG 2.2 AA floor is non-negotiable at the validate step.
 - `vercel-react-best-practices`: use when the project is React/Next.js for performance and implementation patterns
@@ -58,10 +58,10 @@ Use diagnostic tools based on the project's framework:
 1. Identify the target: page, component, or route to be redesigned.
 2. **AUDIT**: read the current implementation, identify the CSS stack (Tailwind, CSS Modules, styled-components, etc.), capture the before-state screenshot (Playwright MCP, or `node .dw/scripts/lib/capture-screenshots.mjs` as the WSL-resilient fallback), run react-doctor if React project.
 3. Ask 3 to 5 questions about redesign goals: style direction, brand constraints, inspirations, target audience, priority devices.
-4. **PROPOSE**: present 2 to 3 design directions after passing the `dw-ui-discipline` hard-gate (brand authorities or curated defaults selected; surface job sentence written; state matrix enumerated; scene sentence written). Each direction lists color palette, typography pairing, layout style, and rationale. Self-check each direction against the 14 anti-slop patterns. For EACH direction, explicitly describe the mobile layout (<=768px) and desktop layout (>=1024px), including how elements reorganize, stack, or hide between breakpoints.
+4. **PROPOSE**: present 2 to 3 design directions after passing the `dw-ui-discipline` hard-gate (brand authorities or curated defaults selected; surface job sentence written; state matrix enumerated; scene sentence written). Directions must diverge on a named axis — layout, density, personality, motion, or interaction model — and are named for that direction ("Quiet", "Editorial", "Dense"), never "Option A/B/C"; three tints of the same idea count as one direction. Each direction lists its axis, color palette, typography pairing, layout style, and rationale. Self-check each direction against the 14 anti-slop patterns. For EACH direction, explicitly describe the mobile layout (<=768px) and desktop layout (>=1024px), including how elements reorganize, stack, or hide between breakpoints.
 5. Wait for explicit user approval before implementing.
 6. **IMPLEMENT**: apply the chosen design with a mobile-first approach — implement the mobile layout first, then add media queries/breakpoints for tablet and desktop. Respect the existing stack. Use `vercel-react-best-practices` for React/Next.js. Maintain the project's CSS methodology.
-7. **VALIDATE**: capture after-state in BOTH resolutions (mobile and desktop), compare before/after, verify accessibility against `dw-ui-discipline/references/accessibility-floor.md` (WCAG 2.2 AA — non-negotiable: contrast, focus-visible, keyboard nav, ARIA, no traps), run react-doctor `--diff` if React. Capture screenshots at 375px (mobile) and 1440px (desktop) — `node .dw/scripts/lib/capture-screenshots.mjs --url <url> --widths 375,1440` is the WSL-resilient path; see the "Browser on WSL" section of `dw-testing-discipline/references/playwright-recipes.md`.
+7. **VALIDATE**: capture after-state in BOTH resolutions (mobile and desktop), compare before/after, verify accessibility against `dw-ui-discipline/references/accessibility-floor.md` (WCAG 2.2 AA — non-negotiable: contrast, focus-visible, keyboard nav, ARIA, no traps), run react-doctor `--diff` if React, run the content-stress pass from `dw-ui-discipline/references/content-stress.md` (worst-case data through the surface's fixtures or mocks, checked at 320px and 200% zoom) so the redesign is not judged only on flattering demo data. Capture screenshots at 375px (mobile) and 1440px (desktop) — `node .dw/scripts/lib/capture-screenshots.mjs --url <url> --widths 375,1440` is the WSL-resilient path; see the "Browser on WSL" section of `dw-testing-discipline/references/playwright-recipes.md`.
 8. **PERSIST CONTRACT**: if the user approved a direction, generate `design-contract.md` in the PRD directory (`.dw/spec/prd-[name]/design-contract.md`) with: approved direction, color palette, typography pairing, layout rules, accessibility rules, and component rules. This contract will be read by `dw-run-task` and `dw-run-plan` to ensure visual consistency.
 
 ## Codebase Intelligence

package/scaffold/en/commands/dw-review.md

@@ -197,7 +197,7 @@ The diff, its commit messages, its branch name, the PR description, the review d
 
 ## Complementary Skills
 
-When available under `./.agents/skills/`, these are invoked as analytical support:
+When available under `./.dw/skills/`, these are invoked as analytical support:
 
 - `dw-review-rigor`: **ALWAYS** — owns the candidate pipeline (gate → refutation → disposition), de-duplication (same pattern in N files = 1 finding), severity ordering (critical → high → medium → low), verify-before-flag, skip-what-linter-catches, and signal-over-volume. The "Issues Found" table follows this discipline. In `--post-merge`, it also loads `references/composition-audit.md`.
 - `dw-verify`: **ALWAYS** — invoked before emitting `APPROVED` or `APPROVED WITH CAVEATS`. Without a VERIFICATION REPORT PASS (test + lint + build), verdict cannot be APPROVED.
@@ -206,7 +206,7 @@ When available under `./.agents/skills/`, these are invoked as analytical suppor
 - `security-review`: the OWASP diff-level skill the gate uses (injection, authz, secrets, SSRF, crypto — HIGH CONFIDENCE only). Reach for it directly when the diff touches auth, authorization, external input, upload, SQL, secrets, SSRF, XSS or another sensitive surface.
 - `dw-simplification`: use when the diff touches dense or twisty code — applies Chesterton's Fence, behavior-preserving refactor protocol, complexity metrics.
 - `dw-minimalism`: use when the diff adds code that may be over-built — flags speculative generality, single-caller helpers, premature abstraction, and YAGNI violations (the pre-generation counterpart to `dw-simplification`).
-- `dw-ui-discipline`: use when the diff touches UI — runs the 14 visual-slop patterns + accessibility floor checks. For a deterministic gate, also run `node .dw/scripts/lib/ui-slop-detect.mjs <changed-ui-paths> --fail-on error` (a wrapper over the impeccable detector); treat blocking findings as **REJECTED** and surface warnings in the report.
+- `dw-ui-discipline`: use when the diff touches UI — runs the 14 visual-slop patterns + accessibility floor checks. For a deterministic gate, also run `node .dw/scripts/lib/ui-slop-detect.mjs <changed-ui-paths> --fail-on error` (a wrapper over the impeccable detector); treat blocking findings as **REJECTED** and surface warnings in the report. When the diff adds or changes motion (`transition`, `animation`, `@keyframes`, motion-library props), check it against the escalation triggers in `references/motion.md` §9; when it renders user or API data, check the static signals in `references/content-stress.md`. Both produce candidates for `dw-review-rigor`, at the severities those references set.
 - `dw-testing-discipline`: use when the diff touches tests — applies the 25 anti-patterns catalog + 6 agent guardrails (when tests were agent-authored).
 - `dw-llm-eval`: **REQUIRED when the diff touches AI/LLM feature code paths**. Reference dataset + ≥2 oracle rungs + judge calibration (if rung 4 used) + eval run results MUST be in the PR. Missing → REJECTED.
 - `vercel-react-best-practices`: use when the diff touches React/Next.js.

package/scaffold/en/commands/dw-skill-health.md

@@ -7,7 +7,7 @@ You are the dev-workflow skill and agent health auditor.
 - Use before promoting a learned pattern into a reusable skill.
 
 ## Process
-1. Read `scaffold/skill-registry.json` when auditing the dev-workflow repo, or `.dw/skill-registry.json` + installed `.agents/skills/` in consumer projects.
+1. Read `scaffold/skill-registry.json` when auditing the dev-workflow repo, or `.dw/skill-registry.json` + the bundled skills installed in `.dw/skills/` in consumer projects. Skills under `.claude/skills/`, `.agents/skills/` and the other agent indexes are command wrappers or the user's own; a dev-workflow skill found there is a legacy copy that `update` removes.
 2. Group skills by `kind`: `protocol`, `domain-pack`, `recipe-pack`, `asset-pack`.
 3. Validate every skill has a trigger, expected output, owner, load policy, and context limit.
 4. Validate every bundled `SKILL.md` has a `## Structured Return` contract with `Status`, `Scope`, `Evidence`, `Artifacts`, `Decisions`, `Risks`, and `Next Step`.
@@ -59,6 +59,28 @@ Declare the window before any judgement: count the instrumented rows — those c
 
 Recommend demotion only when ALL hold: model-invocable cohort; at least 20 instrumented sessions or 30 days of window; zero references; no artifact signal; owner command reachable. Below that, print the counts and say the window is too short to conclude. Removing a bundled skill from the package is an append-only entry in `lib/removed-bundled-skills.js` — this command proposes, it never removes and never deletes files.
 
+### Commands — which entries earn their place in the index
+
+Every installed `dw-*` command is one entry in each agent's skill index, and a crowded index degrades the choice the model makes there. Rows carrying a `commands` object record which commands the session loaded: a read of `.dw/commands/<name>.md` (every wrapper performs one) or a Skill-tool call naming the command. The skill rules apply unchanged: an absent `commands` key is no telemetry, the window is counted only from rows carrying `commands`, and the count measures loading, not success. The hook parses Claude Code transcripts only; when the project also runs Codex, Copilot or OpenCode, say that their sessions are not in the count.
+
+Print one table: command, sessions that loaded it, references. Then, for each family of commands that share a purpose, print the members' counts side by side:
+
+| Family | Members |
+|---|---|
+| Subagent handoff | `dw-subtask-start`, `dw-subtask-complete`, `dw-subtask-resume` |
+| External runners | `dw-codex-run`, `dw-claude-run`, `dw-copilot-run` |
+| Cloud skill installers | `dw-install-aws-skills`, `dw-install-azure-skills` |
+| Install and context audits | `dw-skill-health`, `dw-harness-audit`, `dw-context-budget` |
+| Session checkpoint | `dw-pause`, `dw-resume` |
+
+Classify each family:
+
+- `MERGE CANDIDATE` — the window holds at least 20 instrumented sessions or 30 days, and the whole family was loaded in fewer than 5% of them, or some member was never loaded while another was. One command with modes would cost the index fewer entries.
+- `KEEP SEPARATE` — two or more members were each loaded in at least 5 sessions: the distinct names are in use, and merging them trades a measured habit for a smaller index.
+- `TOO EARLY` — below the window threshold. Print the counts and say so.
+
+Commands outside any family follow the skill wording: a model-invocable command with zero loads over a long enough window is an `IDLE CANDIDATE`, never "unused". A merge or removal in the package is a product decision recorded append-only in `lib/removed-commands.js` (the update then removes the old wrappers); this command proposes, it never renames, removes or edits commands. When auditing the dev-workflow repository itself there is no local telemetry: report `NO TELEMETRY` unless the maintainer supplies `costs.jsonl` files from consumer projects, and aggregate those per project before adding them up.
+
 ## Output
 
 When `.dw/config/routing-defaults.json` exists, compare its current candidates with the owner's `.dw/config/routing.json`. Report relevant differences and validate proposed models/capabilities before adoption. Different values can be intentional; do not treat them as failed migration or overwrite them automatically. Approved task assignments take precedence over either candidate file.
@@ -70,6 +92,7 @@ Include:
 - Registry/schema issues.
 - Structured-return coverage, including any skill missing the contract or status vocabulary.
 - Usage evidence: the declared window, the per-cohort tables, and every idle candidate with its window sentence. When telemetry is missing, say so instead of scoring.
+- Command usage: the per-command table and each family's classification (`MERGE CANDIDATE`, `KEEP SEPARATE`, `TOO EARLY`).
 - Top 3 fixes.
 
 Final marker: `## SKILL-HEALTH COMPLETE`

package/scaffold/en/commands/dw-update.md

@@ -24,14 +24,15 @@ Before overwriting managed files, create a snapshot:
 ```bash
 SNAPSHOT_DIR=".dw/.backup/$(date -u +%Y%m%dT%H%M%SZ)"
 mkdir -p "$SNAPSHOT_DIR"
-cp -r .dw/commands .dw/templates .dw/references .dw/scripts "$SNAPSHOT_DIR/" 2>/dev/null
+cp -r .dw/commands .dw/templates .dw/references .dw/scripts .dw/skills "$SNAPSHOT_DIR/" 2>/dev/null
 [ -d .agents/skills ] && cp -r .agents/skills "$SNAPSHOT_DIR/agents-skills" 2>/dev/null
 # .claude/settings.json is now mutated by update (MCPs + hooks + statusLine)
 [ -f .claude/settings.json ] && mkdir -p "$SNAPSHOT_DIR/claude" && cp .claude/settings.json "$SNAPSHOT_DIR/claude/settings.json" 2>/dev/null
+[ -f .dw/install-state.json ] && cp .dw/install-state.json "$SNAPSHOT_DIR/install-state.json" 2>/dev/null
 echo "Snapshot saved to $SNAPSHOT_DIR"
 ```
 
-Keep only the 3 most recent snapshots (remove older ones) to avoid buildup.
+Keep only the 3 most recent snapshots in `.dw/.backup/` (remove older ones) to avoid buildup. `.dw/.migrated/` is not a snapshot: never prune it.
 
 ### 1. Record Current Version (Required)
 
@@ -85,7 +86,13 @@ The `update` command overwrites managed files and PRESERVES:
 
 The `update` command also runs the GSD migration step automatically — if a project has legacy `.planning/` (from prior GSD usage), the contents are migrated to `.dw/intel/`, `.dw/spec/active-session.md`, `.dw/spec/quick/`, etc., and `.planning/` is renamed to `.planning.gsd-archive-<DATE>/` for inspection. The `.claude/commands/gsd/`, `.claude/agents/gsd-*.md`, `.claude/hooks/gsd-*.js`, and `.claude/gsd-file-manifest.json` files are removed during the migration.
 
-If the update fails (network error, permission, package unavailable): report the error to the user and STOP. Do NOT attempt manual workarounds like copying files by hand.
+The CLI never deletes what it retires: it moves it to `.dw/.migrated/<timestamp>/`, keeping the relative path, and prints the destination. It does this only after the new skills are in `.dw/skills/`, so an interrupted update leaves the old copies in place. What it retires, and how it decides:
+
+- **Legacy bundled-skill copies** under `.agents/skills/` (`[moved]`): only when the copy is dev-workflow's. A same-named skill that is not is printed as `[kept]` and left alone.
+- **Skills removed in past releases** (`[v<N>]`) and **removed command sources** (`[legacy]`): matched by name, so a same-named skill from elsewhere is moved too — the move is what makes that recoverable.
+- **Orphan `dw-*` wrappers** (`[orphan]`): `dw-` is this package's namespace; a user skill named `dw-*` is moved, not lost.
+
+If the update fails (network error, permission, package unavailable): report the error to the user and STOP. Do NOT attempt manual workarounds like copying files by hand. Give the user the snapshot path from step 0 and the two ways out: re-run the update once the cause is fixed (it is idempotent), or `/dw-update --rollback`.
 
 ### 4. Capture New Version
 
@@ -95,7 +102,7 @@ node -e 'const s = JSON.parse(require("node:fs").readFileSync(".dw/install-state
 
 ### Upgrade compatibility checks
 
-Read the refreshed `.dw/commands/dw-update.md` after the CLI completes. Use `.dw/install-state.json` and the CLI's `Installed version` output for the version delta: an `npx` package need not be resolvable from the consumer's `node_modules`. A missing or invalid new install state is a failed verification; do not claim the update succeeded.
+Read the refreshed `.dw/commands/dw-update.md` after the CLI completes. Use `.dw/install-state.json` and the CLI's `Installed version` output for the version delta: an `npx` package need not be resolvable from the consumer's `node_modules`. A missing or invalid new install state is a failed verification; do not claim the update succeeded. The version read in step 4 must equal the right-hand side of the CLI's `Installed version: <old> -> <new>` line; if that line is missing, or the versions differ, the CLI did not finish and the update failed.
 
 For an upgrade from before 2.3.0 (or an unknown legacy version):
 
@@ -115,6 +122,7 @@ Present to the user:
 - Summary of what the `update` output showed (files copied, wrappers generated, MCPs configured)
 - The `Post-update agent actions` printed by the CLI
 - Any warnings or errors
+- Every `[moved]`, `[v<N>]`, `[orphan]`, `[legacy]` or `[kept]` line from `Skill migration`, the `.dw/.migrated/<timestamp>/` path, and any file flagged `was not installed by dev-workflow` (the team's own addition: offer to bring it back into a skill of their own, never into `.dw/skills/`, which update overwrites)
 
 ### 6. Run Post-Update Agent Actions (Required)
 
@@ -143,19 +151,28 @@ If invoked with `--rollback`:
 1. List snapshots in `.dw/.backup/`
 2. If none exist: STOP and report "No snapshot available"
 3. If more than one exists: ask the user which to restore (default: most recent)
-4. Confirm with the user: "Restore snapshot `<path>`? This OVERWRITES `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/`, `.agents/skills/`, and `.claude/settings.json`. Proceed? [y/N]"
+4. Confirm with the user: "Restore snapshot `<path>`? This REPLACES `.dw/commands/`, `.dw/templates/`, `.dw/references/`, `.dw/scripts/` and `.dw/skills/` with the snapshot's copies (when the snapshot has them), copies the snapshot's `.agents/skills/` back over the current one without removing other entries, and restores `.claude/settings.json` and `.dw/install-state.json`. `.dw/templates/overrides/` is never touched. Proceed? [y/N]"
 5. Only after `y`: copy back
 
 ```bash
-cp -r "$SNAPSHOT_DIR/commands"   .dw/
-cp -r "$SNAPSHOT_DIR/templates"  .dw/
-cp -r "$SNAPSHOT_DIR/references" .dw/ 2>/dev/null
-cp -r "$SNAPSHOT_DIR/scripts"    .dw/ 2>/dev/null
-[ -d "$SNAPSHOT_DIR/agents-skills" ] && cp -r "$SNAPSHOT_DIR/agents-skills" .agents/skills 2>/dev/null
+SNAPSHOT_DIR=".dw/.backup/<chosen-timestamp>"   # the snapshot confirmed in step 4
+[ -d "$SNAPSHOT_DIR" ] || { echo "Snapshot not found: $SNAPSHOT_DIR"; exit 1; }
+# Managed .dw folders are replaced, so files added by the newer release do not linger.
+for d in commands references scripts skills; do
+  [ -d "$SNAPSHOT_DIR/$d" ] && rm -rf ".dw/$d" && cp -r "$SNAPSHOT_DIR/$d" .dw/
+done
+# .dw/templates/overrides/ is the owner's: restore the managed templates around it, never remove it.
+if [ -d "$SNAPSHOT_DIR/templates" ]; then
+  find .dw/templates -mindepth 1 -maxdepth 1 ! -name overrides -exec rm -rf {} +
+  for f in "$SNAPSHOT_DIR/templates"/*; do [ "$(basename "$f")" = overrides ] || cp -r "$f" .dw/templates/; done
+fi
+# .agents/skills is shared with the user's own skills: merge, never replace.
+[ -d "$SNAPSHOT_DIR/agents-skills" ] && mkdir -p .agents/skills && cp -r "$SNAPSHOT_DIR/agents-skills/." .agents/skills/ 2>/dev/null
 [ -f "$SNAPSHOT_DIR/claude/settings.json" ] && cp "$SNAPSHOT_DIR/claude/settings.json" .claude/settings.json 2>/dev/null
+[ -f "$SNAPSHOT_DIR/install-state.json" ] && cp "$SNAPSHOT_DIR/install-state.json" .dw/install-state.json 2>/dev/null
 ```
 
-6. Report: snapshot restored, version likely recovered (read from `.dw/commands/dw-help.md` or metadata if present)
+6. Report: snapshot restored, and the version from the restored `.dw/install-state.json` (or "unknown" when the snapshot predates it). A snapshot taken before 2.7.0 has no `skills/`: `.dw/skills/` then stays as it was, which is harmless (older commands read `.agents/skills/`), and the next update retires the restored `.agents/skills/` copies again.
 
 ## Advanced Options
 

package/scaffold/en/references/invariants.md

@@ -81,6 +81,10 @@ This floor is narrow by design. Something genuinely destructive that is not list
 apply the same standard: if the action destroys work with no second copy, rewrites shared history, or moves
 a credential, stop and ask. An extra confirmation costs a message.
 
+The same holds for the skill folders agents share — `.agents/skills/`, `.claude/skills/`, `.codex/skills/`:
+they hold the user's and other tools' skills too. Outside the CLI's own `update`/`uninstall`, list what
+you would remove and ask per entry; move what is approved to `.dw/.migrated/<timestamp>/`, never `rm` it.
+
 ## Attribution
 
 The two-layer model — a floor that project rules may only tighten, never loosen — is adapted from the

package/scaffold/en/templates/project-onepager.md

@@ -80,7 +80,7 @@ services: []
 │   └── api/                      (created by `pnpm dlx @nestjs/cli` or selected scaffold)
 ├── packages/
 │   └── shared/                   (created by /dw-new-project)
-├── docker-compose.dev.yml        (composed from .agents/skills/docker-compose-recipes/)
+├── docker-compose.dev.yml        (composed from .dw/skills/docker-compose-recipes/)
 ├── .env.example                  (consolidated from selected services)
 ├── .gitignore                    (per stack)
 ├── .dockerignore                 (per stack)

package/scaffold/pt-br/agent-instructions.md

@@ -27,7 +27,7 @@ Na quebra de tasks, proponha desenvolvimento local ou cruzado e modelo, esforço
 
 Claude pode delegar implementação por `/dw-codex-run`; Codex pode usar `/dw-claude-run`. O parent conduz review, correções e continuidade. Agentes locais herdam o modelo da sessão salvo override aprovado na task. Delegue trabalho independente e delimitado quando melhorar qualidade ou tempo; mantenha trabalho pequeno ou acoplado local. Máximo de 3 workers por fluxo e nunca escritores simultâneos no mesmo worktree.
 
-Leia primeiro arquivos relevantes. Use `.dw/intel/` ou code-explorer quando ajudar em fluxos amplos ou desconhecidos, conferindo o índice contra o código atual. Carregue entrypoints de skills somente para tasks correspondentes e referências somente para o modo escolhido. Subagentes recebem um pacote compacto e retornam evidências e decisões, não logs completos.
+Leia primeiro arquivos relevantes. Use `.dw/intel/` ou code-explorer quando ajudar em fluxos amplos ou desconhecidos, conferindo o índice contra o código atual. Carregue entrypoints de skills somente para tasks correspondentes e referências somente para o modo escolhido. As skills do dev-workflow ficam em `.dw/skills/<nome>/`; quando um comando nomear uma, leia de lá. `.agents/skills/` e `.claude/skills/` também guardam skills do usuário e de outras ferramentas: fora do `update`, não apague nada ali sem listar e perguntar antes. Subagentes recebem um pacote compacto e retornam evidências e decisões, não logs completos.
 
 ## Conclusão e limites
 

package/scaffold/pt-br/commands/dw-brainstorm.md

@@ -61,7 +61,7 @@ digraph brainstorm_decision {
 
 ## Skills Complementares
 
-Quando disponíveis no projeto em `./.agents/skills/`, use para enriquecer a ideação:
+Quando disponíveis no projeto em `./.dw/skills/`, use para enriquecer a ideação:
 
 - `dw-council`: invocada pelo modo **council** do dispatcher — stress-test multi-advisor das opções mais promissoras com steel-manning obrigatório e concession tracking. O dispatcher dispara quando 2+ caminhos empatam OU consenso se forma rápido demais (sinal de false-consensus). Não roda em todo brainstorm — só quando os sinais justificam.
 - `dw-simplification`: invocada pelo modo **refactor-audit** — aplica Chesterton's Fence + métricas de complexidade + a nova referência **deep-modules** (deletion test, locality, leverage, interface depth) em todo smell flagueado.
@@ -345,7 +345,7 @@ entre turns e escreve arquivos. Por ser stateful e mutante, começa **só com in
 
 <critical>Pergunte exatamente UMA decisão não-resolvida por interação, e espere. Nunca despeje uma lista de perguntas.</critical>
 
-Grill é movido por duas skills internas (lidas por path em `./.agents/skills/`, nunca exportadas):
+Grill é movido por duas skills internas (lidas por path em `./.dw/skills/`, nunca exportadas):
 - **`dw-grilling`** — o motor de entrevista em árvore de decisão (ordenação por dependência, uma decisão por
   turn, uma resposta recomendada para cada pergunta, fatos descobertos em vez de perguntados, o gate de
   shared-understanding).

package/scaffold/pt-br/commands/dw-bugfix.md

@@ -36,7 +36,7 @@
 
     ## Skills Complementares
 
-    Quando disponíveis no projeto em `./.agents/skills/`, use estas skills como suporte contextual sem substituir este comando:
+    Quando disponíveis no projeto em `./.dw/skills/`, use estas skills como suporte contextual sem substituir este comando:
 
     - `dw-debug-protocol`: **SEMPRE** — conduz o bug pelo six-step triage (Reproduzir → Localizar → Reduzir → Fix Root Cause → Guardar → Verificar End-to-End). Stop-the-line discipline; root-cause sobre symptom; regression test commitado no mesmo commit atômico. Para bugs não triviais, ou depois que a primeira tentativa de fix falhar, o Passo 1 precisa estabelecer um loop de feedback red-capable antes de teorizar. Bugs não-reprodutíveis seguem o sub-protocolo instrument-first — sem fix por palpite a não ser com acknowledgement explícito.
     - `dw-verify`: **SEMPRE** — em modo Direto, invocada antes do commit da correção. O VERIFICATION REPORT deve mostrar que o sintoma original do bug não se reproduz mais (não apenas que os testes passam).

package/scaffold/pt-br/commands/dw-commit.md

@@ -11,7 +11,7 @@
 
     ## Skills Complementares
 
-    Quando disponíveis no projeto em `./.agents/skills/`, use estas skills como suporte operacional sem substituir este comando:
+    Quando disponíveis no projeto em `./.dw/skills/`, use estas skills como suporte operacional sem substituir este comando:
 
     - `dw-git-discipline`: **SEMPRE** — aplica atomic commits (uma intenção lógica por commit; refactor separado de feature), formato Conventional Commits, lint+tests+build verdes ANTES do commit e proíbe pular hooks (`--no-verify`) ou amend de commits já empurrados. Em mudanças mistas, separa via `git add -p`.
 

package/scaffold/pt-br/commands/dw-dockerize.md

@@ -44,7 +44,7 @@ Este comando e **complementar** ao `/dw-new-project`:
 - Relatório: `.dw/audit/dockerize-<YYYY-MM-DD>.md` (escopo PRD: `.dw/spec/prd-<slug>/dockerize.md`)
 - Artefatos dev gerados: `<SCOPE>/docker-compose.dev.yml`, `<SCOPE>/Dockerfile.dev`, `<SCOPE>/.dockerignore`
 - Artefatos prod gerados: `<SCOPE>/Dockerfile`, `<SCOPE>/docker-compose.prod.yml` (opcional), `<SCOPE>/.dockerignore`
-- Fonte das receitas: `.agents/skills/docker-compose-recipes/services/*.yml`
+- Fonte das receitas: `.dw/skills/docker-compose-recipes/services/*.yml`
 
 ## Comportamento Obrigatório — Pipeline
 
@@ -163,7 +163,7 @@ Sem aprovação: escreve relatório (Fase 3 com `status: PLANNED`) e para.
 #### 2.1 Artefatos `--dev`
 
 **`docker-compose.dev.yml`**:
-- Componha blocos de `.agents/skills/docker-compose-recipes/services/*.yml` segundo `references/compose-composition.md`.
+- Componha blocos de `.dw/skills/docker-compose-recipes/services/*.yml` segundo `references/compose-composition.md`.
 - Adicione service(s) do app no fim: `build: { context: ., dockerfile: Dockerfile.dev }`, `volumes` para hot reload (bind mount do source, anonymous volume para `node_modules`/`__pycache__`), `env_file: .env`, `depends_on` com `condition: service_healthy` segundo `references/healthcheck-patterns.md`.
 - Preserve a tag da imagem de cada recipe (NÃO converta nenhuma para digest — digest congela a base e nunca alcanca um rebuild de segurança), as vars de credencial obrigatórias e os binds em `127.0.0.1`. As portas loopback mantem intencionalmente a topologia `apps no host` funcionando.
 - Header: `# Generated by /dw-dockerize on YYYY-MM-DD`.