Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.
Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.
New wf-readme workflow (grounded README creation/audit/rewrite) built on
readme-crafter, good-readme and curating-readme skills. Validated with the
QA harness: 302.3 -> 379.0 on the same ruler, all phases verified, no
false-positive skill refs.
Applied it to this repo: audit-repo.sh scan, link/TOC/em-dash validation,
added CONTRIBUTING.md (gap the workflow flagged) and wired the docs.
Add pbakaus/impeccable (v4.1.1, 23 design commands, 59 deterministic
anti-slop rules) to the frontend workflow and READMEs.
Document the QA harness measurements in both READMEs: before/after
workflow scores on the same ruler (total +98.6%), the four green gates,
the meta-tests, and what the refinement added. Full snapshot history
is in qa/snapshots/.
Four SKILL.md-based workflows for agent-driven development: frontend/UI,
backend/API, architecture, and security code review.
Each workflow defines phases with verification steps, acceptance criteria
and hard rules so agents deliver work that can be checked instead of
asserted. The security review consults live sources (OSV.dev, GitHub
Advisory, NVD) because model CVE knowledge is frozen at training cutoff.
Includes a QA harness (qa/) that scores workflows on 30+ criteria, a
non-regression gate, and meta-tests that corrupt the harness to prove it
detects regressions.
evandrodevbr