Dotboost

Not redacted - never loaded.

.env, every *.local.php, config/autoload/local.php, local.test.php and data/oauth/. Database credentials, OAuth signing keys and environment secrets stay out of the transcript.

The files a diff should never touch by accident.

Dependency manifests - composer.json, composer.lock, package.json, package-lock.json - plus vendor/, node_modules/, data/, log/, public/uploads/ and anything under Migration/.

Commands that change your tree without a diff.

composer require, remove, update, install, global; the npm, yarn and pnpm install verbs; git push, reset --hard, clean, submodule; and rm -rf.

Preference, not policy - override per machine.

Ask: migrations, bin/doctrine, database clients, git commits and merges, pipeline and authorization config, the QA config files. Allow: the Composer QA scripts, vendor/bin tools, php -l, and read-only git. Layer changes in settings.local.json, never the shared file.

Path patterns miss what a shell can hide.

guard-bash.sh inspects the command itself, so cd src && composer require foo is caught where a path-based rule would let it through. guard-protected-paths.sh covers edits, and redirects a blocked *.local.php edit to its .dist template.

Deliberately no phpcbf, no --fix.

php-lint.sh and markdown-lint.sh report and stop, because reformatting a file right after it is written invalidates the in-memory copy and breaks the next targeted edit. Bulk formatting belongs at the end of a task. Both skip silently when their tool is missing.

The part a cleared session cannot reconstruct from src/.

One markdown file per feature - what it does, why, the routes and the roles that reach them, the data added, how to exercise it. Where it lands is detected, not assumed: documentation/features/ when that directory exists, docs/features/ otherwise, never a second documentation root beside an existing one. The frontmatter is load-bearing - /dk-review greps routes: and handlers: to decide whether a new route in the diff is documented.

The same numbers /usage reports.

5h and 7d account usage in the status bar, read from the rate-limit payload Claude Code 2.1+ passes on stdin. Pure bash and awk - no jq, no python, no transcript scanning or guessed token budgets, so it works in Git Bash on Windows.

What it detected, before you ask anything.

Which variant, the root namespace, the authorization style, the branch, which config files are still missing - and a CRLF warning when it finds one. The same hook prints the feature-docs directory and a doc count, so the files are discoverable even without the CLAUDE.md block.

Dotkernel repos ship * text eol=lf.

Belt and braces, configure the client so nothing converts: core.autocrlf false, core.eol lf, core.safecrlf warn. Already committed CRLF? Renormalise once with git add --renormalize .. normalize-file.sh keeps new writes clean.

Handlers, HAL collections, OpenAPI attributes.

A REST API on a PSR-15 middleware pipeline, with OAuth 2.0, RBAC, HAL payloads and an OpenAPI 3.0 specification wired up on install.

Forms, CSRF, route-name authorization keys.

Table-based record management with RBAC guards, CSRF-protected forms and 2FA, over the shared Core module.

Action controllers and action-level guards.

A web starter skeleton - user accounts, a contact form, sessions and RBAC-guarded controller actions, rendered on the server.

Minimal modules, config-declared template routes.

The smallest complete Mezzio application - routing, pipeline and Twig, six direct dependencies and no database layer.

Message handlers and background workers.

Background workers on Symfony Messenger - a TCP listener, Valkey streams, retries and a dead letter queue for what still fails.