@bonesofspring/ai-rules 0.2.10 → 0.2.12

package/presets/cursor/mcp-ts/rules/mcp-auth-secrets.mdc

@@ -0,0 +1,45 @@
+---
+description: MCP env config, remote auth, redaction, secret handling
+globs:
+  - **/auth/**/*
+  - **/config/**/*
+  - **/.env*
+  - **/secrets/**/*
+alwaysApply: false
+---
+
+# MCP auth and secrets
+
+## Local stdio
+
+- Prefer env-based configuration for API keys and tokens; never commit live secrets.
+- Redact secrets in logs, error strings, and tool results.
+- Handlers receive only the credentials they need via narrow capability adapters — not `process.env` wholesale.
+
+## Remote / HTTP servers
+
+When remote transport is enabled (see `mcp-transport-packaging`):
+
+- Choose an auth mode explicitly (none only for trusted local-only; bearer/OAuth when exposed).
+- Fail closed when required auth config is missing in non-dev environments.
+- **Per-request authorization (required for bearer/OAuth):** on every request, validate token **issuer**, **audience**, **expiry**, and **scopes/roles** before tool/resource/prompt dispatch. Reject with a safe error if any check fails.
+- Place the authenticated principal (subject + granted scopes) into a **trusted request context** owned by the transport/auth layer — handlers must not re-parse raw `Authorization` headers.
+- Authorize each tool/resource against that context (capability ≠ “any authenticated caller”).
+- Validate and canonicalize untrusted inputs at the boundary before handlers run.
+- **TLS required** for any non-localhost exposure (or a trusted TLS-terminating proxy with a documented trust boundary). Never send bearer/OAuth tokens in plaintext over the network. Bind `127.0.0.1` for local remote-dev; treat `0.0.0.0` as exposed.
+- Safe errors: no token, cookie, or raw header echo in HTTP or tool error bodies.
+- OAuth redirect URIs: allowlist exact redirect targets — reject open redirects.
+
+## Forbidden
+
+- Hardcoded API keys/tokens in source or example configs with live-looking values.
+- Returning raw Authorization headers, cookies, or private keys in tool output.
+- Broad filesystem or network tools that inherit ambient credentials without AC.
+- Trusting client-supplied identity claims without server-side token validation.
+- Putting live tokens into shipped client `mcp.json` / `.mcp.json`.
+
+## Tests
+
+- Negative fixtures: logs/results must not contain bearer tokens or secret env values.
+- Misconfigured auth refuses to start or rejects requests (fail closed).
+- Expired / wrong-audience / insufficient-scope tokens are rejected before handlers run.

package/presets/cursor/mcp-ts/rules/mcp-contract-testing.mdc

@@ -0,0 +1,43 @@
+---
+description: MCP schema snapshots, contract fixtures, optional Inspector smoke
+globs:
+  - **/*.{test,spec}.{ts,tsx,js}
+  - **/fixtures/**/*
+  - src/tools/**/*
+  - src/resources/**/*
+  - src/prompts/**/*
+alwaysApply: false
+---
+
+# MCP contract testing
+
+Protect tool/resource/prompt **schemas and protocol behavior** — not browser E2E and not Go/Java adapter integration suites.
+
+## What to cover
+
+1. **Schema snapshots / fixtures** — registered input/output JSON Schema (or SDK registration result) matches the intended contract.
+2. **Handler unit tests** — validated inputs → expected results/errors (table-driven).
+3. **Compatibility** — additive changes OK; breaking field renames/removals need versioning or new tool names.
+4. **Inspector smoke (optional)** — MCP Inspector CLI may be used as evidence; it is **not** a required Phase 1 gate.
+
+## Workflow (Phase 1)
+
+- `feature-developer` owns contract verification inline (no `contract-test-*` agents yet).
+- Prefer repository test runner discovered via `mcp-ts-tooling`.
+- Store fixtures next to tools/tests (`*.fixture.json`, schema snapshots) per repo convention.
+
+## Security negatives (when capability touches FS / net / auth)
+
+Require at least one deny fixture per exposed capability:
+
+- FS: path traversal / outside-root rejected; secret paths not readable without AC.
+- Net: blocked host / metadata IP rejected; allowlisted host OK.
+- Auth: expired / wrong-audience / insufficient-scope rejected before handler; results must not echo tokens (`mcp-auth-secrets`).
+
+Align shapes with `tests-unit` and `security-mcp`.
+
+## Anti-patterns
+
+- Claiming "works in Inspector" without schema/unit coverage for the change.
+- Testing only TypeScript types without runtime validation of invalid inputs.
+- Requiring Playwright, XCUITest, or Next e2e paths.

package/presets/cursor/mcp-ts/rules/mcp-server-boundaries.mdc

@@ -0,0 +1,29 @@
+---
+description: MCP server module boundaries: registration, handler, capability, lifecycle
+alwaysApply: true
+---
+
+# Границы MCP-сервера
+
+Dependency direction:
+
+```text
+MCP client → transport/entry → registration → schema + handler → scoped capability
+```
+
+- **Registration** (`src/tools|resources|prompts`): owns protocol names, descriptions, schemas, result mapping. No unrelated side effects; no hidden validation skips.
+- **Handlers**: receive **validated** inputs; depend on **narrow** capability adapters (FS paths, APIs). No process-wide secrets, arbitrary filesystem, or ambient client state.
+- **Contracts**: tool/resource/prompt schemas are **versioned public interfaces**. Do not prescribe UI, DB controllers, or Go-style `domain/application/adapters` layouts.
+- **Startup / transport** (`src/index.ts`): owns transport selection, lifecycle, fail-closed config. Do not duplicate startup inside tools.
+
+# Edit bundles (load on matching paths)
+
+- `src/tools|resources|prompts/**` → `mcp-tool-design` (+ `mcp-contract-testing` when changing schemas)
+- `src/index.ts`, package/`bin` → `mcp-transport-packaging`
+- auth/config/env → `mcp-auth-secrets` + `security-mcp`
+- After `*.ts` edits → `post-change-test` (+ `mcp-ts-tooling`)
+
+# Требование к агенту
+
+- Keep registration, validation, and handlers separable — avoid a monolithic `index.ts`.
+- Prefer least privilege for every tool capability.

package/presets/cursor/mcp-ts/rules/mcp-tool-design.mdc

@@ -0,0 +1,38 @@
+---
+description: MCP tool/resource/prompt design: names, schemas, errors, least surprise
+globs:
+  - src/tools/**/*
+  - src/resources/**/*
+  - src/prompts/**/*
+alwaysApply: false
+---
+
+# MCP tool design
+
+Model-facing tools, resources, and prompts are **public contracts**. Optimize for least surprise for the calling model.
+
+## Names and descriptions
+
+- Use stable, verb-oriented tool names (`read_file`, `list_tickets`) — not internal codenames.
+- Descriptions must state **what** the tool does, **when** to use it, and key constraints (side effects, required scopes).
+- Prefer enums / closed sets over free-form strings when the domain is finite.
+- Document idempotency and destructive effects explicitly in the description.
+
+## Schemas (Zod-first authoring)
+
+- Author validation with **Zod** (or the repo's schema library) for TypeScript types + runtime checks.
+- MCP-facing input/output schemas are **JSON Schema-compatible protocol contracts**.
+- Convert with an **SDK-supported** path — never pass a Zod object as the wire schema without verifying the installed `@modelcontextprotocol/sdk` API.
+- When unsure: `// VERIFY: @modelcontextprotocol/sdk @ <version>` and look up docs (Context7).
+
+## Errors and results
+
+- Map failures to clear, actionable error messages; do not leak stack traces, secrets, or absolute internal paths.
+- Keep success payloads structured and stable; avoid dumping entire process env or large blobs by default.
+- Version breaking schema changes (new tool name or documented major) rather than silently reshaping fields.
+
+## Anti-patterns
+
+- Generic "execute_anything" / "run_shell" tools without AC and capability scoping.
+- Duplicated ad-hoc schemas in registration and handler.
+- Side effects inside registration helpers.

package/presets/cursor/mcp-ts/rules/mcp-transport-packaging.mdc

@@ -0,0 +1,44 @@
+---
+description: MCP stdio lifecycle, optional remote transport, bin/npx packaging
+globs:
+  - src/index.ts
+  - package.json
+  - **/Dockerfile
+  - **/docker-compose*.yml
+alwaysApply: false
+---
+
+# MCP transport and packaging
+
+## Default: stdio
+
+- Local Cursor/Claude use → **stdio** transport from the server entry (`src/index.ts` or equivalent).
+- Entry owns connect/listen lifecycle and graceful shutdown; tools must not open competing transports.
+- Fail closed on missing required startup configuration.
+
+## Packaging
+
+- Expose a `bin` / `npx`-friendly entry in `package.json` that runs the compiled or `tsx` entry as appropriate for the repo.
+- Keep `files` / publish contents minimal; do not ship secrets, `.env`, or local credentials.
+- Document install and run commands in the consumer README — not by registering a half-built server into shipped client MCP JSON.
+
+## Optional remote transport
+
+- Streamable HTTP / SSE / remote hosting is **opt-in** — load this rule + `mcp-auth-secrets` + `security-mcp`.
+- Require explicit AC for auth mode, network exposure, and rate limits.
+- Before exposing remotely: implement **per-request** token validation (issuer/audience/expiry/scopes) and trusted request context per `mcp-auth-secrets`; treat retrieved content as untrusted per `security-mcp`.
+- Do not mandate Docker/OAuth/Inspector for every stdio-only server.
+
+## Threat model by transport
+
+| Mode | Trust boundary | Who can invoke tools | Required controls |
+|------|----------------|----------------------|-------------------|
+| **stdio** (default) | Same machine / IDE process | Host user + IDE agent session | Least-privilege tools; no network AuthN assumed; secrets via env; fail closed on missing config |
+| **HTTP / SSE** (opt-in) | Network-reachable process | Any client that can reach bind address | **TLS required** for non-localhost (or trusted TLS-terminating proxy with documented boundary); localhost-only bind OK without TLS; auth fail-closed; per-request issuer/audience/expiry/scopes; rate limits; safe errors (no token echo) |
+
+- Prefer bind `127.0.0.1` for local remote-dev; treat `0.0.0.0` as production exposure needing AC + TLS (or documented TLS-terminating proxy). Never expose bearer/OAuth over plaintext off-localhost.
+- Stdio inherits host privileges — do not compensate by adding “execute anything” tools.
+
+## VERIFY
+
+- Transport constructor and `Server` / `McpServer` APIs drift across SDK versions — verify against the installed package before inventing calls.

package/presets/cursor/mcp-ts/rules/mcp-ts-app-core.mdc

@@ -0,0 +1,28 @@
+---
+description: TypeScript MCP stack, layout, stdio-first entry (mcp-ts preset)
+alwaysApply: true
+---
+
+# Стек и окружение
+
+Версии Node, TypeScript и `@modelcontextprotocol/sdk` — **из `package.json` / lockfile целевого репозитория**. Рамка preset:
+
+- **Язык / платформа:** TypeScript (Node); package manager — discover from lockfile / `packageManager`.
+- **SDK:** official `@modelcontextprotocol/sdk` — verify APIs before use (`VERIFY:` markers when unsure).
+- **Транспорт по умолчанию:** **stdio-first**; remote HTTP/auth — requestable rules only.
+- **Точка входа:** `src/index.ts` (or repo equivalent) owns transport + lifecycle — not individual tools.
+- **Тесты:** repository runner (Vitest/Jest/node:test); contract fixtures for schemas — see `mcp-contract-testing`.
+- **Наблюдаемость:** only if already in repo — never log secrets or full tool payloads with credentials.
+
+# Структура (suggested)
+
+```text
+src/index.ts                 # transport + server lifecycle
+src/tools/                   # tool registration + handlers
+src/resources/               # resource registration (if used)
+src/prompts/                 # prompt registration (if used)
+src/**/schemas.ts            # Zod authoring schemas
+package.json                 # bin / main for stdio packaging
+```
+
+Границы — **`mcp-server-boundaries`**. Tooling — requestable **`mcp-ts-tooling`**. После правок TS — **`post-change-test`**.

package/presets/cursor/mcp-ts/rules/mcp-ts-conventions.mdc

@@ -0,0 +1,30 @@
+---
+description: Strict TypeScript, Zod validation, safe errors, SDK verification for MCP
+globs:
+  - src/**/*.ts
+  - src/**/*.tsx
+alwaysApply: false
+---
+
+# TypeScript conventions (MCP servers)
+
+- Prefer **strict** TypeScript (`strict` true when adding a new tsconfig; do not weaken existing strictness without AC).
+- Validate tool inputs with Zod (or repo schema lib) **before** side effects.
+- Export narrow types for handler inputs inferred from schemas (`z.infer<typeof schema>`).
+- Errors returned to clients: safe messages; log details server-side with redaction.
+- Avoid `any`; prefer `unknown` + narrowing at boundaries.
+- SDK calls: confirm symbols against installed `@modelcontextprotocol/sdk` — use `// VERIFY: @modelcontextprotocol/sdk @ <version>` when unsure.
+- Do not invent hexagonal `internal/domain|application|adapters` layouts unless the target repo already uses them.
+
+## Registration flow
+
+1. Define Zod (or equivalent) input schema next to the tool.
+2. Map schema → JSON Schema / SDK registration shape the repo uses.
+3. Implement a pure handler that accepts validated args + narrow capability ports (FS/net/secrets).
+4. Register the tool once from the server entry (`src/index.ts` or a dedicated register module) — handlers must not open a second transport.
+5. Cover invalid inputs and happy path in colocated `*.spec.ts` / `*.test.ts` before packaging.
+
+## Errors and types
+
+- Prefer typed result/error unions over throwing across the MCP boundary when the SDK pattern allows.
+- Never put stack traces, env dumps, or tokens in tool results.

package/presets/cursor/mcp-ts/rules/mcp-ts-tooling.mdc

@@ -0,0 +1,32 @@
+---
+description: Discover package manager; typecheck/test/Inspector commands for MCP TS
+globs:
+  - package.json
+  - tsconfig*.json
+  - **/vitest.config.*
+  - **/jest.config.*
+  - **/eslint.config.*
+alwaysApply: false
+---
+
+# Tooling (mcp-ts)
+
+Discover package manager **before** running scripts:
+
+1. `packageManager` in `package.json`
+2. Lockfile: `yarn.lock` → yarn; `pnpm-lock.yaml` → pnpm; `package-lock.json` → npm; `bun.lock(b)` → bun
+3. Use **only** that manager for install/run
+
+## Typical gates (adapt to repo scripts)
+
+| Gate | Discovery |
+|------|-----------|
+| Typecheck | `tsc --noEmit` or script `typecheck` / `build` that typechecks |
+| Test | script `test` / `test:unit` / Vitest / Jest / `node:test` |
+| Lint | project ESLint if configured — never invent Next `lint:js`/`lint:css` as required |
+| Inspector | optional smoke — not required for every change |
+
+## Agent requirement
+
+- Do not hard-code `yarn` if the repo uses pnpm/npm/bun.
+- Never require Go tools (`go test` / `go vet`), `xcodebuild`, or Playwright as this stack's gate.

package/presets/cursor/mcp-ts/rules/post-change-test.mdc

@@ -0,0 +1,26 @@
+---
+description: Mandatory typecheck + tests after TypeScript MCP edits
+alwaysApply: false
+---
+
+# Post-change test (requestable, mandatory after TS MCP edits)
+
+After changing TypeScript / package manifests in a consumer MCP server repo:
+
+1. Discover package manager (`mcp-ts-tooling`).
+2. Run **typecheck** (project script or `tsc --noEmit`).
+3. Run **tests** scoped to touched packages/files when possible; full suite before claiming done.
+4. Optional: MCP Inspector smoke for registration changes — not a hard gate.
+
+## Scope hints
+
+- Schema-only changes: include contract/schema fixture tests.
+- Handler changes: unit tests for valid/invalid inputs and error mapping.
+- Packaging/`bin` changes: verify entry still starts under stdio (manual or smoke).
+
+## Agent requirement
+
+- Do not claim completion without running the applicable gate (or noting why CI-only).
+- Pipeline `build-verifier` enforces the same checklist.
+- Skip only when the change is docs/config with no `*.ts` / package impact — state that explicitly.
+- Never require Playwright, XCUITest, Next lint recipes, or Go toolchains.

package/presets/cursor/mcp-ts/rules/preset-layering.mdc

@@ -0,0 +1,36 @@
+---
+description: Preset authoring meta-rule (preset-layering)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-layering.md -->
+
+# Preset layering
+
+Правила для **авторов пресетов** (`packages/ai-rules/presets/**`). Не always-on в consumer apps.
+
+## Слои
+
+| Слой | Где | Что класть |
+|------|-----|------------|
+| **Core** | `presets/_shared/core/**` | Stack-agnostic prose + checklists; без frontmatter; без путей `app/**`, `Features/**`, Playwright, xcodebuild |
+| **Stack** | `presets/{cursor\|claude}/<stack>/` | Domain/tooling, always-on trio стека, stack examples в **Stack notes** |
+| **Platform** | Cursor `.mdc` / Claude `.md` | Frontmatter (`alwaysApply`/`globs` vs `paths:`), platform-only (`BUGBOT.md`, `CLAUDE.md`) |
+
+## Куда класть новое правило
+
+1. Общие принципы для всех стеков → **core** + адаптеры с `<!-- shared-core: … -->`.
+2. Только один из installable стеков (`next` / `ios-swift` / `go` / `java` / `mcp-ts` / `php-hexagonal` / `php-laravel`) → **stack-specific** (не в `_shared`).
+3. Только Cursor или только Claude packaging → platform artifact / frontmatter, не дублировать семантику.
+
+## SoT
+
+- Packages path — SoT; root `.cursor/` — dogfood sync.
+- Per stack: **Cursor** `presets/cursor/<stack>/` → Claude twin same PR.
+- `_shared` **не** `--preset` и не копируется CLI `init`.
+
+См. также: `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`.

package/presets/cursor/mcp-ts/rules/preset-no-cross-stack-leakage.mdc

@@ -0,0 +1,69 @@
+---
+description: Preset authoring meta-rule (preset-no-cross-stack-leakage)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-no-cross-stack-leakage.md -->
+
+# Preset no cross-stack leakage
+
+Запрет протекания stack-specific имён, путей и handoff stems между пресетами.
+
+## Principles
+
+- `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
+- `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
+- Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
+
+## Forbidden in ios-swift hooks/agents (FAIL)
+
+In ios-swift `chain-team-phases.sh` / agent handoffs (Cursor + Claude):
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`
+- `app/__tests__/e2e` as a required path
+- Positive yarn recipes `lint:js` / `lint:css` as commands to run (negation prose alone is weak — prefer zero occurrences)
+
+Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild` or `post-change-build` / `xcode-tooling`.
+
+## Forbidden in next hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
+
+## Forbidden in go / java / php-hexagonal / php-laravel hooks/agents (FAIL)
+
+Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
+
+- `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css`
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Agent file `accessibility-reviewer` (no UI surface)
+
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
+
+## Forbidden in mcp-ts hooks/agents (FAIL)
+
+Same UI/mobile bans as backend stacks, plus:
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css` as required gates
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Go tool commands as required MCP delivery gates: `go test`, `go vet`, `golangci-lint`
+- Agent files: `playwright-test-*`, `xcuitest-test-*`, `integration-test-*`, `accessibility-reviewer`
+
+Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`, `post-change-test`); Phase 1 gates `build-verifier` + `security-reviewer`.
+
+## Soft / document
+
+- Mentioning the other stack in **docs** comparing presets is OK.
+- `build-verifier` may reference other stacks when validating **preset packaging** (`scope: preset-structure-validation`).
+
+## Chain fork
+
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, `go`, `java`, `mcp-ts`, `php-hexagonal`, and `php-laravel` (per platform).

package/presets/cursor/mcp-ts/rules/preset-pr-checklist.mdc

@@ -0,0 +1,39 @@
+---
+description: Preset authoring meta-rule (preset-pr-checklist)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-pr-checklist.md -->
+
+# Preset PR checklist
+
+Чеклист для PR, затрагивающих `packages/ai-rules/presets/**` (и dogfood `.cursor/` sync).
+
+## Before merge
+
+- [ ] **SoT:** правки в `packages/…` (не только root `.cursor/`)
+- [ ] **Core:** если менялся `_shared/core/**` — обновлены все `<!-- shared-core: … -->` consumers (или documented intentional fork)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel — см. `preset-twin-sync`)
+- [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table актуален
+- [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
+- [ ] **Leakage:** нет чужих stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
+- [ ] **Twin depth:** domain ≥15 lines; thin aliases documented
+- [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
+- [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
+- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (or document intentional skip) when maintaining this monorepo
+- [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
+
+## Pointers
+
+- Layering: `preset-layering`
+- Sync: `preset-twin-sync`
+- Budget: `preset-token-budget`
+- Leakage: `preset-no-cross-stack-leakage`
+- Validation: stack `agents/build-verifier.md` → preset-structure section
+- Dogfood script: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`
+- Drift script: `packages/ai-rules/scripts/check-shared-core-drift.sh`
+- Orchestrator: when editing presets, load this checklist + twin-sync

package/presets/cursor/mcp-ts/rules/preset-token-budget.mdc

@@ -0,0 +1,41 @@
+---
+description: Preset authoring meta-rule (preset-token-budget)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-token-budget.md -->
+
+# Preset token budget
+
+Инварианты загрузки правил в **установленном** пресете (consumer app).
+
+## Hard caps
+
+| Platform | Always-on | Cap |
+|----------|-----------|-----|
+| Cursor | `alwaysApply: true` | **≤ 3** |
+| Claude | rules **without** `paths:` | **ровно 3** |
+
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
+
+## Meta / author rules
+
+Rules for preset authors (`preset-layering`, `preset-twin-sync`, …):
+
+- **Never** `alwaysApply: true` on consumer installs.
+- Cursor: `globs` limited to `packages/ai-rules/presets/**` (and dogfood `.cursor/**` where useful).
+- Claude: `paths:` limited to `packages/ai-rules/presets/**` (and `.claude/**` dogfood if present).
+
+## Heavy workflows
+
+Orchestrator, feature-delivery, code-review, post-change gates, domain globs — **requestable / paths**, not always-on.
+
+## Verifier
+
+build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/cursor/mcp-ts/rules/preset-twin-sync.mdc

@@ -0,0 +1,50 @@
+---
+description: Preset authoring meta-rule (preset-twin-sync)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-twin-sync.md -->
+
+# Preset twin sync
+
+Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
+
+## Matrix
+
+| Stack | Cursor SoT | Claude derive | Mapping table |
+|-------|------------|---------------|---------------|
+| `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
+| `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
+| `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+| `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
+| `mcp-ts` | `presets/cursor/mcp-ts/rules/*.mdc` | `presets/claude/mcp-ts/rules/<topic>/` | Keep in `claude/mcp-ts/rules/README.md` |
+| `php-hexagonal` | `presets/cursor/php-hexagonal/rules/*.mdc` | `presets/claude/php-hexagonal/rules/<topic>/` | Keep in `claude/php-hexagonal/rules/README.md` |
+| `php-laravel` | `presets/cursor/php-laravel/rules/*.mdc` | `presets/claude/php-laravel/rules/<topic>/` | Keep in `claude/php-laravel/rules/README.md` |
+
+## Same-PR checklist
+
+1. Edit Cursor rule first (body + frontmatter).
+2. Update Claude twin: body + `paths:` (from Cursor `globs:` / requestable triggers); drop `alwaysApply`.
+3. Update mapping table row if stem/path changed.
+4. If body embeds core (`<!-- shared-core: … -->`), sync core consumers across stacks when core changed.
+
+## Twin depth
+
+- **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
+- **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+
+## Severity (build-verifier)
+
+- **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
+- **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+- **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
+- **mcp-ts:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java; mapping table required).
+- **php-hexagonal:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts; mapping table required).
+- **php-laravel:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts / php-hexagonal; mapping table required).
+
+Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/cursor/mcp-ts/rules/reference-features.mdc

@@ -0,0 +1,34 @@
+---
+description: Reference paths for MCP server layout (dogfood-aligned Phase 1)
+globs:
+  - src/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: architecture/reference-features.template.md -->
+
+# Reference features (mcp-ts) — Phase 1
+
+Canonical layout matches `dogfood/mcp-ts-sample/` (consumer repos may rename; prefer the same shapes).
+
+| Area | Example path | Glob hint |
+|------|--------------|-----------|
+| Entry / transport | `src/index.ts` | `src/index.ts` |
+| Tools | `src/tools/echo.ts` | `src/tools/**` |
+| Tool tests | `src/tools/echo.spec.ts` | `src/tools/**/*.{test,spec}.ts` |
+| Resources | `src/resources/` (optional) | `src/resources/**` |
+| Prompts | `src/prompts/` (optional) | `src/prompts/**` |
+| Schemas | colocated next to tool (or `schemas.ts`) | `**/schemas.ts`, `src/tools/**` |
+| Build output | `dist/index.js` | `dist/**` |
+
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and Claude twin path if both tools installed).
+
+## Dogfood scenarios (Phase 1)
+
+1. `/task` add tool — contract → schema → handler → register → tests → package (`dogfood/mcp-ts-sample`).
+2. Schema validation bug — unit + contract fixtures on `src/tools/*.spec.ts`.
+3. Capability / secrets review — security-reviewer + `security-mcp` (e.g. FS allowlist tool when added).
+
+Init (maintainer): `node packages/ai-rules/bin/cli.js init cursor --preset mcp-ts --cwd dogfood/mcp-ts-sample` — do not commit generated `.cursor/` into the sample unless the team decides otherwise.

package/presets/cursor/mcp-ts/rules/security-mcp.mdc

@@ -0,0 +1,53 @@
+---
+description: MCP security: injection boundaries, capability minimization, SSRF/secrets
+globs:
+  - src/tools/**/*
+  - src/resources/**/*
+  - "**/auth/**/*"
+  - "**/config/**/*"
+alwaysApply: false
+---
+
+# Security (MCP servers)
+
+- Treat tool **arguments** as **untrusted**. Validate with schemas; canonicalize paths/URLs.
+- Minimize capabilities: no default "read any file" / "fetch any URL" without AC and allowlists.
+- Secrets: env/secret manager only; redact in logs and tool results (`mcp-auth-secrets`).
+- Least privilege: each tool gets the smallest capability adapter it needs — no ambient `process.env` dumps.
+
+## Path traversal (FAIL patterns)
+
+- Resolve with `path.resolve` (or equivalent) then require the result stays under an approved root (`path.relative` must not start with `..`).
+- Deny `../`, encoded variants (`%2e%2e`), and null-byte tricks before FS access.
+- Follow symlinks only if the **final** realpath is still inside the root — otherwise reject.
+- Unit shapes: `tool.rejectsPathTraversal`, `tool.rejectsSymlinkEscape`, `tool.acceptsInRoot`.
+
+## SSRF / outbound URL (FAIL patterns)
+
+When tools fetch URLs:
+
+- Allowlist hosts (or deny by default); block metadata IP `169.254.169.254`, link-local (`169.254.0.0/16`), loopback when not explicitly local-dev, and private ranges unless AC says otherwise.
+- Do not follow redirects to a host outside the allowlist; re-validate after each hop.
+- Prefer literal IPs from a resolved allowlist over trusting DNS alone when policy requires it.
+- Unit shapes: `tool.deniesMetadataIp`, `tool.deniesBlockedHost`, `tool.allowsAllowlistedHost`.
+
+## Prompt injection and untrusted content
+
+- Tool **descriptions** and **results** must not instruct the model to ignore safety; handlers must not execute model-supplied shell without an explicit, reviewed design.
+- Treat **retrieved** tool/resource/prompt content (and any fetched remote payload) as **untrusted data**, not as authority:
+  - It must **not** expand tool capabilities, change auth/scopes, or trigger shell/network/FS side effects merely because the content contains instructions.
+  - Handlers decide actions from validated args + trusted request context only — never from natural-language directives inside resource bodies or prior tool output.
+  - Do not echo secrets found in untrusted content into logs or subsequent tool results.
+
+## Forbidden
+
+- Shipping live credentials in examples or fixtures.
+- Echoing `process.env` or Authorization headers into tool output.
+- Fail-open auth when remote transport is enabled.
+- Broad "run arbitrary command" tools without explicit AC and sandboxing.
+- Letting tool/resource text escalate privileges or bypass schema/auth checks.
+
+## Agents
+
+- `security-reviewer` on tool/auth/config/capability changes; then `post-change-test`.
+- Phase 1: feature-developer must not skip schema validation to "move faster".