@bonesofspring/ai-rules 0.2.10 → 0.2.12

package/presets/cursor/php-laravel/hooks/guard-shell-command.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Lightweight shell guard for Laravel preset projects.
+# PHP: do NOT blanket-block php artisan test / composer test / compiler/IDE inspections / configured static analysis / repo static analysis.
+# Package-manager mismatch checks apply only when a JS lockfile/package.json exists.
+
+set -euo pipefail
+# PHP_PRESET_GUARD: allow composer/composer test; no Playwright/XCUITest assumptions
+
+input=$(cat)
+
+INPUT="$input" node <<'NODE'
+const fs = require('fs');
+
+const raw = process.env.INPUT || '';
+let event;
+try {
+  event = JSON.parse(raw);
+} catch {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const command = String(event.command || event.input?.command || '');
+if (!command.trim()) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+function out(permission, userMessage, agentMessage) {
+  process.stdout.write(JSON.stringify({
+    permission,
+    user_message: userMessage,
+    agent_message: agentMessage || userMessage,
+  }));
+}
+
+const dangerousGit = /\bgit\s+(reset\s+--hard|clean\s+-[^\n]*f|push\s+--force|push\s+-f|checkout\s+--\s+)/;
+if (dangerousGit.test(command)) {
+  out(
+    'ask',
+    'This command looks destructive for git state. Review it before continuing.',
+    'A project hook flagged a destructive git command. Ask the user before running it.',
+  );
+  process.exit(0);
+}
+
+const managerByFile = [
+  ['yarn.lock', 'yarn'],
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['package-lock.json', 'npm'],
+].find(([file]) => fs.existsSync(file));
+
+let expected = managerByFile?.[1];
+if (!expected && fs.existsSync('package.json')) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+    const pm = typeof pkg.packageManager === 'string' ? pkg.packageManager : '';
+    expected = pm.split('@')[0] || undefined;
+  } catch {
+    // Ignore invalid package.json in the hook; the agent can diagnose it later.
+  }
+}
+
+if (!expected) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const used = command.match(/(^|[;&|]\s*)(npm|yarn|pnpm)\s+/)?.[2];
+if (used && used !== expected) {
+  out(
+    'ask',
+    `This repository appears to use ${expected}, but the command uses ${used}. Confirm before continuing.`,
+    `Use ${expected} for package scripts and installs unless the user explicitly approves ${used}.`,
+  );
+  process.exit(0);
+}
+
+process.stdout.write('{ "permission": "allow" }');
+NODE

package/presets/cursor/php-laravel/hooks.json

@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "hooks": {
+    "beforeShellExecution": [
+      {
+        "command": ".cursor/hooks/guard-shell-command.sh",
+        "failClosed": true
+      }
+    ],
+    "subagentStop": [
+      {
+        "command": ".cursor/hooks/chain-team-phases.sh",
+        "loop_limit": 15
+      }
+    ]
+  }
+}

package/presets/cursor/php-laravel/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@upstash/context7-mcp"
+      ]
+    }
+  }
+}

package/presets/cursor/php-laravel/rules/README.md

@@ -0,0 +1,111 @@
+# Rules (preset php-laravel)
+
+## alwaysApply (3)
+
+| Rule | Role |
+|------|------|
+| `laravel-app-core` | Stack + layout (Laravel `app/`, routes, artisan) |
+| `architecture-boundaries` | Laravel layer invariants |
+| `code-quality-and-refactoring` | Shared quality + Laravel Stack notes |
+
+**Session-start body budget:** sum of the 3 always-on bodies ≤ **140** lines (stretch ≤120).
+
+## Twin depth (Cursor↔Claude)
+
+- **Domain** rules: target ≥15 non-empty body lines (FAIL soft when undocumented stubs).
+- **Thin aliases** (may be shorter): `agent-team-intake`, `technical-retro`, `domain-layer` (modular note only).
+- **Not shipped in v1:** `api-grpc`, `messaging-adapters`, hexagonal ports/adapters stems (`ports-interfaces`, `adapters-*`, `composition-root`, `api-http`, `persistence-adapters`, `application-usecases`, `php-app-core`, `php-conventions`).
+
+## Loading strategy
+
+- **`alwaysApply: true`** (Cursor) / **без `paths:`** (Claude) — только базовые инварианты (**3**): `laravel-app-core`, `architecture-boundaries`, `code-quality-and-refactoring`
+- **On-demand / requestable** — `post-change-test`, `php-tooling`, Laravel domain rules, tests, feature-delivery-workflow, reference-features, `design-guidance`, `anti-sycophancy-discipline`, `technical-retro`, agent-team
+- **Preset author meta** (globs `packages/ai-rules/presets/**`, never alwaysApply): `preset-layering`, `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`
+- **Skills** — `feature-delivery`, `code-review`, `integration-testing`, `unit-testing`, …
+
+### Laravel edit bundles
+
+| When editing | Load |
+|--------------|------|
+| `app/Http/**`, Resources | `http-layer` + `form-requests` + `architecture-boundaries` |
+| `routes/**` | `routes-api` |
+| `app/Models/**`, migrations | `eloquent-persistence` |
+| `app/Actions/**`, `app/Services/**` | `actions-services` |
+| `app/Providers/**` | `service-providers` |
+| `app/Policies/**` | `policies-authorization` |
+| `app/Jobs/**` | `jobs-queues` |
+| `app/Events/**`, `app/Listeners/**` | `events-listeners` |
+| After `*.php` edits | `post-change-test` (+ `php-tooling`) |
+
+## Shared core → stack mapping
+
+SoT prose: `packages/ai-rules/presets/_shared/core/**` (see `_shared/README.md`). Adapters carry `<!-- shared-core: … -->`.
+
+| Shared core | This stack adapter | Mode | Delta |
+|-------------|--------------------|------|-------|
+| `quality/code-quality-and-refactoring.md` | `code-quality-and-refactoring.mdc` | embed | Stack notes: Laravel Actions/Models/Providers, `post-change-test` |
+| `quality/anti-sycophancy-discipline.md` | `anti-sycophancy-discipline.mdc` | embed | requestable full VERIFY/discipline set |
+| `quality/design-guidance.md` | `design-guidance.mdc` | embed | requestable smells/GoF; Laravel Stack notes |
+| `agent-team/agent-team-orchestrator.md` | `agent-team-orchestrator.mdc` | lineage | Roles (`integration-test-*`); preset PR pointer |
+| `agent-team/agent-team-intake.md` | `agent-team-intake.mdc` | embed | thin alias |
+| `architecture/feature-delivery-workflow.md` | `feature-delivery-workflow.mdc` | lineage | Laravel checklist |
+| `architecture/reference-features.template.md` | `reference-features.mdc` | lineage | `dogfood/php-laravel` path table + scenarios |
+| `review/code-review-mr.md` | `code-review-mr.mdc` | embed | Laravel checklist |
+| `review/technical-retro.md` | `technical-retro.mdc` | embed | thin alias |
+| `meta/preset-*.md` | `preset-*.mdc` | embed | author-only globs (incl. `preset-no-cross-stack-leakage`) |
+
+Claude twins + Cursor→Claude map: `presets/claude/php-laravel/rules/README.md`. Cross-stack leakage policy: `preset-no-cross-stack-leakage`.
+
+Compare with framework-agnostic hexagonal: installable id **`php-hexagonal`** (ports & adapters). This preset is **Laravel-first**.
+
+## Catalog
+
+| Stem | Depth | Notes |
+|------|-------|-------|
+| `laravel-app-core` | full | always-on |
+| `architecture-boundaries` | full | always-on |
+| `code-quality-and-refactoring` | full | always-on + shared embed |
+| `anti-sycophancy-discipline` | full | requestable embed |
+| `design-guidance` | full | requestable embed; Laravel Stack notes |
+| `feature-delivery-workflow` | full | Laravel checklist + matrix |
+| `reference-features` | full | `dogfood/php-laravel` path table |
+| `agent-team-orchestrator` | full | Roles table (21) + `integration-test-*` |
+| `code-review-mr` | full | Laravel Stack notes checklist |
+| `preset-*` (×5) | full | author meta |
+| `agent-team-intake` | thin-alias | |
+| `technical-retro` | thin-alias | |
+| `domain-layer` | thin-alias | modular/`app/Domain` note only |
+| `http-layer` | full | Controllers / Resources |
+| `form-requests` | full | validation edge |
+| `routes-api` | full | `routes/api.php` / `web.php` |
+| `eloquent-persistence` | full | Models / migrations |
+| `actions-services` | full | application logic |
+| `service-providers` | full | container wiring |
+| `policies-authorization` | full | Policies / gates |
+| `jobs-queues` | full | queued Jobs |
+| `events-listeners` | full | Events / Listeners |
+| `laravel-conventions` | full | idiomatic Laravel/PHP |
+| `module-public-api` | full | package/module boundaries |
+| `php-tooling` | full | artisan / Composer / Pint discovery |
+| `post-change-test` | full | requestable gate |
+| `security-php` | full | Laravel auth/csrf/mass-assignment |
+| `tests-unit` | full | PHPUnit / Pest |
+| `tests-integration` | full | Feature tests; integration-test-* |
+| `tests-e2e` | full | optional smoke |
+
+**Всего topic `.mdc`:** 29 domain + 5 preset-meta (без README) = 34.
+
+## Defaults (human-locked)
+
+- Laravel-first; flat `app/` default; Laravel **11+** / PHP **8.2+** baseline in Stack notes (read versions from target `composer.json`)
+- gRPC / messaging adapter stems **dropped** in v1 (use Jobs/Queues/Events)
+- Dogfood sample: `dogfood/php-laravel` (full Laravel via create-project)
+- MCP = Context7 only
+- Static analysis / format = discover from repo/CI
+- Coexists with **`php-hexagonal`** — distinct install id; do not register legacy id `php`
+
+## Metrics policy mapping
+
+| Shared core | Runtime integration | Loading |
+|-------------|---------------------|---------|
+| `agent-team/agent-task-metrics.md` | `agent-team-orchestrator` + `hooks/chain-team-phases.sh` | requestable/on-demand; never session-start |

package/presets/cursor/php-laravel/rules/actions-services.mdc

@@ -0,0 +1,33 @@
+---
+description: Laravel Actions and Services for application logic
+globs:
+  - "**/Actions/**/*"
+  - "**/Services/**/*"
+alwaysApply: false
+---
+
+
+# Actions / Services
+
+- Prefer **single-purpose Actions** (`CreateTodo`, `CompleteTodo`) for one use case; **Services** for multi-step orchestration shared across entry points.
+- Accept primitives / arrays / domain value objects — **not** Form Requests or `Request` objects.
+- Persist via Eloquent (or a justified repository); dispatch Jobs/Events for side effects.
+- Keep methods small and named after the business verb; avoid god `TodoService` with every CRUD method unless the repo already uses that shape.
+- Transaction boundaries: `DB::transaction` in the Action/Service when multiple writes must commit together.
+
+## Structure
+
+- `app/Actions/<Feature>/CreateX.php` or flat `app/Actions/CreateX.php` — match neighbors.
+- Invokable `__invoke` or explicit `handle` / `execute` — follow existing style; do not invent a new Action base class mid-feature.
+- Repository interfaces only when multiple backends or heavy test seams justify them (fold of hexagonal ports — not required).
+
+## Testing
+
+- Unit-test Actions with fakes/mocks when pure enough; Feature tests cover HTTP → Action → DB happy path.
+- Assert Job/Event dispatch with `Bus::fake` / `Event::fake` when side effects are in scope.
+
+## Forbidden
+
+- HTTP status codes / Resources inside Actions.
+- Fat Actions that also validate Form Request rules (validation stays at HTTP edge).
+- Skipping Actions to put business SQL directly in controllers “for speed”.

package/presets/cursor/php-laravel/rules/agent-team-intake.mdc

@@ -0,0 +1,20 @@
+---
+description: Suggest /task for PHP backend work requests
+alwaysApply: false
+---
+
+<!-- shared-core: agent-team/agent-team-intake.md -->
+
+# Agent team intake
+
+When the user message looks like a **work request** (implement, add, fix, refactor, review MR, write tests, spike) — not a question about how code works:
+
+1. Prefer **`/task <their request>`** or invoke **task-router** first.
+2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
+3. Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
+
+Exceptions: user explicitly says «без pipeline», «просто сделай», or continues an active slug.
+
+## Stack notes
+
+- Scope: Laravel (`app/**`, `routes/**`, `tests/**`) — Controllers, Actions/Services, Eloquent, Policies — not Playwright/XCUITest UI flows.

package/presets/cursor/php-laravel/rules/agent-team-orchestrator.mdc

@@ -0,0 +1,178 @@
+---
+description: Orchestrates the agent team via task-router and pipeline.json for PHP presets
+alwaysApply: false
+---
+
+<!-- shared-core: agent-team/agent-team-orchestrator.md -->
+
+# Agent team orchestrator
+
+Parent agent = **manager**. Router plans; specialists execute. Artifacts: `.cursor/team/tasks/<slug>/` (Claude: `.claude/team/tasks/<slug>/`).
+
+Work request без `/task` — см. **agent-team-intake** (когда предлагать router вместо прямого кодинга).
+
+## Entry points
+
+| Command | When |
+|---------|------|
+| **`/task <desc>`** | **Preferred** — router → dynamic pipeline → first agent |
+| `/task-continue <slug>` | After human gate or pause |
+| `/feature-start <desc>` | Legacy: analyst-only start (no router) |
+| `/feature-continue <slug>` | Alias of task-continue |
+| `/technical-retro [slug]` | Retro with agent team block |
+
+## Roles (shared catalog)
+
+Roster of specialists is **stack-specific** (agent names and write scopes differ). See **Stack notes** in the stack adapter for the live Roles table. Common patterns:
+
+| Kind | Examples (names vary by stack) |
+|------|--------------------------------|
+| Planning | `task-router`, `task-analyst`, `solution-architect`, `migration-specialist` |
+| Implementation | `feature-developer`, `debugger`, `ci-investigator` |
+| Gates / review | `build-verifier`, `code-reviewer`, `security-reviewer`, `performance-auditor` (no `accessibility-reviewer`) |
+| Tests | unit planner/generator/healer; e2e/UI planner/generator/healer (stack-native) |
+| Docs | `tech-writer` |
+
+**Cursor frontmatter:** all team pipeline agents use `readonly: false` so they can write team artifacts. Production/app restrictions live in the agent prompt body — do **not** set `readonly: true`.
+
+Full prompts: stack `agents/*.md`. Artifact conventions: stack `team/README.md`.
+
+## Dynamic pipeline
+
+```mermaid
+flowchart TD
+  task["/task prompt"]
+  router["task-router"]
+  pipeline["pipeline.json"]
+  step0["steps 0..N"]
+  gate{"humanGates?"}
+  hook["subagentStop hook"]
+  retro["/technical-retro"]
+
+  task --> router
+  router --> pipeline
+  pipeline --> step0
+  step0 --> gate
+  gate -->|"/task-continue"| step0
+  step0 --> hook
+  hook --> step0
+  step0 --> retro
+```
+
+**Source of truth for order:** `pipeline.json` → `steps[]`. Never hardcode analyst → dev → review → QA when `pipeline.json` exists.
+
+## Metrics lifecycle
+
+Use the local `metrics.json` ledger described by **agent-task-metrics**: initialize attempts before invocation, let hooks record host-clock ends, and never guess a parallel completion from `currentAgent`.
+
+## status.json (pipeline mode)
+
+```json
+{
+  "slug": "...",
+  "intent": "feature",
+  "pipelineIndex": 0,
+  "currentAgent": "task-analyst",
+  "phase": "executing",
+  "state": "in_progress",
+  "awaitingHumanGate": false
+}
+```
+
+| state | Meaning |
+|-------|---------|
+| `in_progress` | Current step running |
+| `completed` | Current step done; hook advances |
+| `awaiting_approval` | Human gate; wait for `/task-continue` |
+| `changes_requested` | Reviewer blocked; re-run developer (`retryAfterFix`) |
+| `validation_failed` | build-verifier failed; re-run developer then build-verifier |
+
+## Pipeline step options
+
+| Field | Use |
+|-------|-----|
+| `skipIf` | `debugger.fixed` / `ci-investigator.resolved` — hook skips step when artifact says fix applied |
+| `parallel: true` | `agent` is array — invoke **all** agents in one parent turn; each appends to `parallelCompleted` |
+| `scope` | e.g. `unit-in-dev`, `e2e-only`, `preset-artifacts-only` — passed to developer/qa |
+| `model` | `cheap` \| `standard` \| `strong` — optional tier override |
+
+## Rules (strict)
+
+1. **`/task` always starts with task-router** (except user says "skip router" with documented pipeline).
+2. Read `pipeline.json` before every subagent invocation.
+3. One role per Task call — **except** parallel steps: multiple Task calls in one message.
+4. **Never** skip `humanGates` without `/task-continue` or explicit user approval.
+5. Persist handoffs to disk (`brief.md`, `decomposition.md`, `debug-report.md`, `validation-report.md`, `architecture.md`, `migration-plan.md`, `ci-report.md`, `a11y-review.md`, `perf-report.md`, `security-review.md`, `api-contract-review.md`, `unit-test-plan.md`, `documentation.md`, `review.md`).
+6. On `changes_requested` from reviewers: hook sets `retryAfterFix` → developer → same reviewer.
+7. On `validation_failed` from `build-verifier`: hook sets `retryAfterFix: build-verifier` → developer → build-verifier.
+8. When all steps complete, suggest `/technical-retro <slug>`.
+9. If `autoChain: false` in pipeline, do not rely on hook — manual step only.
+
+## Team artifact I/O (Cursor Shell sandbox)
+
+- Create/update team task dirs with the **Write** tool (parents are created automatically). Do **not** bootstrap slug dirs with Shell `mkdir -p` — default sandbox returns `Operation not permitted` (worse on macOS Desktop/Documents with TCC).
+- If Shell must touch team paths and fails with EPERM, retry with `required_permissions: ["all"]`. Prefer Write for artifacts.
+- Prefer repo under `~/Projects` / `WebstormProjects` over `~/Desktop` when using agent team heavily.
+
+## Invoking agents
+
+Use Task tool or `/agent-name`. Pass: slug, artifact paths, step `scope` if set.
+
+### Model when invoking (Task)
+
+1. Read `steps[i].model` if present; else use the agent’s frontmatter `model` (see `agents/README.md` matrix).
+2. Map abstract tiers:
+   - **`cheap`** → pass Task `model: "fast"` when the tool accepts it (or rely on agent `fast`).
+   - **`standard`** → omit Task `model` (frontmatter `inherit` / mid default).
+   - **`strong`** → **never** pass `fast`; rely on agent pin or parent Max model.
+3. Parallel steps: apply the step-level `model` to **each** agent in the array (or omit → each agent’s own frontmatter).
+
+After each agent completes, ensure `status.json` has `state: completed` (or `awaiting_approval` if gate applies).
+
+## Legacy mode
+
+If `pipeline.json` is missing (old `/feature-start` tasks), fall back to fixed phases: analysis → development → review → testing. Hook supports both.
+
+## Skip pipeline when
+
+Do **not** run `/task` + router for:
+
+- Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** for deep traces; inline OK for trivial one-liners.
+- Typo / one-file fix / trivial config with no architecture risk.
+- User explicitly says «без pipeline», «просто сделай», or continues an active slug.
+- Single-line `docs-only` with no code impact.
+
+Borderline work requests — см. **agent-team-intake**.
+
+## Auto-detection (optional)
+
+When user describes a **non-trivial task** (not a question), suggest `/task <message>` or run router if they agree.
+
+## Preset authoring
+
+When the work edits `packages/ai-rules/presets/**` (or dogfood `.cursor/` sync of presets), follow meta-rules: **preset-pr-checklist**, **preset-twin-sync**, **preset-layering**, **preset-token-budget**, **preset-no-cross-stack-leakage**.
+
+## Stack notes
+
+### Roles (Laravel — 21 agents)
+
+| Kind | Agents | Writes |
+|------|--------|--------|
+| Planning | `task-router`, `task-analyst`, `solution-architect` | team only |
+| Analysis | `codebase-analyzer` | explain-as-is only |
+| Implementation | `feature-developer`, `debugger`, `ci-investigator` | sources / minimal |
+| Gates | `build-verifier` | `validation-report.md` only |
+| Review | `code-reviewer`, `security-reviewer`, `performance-auditor`, `api-contract-reviewer`, `migration-specialist` | team / plans |
+| Docs | `tech-writer` | docs |
+| Unit tests | `unit-test-{planner,generator,healer}`, `qa-tester` | tests |
+| Integration | `integration-test-{planner,generator,healer}` | Feature / HTTP-DB tests |
+
+**No** `accessibility-reviewer`, Playwright, or XCUITest. Replace those intents with **`integration-test-*`**.
+
+### Handoffs / gates
+
+- Scope: Laravel (`app/Http/**`, `app/Actions|Services/**`, `app/Models/**`, `app/Providers/**`, `routes/**`, `tests/**`) — not Next `app/src` or iOS `Features/`.
+- After PHP code changes, pipeline includes **build-verifier** with `php artisan test` / `composer test` + `post-change-test` / `php-tooling` (static analysis only if repo/CI already configures it).
+- **Risk-based security-reviewer:** schedule when the task touches auth/Policies/Gates/middleware, routes/HTTP bootstrap, Form Requests, mass assignment, Jobs/queues, config/secrets, uploads, or PII logging — see `task-router` § Security-reviewer routing. Parallel with `code-reviewer` is OK; document skip with an auditable reason when those surfaces are unaffected.
+- Chain hook handoffs: `integration-test-*`, `post-change-test`, `php-tooling` — never `lint:js`, Playwright, XCUITest, or `xcodebuild`.
+- Skills: `feature-delivery`, `unit-testing`, `integration-testing`, `ci-investigation`, `debug-investigation`, `code-review`, `technical-retro`, `write-adr`.

package/presets/cursor/php-laravel/rules/anti-sycophancy-discipline.mdc

@@ -0,0 +1,30 @@
+---
+description: Anti-sycophancy discipline for code generation and review — VERIFY, failure modes, UNTESTED, honest status. Load when writing or changing code.
+globs:
+  - "**/*.php"
+alwaysApply: false
+---
+
+<!-- shared-core: quality/anti-sycophancy-discipline.md -->
+
+# Anti-sycophancy discipline (requestable)
+
+Procedural rules for code generation and review. Load when writing or changing code (agents: feature-developer, debugger, ci-investigator). Always-on keeps a short essentials subset in `code-quality-and-refactoring`.
+
+1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If you cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
+2. **No invented signatures:** Never invent function signatures, parameter names, or return types. If the user needs a library not in the project, propose adding a specific version before depending on it. Silent stubs are worse than refusal.
+3. **Enumerate edge cases before validating:** When asked "is this correct?" or "does this work?", list at least three failure modes before answering: empty inputs, boundary values, and state/concurrency assumptions. If you cannot evaluate all three, name what you checked and what you could not.
+4. **Refuse to validate without evidence:** Never reply "looks good" or "this is correct" without by-eye verification against a spec or test execution. If no spec exists, ask for one or refuse to validate.
+5. **Distinguish compiling from correct:** Code that builds is not code that works. Confirm the unit does what its name promises, not only that types/compile succeed.
+6. **Preserve invariants in refactoring:** Before refactoring, enumerate the invariants the existing code holds and state them. After the refactor, verify each still holds.
+7. **Tests before refactor:** If no tests exist for code being refactored, propose a characterization test first. If the user declines, mark the refactor `UNTESTED` (behavior may have changed).
+8. **Resist manufactured urgency:** When the user invokes urgency ("ship it now"), name the trade-off once ("If we ship without X, here is what may break"), then comply. Do not repeat the warning or apologize in a loop.
+9. **Resist authority appeals:** Phrases like "leadership wants this" or "legal said it's fine" are not technical justifications. Evaluate on technical grounds.
+10. **Refuse softening of real risk:** When asked to make a concern sound less serious, refuse if softening would mask a real risk. If the risk is genuinely minor, comply and explain why.
+11. **Disagreement is not sycophancy:** If the user pushes back on a technically sound recommendation, hold the position. Update only on new evidence, not on emotional pressure or repetition.
+12. **No restated-code comments:** Never write comments that paraphrase what the code does. Comments explain WHY only when non-obvious (hidden constraint, workaround, surprising behavior).
+13. **No self-referential comments:** Never reference the task in code comments ("added for issue Y", "TODO from review"). Those belong in commits/PRs and rot as the codebase evolves.
+14. **Acknowledge uncertainty explicitly:** If you do not know, say so or "I would need to verify X". Do not invent a plausible-sounding answer.
+15. **Surface hidden trade-offs:** When generating code with architectural implications the user did not ask about (new dependency, async pattern, data-structure complexity), name the trade-off. Do not bury it.
+16. **Match verification to risk:** Trivial → syntax/type check. Logic → manual trace. Concurrency/state → written scenario. Skipping verification proportional to risk is the failure mode.
+17. **Honest status reporting:** When asked "is X done?", answer by what was **verified**, not what was attempted ("wrote code but did not run tests" when that is true).

package/presets/cursor/php-laravel/rules/architecture-boundaries.mdc

@@ -0,0 +1,37 @@
+---
+description: Laravel layer boundaries (HTTP, Actions/Services, Eloquent, Policies, Providers)
+alwaysApply: true
+---
+
+
+# Границы слоёв (Laravel)
+
+- **HTTP** (`app/Http/**`, Resources):
+  - Может: Controllers, Form Requests, API Resources, Middleware; map to Actions/Services; authorize via Policies.
+  - Не должен: fat business SQL; multi-step orchestration; queue side effects without Jobs/Events.
+- **Actions / Services** (`app/Actions/**`, `app/Services/**`):
+  - Может: single-purpose Actions; multi-step Services; Eloquent / domain helpers; dispatch Jobs/Events.
+  - Не должен: `Request` / Form Request types; HTTP status mapping; controller concerns.
+- **Eloquent** (`app/Models/**`, migrations):
+  - Может: persistence-focused models, casts, relations, scopes.
+  - Не должен: request/HTTP leakage; AuthZ role checks that belong in Policies.
+- **Policies** (`app/Policies/**`): AuthZ via Policies / gates — not ad-hoc role checks in controllers.
+- **Providers** (`app/Providers/**`): bindings/singletons only — no business rules.
+- **Jobs / Events / Listeners**: deferred / async side effects — not a substitute for clear sync Actions.
+
+# Зависимости
+
+- Направление: **HTTP → Actions/Services → Eloquent**; Policies at HTTP edge; Providers wire the container.
+- Cross-module access — public APIs / facades only (`module-public-api`); no deep sibling imports.
+
+# Edit bundles (load on matching paths)
+
+- `app/Http/**`, Resources → `http-layer` + `form-requests` + `architecture-boundaries`
+- `routes/**` → `routes-api`; `app/Models/**`, migrations → `eloquent-persistence`
+- `app/Actions/**`, `app/Services/**` → `actions-services`; `app/Providers/**` → `service-providers`
+- `app/Policies/**` → `policies-authorization`; `app/Jobs/**` → `jobs-queues`
+- `app/Events/**`, `app/Listeners/**` → `events-listeners`; after `*.php` → `post-change-test` (+ `php-tooling`)
+
+# Требование к агенту
+
+- Класть файлы в правильный слой; thin controllers; DI wiring только в Providers.

package/presets/cursor/php-laravel/rules/code-quality-and-refactoring.mdc

@@ -0,0 +1,54 @@
+---
+description: Code quality and light refactoring for Laravel backends
+alwaysApply: true
+---
+
+<!-- shared-core: quality/code-quality-and-refactoring.md -->
+
+# Поддержка существующего стиля
+
+- Следовать существующим паттернам (имена, структура, типизация / DI / error handling); минимизировать стилистический шум (лишний format/rename).
+- Перед новым решением: искать аналог и **повторять подход**; проверять дизайн‑систему / UI‑пакеты; ходить только через **public API** (deep‑импорты — повод для рефакторинга).
+
+# Принципы
+
+- **KISS:** самое простое изменение в паттернах репозитория.
+- **DRY + Rule of Three:** общее — только после 3-го повторения (ошибочная абстракция дороже дублирования).
+- **YAGNI:** без API, флагов, слоёв «на будущее» без текущего требования.
+- **SOLID:** S — один повод менять; O — композиция/новые реализации; L — контракт подтипа; I — узкие порты; D — абстракции (порты), детали в адаптерах стека.
+- **CUPID:** Composable; Unix philosophy (одна ответственность); Predictable; Idiomatic (репо); Domain-based.
+- **Composition over inheritance;** Law of Demeter — без цепочек `a.b.c.d`; через public API / facade.
+
+# Рефакторинг при изменениях
+
+- Лёгкий refactor OK, если меньше дублирования, выше читаемость, без ломки публичных контрактов.
+- Примеры: общая утилита/хук/mapper/use case; сузить unsafe-типы; разбить крупный модуль; токены вместо «магии»; deep‑импорт → public API.
+- Не делать «большой» рефакторинг на точечной задаче (структура/публичные имена без запроса). Крупное — минимальными шагами; код остаётся собираемым.
+
+# Требование к агенту
+
+- **Boy scout:** оставлять модуль немного лучше; не жертвовать архитектурой и слоями ради краткости.
+
+## Agent discipline (anti-sycophancy)
+
+Essentials below. Full procedural set (~17 rules) → load **`anti-sycophancy-discipline`**.
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent); never invent signatures.
+- Before «is this correct?» — ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose characterization test; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential «added for issue Y».
+- Urgency/authority: name the trade-off once, then comply — no apology loops.
+- Match verification to risk; report by what was **verified**, not attempted.
+
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**.
+
+> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
+
+## Stack notes
+
+- **No UI layer in this preset** — ignore shared-core bullets about дизайн‑система / UI‑пакеты / CSS‑токены; apply public-API and boy-scout rules to Laravel Actions/Models/Providers instead.
+- Prefer thin controllers + single-purpose Actions; Services for multi-step orchestration — avoid fat controllers and god Services.
+- Repository interfaces **only when justified** (multiple backends / test seams) — not required for every Eloquent model.
+- Prefer Laravel exceptions + Form Request / Policy mapping at the HTTP edge; do not leak raw persistence exceptions as HTTP bodies.
+- Post-change gate: **`post-change-test.mdc`** + **`php-tooling.mdc`** (`php artisan test` / `composer test` — not yarn lint / xcodebuild / Playwright).
+- Style/static analysis: use **repository/CI** Pint/PHPStan/Psalm — do not invent a parallel bible in rules.

package/presets/cursor/php-laravel/rules/code-review-mr.mdc

@@ -0,0 +1,56 @@
+---
+description: Code review checklist for Laravel merge requests
+alwaysApply: false
+---
+
+<!-- shared-core: review/code-review-mr.md -->
+
+# Code review merge requests
+
+On-demand rule for review flows. **Procedure and output format:** skill `code-review`.
+
+## When to load
+
+- User asks for review/MR/diff
+- Pipeline step `code-reviewer`
+- Platform automated review (e.g. BUGBOT) when present
+
+## Checklist references (abstract)
+
+- Architecture layers and stack core rules
+- Public imports / module boundaries
+- UI conventions of the stack
+- Unit and e2e/UI test conventions
+- Post-change lint/build gate before final report
+- Design smells **in MR diff scope** — load `design-guidance`; не разворачивать полный каталог Fowler вне диффа
+- Pattern name (GoF) — только если репозиторий уже использует эту форму или match минимален
+- Principles (KISS / DRY+Ro3 / YAGNI / SOLID / CUPID) — через always-on `code-quality-and-refactoring`, не дублировать эссе в review
+
+Concrete rule stems — in **Stack notes**.
+
+## Constraints
+
+- Focus on MR diff, not the whole repo.
+- Use local `git diff` — do not invent hosting metadata.
+- Boy scout rule: suggest fixes feasible within the MR scope.
+- No «большие рефакторинги» without an explicit request (`code-quality-and-refactoring`).
+
+## Output contract
+
+Procedure details live in skill `code-review`. Required shape:
+
+- Each finding cites **`path:line`**, the problem, impact, and a concrete fix direction.
+- Rank by severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding file context.
+- End with a verdict on its own line: **`Safe to merge | needs changes | reject`**.
+
+## Stack notes
+
+- Laravel boundaries: `architecture-boundaries` — HTTP → Actions/Services → Eloquent; Policies at the edge; Providers wire only.
+- HTTP edge: `http-layer`, `form-requests`, `routes-api` — thin Controllers, Form Request validation, API Resources.
+- Application + persistence: `actions-services`, `eloquent-persistence`, `policies-authorization`, `service-providers`.
+- Paths: `app/Http/**`, `app/Actions|Services/**`, `app/Models/**`, `app/Policies/**`, `app/Providers/**`, `routes/**`.
+- Tests: `tests-unit` (Actions/pure PHP); `tests-integration` (Feature HTTP/DB); post-change: `post-change-test` / `php-tooling`.
+- Security: secrets/PII/`security-php`; AuthZ via Policies — not ad-hoc role checks in Controllers/Models.
+- Never require Playwright, XCUITest, `lint:js`, or `xcodebuild` for Laravel MRs.
+