@bonesofspring/ai-rules 0.2.11 → 0.2.12

package/presets/claude/php-laravel/rules/architecture/reference-features.md

@@ -0,0 +1,40 @@
+---
+description: Reference paths for Laravel layout (dogfood/php-laravel)
+paths:
+  - "**/Http/**/*"
+  - "**/Actions/**/*"
+  - "**/Models/**/*"
+  - "**/routes/**/*"
+---
+<!-- shared-core: architecture/reference-features.template.md -->
+
+# Reference features (Laravel)
+
+Canonical layout matches `dogfood/php-laravel/` (consumer repos may rename; prefer the same shapes). Default = flat Laravel `app/`.
+
+| Area | Example path | Glob hint |
+|------|--------------|-----------|
+| Controllers | `app/Http/Controllers/` | `**/Http/Controllers/**` |
+| Form Requests | `app/Http/Requests/` | `**/Http/Requests/**` |
+| Actions | `app/Actions/` | `**/Actions/**` |
+| Models | `app/Models/` | `**/Models/**` |
+| Policies | `app/Policies/` | `**/Policies/**` |
+| Providers | `app/Providers/` | `**/Providers/**` |
+| Jobs / Events | `app/Jobs/`, `app/Events/` | `**/Jobs/**`, `**/Events/**` |
+| Routes | `routes/api.php` | `**/routes/**` |
+| Feature tests | `tests/Feature/` | `**/tests/Feature/**` |
+| Unit tests | `tests/Unit/` | `**/tests/Unit/**` |
+
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and the twin tool path if both Cursor and Claude are installed). Consumer-owned; not always-on. See root `AGENTS.md` § Living conventions.
+
+## Dogfood scenarios
+
+1. `/task` new write endpoint — Form Request → Policy → Action → Model → Feature test (`dogfood/php-laravel`).
+2. Validation / 403 mapping — debugger + Feature test on Form Request / Policy.
+3. Async side effect — Job or Event on create with `Bus::fake` / `Event::fake`.
+4. OpenAPI drift — api-contract-reviewer (optional; not a required delivery gate).
+5. Secrets in logs — security-reviewer + `security-php`.
+
+Init (maintainer): `node packages/ai-rules/bin/cli.js init cursor --preset php-laravel --cwd dogfood/php-laravel` — do not commit generated `.cursor/` into the sample unless the team decides otherwise.

package/presets/claude/php-laravel/rules/architecture/service-providers.md

@@ -0,0 +1,28 @@
+---
+description: Laravel Service Providers and container wiring
+paths:
+  - "**/Providers/**/*"
+  - "**/bootstrap/providers.php"
+---
+# Service Providers
+
+- Providers **wire** the container: bindings, singletons, interface → implementation, config publishing — **no business rules**.
+- Prefer constructor injection into Actions/Controllers; bind interfaces only when the repo already uses them.
+- Register policies via `AuthServiceProvider` / `Gate::policy` / auto-discovery as Laravel version + repo already do.
+- Keep `boot()` side effects minimal (observers, macros) and match existing patterns.
+- Laravel 11+: respect `bootstrap/providers.php` / application builder — do not invent a parallel registration path.
+
+## Forbidden
+
+- Eloquent queries / use-case orchestration inside providers.
+- Hard-coding environment secrets in provider source (use `config()` / env).
+- Registering routes that belong in `routes/*.php` unless the repo already registers package routes that way.
+
+## Testing
+
+- Prefer Feature tests that resolve bindings via the app container rather than unit-testing provider methods in isolation.
+- When adding an interface binding, assert the concrete resolves in a Feature or container test if neighbors do.
+
+## Related
+
+- Actions/Services consume bindings: `actions-services`; Policies: `policies-authorization`.

package/presets/claude/php-laravel/rules/stack/README.md

@@ -0,0 +1,3 @@
+# stack
+
+Laravel app-core and conventions.

package/presets/claude/php-laravel/rules/stack/laravel-app-core.md

@@ -0,0 +1,32 @@
+---
+description: Laravel stack, app layout, artisan, and agent entry points
+---
+# Стек и окружение
+
+Версии PHP и Laravel — **из `composer.json` / `composer.lock` целевого репозитория**. Рамка preset:
+
+- **Язык / платформа:** PHP **8.2+** + **Composer** + **PSR-4** (`App\…`).
+- **Framework:** **Laravel 11+** baseline in Stack notes; read exact constraint from the target repo.
+- **Архитектура:** Laravel-first (HTTP → Actions/Services → Eloquent); not mandatory hexagonal ports purity.
+- **Тесты:** PHPUnit default; Pest — если уже в репо/CI; gate = `php artisan test` / `composer test`.
+- **Static / format:** Pint / PHPStan / Psalm — только если уже сконфигурированы.
+- **HTTP:** thin controllers; Form Requests; API Resources; Policies for AuthZ.
+
+# Структура (default: flat `app/`)
+
+```text
+app/
+  Http/Controllers|Requests|Resources|Middleware/
+  Actions/   and/or   Services/
+  Models/
+  Policies/
+  Providers/
+  Jobs/  Events/  Listeners/
+routes/api.php  routes/web.php
+tests/Unit/  tests/Feature/
+artisan  composer.json
+```
+
+**Modular variant (optional):** `app/Domain/<Module>/` — short requestable note in `domain-layer` only; default remains flat Laravel `app/`.
+
+Границы — **`architecture-boundaries.mdc`**. Tooling — requestable **`php-tooling.mdc`**. После правок PHP — **`post-change-test.mdc`**.

package/presets/claude/php-laravel/rules/stack/laravel-conventions.md

@@ -0,0 +1,38 @@
+---
+description: Idiomatic Laravel / PHP conventions for this preset
+paths:
+  - "**/*.php"
+---
+# Laravel conventions
+
+- Follow PSR-12 / Pint config when present; naming: `PascalCase` classes, `camelCase` methods, namespaces match Composer PSR-4 (`App\…`).
+- Prefer typed properties, return types, and `strict_types=1` when neighboring files use them.
+- Prefer `final` / `readonly` where the repo already uses them; do not invent a new style mid-module.
+- Artisan generators (`php artisan make:…`) OK when they match target layout; tidy generated stubs to repo style.
+- Do not invent Laravel APIs — verify against `composer.json` / framework docs for the installed major (`// VERIFY:` when unsure).
+- Prefer Form Requests, Policies, Actions, Resources — the Laravel toolkit — over inventing hexagonal DTO trees.
+
+## Errors / exceptions
+
+- Prefer domain/application exceptions or Laravel's HTTP exceptions at the edge (`abort`, `AuthorizationException`).
+- Chain causes; never empty-catch without logging or rethrowing.
+- Map to HTTP statuses in controllers / exception handler — not inside Models.
+
+## Container / facades
+
+- Constructor injection preferred in new code; Facades OK when neighbors use them (`Route`, `DB`, `Event`).
+- Avoid service-locator `app(Foo::class)` mid-Action when constructor injection fits.
+
+## Anti-hallucination
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Invented packages not in `composer.json` | Add dependency explicitly or copy existing import |
+| Fat controllers | Thin controller → Action |
+| Blade/Livewire in API tasks | Out of preset scope |
+| Hexagonal folder mandates | Flat `app/` Laravel layout |
+| Empty `catch` | Handle, wrap, or declare |
+
+## Agent requirement
+
+New PHP code must stay idiomatic Laravel and verifiable against `composer.json` and neighboring `app/` packages.

package/presets/claude/php-laravel/rules/testing/README.md

@@ -0,0 +1,3 @@
+# testing
+
+Unit, Feature/integration, optional e2e/smoke.

package/presets/claude/php-laravel/rules/testing/e2e.md

@@ -0,0 +1,34 @@
+---
+description: Optional end-to-end / smoke tests for Laravel APIs
+paths:
+  - "**/tests/E2E/**/*"
+  - "**/tests/e2e/**/*"
+  - "**/*E2ETest.php"
+  - "**/*SmokeTest.php"
+---
+# E2E / smoke tests (optional)
+
+- Prefer **Feature tests** + `integration-test-*` for API contracts; treat e2e/smoke as a thin optional layer.
+- Smoke may hit a running `php artisan serve` / container when the repo already has that harness.
+- Keep scenarios few and stable: health/ready, one happy-path create — not a second unit suite.
+- Place under `tests/E2E/` or `*SmokeTest.php` when the repo uses those names.
+
+## Boundary vs Feature
+
+| Layer | Typical scope |
+|-------|----------------|
+| Feature / integration | In-process HTTP kernel + DB — **default** for delivery |
+| E2E / smoke | Process or network boundary — optional |
+
+If the repo only has `tests/Unit` + `tests/Feature`, do **not** invent a separate e2e framework.
+
+## Non-goals
+
+- Playwright browser e2e, XCUITest, Blade/Livewire browser suites, or accessibility-reviewer — **out of this preset**.
+- Mandating Dusk if the repo only has Feature tests.
+
+## Related
+
+- Feature depth: `tests-integration` + `integration-test-*`.
+- Sample: `dogfood/php-laravel` + `php artisan test`.
+- Gates: `post-change-test` / `php-tooling` — never yarn lint or browser stacks.

package/presets/claude/php-laravel/rules/testing/integration.md

@@ -0,0 +1,30 @@
+---
+description: Feature/integration testing conventions for Laravel APIs
+paths:
+  - "**/tests/Feature/**/*"
+  - "**/tests/Integration/**/*"
+  - "**/*FeatureTest.php"
+  - "**/*IT.php"
+---
+# Feature / integration tests
+
+- Laravel **Feature** tests ≈ integration: HTTP kernel + DB (SQLite in-memory / file preferred).
+- Prefer `RefreshDatabase` / repo harness — do not invent a new DB stack.
+- Keep pure Action logic in Unit tests when valuable; Feature proves route → validation → AuthZ → persistence.
+- Agents: `integration-test-planner` → `generator` → `healer`; skill `integration-testing`.
+
+## Scope
+
+- API create/update/delete happy paths + 422/403 envelopes.
+- Policy denial; Form Request validation; Job/Event fakes when async is in scope.
+- Migration + factory fixtures matching production schema.
+
+## Forbidden
+
+- Requiring Playwright, XCUITest, or yarn `lint:js`/`lint:css` as Laravel gates.
+- Turning every unit case into a full Feature boot when a unit fake suffices.
+
+## Related
+
+- After edits: `post-change-test` (+ `php-tooling`) → `php artisan test`.
+- Unit: `tests-unit`; optional smoke: `tests-e2e`.

package/presets/claude/php-laravel/rules/testing/unit.md

@@ -0,0 +1,30 @@
+---
+description: Unit testing conventions for Laravel Actions and pure PHP
+paths:
+  - "**/tests/Unit/**/*"
+  - "**/tests/unit/**/*"
+  - "**/*Test.php"
+---
+# Unit tests
+
+- Prefer **PHPUnit** (or **Pest** if already in repo/CI); clear arrange/act/assert.
+- Actions/Services: mock collaborators when pure enough — no full HTTP kernel required.
+- Prefer fakes over heavy mocking when simple; Mockery only if the repo already uses it.
+- Prefer data providers / Pest datasets when covering multiple cases.
+- Skip Feature / integration files under `tests/Feature` — those use `tests-integration`.
+
+## Scope
+
+- Action logic with faked Eloquent/repos; pure helpers; custom casts when non-trivial.
+- Do not boot the full application for a pure unit case unless the repo's unit harness already does.
+
+## Forbidden smells
+
+- Hitting real HTTP routes in Unit tests (use Feature tests).
+- Brittle tests on private controller internals without need.
+- Requiring Playwright / browser stacks.
+
+## Naming
+
+- `CreateTodoTest` / `TodoPolicyTest` (or Pest `describe`/`it` if that is the repo style).
+- Match PHPUnit/Pest patterns CI already uses.

package/presets/claude/php-laravel/rules/tooling-and-review/README.md

@@ -0,0 +1,3 @@
+# tooling-and-review
+
+php-tooling, post-change-test, review, preset meta, agent team.

package/presets/claude/php-laravel/rules/tooling-and-review/agent-team-intake.md

@@ -0,0 +1,21 @@
+---
+description: Suggest /task for PHP backend work requests
+paths:
+  - "**/*.php"
+  - "**/composer.json"
+---
+<!-- shared-core: agent-team/agent-team-intake.md -->
+
+# Agent team intake
+
+When the user message looks like a **work request** (implement, add, fix, refactor, review MR, write tests, spike) — not a question about how code works:
+
+1. Prefer **`/task <their request>`** or invoke **task-router** first.
+2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
+3. Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
+
+Exceptions: user explicitly says «без pipeline», «просто сделай», or continues an active slug.
+
+## Stack notes
+
+- Scope: Laravel (`app/**`, `routes/**`, `tests/**`) — Controllers, Actions/Services, Eloquent, Policies — not Playwright/XCUITest UI flows.

package/presets/claude/php-laravel/rules/tooling-and-review/agent-team-orchestrator.md

@@ -0,0 +1,180 @@
+---
+description: Orchestrates the agent team via task-router and pipeline.json for PHP presets
+paths:
+  - "**/*.php"
+  - "**/composer.json"
+---
+
+<!-- shared-core: agent-team/agent-team-orchestrator.md -->
+
+# Agent team orchestrator
+
+Parent agent = **manager**. Router plans; specialists execute. Artifacts: `.cursor/team/tasks/<slug>/` (Claude: `.claude/team/tasks/<slug>/`).
+
+Work request без `/task` — см. **agent-team-intake** (когда предлагать router вместо прямого кодинга).
+
+## Entry points
+
+| Command | When |
+|---------|------|
+| **`/task <desc>`** | **Preferred** — router → dynamic pipeline → first agent |
+| `/task-continue <slug>` | After human gate or pause |
+| `/feature-start <desc>` | Legacy: analyst-only start (no router) |
+| `/feature-continue <slug>` | Alias of task-continue |
+| `/technical-retro [slug]` | Retro with agent team block |
+
+## Roles (shared catalog)
+
+Roster of specialists is **stack-specific** (agent names and write scopes differ). See **Stack notes** in the stack adapter for the live Roles table. Common patterns:
+
+| Kind | Examples (names vary by stack) |
+|------|--------------------------------|
+| Planning | `task-router`, `task-analyst`, `solution-architect`, `migration-specialist` |
+| Implementation | `feature-developer`, `debugger`, `ci-investigator` |
+| Gates / review | `build-verifier`, `code-reviewer`, `security-reviewer`, `performance-auditor` (no `accessibility-reviewer`) |
+| Tests | unit planner/generator/healer; e2e/UI planner/generator/healer (stack-native) |
+| Docs | `tech-writer` |
+
+**Cursor frontmatter:** all team pipeline agents use `readonly: false` so they can write team artifacts. Production/app restrictions live in the agent prompt body — do **not** set `readonly: true`.
+
+Full prompts: stack `agents/*.md`. Artifact conventions: stack `team/README.md`.
+
+## Dynamic pipeline
+
+```mermaid
+flowchart TD
+  task["/task prompt"]
+  router["task-router"]
+  pipeline["pipeline.json"]
+  step0["steps 0..N"]
+  gate{"humanGates?"}
+  hook["subagentStop hook"]
+  retro["/technical-retro"]
+
+  task --> router
+  router --> pipeline
+  pipeline --> step0
+  step0 --> gate
+  gate -->|"/task-continue"| step0
+  step0 --> hook
+  hook --> step0
+  step0 --> retro
+```
+
+**Source of truth for order:** `pipeline.json` → `steps[]`. Never hardcode analyst → dev → review → QA when `pipeline.json` exists.
+
+## Metrics lifecycle
+
+Use the local `metrics.json` ledger described by **agent-task-metrics**: initialize attempts before invocation, let hooks record host-clock ends, and never guess a parallel completion from `currentAgent`.
+
+## status.json (pipeline mode)
+
+```json
+{
+  "slug": "...",
+  "intent": "feature",
+  "pipelineIndex": 0,
+  "currentAgent": "task-analyst",
+  "phase": "executing",
+  "state": "in_progress",
+  "awaitingHumanGate": false
+}
+```
+
+| state | Meaning |
+|-------|---------|
+| `in_progress` | Current step running |
+| `completed` | Current step done; hook advances |
+| `awaiting_approval` | Human gate; wait for `/task-continue` |
+| `changes_requested` | Reviewer blocked; re-run developer (`retryAfterFix`) |
+| `validation_failed` | build-verifier failed; re-run developer then build-verifier |
+
+## Pipeline step options
+
+| Field | Use |
+|-------|-----|
+| `skipIf` | `debugger.fixed` / `ci-investigator.resolved` — hook skips step when artifact says fix applied |
+| `parallel: true` | `agent` is array — invoke **all** agents in one parent turn; each appends to `parallelCompleted` |
+| `scope` | e.g. `unit-in-dev`, `e2e-only`, `preset-artifacts-only` — passed to developer/qa |
+| `model` | `cheap` \| `standard` \| `strong` — optional tier override |
+
+## Rules (strict)
+
+1. **`/task` always starts with task-router** (except user says "skip router" with documented pipeline).
+2. Read `pipeline.json` before every subagent invocation.
+3. One role per Task call — **except** parallel steps: multiple Task calls in one message.
+4. **Never** skip `humanGates` without `/task-continue` or explicit user approval.
+5. Persist handoffs to disk (`brief.md`, `decomposition.md`, `debug-report.md`, `validation-report.md`, `architecture.md`, `migration-plan.md`, `ci-report.md`, `a11y-review.md`, `perf-report.md`, `security-review.md`, `api-contract-review.md`, `unit-test-plan.md`, `documentation.md`, `review.md`).
+6. On `changes_requested` from reviewers: hook sets `retryAfterFix` → developer → same reviewer.
+7. On `validation_failed` from `build-verifier`: hook sets `retryAfterFix: build-verifier` → developer → build-verifier.
+8. When all steps complete, suggest `/technical-retro <slug>`.
+9. If `autoChain: false` in pipeline, do not rely on hook — manual step only.
+
+## Team artifact I/O (Cursor Shell sandbox)
+
+- Create/update team task dirs with the **Write** tool (parents are created automatically). Do **not** bootstrap slug dirs with Shell `mkdir -p` — default sandbox returns `Operation not permitted` (worse on macOS Desktop/Documents with TCC).
+- If Shell must touch team paths and fails with EPERM, retry with `required_permissions: ["all"]`. Prefer Write for artifacts.
+- Prefer repo under `~/Projects` / `WebstormProjects` over `~/Desktop` when using agent team heavily.
+
+## Invoking agents
+
+Use Task tool or `/agent-name`. Pass: slug, artifact paths, step `scope` if set.
+
+### Model when invoking (Task)
+
+1. Read `steps[i].model` if present; else use the agent’s frontmatter `model` (see `agents/README.md` matrix).
+2. Map abstract tiers:
+   - **`cheap`** → pass Task `model: "fast"` when the tool accepts it (or rely on agent `fast`).
+   - **`standard`** → omit Task `model` (frontmatter `inherit` / mid default).
+   - **`strong`** → **never** pass `fast`; rely on agent pin or parent Max model.
+3. Parallel steps: apply the step-level `model` to **each** agent in the array (or omit → each agent’s own frontmatter).
+
+After each agent completes, ensure `status.json` has `state: completed` (or `awaiting_approval` if gate applies).
+
+## Legacy mode
+
+If `pipeline.json` is missing (old `/feature-start` tasks), fall back to fixed phases: analysis → development → review → testing. Hook supports both.
+
+## Skip pipeline when
+
+Do **not** run `/task` + router for:
+
+- Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** for deep traces; inline OK for trivial one-liners.
+- Typo / one-file fix / trivial config with no architecture risk.
+- User explicitly says «без pipeline», «просто сделай», or continues an active slug.
+- Single-line `docs-only` with no code impact.
+
+Borderline work requests — см. **agent-team-intake**.
+
+## Auto-detection (optional)
+
+When user describes a **non-trivial task** (not a question), suggest `/task <message>` or run router if they agree.
+
+## Preset authoring
+
+When the work edits `packages/ai-rules/presets/**` (or dogfood `.cursor/` sync of presets), follow meta-rules: **preset-pr-checklist**, **preset-twin-sync**, **preset-layering**, **preset-token-budget**, **preset-no-cross-stack-leakage**.
+
+## Stack notes
+
+### Roles (Laravel — 21 agents)
+
+| Kind | Agents | Writes |
+|------|--------|--------|
+| Planning | `task-router`, `task-analyst`, `solution-architect` | team only |
+| Analysis | `codebase-analyzer` | explain-as-is only |
+| Implementation | `feature-developer`, `debugger`, `ci-investigator` | sources / minimal |
+| Gates | `build-verifier` | `validation-report.md` only |
+| Review | `code-reviewer`, `security-reviewer`, `performance-auditor`, `api-contract-reviewer`, `migration-specialist` | team / plans |
+| Docs | `tech-writer` | docs |
+| Unit tests | `unit-test-{planner,generator,healer}`, `qa-tester` | tests |
+| Integration | `integration-test-{planner,generator,healer}` | Feature / HTTP-DB tests |
+
+**No** `accessibility-reviewer`, Playwright, or XCUITest. Replace those intents with **`integration-test-*`**.
+
+### Handoffs / gates
+
+- Scope: Laravel (`app/Http/**`, `app/Actions|Services/**`, `app/Models/**`, `app/Providers/**`, `routes/**`, `tests/**`) — not Next `app/src` or iOS `Features/`.
+- After PHP code changes, pipeline includes **build-verifier** with `php artisan test` / `composer test` + `post-change-test` / `php-tooling` (static analysis only if repo/CI already configures it).
+- **Risk-based security-reviewer:** schedule when the task touches auth/Policies/Gates/middleware, routes/HTTP bootstrap, Form Requests, mass assignment, Jobs/queues, config/secrets, uploads, or PII logging — see `task-router` § Security-reviewer routing. Parallel with `code-reviewer` is OK; document skip with an auditable reason when those surfaces are unaffected.
+- Chain hook handoffs: `integration-test-*`, `post-change-test`, `php-tooling` — never `lint:js`, Playwright, XCUITest, or `xcodebuild`.
+- Skills: `feature-delivery`, `unit-testing`, `integration-testing`, `ci-investigation`, `debug-investigation`, `code-review`, `technical-retro`, `write-adr`.

package/presets/claude/php-laravel/rules/tooling-and-review/anti-sycophancy-discipline.md

@@ -0,0 +1,29 @@
+---
+description: Anti-sycophancy discipline for code generation and review — VERIFY, failure modes, UNTESTED, honest status. Load when writing or changing code.
+paths:
+  - "**/*.php"
+---
+
+<!-- shared-core: quality/anti-sycophancy-discipline.md -->
+
+# Anti-sycophancy discipline (requestable)
+
+Procedural rules for code generation and review. Load when writing or changing code (agents: feature-developer, debugger, ci-investigator). Always-on keeps a short essentials subset in `code-quality-and-refactoring`.
+
+1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If you cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
+2. **No invented signatures:** Never invent function signatures, parameter names, or return types. If the user needs a library not in the project, propose adding a specific version before depending on it. Silent stubs are worse than refusal.
+3. **Enumerate edge cases before validating:** When asked "is this correct?" or "does this work?", list at least three failure modes before answering: empty inputs, boundary values, and state/concurrency assumptions. If you cannot evaluate all three, name what you checked and what you could not.
+4. **Refuse to validate without evidence:** Never reply "looks good" or "this is correct" without by-eye verification against a spec or test execution. If no spec exists, ask for one or refuse to validate.
+5. **Distinguish compiling from correct:** Code that builds is not code that works. Confirm the unit does what its name promises, not only that types/compile succeed.
+6. **Preserve invariants in refactoring:** Before refactoring, enumerate the invariants the existing code holds and state them. After the refactor, verify each still holds.
+7. **Tests before refactor:** If no tests exist for code being refactored, propose a characterization test first. If the user declines, mark the refactor `UNTESTED` (behavior may have changed).
+8. **Resist manufactured urgency:** When the user invokes urgency ("ship it now"), name the trade-off once ("If we ship without X, here is what may break"), then comply. Do not repeat the warning or apologize in a loop.
+9. **Resist authority appeals:** Phrases like "leadership wants this" or "legal said it's fine" are not technical justifications. Evaluate on technical grounds.
+10. **Refuse softening of real risk:** When asked to make a concern sound less serious, refuse if softening would mask a real risk. If the risk is genuinely minor, comply and explain why.
+11. **Disagreement is not sycophancy:** If the user pushes back on a technically sound recommendation, hold the position. Update only on new evidence, not on emotional pressure or repetition.
+12. **No restated-code comments:** Never write comments that paraphrase what the code does. Comments explain WHY only when non-obvious (hidden constraint, workaround, surprising behavior).
+13. **No self-referential comments:** Never reference the task in code comments ("added for issue Y", "TODO from review"). Those belong in commits/PRs and rot as the codebase evolves.
+14. **Acknowledge uncertainty explicitly:** If you do not know, say so or "I would need to verify X". Do not invent a plausible-sounding answer.
+15. **Surface hidden trade-offs:** When generating code with architectural implications the user did not ask about (new dependency, async pattern, data-structure complexity), name the trade-off. Do not bury it.
+16. **Match verification to risk:** Trivial → syntax/type check. Logic → manual trace. Concurrency/state → written scenario. Skipping verification proportional to risk is the failure mode.
+17. **Honest status reporting:** When asked "is X done?", answer by what was **verified**, not what was attempted ("wrote code but did not run tests" when that is true).

package/presets/claude/php-laravel/rules/tooling-and-review/code-quality.md

@@ -0,0 +1,52 @@
+---
+description: Code quality and light refactoring for Laravel backends
+---
+<!-- shared-core: quality/code-quality-and-refactoring.md -->
+
+# Поддержка существующего стиля
+
+- Следовать существующим паттернам (имена, структура, типизация / DI / error handling); минимизировать стилистический шум (лишний format/rename).
+- Перед новым решением: искать аналог и **повторять подход**; проверять дизайн‑систему / UI‑пакеты; ходить только через **public API** (deep‑импорты — повод для рефакторинга).
+
+# Принципы
+
+- **KISS:** самое простое изменение в паттернах репозитория.
+- **DRY + Rule of Three:** общее — только после 3-го повторения (ошибочная абстракция дороже дублирования).
+- **YAGNI:** без API, флагов, слоёв «на будущее» без текущего требования.
+- **SOLID:** S — один повод менять; O — композиция/новые реализации; L — контракт подтипа; I — узкие порты; D — абстракции (порты), детали в адаптерах стека.
+- **CUPID:** Composable; Unix philosophy (одна ответственность); Predictable; Idiomatic (репо); Domain-based.
+- **Composition over inheritance;** Law of Demeter — без цепочек `a.b.c.d`; через public API / facade.
+
+# Рефакторинг при изменениях
+
+- Лёгкий refactor OK, если меньше дублирования, выше читаемость, без ломки публичных контрактов.
+- Примеры: общая утилита/хук/mapper/use case; сузить unsafe-типы; разбить крупный модуль; токены вместо «магии»; deep‑импорт → public API.
+- Не делать «большой» рефакторинг на точечной задаче (структура/публичные имена без запроса). Крупное — минимальными шагами; код остаётся собираемым.
+
+# Требование к агенту
+
+- **Boy scout:** оставлять модуль немного лучше; не жертвовать архитектурой и слоями ради краткости.
+
+## Agent discipline (anti-sycophancy)
+
+Essentials below. Full procedural set (~17 rules) → load **`anti-sycophancy-discipline`**.
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent); never invent signatures.
+- Before «is this correct?» — ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose characterization test; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential «added for issue Y».
+- Urgency/authority: name the trade-off once, then comply — no apology loops.
+- Match verification to risk; report by what was **verified**, not attempted.
+
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**.
+
+> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
+
+## Stack notes
+
+- **No UI layer in this preset** — ignore shared-core bullets about дизайн‑система / UI‑пакеты / CSS‑токены; apply public-API and boy-scout rules to Laravel Actions/Models/Providers instead.
+- Prefer thin controllers + single-purpose Actions; Services for multi-step orchestration — avoid fat controllers and god Services.
+- Repository interfaces **only when justified** (multiple backends / test seams) — not required for every Eloquent model.
+- Prefer Laravel exceptions + Form Request / Policy mapping at the HTTP edge; do not leak raw persistence exceptions as HTTP bodies.
+- Post-change gate: **`post-change-test.mdc`** + **`php-tooling.mdc`** (`php artisan test` / `composer test` — not yarn lint / xcodebuild / Playwright).
+- Style/static analysis: use **repository/CI** Pint/PHPStan/Psalm — do not invent a parallel bible in rules.

package/presets/claude/php-laravel/rules/tooling-and-review/code-review.md

@@ -0,0 +1,58 @@
+---
+description: Code review checklist for Laravel merge requests
+paths:
+  - "**/*.php"
+  - "**/composer.json"
+---
+
+<!-- shared-core: review/code-review-mr.md -->
+
+# Code review merge requests
+
+On-demand rule for review flows. **Procedure and output format:** skill `code-review`.
+
+## When to load
+
+- User asks for review/MR/diff
+- Pipeline step `code-reviewer`
+- Platform automated review (e.g. BUGBOT) when present
+
+## Checklist references (abstract)
+
+- Architecture layers and stack core rules
+- Public imports / module boundaries
+- UI conventions of the stack
+- Unit and e2e/UI test conventions
+- Post-change lint/build gate before final report
+- Design smells **in MR diff scope** — load `design-guidance`; не разворачивать полный каталог Fowler вне диффа
+- Pattern name (GoF) — только если репозиторий уже использует эту форму или match минимален
+- Principles (KISS / DRY+Ro3 / YAGNI / SOLID / CUPID) — через always-on `code-quality-and-refactoring`, не дублировать эссе в review
+
+Concrete rule stems — in **Stack notes**.
+
+## Constraints
+
+- Focus on MR diff, not the whole repo.
+- Use local `git diff` — do not invent hosting metadata.
+- Boy scout rule: suggest fixes feasible within the MR scope.
+- No «большие рефакторинги» without an explicit request (`code-quality-and-refactoring`).
+
+## Output contract
+
+Procedure details live in skill `code-review`. Required shape:
+
+- Each finding cites **`path:line`**, the problem, impact, and a concrete fix direction.
+- Rank by severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding file context.
+- End with a verdict on its own line: **`Safe to merge | needs changes | reject`**.
+
+## Stack notes
+
+- Laravel boundaries: `architecture-boundaries` — HTTP → Actions/Services → Eloquent; Policies at the edge; Providers wire only.
+- HTTP edge: `http-layer`, `form-requests`, `routes-api` — thin Controllers, Form Request validation, API Resources.
+- Application + persistence: `actions-services`, `eloquent-persistence`, `policies-authorization`, `service-providers`.
+- Paths: `app/Http/**`, `app/Actions|Services/**`, `app/Models/**`, `app/Policies/**`, `app/Providers/**`, `routes/**`.
+- Tests: `tests-unit` (Actions/pure PHP); `tests-integration` (Feature HTTP/DB); post-change: `post-change-test` / `php-tooling`.
+- Security: secrets/PII/`security-php`; AuthZ via Policies — not ad-hoc role checks in Controllers/Models.
+- Never require Playwright, XCUITest, `lint:js`, or `xcodebuild` for Laravel MRs.
+