@bonesofspring/ai-rules 0.2.11 → 0.2.13

package/presets/claude/next/rules/README.md

@@ -103,3 +103,9 @@
 | `tooling-and-review/` | Quality, review, lint, agent-team, retro, **preset meta** |
 
 **Коллизии:** импорт типов и API — **`architecture/public-imports.md`**.
+
+## Metrics policy mapping
+
+| Shared core | Runtime integration | Loading |
+|-------------|---------------------|---------|
+| `agent-team/agent-task-metrics.md` | `agent-team-orchestrator` + `hooks/chain-team-phases.sh` | requestable/on-demand; never session-start |

package/presets/claude/next/rules/tooling-and-review/agent-team-orchestrator.md

@@ -50,7 +50,7 @@ Work request без `/task` — см. **`tooling-and-review/agent-team-intake.md
 | `playwright-test-healer` | tests only | failing/flaky e2e fixes |
 | `tech-writer` | docs only | docs-only, feature/migration docs |
 
-Full prompts: `.claude/agents/*.md`. Artifact conventions: `.claude/team/README.md`.
+Full prompts: `.claude/agents/*.md`. Artifact conventions: `.claude/team/README.md`; schema SoT: **agent-artifact-contracts**.
 
 ## Dynamic pipeline
 
@@ -76,6 +76,22 @@ flowchart TD
 
 **Source of truth for order:** `pipeline.json` → `steps[]`. Never hardcode analyst → dev → review → QA when `pipeline.json` exists.
 
+New pipelines retain top-level `profile` and include `routingDecision` with `complexity`, `riskFlags`, non-empty `routingReasons`, `estimatedWorkPackages`, and `openDecisionCount`. The stack `task-router` owns heuristics; this metadata is auditable evidence and does not change hook semantics.
+
+## Metrics lifecycle
+
+Use the local `metrics.json` ledger described by **agent-task-metrics**: the orchestration runtime initializes attempts before invocation, hooks record host-clock ends, and agents never guess a parallel completion from `currentAgent`.
+
+## Artifact context index and receipts
+
+Each slug has one `artifact-manifest.json`: `.cursor/team/tasks/<slug>/` or `.claude/team/tasks/<slug>/`. Schema SoT: **agent-artifact-contracts**.
+
+- Read the manifest before broad prior-artifact discovery. Each step receives authoritative input entry IDs, owns named output entry IDs, and finishes with one terminal receipt linked to AC/task IDs.
+- Markdown remains detailed evidence; the manifest records producer, status, authoritative paths, timestamps, outcome, and evidence paths.
+- Agents upsert only entries they own and preserve foreign entries. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges.
+- The orchestration runtime/hook is the single writer for `status.json` lifecycle fields and `metrics.json`. Agents read status for eligibility but never rewrite state, gate, retry, attempt, timestamp, or metrics fields.
+- Missing/stale manifests are reported as a handoff gap; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` rather than inventing authority.
+
 ## status.json (pipeline mode)
 
 ```json
@@ -86,10 +102,23 @@ flowchart TD
   "currentAgent": "task-analyst",
   "phase": "executing",
   "state": "in_progress",
-  "awaitingHumanGate": false
+  "awaitingHumanGate": false,
+  "activeAttempts": {},
+  "lastCompletedAttempt": null,
+  "parallelCompleted": [],
+  "parallelOutcomes": {}
 }
 ```
 
+| Field | Meaning |
+|-------|---------|
+| `activeAttempts` | Transient timing bridge keyed by `attemptId` |
+| `lastCompletedAttempt` | Diagnostic pointer to the latest finished attempt |
+| `parallelCompleted` | Agents that have stopped in the current parallel step |
+| `parallelOutcomes` | Per-agent `{ outcome, attemptId, confidence }` for the current parallel join; cleared when the step advances or retries |
+
+On each `subagentStop`, the hook reconciles `status.state` from the completing producer's terminal `artifact-manifest.json` receipt when agents left lifecycle fields untouched. Wait for that handoff before invoking the next step.
+
 | state | Meaning |
 |-------|---------|
 | `in_progress` | Current step running |
@@ -136,7 +165,7 @@ Use the available Claude Code subagent / Agent tool. Pass: slug, artifact paths,
    - **`strong`** → `opus` (matches strong-agent frontmatter). Prefer explicit per-invocation `model` when frontmatter pins are flaky.
 3. Parallel steps: apply the step-level `model` to each agent (or omit → each frontmatter).
 
-After each agent completes, ensure `status.json` has `state: completed` (or `awaiting_approval` if gate applies).
+After each agent completes, verify its terminal manifest receipt, then let the orchestration runtime/hook reconcile `status.json` (`completed`, a blocking outcome, or `awaiting_approval`) from that receipt. Do not ask the agent to mutate shared lifecycle fields, and do not invoke the next specialist until the hook has written the handoff / updated `status.json`.
 
 ## Legacy mode
 

package/presets/claude/next/rules/tooling-and-review/preset-layering.md

@@ -24,7 +24,7 @@ paths:
 ## Куда класть новое правило
 
 1. Общие принципы для всех стеков → **core** + адаптеры с `<!-- shared-core: … -->`.
-2. Только один из installable стеков (`next` / `ios-swift` / `go` / `java`) → **stack-specific** (не в `_shared`).
+2. Только один из installable стеков (`next` / `ios-swift` / `go` / `java` / `mcp-ts` / `php-hexagonal` / `php-laravel`) → **stack-specific** (не в `_shared`).
 3. Только Cursor или только Claude packaging → platform artifact / frontmatter, не дублировать семантику.
 
 ## SoT

package/presets/claude/next/rules/tooling-and-review/preset-no-cross-stack-leakage.md

@@ -17,7 +17,7 @@ paths:
 
 - `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
 - `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
-- `go` / `java` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
 - `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
 - Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
 
@@ -36,16 +36,16 @@ Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild`
 - `xcuitest-test-` as handoff stems
 - Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
 
-## Forbidden in go / java hooks/agents (FAIL)
+## Forbidden in go / java / php-hexagonal / php-laravel hooks/agents (FAIL)
 
-Shared backend-stack bans (both `go` and `java`):
+Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
 
 - `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
 - Positive yarn recipes `lint:js` / `lint:css`
 - `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
 - Agent file `accessibility-reviewer` (no UI surface)
 
-Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`) or `java-tooling` (`mvn test` / `./gradlew test`).
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
 
 ## Forbidden in mcp-ts hooks/agents (FAIL)
 
@@ -66,4 +66,4 @@ Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`,
 
 ## Chain fork
 
-`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, `go`, `java`, and `mcp-ts` (per platform).
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, `go`, `java`, `mcp-ts`, `php-hexagonal`, and `php-laravel` (per platform).

package/presets/claude/next/rules/tooling-and-review/preset-pr-checklist.md

@@ -17,7 +17,7 @@ paths:
 
 - [ ] **SoT:** правки в `packages/…` (не только root `.cursor/`)
 - [ ] **Core:** если менялся `_shared/core/**` — обновлены все `<!-- shared-core: … -->` consumers (или documented intentional fork)
-- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, go, and java — см. `preset-twin-sync`)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel — см. `preset-twin-sync`)
 - [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table актуален
 - [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
 - [ ] **Leakage:** нет чужих stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)

package/presets/claude/next/rules/tooling-and-review/preset-twin-sync.md

@@ -22,6 +22,8 @@ Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
 | `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
 | `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
 | `mcp-ts` | `presets/cursor/mcp-ts/rules/*.mdc` | `presets/claude/mcp-ts/rules/<topic>/` | Keep in `claude/mcp-ts/rules/README.md` |
+| `php-hexagonal` | `presets/cursor/php-hexagonal/rules/*.mdc` | `presets/claude/php-hexagonal/rules/<topic>/` | Keep in `claude/php-hexagonal/rules/README.md` |
+| `php-laravel` | `presets/cursor/php-laravel/rules/*.mdc` | `presets/claude/php-laravel/rules/<topic>/` | Keep in `claude/php-laravel/rules/README.md` |
 
 ## Same-PR checklist
 
@@ -42,5 +44,7 @@ Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
 - **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
 - **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
 - **mcp-ts:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java; mapping table required).
+- **php-hexagonal:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts; mapping table required).
+- **php-laravel:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts / php-hexagonal; mapping table required).
 
 Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/claude/next/rules/tooling-and-review/technical-retro.md

@@ -13,4 +13,6 @@ paths:
 
 **`commands/technical-retro.md`** → `/technical-retro`
 
+When a task has `metrics.json`, use the local aggregation script and state the cohort, sample size, incomplete artifacts, attribution confidence, active attempt duration, and human-gate wait separately. Do not score malformed artifacts or gate wait as agent work.
+
 Используй rule только если command недоступен. Не дублируй содержимое command в ответе — следуй command-файлу и skill `technical-retro`.

package/presets/claude/next/team/README.md

@@ -12,6 +12,7 @@
     <slug>/
       pipeline.json
       status.json
+      metrics.json             # schema-v1 append-only event ledger (see Local metrics ledger)
       brief.md
       decomposition.md
       debug-report.md          # fixApplied: true/false
@@ -69,8 +70,11 @@
   "phase": "executing",
   "state": "in_progress",
   "awaitingHumanGate": false,
-  "parallelCompleted": [],
   "retryAfterFix": null,
+  "activeAttempts": {},
+  "lastCompletedAttempt": null,
+  "parallelCompleted": [],
+  "parallelOutcomes": {},
   "updatedAt": "2026-05-29T12:00:00.000Z"
 }
 ```
@@ -103,3 +107,30 @@ Legacy: `/feature-start`, `/feature-continue`.
 ## Git
 
 Commit task artifacts if you want them to survive `ai-rules clean claude`. Or copy finished tasks to `docs/agent-workflow/tasks/<slug>/`.
+
+## Artifact manifest and receipts
+
+Each slug stores one context index at `.claude/team/tasks/<slug>/artifact-manifest.json`. Schema v1 is defined by shared core `agent-team/agent-artifact-contracts.md`: every entry declares its producer, status, authoritative paths, acceptance-criteria IDs, decomposition task IDs, timestamps, and a terminal completion receipt.
+
+Producer/consumer rules:
+
+- Read the manifest first and use only the authoritative inputs needed by the current step; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` when it is missing or stale, and report that gap.
+- Producers upsert only their stable entry IDs, preserve foreign entries, and finish with `completed`, `blocked`, `changes_requested`, or `validation_failed` receipt evidence.
+- The router owns `pipeline.json` and its routing entry; analyst, developer, verifier, and reviewer own their named outputs and receipts. Consumers do not edit another producer's receipt.
+- Agents do not mutate `status.json` or `metrics.json`. The orchestration runtime/hook is their single writer. Parallel receipt merges are serialized by the parent/orchestrator.
+
+## Local metrics ledger
+
+`metrics.json` is an append-only schema-v1 event ledger for one task run. It contains only allowlisted IDs, task dimensions, timestamps, outcomes, and attribution confidence—never prompts, secrets, file paths, or contents. Policy SoT: `presets/_shared/core/agent-team/agent-task-metrics.md`. The orchestration runtime writes `task_started` / `attempt_started`; the hook records host-clock completion and human-gate edges under a per-task lock with temp-and-rename.
+
+`status.json.activeAttempts` is a transient timing bridge keyed by `attemptId`; `lastCompletedAttempt` is diagnostic; `parallelOutcomes` holds per-agent outcomes for the current parallel join until the step advances. For parallel stops, the hook must use a stable payload identity or the sole active attempt. Otherwise an explicit `.metrics-receipts.json` receipt is fallback data marked `source: agent`, `attributionConfidence: fallback`; it must never guess from `currentAgent`.
+
+After a human gate, `/task-continue` closes wait via the installed hook (do not hand-edit `pipelineIndex` first):
+
+```bash
+printf '%s\n' '{"status":"completed","action":"end_human_gate","activateNext":true}' | bash .claude/hooks/chain-team-phases.sh
+```
+
+That appends `human_gate_ended` before the next `attempt_started`. Cursor twin uses the same payload against `.cursor/hooks/chain-team-phases.sh`. Other installable stacks ship the same ledger contract in their `team/README.md`.
+
+Aggregate with `node packages/ai-rules/scripts/aggregate-agent-task-metrics.mjs --team-root .claude/team`. It reports role/agent count, completed count, total/average duration, distinct completed run IDs, separate human-gate wait, and incomplete artifacts. For retros, see `/technical-retro` → **Metrics evidence**.

package/presets/claude/next/team/fixtures/artifact-manifest.example.json

@@ -0,0 +1,61 @@
+{
+  "schemaVersion": 1,
+  "slug": "order-history-date-filter",
+  "updatedAt": "2026-07-31T12:20:00.000Z",
+  "artifacts": [
+    {
+      "id": "routing",
+      "producer": "task-router",
+      "status": "completed",
+      "authoritativePaths": ["pipeline.json"],
+      "acceptanceCriteriaIds": [],
+      "taskIds": [],
+      "timestamps": {
+        "createdAt": "2026-07-31T12:00:00.000Z",
+        "updatedAt": "2026-07-31T12:00:00.000Z",
+        "completedAt": "2026-07-31T12:00:00.000Z"
+      },
+      "receipt": {
+        "outcome": "completed",
+        "summary": "The feature pipeline and routing evidence are authoritative.",
+        "evidencePaths": ["pipeline.json"]
+      }
+    },
+    {
+      "id": "analysis",
+      "producer": "task-analyst",
+      "status": "completed",
+      "authoritativePaths": ["brief.md", "decomposition.md"],
+      "acceptanceCriteriaIds": ["AC-1", "AC-2"],
+      "taskIds": ["T1", "T2"],
+      "timestamps": {
+        "createdAt": "2026-07-31T12:01:00.000Z",
+        "updatedAt": "2026-07-31T12:05:00.000Z",
+        "completedAt": "2026-07-31T12:05:00.000Z"
+      },
+      "receipt": {
+        "outcome": "completed",
+        "summary": "The acceptance criteria and implementation tasks are ready.",
+        "evidencePaths": ["brief.md", "decomposition.md"]
+      }
+    },
+    {
+      "id": "implementation",
+      "producer": "feature-developer",
+      "status": "completed",
+      "authoritativePaths": ["implementation.md"],
+      "acceptanceCriteriaIds": ["AC-1", "AC-2"],
+      "taskIds": ["T1", "T2"],
+      "timestamps": {
+        "createdAt": "2026-07-31T12:06:00.000Z",
+        "updatedAt": "2026-07-31T12:20:00.000Z",
+        "completedAt": "2026-07-31T12:20:00.000Z"
+      },
+      "receipt": {
+        "outcome": "completed",
+        "summary": "Implementation and focused unit coverage are complete.",
+        "evidencePaths": ["implementation.md"]
+      }
+    }
+  ]
+}

package/presets/claude/next/team/fixtures/bugfix-standard.json

@@ -2,6 +2,16 @@
   "slug": "example-bugfix-standard",
   "intent": "bugfix",
   "profile": "standard",
+  "routingDecision": {
+    "complexity": "moderate",
+    "riskFlags": ["behavior-regression"],
+    "routingReasons": [
+      "The regression needs root-cause evidence before deciding whether a separate fix pass is necessary.",
+      "The bounded behavior change still requires validation and independent review."
+    ],
+    "estimatedWorkPackages": 1,
+    "openDecisionCount": 0
+  },
   "summary": "Regression fix with review",
   "steps": [
     { "agent": "debugger", "label": "Root cause" },

package/presets/claude/next/team/fixtures/feature-full.json

@@ -2,6 +2,16 @@
   "slug": "example-feature-full",
   "intent": "feature",
   "profile": "full",
+  "routingDecision": {
+    "complexity": "high",
+    "riskFlags": ["cross-layer", "public-contract", "broad-test-surface"],
+    "routingReasons": [
+      "The feature spans UI, state, and API boundaries, so architecture and implementation checkpoints are required.",
+      "The public contract and e2e acceptance surface require independent validation and review."
+    ],
+    "estimatedWorkPackages": 2,
+    "openDecisionCount": 1
+  },
   "summary": "Multi-layer feature with e2e coverage",
   "steps": [
     { "agent": "task-analyst", "label": "Clarify and decompose" },

package/presets/claude/next/team/fixtures/feature-light.json

@@ -2,6 +2,16 @@
   "slug": "example-feature-light",
   "intent": "feature",
   "profile": "light",
+  "routingDecision": {
+    "complexity": "low",
+    "riskFlags": [],
+    "routingReasons": [
+      "The request has explicit acceptance criteria and a reversible single-file scope.",
+      "No public contract, cross-layer coordination, or open decision requires analysis or architecture."
+    ],
+    "estimatedWorkPackages": 1,
+    "openDecisionCount": 0
+  },
   "summary": "Trivial single-file change with explicit AC",
   "steps": [
     { "agent": "feature-developer", "label": "Implement", "model": "cheap" },

package/presets/claude/php-hexagonal/CLAUDE.md

@@ -0,0 +1,31 @@
+# PHP hexagonal (Claude)
+
+Preset for PHP backends using ports & adapters (PSR / Composer-first).
+
+**Repo-root agents:** see [`AGENTS.md`](../../AGENTS.md) at the project root.
+
+- Session-start: `php-app-core`, `architecture/boundaries`, `code-quality` (exactly 3).
+- Delivery: `architecture/feature-delivery.md` + skill `feature-delivery`.
+- After PHP edits: `tooling-and-review/post-change-test.md` (+ `php-tooling`).
+- Integration tests: agents `integration-test-*` + skill `integration-testing` (never Playwright/XCUITest).
+- Unit tests: agents `unit-test-*` + skill `unit-testing` (PHPUnit).
+- ADR: skill `write-adr` (on-demand).
+- How does X work: agent `codebase-analyzer` (explain-as-is; no `/task`).
+
+## Inventory
+
+- **21 agents** — `agents/README.md` (no a11y / Playwright / XCUITest)
+- **8 skills** — feature-delivery, unit-testing, integration-testing, ci-investigation, debug-investigation, code-review, technical-retro, write-adr
+- **5 commands** — `/task`, `/task-continue`, `/feature-start`, `/feature-continue`, `/technical-retro`
+
+## Dogfood (5 scenarios)
+
+Host: `dogfood/php-hexagonal`.
+
+1. `/task` — domain use case through ports, adapters, Composition on the sample.
+2. HTTP DTO mapping bug — debugger + `TodoController` unit.
+3. Repository contract — integration-test trio (sample: in-memory persistence).
+4. PHPUnit unit test for use case with port fake/mock.
+5. Secrets/authz logging — `security-reviewer` + `security-php`.
+
+Init: `npx @bonesofspring/ai-rules init claude --preset php-hexagonal` (also copies `REPO_AGENTS.md` → root `AGENTS.md`).

package/presets/claude/php-hexagonal/MCP.md

@@ -0,0 +1,15 @@
+# MCP (preset `php-hexagonal`, Claude)
+
+Копируется в project `.mcp.json` при `ai-rules init claude --preset php-hexagonal`.
+
+## Servers
+
+| Name | Package | Зачем |
+|------|---------|--------|
+| `context7` | `@upstash/context7-mcp` | Актуальная документация PHP / Composer / популярных библиотек |
+
+Figma и browser e2e MCP (Playwright / Chrome DevTools) **не** входят в php-hexagonal-пресет (backend-only).
+
+Секреты в файл не кладём. Опционально: `CONTEXT7_API_KEY` в окружении.
+
+После init: включить MCP серверы в Claude Code. `init` перезаписывает одноимённый `mcp.json`.

package/presets/claude/php-hexagonal/README.md

@@ -0,0 +1,26 @@
+# Preset `php-hexagonal` (Claude)
+
+Installable Claude Code preset for **PHP hexagonal** services (PSR / Composer-first).
+
+```bash
+npx @bonesofspring/ai-rules init claude --preset php-hexagonal
+```
+
+## Layout
+
+| Path | Role |
+|------|------|
+| `rules/<topic>/` | Derived twins + mapping table in `rules/README.md` |
+| `rules/ui-and-accessibility/` | N/A stub (backend) |
+| `agents/` | 21 agents + README (no a11y / Playwright / XCUITest) |
+| `skills/` | 8 skills + README |
+| `commands/` | 5 slash commands |
+| `team/` | conventions + fixtures |
+| `hooks/` | Shell guard + team chain (byte-forked); **no `hooks.json`** (Claude platform limit) |
+| `REPO_AGENTS.md` | → consumer root `AGENTS.md` |
+| `CLAUDE.md` | Thin Claude entry + inventory / dogfood — **Claude-only** |
+| `MCP.md` / `mcp.json` | Context7 only |
+
+**Platform asymmetry:** `CLAUDE.md` is Claude-only. Cursor SoT has `BUGBOT.md` + `hooks.json` (not shipped here).
+
+Cursor SoT: `presets/cursor/php-hexagonal/`. Contribution: `docs/PRESET-CONTRIBUTION.md`.

package/presets/claude/php-hexagonal/REPO_AGENTS.md

@@ -0,0 +1,46 @@
+# PHP — agent instructions
+
+Cross-tool repo-root guide for the **php-hexagonal** preset (PSR / Composer-first). Tool-specific maps stay under `.cursor/AGENTS.md` and `.claude/CLAUDE.md`.
+
+## Cross-tool setup
+
+- Treat this file as the **shared** entry for any agent (Cursor, Claude Code, or other).
+- Install:
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset php-hexagonal
+npx @bonesofspring/ai-rules init claude --preset php-hexagonal
+```
+
+`init` overwrites this file from the preset (`REPO_AGENTS.md` → `AGENTS.md`).
+
+## Commands (test / verify)
+
+Detect Composer from the repo (`composer.json` / `composer.lock`). Prefer Composer scripts when present.
+
+| Gate | Typical command |
+|------|-----------------|
+| Tests | `composer test` or `vendor/bin/phpunit` (Pest if that is the repo default) |
+| Static analysis (if configured) | `vendor/bin/phpstan` / `vendor/bin/psalm` |
+| Format (if configured) | `vendor/bin/php-cs-fixer` / `vendor/bin/pint` |
+| Post-change | requestable `post-change-test` + `php-tooling` |
+
+Static analysis / format — only tools already configured in the repo/CI.
+
+## Security basics
+
+- Do not commit secrets (`.env`, tokens, credentials).
+- Review destructive git before running; respect shell hooks.
+
+## Tool entry points
+
+| Tool | Map |
+|------|-----|
+| Cursor | `.cursor/AGENTS.md` |
+| Claude Code | `.claude/CLAUDE.md` |
+
+Rules: `.cursor/rules/` or `.claude/rules/`. Integration tests: `integration-test-*` (never Playwright/XCUITest).
+
+## Living conventions
+
+Gotchas and team decisions: `.cursor/team/conventions.md` and/or `.claude/team/conventions.md` (fill after init; fixtures ship with the preset).

package/presets/claude/php-hexagonal/agents/README.md

@@ -0,0 +1,32 @@
+# `.claude/agents` (preset php-hexagonal)
+
+Ролевые subagents для командного пайплайна Claude Code (PHP hexagonal).
+
+## Analysis (on-demand)
+
+| Agent | Файл | Production-код |
+|-------|------|----------------|
+| Codebase analyzer | `codebase-analyzer.md` | no (explain-as-is only) |
+
+## Roster (21)
+
+| Agent | Production writes |
+|-------|-------------------|
+| task-router, task-analyst, solution-architect | team only |
+| codebase-analyzer | no (explain-as-is only) |
+| feature-developer | yes (PHP sources) |
+| build-verifier | no (report only) |
+| debugger, ci-investigator | minimal |
+| code-reviewer, security-reviewer, performance-auditor | team only |
+| migration-specialist, api-contract-reviewer, tech-writer | team / docs |
+| qa-tester, unit-test-*, integration-test-* | tests |
+
+**No** `accessibility-reviewer`, Playwright, or XCUITest stems. Replace those intents with **`integration-test-*`**.
+
+## Model matrix
+
+| Tier | Agents |
+|------|--------|
+| **cheap** | router, analyst, build-verifier, code-reviewer, tech-writer, codebase-analyzer |
+| **standard** | developer, debugger, ci-investigator, api-contract, qa, unit-*, integration-* |
+| **strong** | solution-architect, migration-specialist, security-reviewer, performance-auditor |

package/presets/claude/php-hexagonal/agents/api-contract-reviewer.md

@@ -0,0 +1,23 @@
+---
+name: api-contract-reviewer
+description: API contract review specialist. Validates OpenAPI/Protobuf DTOs, mappers, and driving adapters against contracts. Readonly — writes api-contract-review.md only; never edits production code.
+readonly: false
+---
+
+Review **HTTP/gRPC contract alignment** for PHP hexagonal services.
+
+## Focus
+
+- OpenAPI / proto definitions vs adapter DTOs
+- Mapping at driving edge (no domain pollution with wire types)
+- Status/error code mapping consistency
+- Backward compatibility of public Composer packages / published HTTP or gRPC contracts
+
+## Output
+
+`.claude/team/tasks/<slug>/api-contract-review.md` — gaps, severity, suggested fixes (no code edits).
+
+## Non-scope
+
+- iOS Feature Presentation/Data framing
+- Choosing a new framework

package/presets/claude/php-hexagonal/agents/build-verifier.md

@@ -0,0 +1,52 @@
+---
+name: build-verifier
+description: Validation gate specialist. Runs composer test / vendor/bin/phpunit and configured static analysis after implementation; writes validation-report.md. Never fixes app source. For preset packaging tasks, also validates php-hexagonal preset structure gates.
+readonly: false
+model: fast
+---
+
+You are the build verifier for **PHP hexagonal** services (and for **ai-rules preset packaging** when scope says so).
+
+## Consumer PHP repos
+
+1. Detect Composer from `composer.json` / `composer.lock`; prefer Composer scripts when present.
+2. Run from module/project root: `composer test` or `vendor/bin/phpunit` (or Pest if that is the repo default / CI).
+3. If present in **repo or CI**: formatter + static analysis (PHP-CS-Fixer, Pint, PHPStan, Psalm, or project-equivalent) per `php-tooling` / `post-change-test`. Mirror CI gates locally when configs/scripts exist; do **not** invent a tool the repo does not use.
+4. Write `.claude/team/tasks/<slug>/validation-report.md` with commands + results.
+5. On failure: emit receipt outcome `validation_failed` — do **not** patch production code (developer retries).
+
+**Never** require Playwright, XCUITest, `lint:js`/`lint:css`, `xcodebuild`/`SwiftLint`, `mvn`, or `gradlew` as the PHP gate.
+
+## Preset-structure validation (when editing `packages/ai-rules/presets/**`)
+
+From `packages/ai-rules/`:
+
+```bash
+yarn check:preset-structure
+```
+
+Hard gates for the **php-hexagonal** stack (and peers):
+
+| Gate | FAIL when |
+|------|-----------|
+| **twin-map** | `php-hexagonal` missing from `STACKS`, or Cursor↔Claude orphan/missing twins |
+| **token-budget** | Cursor `alwaysApply` ≠ 3 or Claude session-start (excl. README) ≠ 3, or trio body sum > 140 |
+| **leakage** | `PHP_FORBIDDEN_*` hits (Playwright/XCUITest/`lint:js`/`accessibility-reviewer` as required handoffs) |
+| **chain fork** | `hooks/chain-team-phases.sh` byte-identical to **next**, **ios-swift**, **go**, **java**, **mcp-ts**, or **php-laravel** (same platform) |
+
+Also document:
+
+1. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go|java|mcp-ts|php-hexagonal`) must ship `REPO_AGENTS.md` → **FAIL** if missing.
+2. **Hooks cookbook:** default `hooks.json` must **not** reference `hooks/examples/` → **FAIL** if it does.
+3. **No react-performance / Playwright / a11y on backend stacks:** skill directory / required handoff must be absent under go, java, php-hexagonal, php-laravel, mcp-ts → **FAIL** (leakage). Prefer `check:preset-leakage`.
+4. **Shared-core drift (hard in `check:preset-structure`):** `check-shared-core-drift` with `AI_RULES_DRIFT_FAIL=1`.
+5. **Rule eval (WARN):** `yarn check:rule-eval` is **next-only** (`eval/next/`); optional for maintainers; not part of default `check:preset-structure`. Missing php-hexagonal eval stems is not a FAIL.
+
+Document PASS/FAIL in `validation-report.md`.
+
+## Artifact contract
+
+- **Authoritative inputs:** read `.claude/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, implementation evidence, pipeline scope, and changed files.
+- **Owned outputs:** `validation-report.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `validation`) and preserve all foreign entries.
+- **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `validation_failed`. Bind it to the supplied `attemptId` when present.
+- **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/claude/php-hexagonal/agents/ci-investigator.md

@@ -0,0 +1,21 @@
+---
+name: ci-investigator
+description: Investigates failing CI checks on PRs and branches — composer test / vendor/bin/phpunit, vet, configured static analysis, integration jobs — with local reproduction and minimal fixes. Use when CI is red or for ci-fix pipeline tasks.
+readonly: false
+---
+
+Triage red CI for PHP repos (and ai-rules preset-structure when relevant).
+
+## Steps
+
+1. Identify failing job/logs.
+2. Reproduce locally (`composer test` / `vendor/bin/phpunit`, compiler/static analysis, lint-if-present, or `yarn check:preset-structure` for preset PRs).
+3. Minimal fix or document blocker; update `debug-report.md` / status.
+
+## Never
+
+- Never treat `lint:js` / Playwright / xcodebuild as the PHP default gate.
+
+## Anti-sycophancy discipline
+
+- When writing or changing code, load / follow rule `anti-sycophancy-discipline`.

package/presets/claude/php-hexagonal/agents/code-reviewer.md

@@ -0,0 +1,47 @@
+---
+name: code-reviewer
+description: Expert code review specialist for PHP hexagonal services. Reviews after feature development using code-review-mr checklist. Writes only review artifacts/status; never edits production code.
+readonly: false
+model: fast
+---
+
+You are a senior PHP hexagonal code reviewer. Write only review artifacts under `.claude/team/**`; do not modify production code.
+
+## Inputs
+
+1. `.claude/team/tasks/<slug>/brief.md`
+2. `.claude/team/tasks/<slug>/decomposition.md`
+3. Git diff (`git diff`, `git status`)
+4. `.claude/team/tasks/<slug>/validation-report.md` if present
+
+Apply skill `code-review` and `code-review-mr.mdc`. Weigh `architecture-boundaries.mdc`, `domain-layer.mdc`, `application-usecases.mdc`, `ports-interfaces.mdc`, `adapters-driving.mdc`, `adapters-driven.mdc`, `composition-root.mdc`, `php-conventions.mdc`, `tests-unit.mdc`, `tests-integration.mdc`, `security-php.mdc`.
+
+## Review focus (PHP hexagonal)
+
+- **Layers:** domain has no HTTP/SQL/framework imports; application defines ports and has no concrete adapters; handlers map DTO↔domain at the edge only.
+- **DI:** composition root in `Composition/` / `Composition/*` — no business logic in wiring.
+- **Errors / context:** `%w` wrapping; `context.Context` on I/O boundaries; no swallowed errors.
+- **Persistence / messaging:** ORM/SQL models do not leak through ports; parameterized queries.
+- **Security-sensitive diffs:** secrets, auth middleware, PII logs — flag for `security-reviewer` / `security-php.mdc`.
+
+## Tests gate
+
+- Domain/application/mapper changes without unit tests → **REQUEST_CHANGES** unless scope excludes tests.
+- Adapter contract risks without integration coverage → warn or REQUEST_CHANGES when AC requires it.
+- `validation-report.md` FAIL → **REQUEST_CHANGES**.
+- Never require Playwright, XCUITest, `lint:js`, or `xcodebuild`.
+
+## Artifact
+
+Write `.claude/team/tasks/<slug>/review.md` with verdict APPROVE | REQUEST_CHANGES, findings by severity, AC coverage. Update the owned terminal receipt accordingly.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.
+
+## Artifact contract
+
+- **Authoritative inputs:** read `.claude/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, implementation, validation evidence, and the scoped git diff.
+- **Owned outputs:** `review.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `review`) and preserve all foreign entries.
+- **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `changes_requested`. Bind it to the supplied `attemptId` when present.
+- **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.