@bonesofspring/ai-rules 0.2.11 → 0.2.13

package/presets/claude/php-hexagonal/skills/ci-investigation/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: ci-investigation
+description: Investigates failing CI checks on PRs and branches — composer test / vendor/bin/phpunit (Pest if present), optional PHPStan/Psalm, integration, preset-structure — with local reproduction and minimal fixes. Use when CI is red or for ci-fix pipeline tasks.
+---
+
+# CI investigation (PHP)
+
+1. Identify job + log excerpt.
+2. Reproduce locally with the same commands.
+3. Minimal fix; for ai-rules preset PRs run `yarn check:preset-structure`.
+4. Do not treat Playwright/xcodebuild/`lint:js` as default PHP gates.

package/presets/claude/php-hexagonal/skills/code-review/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: code-review
+description: Reviews pull requests and branch diffs for PHP hexagonal services using architecture, ports/adapters, networking, and testing standards. Use when the user asks for review or when code-reviewer runs.
+---
+
+# Code review (PHP)
+
+1. Diff-first; load `tooling-and-review/code-review.md` + hexagonal rules.
+2. Check layer leaks, port ownership, composition root purity, tests, security-sensitive bits.
+3. **Reuse lens:** flag new helpers that duplicate existing packages/utilities; prefer shared adapters over copy-paste.
+4. **Efficiency lens:** unnecessary allocations, N+1 I/O, sequential work that should be concurrent, hot-path bloat, missing context cancellation.
+5. Write `review.md` using the output contract below.
+
+## Output
+
+- Each finding: **`path:line`** — problem — impact — concrete fix direction.
+- Severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- End with a verdict line: **`Safe to merge | needs changes | reject`**.
+- Map agent status: Safe to merge → `completed`; needs changes / reject → `changes_requested`.
+
+Never require iOS/Next-only gates (XCUITest, Playwright, `lint:js`).
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/claude/php-hexagonal/skills/debug-investigation/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: debug-investigation
+description: Investigates bugs, failing tests, and unexpected behavior in PHP services with runtime evidence before applying minimal fixes. Use for bugfix tasks, debugger agent runs, or regressions.
+---
+
+# Debug investigation (PHP)
+
+1. Capture failing `composer test` / `vendor/bin/phpunit` / logs / stack traces.
+2. Hypothesize layer (domain vs adapter vs wiring).
+3. Minimal fix + regression test when appropriate.
+4. Document in `debug-report.md`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/claude/php-hexagonal/skills/feature-delivery/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: feature-delivery
+description: Delivers PHP hexagonal backend features end-to-end across domain, application/ports, adapters, composition root, tests, and post-change-test validation. Use when implementing or extending a feature, especially through /task or feature-developer.
+---
+
+# Feature Delivery (PHP hexagonal)
+
+1. Read brief, AC, and decomposition.
+2. Follow `feature-delivery-workflow.mdc` + `reference-features.mdc`: domain → application/ports → driven adapters → driving adapters → composition root → tests.
+3. Wire DI only in `Composition/` / `Composition/*`.
+4. Add unit tests for domain/use cases; integration tests for risky adapters.
+5. After PHP edits: **invoke** `post-change-test.mdc` (+ `php-tooling.mdc`).
+
+## Do / Don't
+
+- **Do** keep ports owned by application; map wire types at adapters.
+- **Don't** put SQL/business rules in HTTP handlers or frameworks in domain.
+- **Don't** use Playwright, XCUITest, or yarn lint as this stack's gate.
+
+## Scope discipline
+
+Implement only the current AC / decomposition task. Clarify ambiguity before coding; do not add unrelated hardening or drive-by refactors. See `feature-developer` → **Zero improvisation**.
+
+## Handoff
+
+Summarize by layer + validation. Update `.claude/team/tasks/<slug>/status.json`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/claude/php-hexagonal/skills/integration-testing/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: integration-testing
+description: Plans, generates, and heals PHP integration and adapter contract tests (HTTP controller tests, integration DB fixtures). Use for integration-test-* agents or adapter/e2e coverage.
+---
+
+# Integration testing (PHP)
+
+1. Read `tests-integration` / `tests-e2e` rules and task brief.
+2. Prefer testing driven adapters behind ports; HTTP adapters with `HTTP controller tests` + fakes.
+3. Use build tags / CI job split if the repo already does.
+4. Do not introduce Playwright or XCUITest.
+
+## Agents
+
+`integration-test-planner` → `integration-test-generator` → `integration-test-healer` as needed.

package/presets/claude/php-hexagonal/skills/technical-retro/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: technical-retro
+description: Facilitates technical retrospectives for tasks, sprints, incidents, releases, and agent-team pipelines. Use when the user asks for retro, postmortem, process review, or action items after delivery.
+---
+
+# Technical Retro
+
+## Inputs
+
+Ask for missing period, focus, task slug, participants, or format constraints. If a slug is provided, read `.claude/team/tasks/<slug>/` artifacts and local git status/diff. Do not invent facts not present in artifacts or the user's message.
+
+## Facilitation Principles
+
+- Focus on process and system behavior, not blame.
+- Separate facts, interpretations, and proposed actions.
+- Balance what worked with what slowed delivery.
+- Keep action items concrete, owned, and measurable.
+
+## Default Structure
+
+1. Goal and scope.
+2. Timeline or factual observations.
+3. What worked.
+4. What hurt quality, speed, or confidence.
+5. Root causes for the top one or two issues.
+6. Experiments and action items.
+
+## Agent Team Block
+
+For `/task` pipelines, include router, analyst, developer, **build-verifier** (composer test / vendor/bin/phpunit), reviewer, QA/integration tests, hooks, and rules.
+
+## Wrong-turn taxonomy (optional)
+
+When artifacts or the user mention agent mistakes, tag incidents:
+
+| Kind | Signal |
+|------|--------|
+| `correction` | User pushback («no», «don't», «actually») |
+| `retry` | Same tool/approach 2+ times before success |
+| `waste` | Many searches before the right file |
+| `reversal` | Edit then revert / delete |
+| `dead-end` | Env/tool failure (missing binary, wrong path) |
+
+Severity: **high** (explicit correction / large waste) · **med** · **low**. Confidence 0–100 — be honest; low-confidence items are optional.
+
+## Preset feedback loop
+
+If the same issue appeared in **2+** tasks (or **3+** for packaging a new rule/skill — Rule of Three), add section **Preset updates**:
+
+- Proposed change to `.claude/rules/`, `.claude/agents/`, `.claude/skills/`, or **`.claude/team/conventions.md`** (prefer conventions for project gotchas)
+- One concrete snippet or file path
+- Whether it belongs in session-start vs `paths:` vs skill vs conventions (see `PRESET-CONTRIBUTION` → Building blocks)
+
+Do not apply preset or conventions changes without user approval.

package/presets/claude/php-hexagonal/skills/unit-testing/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: unit-testing
+description: Plans, generates, and heals parameterized PHPUnit unit tests for domain, use cases, and mappers using *Test.php and tests-unit rules. Use for unit-test planning, generation, or healing.
+---
+
+# Unit testing (PHP)
+
+1. Prefer PHPUnit `@ParameterizedTest` (and PHPUnit assertions assertions) beside code under test (`*Test.php`).
+2. Fake outbound ports for use cases with PHPUnit mocks; no real DB/network.
+3. Follow `tests-unit.md`; heal with `unit-test-healer` when red.
+
+## Agents
+
+`unit-test-planner` → `unit-test-generator` → `unit-test-healer`.

package/presets/claude/php-hexagonal/skills/write-adr/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: write-adr
+description: Author an Architecture Decision Record (ADR) with Context, Decision, Consequences, and Links. Use when capturing a durable technical choice for the team.
+---
+
+# Write ADR
+
+On-demand skill for durable architecture decisions. Stack-agnostic sections — fill with project-specific paths and links.
+
+## When to use
+
+- Choosing between non-trivial alternatives (storage, layering, library, API shape).
+- Recording a decision that future agents/humans should not silently reverse.
+- User asks for an ADR, decision log, or “why did we pick X”.
+
+## Template
+
+Create (or append) a short markdown ADR in the repo’s agreed location (e.g. `docs/adr/`, `.cursor/team/`, wiki). Suggested filename: `NNNN-short-title.md`.
+
+```markdown
+# ADR NNNN: <Title>
+
+## Context
+What problem / constraint / force requires a decision?
+
+## Decision
+What we chose (one clear option). Include rejected alternatives briefly if useful.
+
+## Consequences
+Positive and negative outcomes; follow-up work; what becomes harder.
+
+## Links
+Related PRs, issues, rules, prior ADRs, diagrams.
+```
+
+## Guidelines
+
+- Prefer one decision per ADR.
+- Keep Context factual; Decision imperative and short.
+- Link living gotchas to `team/conventions.md` when the decision becomes a recurring local pattern.
+- Do not put ADR bodies only in root `AGENTS.md` (overwrite on init).

package/presets/claude/php-hexagonal/team/README.md

@@ -0,0 +1,48 @@
+# Agent team artifacts (preset php-hexagonal)
+
+Каталог артефактов пайплайна «команда агентов» для PHP backend (hexagonal / ports & adapters).
+
+## Layout
+
+```
+.claude/team/
+  active-task.json
+  fixtures/
+  tasks/<slug>/
+    pipeline.json
+    status.json
+    brief.md
+    decomposition.md
+    …
+```
+
+## Fixtures
+
+| Fixture | Notes |
+|---------|-------|
+| `feature-full.json` | Full profile; QA scope `e2e-only` = **adapter/integration tests** (not UI e2e); Playwright/XCUITest stems in `skipped` |
+| `feature-light.json` | developer → build-verifier (`composer test` / `vendor/bin/phpunit` / configured static analysis) |
+| `bugfix-standard.json` | debugger → developer (skipIf) → verifier → reviewer |
+
+**Never** schedule Playwright/XCUITest-only steps for this preset. Use `integration-test-*` (or QA with `e2e-only` = integration) for adapter-level coverage.
+
+`playwright-test-*`, `xcuitest-test-*`, and `accessibility-reviewer` appear in fixture `skipped[]` **on purpose** — documented anti-patterns for backend presets (same as go/java). Leakage checker allows those stems only under `skipped[]`; scheduling them in `steps[]` is a **FAIL**.
+
+## Artifact manifest and receipts
+
+Each slug stores one context index at `.claude/team/tasks/<slug>/artifact-manifest.json`. Schema v1 is defined by shared core `agent-team/agent-artifact-contracts.md`: every entry declares its producer, status, authoritative paths, acceptance-criteria IDs, decomposition task IDs, timestamps, and a terminal completion receipt.
+
+Producer/consumer rules:
+
+- Read the manifest first and use only the authoritative inputs needed by the current step; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` when it is missing or stale, and report that gap.
+- Producers upsert only their stable entry IDs, preserve foreign entries, and finish with `completed`, `blocked`, `changes_requested`, or `validation_failed` receipt evidence.
+- The router owns `pipeline.json` and its routing entry; analyst, developer, verifier, and reviewer own their named outputs and receipts. Consumers do not edit another producer's receipt.
+- Agents do not mutate `status.json` or `metrics.json`. The orchestration runtime/hook is their single writer. Parallel receipt merges are serialized by the parent/orchestrator.
+
+## Local metrics ledger
+
+`metrics.json` is an append-only schema-v1 event ledger for one task run. It contains only allowlisted IDs, task dimensions, timestamps, outcomes, and attribution confidence—never prompts, secrets, file paths, or contents. The orchestration runtime writes `task_started` / `attempt_started`; the hook records host-clock completion and human-gate edges under a per-task lock with temp-and-rename.
+
+`status.json.activeAttempts` is a transient timing bridge keyed by `attemptId`; `lastCompletedAttempt` is diagnostic; `parallelOutcomes` holds per-agent outcomes for the current parallel join until the step advances. For parallel stops, the hook must use a stable payload identity or the sole active attempt. Otherwise an explicit `.metrics-receipts.json` receipt is fallback data marked `source: agent`, `attributionConfidence: fallback`; it must never guess from `currentAgent`.
+
+Aggregate with `node packages/ai-rules/scripts/aggregate-agent-task-metrics.mjs --team-root .claude/team`. It reports role/agent count, completed count, total/average duration, distinct completed run IDs, separate human-gate wait, and incomplete artifacts.

package/presets/claude/php-hexagonal/team/conventions.md

@@ -0,0 +1,21 @@
+# Living conventions (team)
+
+Consumer-owned store for post-init gotchas, patterns, and decisions. **Not** always-on. Fill after `ai-rules init`. Root `AGENTS.md` only points here.
+
+## Gotchas
+
+<!-- e.g. fragile flows, “never do X in this repo” -->
+
+-
+
+## Patterns
+
+<!-- local patterns beyond reference-features table -->
+
+-
+
+## Decisions
+
+<!-- short pointers to ADRs / product choices that affect code -->
+
+-

package/presets/claude/php-hexagonal/team/fixtures/bugfix-standard.json

@@ -0,0 +1,37 @@
+{
+  "slug": "example-bugfix-standard",
+  "intent": "bugfix",
+  "profile": "standard",
+  "summary": "Regression fix with review",
+  "steps": [
+    {
+      "agent": "debugger",
+      "label": "Root cause"
+    },
+    {
+      "agent": "feature-developer",
+      "label": "Fix if needed",
+      "skipIf": "debugger.fixed"
+    },
+    {
+      "agent": "build-verifier",
+      "label": "composer test / vendor/bin/phpunit / static analysis"
+    },
+    {
+      "agent": "code-reviewer",
+      "label": "Code review"
+    }
+  ],
+  "humanGates": [],
+  "autoChain": true,
+  "skipped": [
+    {
+      "agent": "playwright-test-planner",
+      "reason": "PHP backend uses integration-test-* — not in this bugfix path"
+    },
+    {
+      "agent": "xcuitest-test-planner",
+      "reason": "PHP backend uses integration-test-* — not in this bugfix path"
+    }
+  ]
+}

package/presets/claude/php-hexagonal/team/fixtures/feature-full.json

@@ -0,0 +1,25 @@
+{
+  "slug": "example-feature-full",
+  "intent": "feature",
+  "profile": "full",
+  "summary": "Multi-layer PHP use case with integration-test coverage",
+  "steps": [
+    { "agent": "task-analyst", "label": "Clarify and decompose" },
+    { "agent": "solution-architect", "label": "Design boundaries", "model": "strong" },
+    { "agent": "feature-developer", "label": "Implement + unit tests", "scope": "unit-in-dev" },
+    { "agent": "build-verifier", "label": "composer test / vendor/bin/phpunit / static analysis", "model": "cheap" },
+    { "agent": "security-reviewer", "label": "Security review", "model": "strong" },
+    { "agent": "code-reviewer", "label": "Code review", "model": "cheap" },
+    { "agent": "qa-tester", "label": "Integration tests", "scope": "e2e-only" },
+    { "agent": "integration-test-planner", "label": "Plan integration coverage" },
+    { "agent": "integration-test-generator", "label": "Generate integration tests" }
+  ],
+  "humanGates": ["after:task-analyst"],
+  "autoChain": true,
+  "skipped": [
+    {
+      "agent": "accessibility-reviewer",
+      "reason": "PHP backend has no UI surface"
+    }
+  ]
+}

package/presets/claude/php-hexagonal/team/fixtures/feature-light.json

@@ -0,0 +1,17 @@
+{
+  "slug": "example-feature-light",
+  "intent": "feature",
+  "profile": "light",
+  "summary": "Trivial single-package change with explicit AC",
+  "steps": [
+    { "agent": "feature-developer", "label": "Implement", "model": "cheap" },
+    { "agent": "build-verifier", "label": "composer test / vendor/bin/phpunit / static analysis", "model": "cheap" }
+  ],
+  "humanGates": [],
+  "autoChain": true,
+  "skipped": [
+    { "agent": "task-analyst", "reason": "Explicit AC and single-package scope" },
+    { "agent": "code-reviewer", "reason": "Light profile — non-trivial module/service changes should use standard" },
+    { "agent": "qa-tester", "reason": "No integration-test AC" }
+  ]
+}

package/presets/claude/php-laravel/CLAUDE.md

@@ -0,0 +1,20 @@
+# Laravel stack — Claude Code map
+
+**Repo-root agents:** see root `AGENTS.md` (from `REPO_AGENTS.md`).
+
+| Task | Where |
+|------|-------|
+| New work | `/task` + `agent-team-orchestrator` |
+| Feature E2E | skill `feature-delivery` + `feature-delivery-workflow` |
+| Stack / layers | `laravel-app-core`, `architecture-boundaries` |
+| After PHP edits | `post-change-test` (+ `php-tooling`) → `php artisan test` |
+| Feature tests | `integration-test-*` |
+| Review | skill `code-review` |
+
+## Install
+
+```bash
+npx @bonesofspring/ai-rules init claude --preset php-laravel
+```
+
+Dogfood: `dogfood/php-laravel`.

package/presets/claude/php-laravel/MCP.md

@@ -0,0 +1,5 @@
+# MCP (php-laravel)
+
+Default MCP surface for this preset: **Context7** only (library docs).
+
+See `mcp.json`. Do not require Playwright or browser MCP servers for Laravel API delivery.

package/presets/claude/php-laravel/README.md

@@ -0,0 +1,30 @@
+# Preset `php-laravel` (Claude)
+
+Installable Claude Code preset for **Laravel** backend/API projects (Eloquent, Form Requests, Policies, Actions/Services, Jobs/Queues).
+
+```bash
+npx @bonesofspring/ai-rules init claude --preset php-laravel
+```
+
+## When to use
+
+| Preset | Use when |
+|--------|----------|
+| **`php-laravel`** | App is (or will be) a Laravel backend/API |
+| **`php-hexagonal`** | Framework-agnostic / multi-framework PHP with strict ports & adapters |
+
+## Layout
+
+| Path | Role |
+|------|------|
+| `rules/<topic>/*.md` | Claude twins (34 stems); session-start trio without `paths:` |
+| `agents/` | 21 agents + README |
+| `skills/` | 8 skills + README |
+| `commands/` | 5 slash commands |
+| `team/` | conventions + fixtures |
+| `hooks/` | Shell guard + team chain (byte-forked) — hook scripts only; no `hooks.json` |
+| `REPO_AGENTS.md` | → consumer root `AGENTS.md` |
+| `CLAUDE.md` | Claude quick-start map — **Claude-only** |
+| `MCP.md` / `.mcp.json` | Context7 only (installed to project root) |
+
+Cursor SoT: `presets/cursor/php-laravel/`. Mapping: `rules/README.md`. Dogfood: `dogfood/php-laravel`. Contribution: `docs/PRESET-CONTRIBUTION.md`.

package/presets/claude/php-laravel/REPO_AGENTS.md

@@ -0,0 +1,47 @@
+# Laravel — agent instructions
+
+Cross-tool repo-root guide for the **php-laravel** preset (Laravel-first). Tool-specific maps stay under `.cursor/AGENTS.md` and `.claude/CLAUDE.md`.
+
+## Cross-tool setup
+
+- Treat this file as the **shared** entry for any agent (Cursor, Claude Code, or other).
+- Install:
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset php-laravel
+npx @bonesofspring/ai-rules init claude --preset php-laravel
+```
+
+`init` overwrites this file from the preset (`REPO_AGENTS.md` → `AGENTS.md`).
+
+## Commands (test / verify)
+
+Detect Composer from the repo (`composer.json` / `composer.lock`). Prefer `php artisan test` when `artisan` exists.
+
+| Gate | Typical command |
+|------|-----------------|
+| Tests | `php artisan test` or `composer test` (Pest if that is the repo default) |
+| Static analysis (if configured) | `vendor/bin/phpstan` / `vendor/bin/psalm` |
+| Format (if configured) | `vendor/bin/pint` / `php-cs-fixer` |
+| Post-change | requestable `post-change-test` + `php-tooling` |
+
+Static analysis / format — only tools already configured in the repo/CI.
+
+## Security basics
+
+- Do not commit secrets (`.env`, tokens, credentials).
+- Review destructive git before running; respect shell hooks.
+- Prefer Form Requests + Policies; keep mass-assignment protection tight.
+
+## Tool entry points
+
+| Tool | Map |
+|------|-----|
+| Cursor | `.cursor/AGENTS.md` |
+| Claude Code | `.claude/CLAUDE.md` |
+
+Rules: `.cursor/rules/` or `.claude/rules/`. Feature/integration tests: `integration-test-*` (never Playwright/XCUITest).
+
+## Living conventions
+
+Gotchas and team decisions: `.cursor/team/conventions.md` and/or `.claude/team/conventions.md` (fill after init; fixtures ship with the preset).

package/presets/claude/php-laravel/agents/README.md

@@ -0,0 +1,32 @@
+# `.claude/agents` (preset php-laravel)
+
+Ролевые subagents для командного пайплайна Claude Code (Laravel).
+
+## Analysis (on-demand)
+
+| Agent | Файл | Production-код |
+|-------|------|----------------|
+| Codebase analyzer | `codebase-analyzer.md` | no (explain-as-is only) |
+
+## Roster (21)
+
+| Agent | Production writes |
+|-------|-------------------|
+| task-router, task-analyst, solution-architect | team only |
+| codebase-analyzer | no (explain-as-is only) |
+| feature-developer | yes (PHP sources) |
+| build-verifier | no (report only) |
+| debugger, ci-investigator | minimal |
+| code-reviewer, security-reviewer, performance-auditor | team only |
+| migration-specialist, api-contract-reviewer, tech-writer | team / docs |
+| qa-tester, unit-test-*, integration-test-* | tests |
+
+**No** `accessibility-reviewer`, Playwright, or XCUITest stems. Replace those intents with **`integration-test-*`**.
+
+## Model matrix
+
+| Tier | Agents |
+|------|--------|
+| **cheap** | router, analyst, build-verifier, code-reviewer, tech-writer, codebase-analyzer |
+| **standard** | developer, debugger, ci-investigator, api-contract, qa, unit-*, integration-* |
+| **strong** | solution-architect, migration-specialist, security-reviewer, performance-auditor |

package/presets/claude/php-laravel/agents/api-contract-reviewer.md

@@ -0,0 +1,23 @@
+---
+name: api-contract-reviewer
+description: API contract review specialist. Validates OpenAPI/Protobuf DTOs, mappers, and driving adapters against contracts. Readonly — writes api-contract-review.md only; never edits production code.
+readonly: false
+---
+
+Review **HTTP/gRPC contract alignment** for Laravel services.
+
+## Focus
+
+- OpenAPI / proto definitions vs adapter DTOs
+- Mapping at driving edge (no domain pollution with wire types)
+- Status/error code mapping consistency
+- Backward compatibility of public Composer packages / published HTTP or gRPC contracts
+
+## Output
+
+`.claude/team/tasks/<slug>/api-contract-review.md` — gaps, severity, suggested fixes (no code edits).
+
+## Non-scope
+
+- iOS Feature Presentation/Data framing
+- Choosing a new framework

package/presets/claude/php-laravel/agents/build-verifier.md

@@ -0,0 +1,52 @@
+---
+name: build-verifier
+description: Validation gate specialist. Runs php artisan test / composer test and configured static analysis after implementation; writes validation-report.md. Never fixes app source. For preset packaging tasks, also validates php-laravel preset structure gates.
+readonly: false
+model: fast
+---
+
+You are the build verifier for **Laravel** services (and for **ai-rules preset packaging** when scope says so).
+
+## Consumer Laravel / PHP repos
+
+1. Detect Composer from `composer.json` / `composer.lock`; prefer `php artisan test` when `artisan` exists.
+2. Run from module/project root: `php artisan test` or `composer test` or `vendor/bin/phpunit` (or Pest if that is the repo default / CI).
+3. If present in **repo or CI**: formatter + static analysis (Pint, PHPStan, Psalm, PHP-CS-Fixer, or project-equivalent) per `php-tooling` / `post-change-test`. Mirror CI gates locally when configs/scripts exist; do **not** invent a tool the repo does not use.
+4. Write `.claude/team/tasks/<slug>/validation-report.md` with commands + results.
+5. On failure: emit receipt outcome `validation_failed` — do **not** patch production code (developer retries).
+
+**Never** require Playwright, XCUITest, `lint:js`/`lint:css`, `xcodebuild`/`SwiftLint`, `mvn`, or `gradlew` as the Laravel gate.
+
+## Preset-structure validation (when editing `packages/ai-rules/presets/**`)
+
+From `packages/ai-rules/`:
+
+```bash
+yarn check:preset-structure
+```
+
+Hard gates for the **php-laravel** stack (and peers):
+
+| Gate | FAIL when |
+|------|-----------|
+| **twin-map** | `php-laravel` missing from `STACKS`, or Cursor↔Claude orphan/missing twins |
+| **token-budget** | Cursor `alwaysApply` ≠ 3 or Claude session-start (excl. README) ≠ 3, or trio body sum > 140 |
+| **leakage** | `PHP_FORBIDDEN_*` hits (Playwright/XCUITest/`lint:js`/`accessibility-reviewer` as required handoffs) |
+| **chain fork** | `hooks/chain-team-phases.sh` byte-identical to **next**, **ios-swift**, **go**, **java**, **mcp-ts**, or **php-hexagonal** (same platform) |
+
+Also document:
+
+1. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go|java|mcp-ts|php-hexagonal|php-laravel`) must ship `REPO_AGENTS.md` → **FAIL** if missing.
+2. **Hooks cookbook:** default `hooks.json` must **not** reference `hooks/examples/` → **FAIL** if it does.
+3. **No react-performance / Playwright / a11y on backend stacks:** skill directory / required handoff must be absent under go, java, php-hexagonal, php-laravel, mcp-ts → **FAIL** (leakage). Prefer `check:preset-leakage`.
+4. **Shared-core drift (hard in `check:preset-structure`):** `check-shared-core-drift` with `AI_RULES_DRIFT_FAIL=1`.
+5. **Rule eval (WARN):** `yarn check:rule-eval` is **next-only** (`eval/next/`); optional for maintainers; not part of default `check:preset-structure`. Missing php-laravel eval stems is not a FAIL.
+
+Document PASS/FAIL in `validation-report.md`.
+
+## Artifact contract
+
+- **Authoritative inputs:** read `.claude/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, implementation evidence, pipeline scope, and changed files.
+- **Owned outputs:** `validation-report.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `validation`) and preserve all foreign entries.
+- **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `validation_failed`. Bind it to the supplied `attemptId` when present.
+- **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/claude/php-laravel/agents/ci-investigator.md

@@ -0,0 +1,21 @@
+---
+name: ci-investigator
+description: Investigates failing CI checks on PRs and branches — composer test / vendor/bin/phpunit, vet, configured static analysis, integration jobs — with local reproduction and minimal fixes. Use when CI is red or for ci-fix pipeline tasks.
+readonly: false
+---
+
+Triage red CI for PHP repos (and ai-rules preset-structure when relevant).
+
+## Steps
+
+1. Identify failing job/logs.
+2. Reproduce locally (`composer test` / `vendor/bin/phpunit`, compiler/static analysis, lint-if-present, or `yarn check:preset-structure` for preset PRs).
+3. Minimal fix or document blocker; update `debug-report.md` / status.
+
+## Never
+
+- Never treat `lint:js` / Playwright / xcodebuild as the PHP default gate.
+
+## Anti-sycophancy discipline
+
+- When writing or changing code, load / follow rule `anti-sycophancy-discipline`.