@bonesofspring/ai-rules 0.2.11 → 0.2.13

package/presets/claude/php-laravel/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **go** — recipes must stay stack-safe (no cross-stack lint/test commands).

package/presets/claude/php-laravel/hooks/examples/format-edited.example.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Optional: project formatter on edited PHP sources.
+# NOT in default hooks.json. Discover formatter from repo/CI — do not invent one.
+set -euo pipefail
+changed=$(git diff --name-only --diff-filter=ACMR HEAD 2>/dev/null | grep '\.php$' || true)
+if [[ -n "${changed:-}" ]]; then
+  # Prefer repo tool already configured — placeholders only:
+  # vendor/bin/php-cs-fixer fix $changed  OR  vendor/bin/pint $changed
+  true
+fi
+exit 0

package/presets/claude/php-laravel/hooks/examples/secret-guard.example.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Optional cookbook: block committing likely secrets in staged diffs.
+# NOT wired in default hooks.json — copy to hooks/ and register manually.
+set -euo pipefail
+PATTERN='(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----|api[_-]?key\s*[:=]\s*['\''\"][^'\''\"]{12,})'
+if git diff --cached -U0 2>/dev/null | grep -Eiq "$PATTERN"; then
+  echo "secret-guard: possible secret in staged diff — review before commit" >&2
+  exit 1
+fi
+exit 0

package/presets/claude/php-laravel/hooks/examples/test-on-save.example.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Optional: Composer/PHPUnit (or Pest) after PHP edits.
+# NOT in default hooks.json. Prefer Composer scripts when present.
+set -euo pipefail
+changed=$(git diff --name-only --diff-filter=ACMR HEAD 2>/dev/null | grep '\.php$' || true)
+if [[ -z "${changed:-}" ]]; then
+  exit 0
+fi
+if [[ ! -f composer.json ]]; then
+  exit 0
+fi
+if composer test -q >/dev/null 2>&1; then
+  composer test -q 2>/dev/null || true
+elif [[ -x vendor/bin/pest ]]; then
+  vendor/bin/pest 2>/dev/null || true
+elif [[ -x vendor/bin/phpunit ]]; then
+  vendor/bin/phpunit 2>/dev/null || true
+fi
+exit 0

package/presets/claude/php-laravel/hooks/guard-shell-command.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Lightweight shell guard for Claude Code projects using this preset.
+# PHP: do NOT blanket-block composer test / vendor/bin/phpunit / compiler/IDE inspections / configured static analysis / repo static analysis.
+# Package-manager mismatch checks apply only when a JS lockfile/package.json exists.
+
+set -euo pipefail
+# PHP_PRESET_GUARD: allow composer/composer test; no Playwright/XCUITest assumptions
+
+input=$(cat)
+
+INPUT="$input" node <<'NODE'
+const fs = require('fs');
+
+const raw = process.env.INPUT || '';
+let event;
+try {
+  event = JSON.parse(raw);
+} catch {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const command = String(event.command || event.input?.command || '');
+if (!command.trim()) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+function out(permission, userMessage, agentMessage) {
+  process.stdout.write(JSON.stringify({
+    permission,
+    user_message: userMessage,
+    agent_message: agentMessage || userMessage,
+  }));
+}
+
+const dangerousGit = /\bgit\s+(reset\s+--hard|clean\s+-[^\n]*f|push\s+--force|push\s+-f|checkout\s+--\s+)/;
+if (dangerousGit.test(command)) {
+  out(
+    'ask',
+    'This command looks destructive for git state. Review it before continuing.',
+    'A project hook flagged a destructive git command. Ask the user before running it.',
+  );
+  process.exit(0);
+}
+
+const managerByFile = [
+  ['yarn.lock', 'yarn'],
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['package-lock.json', 'npm'],
+].find(([file]) => fs.existsSync(file));
+
+let expected = managerByFile?.[1];
+if (!expected && fs.existsSync('package.json')) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+    const pm = typeof pkg.packageManager === 'string' ? pkg.packageManager : '';
+    expected = pm.split('@')[0] || undefined;
+  } catch {
+    // Ignore invalid package.json in the hook; the agent can diagnose it later.
+  }
+}
+
+if (!expected) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const used = command.match(/(^|[;&|]\s*)(npm|yarn|pnpm)\s+/)?.[2];
+if (used && used !== expected) {
+  out(
+    'ask',
+    `This repository appears to use ${expected}, but the command uses ${used}. Confirm before continuing.`,
+    `Use ${expected} for package scripts and installs unless the user explicitly approves ${used}.`,
+  );
+  process.exit(0);
+}
+
+process.stdout.write('{ "permission": "allow" }');
+NODE

package/presets/claude/php-laravel/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@upstash/context7-mcp"
+      ]
+    }
+  }
+}

package/presets/claude/php-laravel/rules/README.md

@@ -0,0 +1,67 @@
+# `.claude/rules` (preset php-laravel)
+
+Claude topic `.md` files are **derived** from Cursor SoT `presets/cursor/php-laravel/rules/*.mdc`.
+
+## SoT sync
+
+| Principle | Detail |
+|-----------|--------|
+| **SoT** | `presets/cursor/php-laravel/rules/*.mdc` |
+| **Derive** | Claude topic `.md` + `paths:` (drop `alwaysApply`) |
+| **Checklist** | change Cursor → update Claude twin **same PR** (**FAIL** if missing — next, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel; see `preset-twin-sync` / build-verifier) |
+
+## Loading budget
+
+- **Session-start (no `paths:`):** exactly **3** — `laravel-app-core`, `boundaries`, `code-quality`
+- All others — with `paths:`
+- **Twin depth:** domain rules target ≥15 body lines; thin aliases: `agent-team-intake`, `technical-retro`, `domain-layer`; see Cursor `presets/cursor/php-laravel/rules/README.md` Catalog
+
+## Cursor → Claude mapping
+
+| Cursor `.mdc` (SoT) | Claude topic |
+|---------------------|--------------|
+| `actions-services.mdc` | `architecture/actions-services.md` |
+| `agent-team-intake.mdc` | `tooling-and-review/agent-team-intake.md` |
+| `agent-team-orchestrator.mdc` | `tooling-and-review/agent-team-orchestrator.md` |
+| `anti-sycophancy-discipline.mdc` | `tooling-and-review/anti-sycophancy-discipline.md` |
+| `architecture-boundaries.mdc` | `architecture/boundaries.md` |
+| `code-quality-and-refactoring.mdc` | `tooling-and-review/code-quality.md` |
+| `code-review-mr.mdc` | `tooling-and-review/code-review.md` |
+| `design-guidance.mdc` | `tooling-and-review/design-guidance.md` |
+| `domain-layer.mdc` | `architecture/domain-layer.md` |
+| `eloquent-persistence.mdc` | `api-and-data/eloquent-persistence.md` |
+| `events-listeners.mdc` | `api-and-data/events-listeners.md` |
+| `feature-delivery-workflow.mdc` | `architecture/feature-delivery.md` |
+| `form-requests.mdc` | `api-and-data/form-requests.md` |
+| `http-layer.mdc` | `api-and-data/http-layer.md` |
+| `jobs-queues.mdc` | `api-and-data/jobs-queues.md` |
+| `laravel-app-core.mdc` | `stack/laravel-app-core.md` |
+| `laravel-conventions.mdc` | `stack/laravel-conventions.md` |
+| `module-public-api.mdc` | `architecture/module-public-api.md` |
+| `php-tooling.mdc` | `tooling-and-review/php-tooling.md` |
+| `policies-authorization.mdc` | `api-and-data/policies-authorization.md` |
+| `post-change-test.mdc` | `tooling-and-review/post-change-test.md` |
+| `preset-layering.mdc` | `tooling-and-review/preset-layering.md` |
+| `preset-no-cross-stack-leakage.mdc` | `tooling-and-review/preset-no-cross-stack-leakage.md` |
+| `preset-pr-checklist.mdc` | `tooling-and-review/preset-pr-checklist.md` |
+| `preset-token-budget.mdc` | `tooling-and-review/preset-token-budget.md` |
+| `preset-twin-sync.mdc` | `tooling-and-review/preset-twin-sync.md` |
+| `reference-features.mdc` | `architecture/reference-features.md` |
+| `routes-api.mdc` | `api-and-data/routes-api.md` |
+| `security-php.mdc` | `tooling-and-review/security-php.md` |
+| `service-providers.mdc` | `architecture/service-providers.md` |
+| `technical-retro.mdc` | `tooling-and-review/technical-retro.md` |
+| `tests-e2e.mdc` | `testing/e2e.md` |
+| `tests-integration.mdc` | `testing/integration.md` |
+| `tests-unit.mdc` | `testing/unit.md` |
+
+## Topics
+
+`architecture/`, `stack/`, `api-and-data/`, `testing/`, `tooling-and-review/`.  
+`ui-and-accessibility/` — README stub only (N/A backend).
+
+## Metrics policy mapping
+
+| Shared core | Runtime integration | Loading |
+|-------------|---------------------|---------|
+| `agent-team/agent-task-metrics.md` | `agent-team-orchestrator` + `hooks/chain-team-phases.sh` | requestable/on-demand; never session-start |

package/presets/claude/php-laravel/rules/api-and-data/README.md

@@ -0,0 +1,3 @@
+# api-and-data
+
+HTTP, Form Requests, routes, Eloquent, Policies, Jobs, Events.

package/presets/claude/php-laravel/rules/api-and-data/eloquent-persistence.md

@@ -0,0 +1,31 @@
+---
+description: Eloquent models, migrations, and persistence conventions
+paths:
+  - "**/Models/**/*"
+  - "**/database/migrations/**/*"
+  - "**/database/factories/**/*"
+  - "**/database/seeders/**/*"
+---
+# Eloquent persistence
+
+- Models stay **persistence-focused**: fillable/guarded, casts, relations, scopes, accessors already used by the repo.
+- Prefer mass-assignment protection (`$fillable` / `$guarded`) consistent with neighbors; never `$guarded = []` casually on user-facing models.
+- Migrations are the schema SoT; keep them additive and reversible when the repo expects `down()`.
+- Factories/seeders for Feature tests — match existing factory patterns.
+- Repository / query object interfaces **only when justified** (swap backends, heavy query seams) — default is Eloquent on the Action/Service.
+
+## Forbidden
+
+- Importing `Illuminate\Http\Request` / Form Requests into models.
+- AuthZ role checks inside model boot hooks when Policies exist.
+- Returning models directly from controllers when the repo uses API Resources.
+- Raw SQL in controllers; prefer Eloquent/query builder in Actions or dedicated query classes.
+
+## Testing
+
+- Feature tests use `RefreshDatabase` / `DatabaseMigrations` as the repo does (SQLite in-memory preferred for dogfood/CI).
+- Unit-test custom casts/scopes when non-trivial; otherwise Feature coverage is enough.
+
+## Related
+
+- Actions calling models: `actions-services`; HTTP mapping: `http-layer` + `form-requests`.

package/presets/claude/php-laravel/rules/api-and-data/events-listeners.md

@@ -0,0 +1,31 @@
+---
+description: Laravel Events and Listeners
+paths:
+  - "**/Events/**/*"
+  - "**/Listeners/**/*"
+  - "**/*Event.php"
+  - "**/*Listener.php"
+---
+# Events / Listeners
+
+- Domain/application events signal that **something happened**; Listeners react (notify, project, enqueue).
+- Dispatch from Actions/Services (`TodoCreated::dispatch($todo)`); keep event payloads small (IDs / models via SerializesModels).
+- Prefer dedicated Listener classes over closures in `EventServiceProvider` when neighbors use classes.
+- Queued listeners (`ShouldQueue`) for slow side effects; sync listeners for cheap in-process reactions.
+- Discover listeners via attributes / provider registration matching the Laravel version + repo.
+
+## Structure
+
+- `app/Events/TodoCreated.php`, `app/Listeners/SendTodoCreatedNotification.php`.
+- One listener ≈ one reaction; split when a listener grows multiple unrelated side effects.
+
+## Testing
+
+- `Event::fake()`; `Event::assertDispatched(TodoCreated::class)`.
+- Feature tests may assert listener effects when not faked — match repo style.
+
+## Forbidden
+
+- Business rules that belong in Actions living only inside Listeners (harder to test/sync).
+- Circular event storms (Listener dispatches the same event without guard).
+- Using Events as a mandatory hexagonal port layer — optional async pattern only.

package/presets/claude/php-laravel/rules/api-and-data/form-requests.md

@@ -0,0 +1,29 @@
+---
+description: Laravel Form Request validation at the HTTP edge
+paths:
+  - "**/Http/Requests/**/*"
+  - "**/*Request.php"
+---
+# Form Requests
+
+- Validate untrusted input in **Form Requests** (or the repo's established validator) — not ad-hoc `$request->validate` sprinkled in Actions when neighbors use Form Requests.
+- `rules()` / `messages()` / `attributes()` stay at the HTTP edge; Actions receive already-validated arrays or typed props — **not** the Form Request object when avoidable.
+- Prefer `authorize()` on the Form Request **or** Policy/`$this->authorize` in the controller — pick the pattern neighbors use; do not double-authorize inconsistently.
+- Keep rules focused: required/types/uniqueness; complex cross-field domain rules may live in Action after validation basics pass.
+- Use `$request->validated()` (or `safe()->only(...)`) — never trust raw `$request->all()` into persistence.
+
+## Structure
+
+- `app/Http/Requests/<Feature>/StoreXRequest.php` (or flat `StoreXRequest`) matching repo nesting.
+- Shared rule fragments: extract only after Rule of Three; prefer Laravel Rule objects already in the repo.
+
+## Testing
+
+- Feature tests assert 422 validation envelopes for missing/invalid fields.
+- Do not unit-test every rule string in isolation unless the repo already does.
+
+## Forbidden
+
+- Importing Form Requests into Models or Jobs as a validation substitute.
+- Putting Eloquent queries that belong in Actions into Form Request `prepareForValidation` without need.
+- Inventing a custom validation framework when Laravel Form Requests suffice.

package/presets/claude/php-laravel/rules/api-and-data/http-layer.md

@@ -0,0 +1,32 @@
+---
+description: Thin Laravel controllers, API Resources, and HTTP edge mapping
+paths:
+  - "**/Http/Controllers/**/*"
+  - "**/Http/Resources/**/*"
+  - "**/Http/Middleware/**/*"
+  - "**/*Controller.php"
+---
+# HTTP layer (Laravel)
+
+- Controllers are **thin**: authorize → validate (Form Request) → call one Action/Service → return Resource / response.
+- Prefer invokable or resource controllers matching existing repo style; do not invent a new controller taxonomy mid-feature.
+- Map status + body at the edge; use API Resources (or repo-equivalent) for JSON — do not return Eloquent models raw when neighbors use Resources.
+- Keep business orchestration in Actions/Services — not private methods that grow into a second service layer inside the controller.
+- Middleware owns cross-cutting HTTP concerns (auth, throttle, locale) already used by the repo.
+
+## Resilience
+
+- Side-effect endpoints: accept/propagate an **idempotency key** when the domain already uses one; document if intentionally omitted.
+- Soft size hint: split when a controller grows past ~200 LOC or owns more than one use case.
+
+## Testing
+
+- Prefer Feature tests through the HTTP kernel (`tests/Feature`) with SQLite / repo test DB.
+- Unit-test Actions separately when logic is non-trivial; mock Eloquent only if the repo already does.
+
+## Forbidden
+
+- Business SQL / multi-model workflows in controllers.
+- Skipping Form Requests when neighbors validate via Form Requests.
+- Ad-hoc role/`if ($user->isAdmin)` AuthZ when a Policy exists or should.
+- Blade/Livewire/Filament concerns — **out of this preset**.

package/presets/claude/php-laravel/rules/api-and-data/jobs-queues.md

@@ -0,0 +1,41 @@
+---
+description: Laravel queued Jobs conventions
+paths:
+  - "**/Jobs/**/*"
+  - "**/*Job.php"
+---
+# Jobs / queues
+
+- Use Jobs for **deferred / async** work (email, fan-out, slow I/O) — not as a substitute for a clear sync Action.
+- Dispatch from Actions/Services after the sync write succeeds (or inside the same transaction only when the repo already uses `afterCommit`).
+- Implement `ShouldQueue` when neighbors queue; keep `handle()` focused.
+- Configure `$tries`, `$backoff`, `$timeout` only when the job needs them or neighbors set them.
+- Fail closed: don't swallow exceptions; use failed-job handling the repo already has.
+
+## Serialization / DI (queued jobs)
+
+Queued Job **constructors and public properties are serialized** onto the queue. Put only **serializable payloads** there:
+
+- Primitives, IDs, arrays of scalars, DTOs that serialize cleanly.
+- Eloquent models only when using `SerializesModels` carefully (prefer IDs when the model may change or be large).
+
+**Resolve services / repositories / collaborators via `handle()` method injection** (or container resolve inside `handle`). Do **not** inject app services, repositories, mailers, HTTP clients, or other container collaborators through the queued Job constructor — they are not reliable queue payloads.
+
+Sync-only jobs that never implement `ShouldQueue` may use constructor DI if that matches neighbors; prefer the same `handle()` injection pattern for consistency.
+
+## Structure
+
+- `app/Jobs/SendTodoCreatedNotification.php` (verb + subject naming).
+- Prefer serializing models via `SerializesModels` as Laravel defaults when models are the payload.
+
+## Testing
+
+- `Bus::fake()` / `Queue::fake()` in Feature tests; assert `Bus::assertDispatched(…)`.
+- Optionally `Bus::dispatchSync` in integration when asserting side effects end-to-end.
+
+## Forbidden
+
+- Injecting services / repositories / other collaborators via the queued Job constructor.
+- HTTP Request types inside Jobs.
+- Huge Jobs that re-implement the whole Action — pass IDs / minimal payloads.
+- Requiring external brokers in dogfood when `sync` / `array` / `database` driver suffices.

package/presets/claude/php-laravel/rules/api-and-data/policies-authorization.md

@@ -0,0 +1,29 @@
+---
+description: Laravel Policies and authorization gates
+paths:
+  - "**/Policies/**/*"
+  - "**/*Policy.php"
+---
+# Policies / authorization
+
+- Authorize via **Policies** / `Gate` — not scattered `$user->role === …` checks in controllers/Actions.
+- Controllers: `$this->authorize('update', $todo)` or Form Request `authorize()` — match neighbors.
+- Policy methods return `bool` / `Response`; keep them focused on AuthZ (ownership, roles, abilities).
+- Register policies via auto-discovery or `AuthServiceProvider` as the Laravel version expects.
+- Guest / unauthenticated: return false or use `Gate::before` only if the repo already uses that pattern.
+
+## Structure
+
+- `app/Policies/TodoPolicy.php` with `view`, `create`, `update`, `delete` (or repo verbs).
+- Prefer model-type hints (`User $user, Todo $todo`); use class-string abilities for create when needed.
+
+## Testing
+
+- Feature tests assert **403** on denied actions and **201/200** when allowed.
+- Use actingAs / Sanctum helpers the repo already uses.
+
+## Forbidden
+
+- Duplicating the same role check in Controller + Action + Model.
+- Putting business validation (field formats) into Policies — that belongs in Form Requests.
+- Inventing a custom ACL framework when Laravel Policies suffice.

package/presets/claude/php-laravel/rules/api-and-data/routes-api.md

@@ -0,0 +1,29 @@
+---
+description: Laravel routes (api.php / web.php) and middleware wiring
+paths:
+  - "**/routes/**/*"
+  - "**/bootstrap/app.php"
+---
+# Routes (API / web)
+
+- Prefer `routes/api.php` for JSON APIs and `routes/web.php` for session/cookie web — follow the target Laravel version's routing layout (`bootstrap/app.php` on Laravel 11+).
+- Route → controller method (or invokable); keep closures only for trivial health/ping already used by the repo.
+- Apply auth / throttle / middleware groups at the **route** layer (`auth:sanctum`, `auth:api`, etc. as already configured).
+- Name routes when neighbors name them (`->name('todos.store')`); keep URI style consistent (`/api/todos` vs versioned `/api/v1/...`).
+- Resource routes (`Route::apiResource`) OK when CRUD matches; otherwise explicit verbs.
+
+## Structure
+
+- Feature-local route files only if the repo already splits (`routes/api/todos.php` required from `api.php`).
+- Do not register business logic in route files.
+
+## Testing
+
+- Feature tests hit named URIs or `route('…')` helpers matching production paths.
+- Assert middleware (401/403) when AuthZ is in scope.
+
+## Forbidden
+
+- Fat closures with Eloquent / Actions inlined in `routes/*.php`.
+- Mixing Blade view routes into API delivery tasks without AC.
+- Requiring Next/Playwright route conventions — Laravel only.

package/presets/claude/php-laravel/rules/architecture/README.md

@@ -0,0 +1,3 @@
+# architecture
+
+Laravel layering, Actions/Services, providers, delivery workflow.

package/presets/claude/php-laravel/rules/architecture/actions-services.md

@@ -0,0 +1,30 @@
+---
+description: Laravel Actions and Services for application logic
+paths:
+  - "**/Actions/**/*"
+  - "**/Services/**/*"
+---
+# Actions / Services
+
+- Prefer **single-purpose Actions** (`CreateTodo`, `CompleteTodo`) for one use case; **Services** for multi-step orchestration shared across entry points.
+- Accept primitives / arrays / domain value objects — **not** Form Requests or `Request` objects.
+- Persist via Eloquent (or a justified repository); dispatch Jobs/Events for side effects.
+- Keep methods small and named after the business verb; avoid god `TodoService` with every CRUD method unless the repo already uses that shape.
+- Transaction boundaries: `DB::transaction` in the Action/Service when multiple writes must commit together.
+
+## Structure
+
+- `app/Actions/<Feature>/CreateX.php` or flat `app/Actions/CreateX.php` — match neighbors.
+- Invokable `__invoke` or explicit `handle` / `execute` — follow existing style; do not invent a new Action base class mid-feature.
+- Repository interfaces only when multiple backends or heavy test seams justify them (fold of hexagonal ports — not required).
+
+## Testing
+
+- Unit-test Actions with fakes/mocks when pure enough; Feature tests cover HTTP → Action → DB happy path.
+- Assert Job/Event dispatch with `Bus::fake` / `Event::fake` when side effects are in scope.
+
+## Forbidden
+
+- HTTP status codes / Resources inside Actions.
+- Fat Actions that also validate Form Request rules (validation stays at HTTP edge).
+- Skipping Actions to put business SQL directly in controllers “for speed”.

package/presets/claude/php-laravel/rules/architecture/boundaries.md

@@ -0,0 +1,34 @@
+---
+description: Laravel layer boundaries (HTTP, Actions/Services, Eloquent, Policies, Providers)
+---
+# Границы слоёв (Laravel)
+
+- **HTTP** (`app/Http/**`, Resources):
+  - Может: Controllers, Form Requests, API Resources, Middleware; map to Actions/Services; authorize via Policies.
+  - Не должен: fat business SQL; multi-step orchestration; queue side effects without Jobs/Events.
+- **Actions / Services** (`app/Actions/**`, `app/Services/**`):
+  - Может: single-purpose Actions; multi-step Services; Eloquent / domain helpers; dispatch Jobs/Events.
+  - Не должен: `Request` / Form Request types; HTTP status mapping; controller concerns.
+- **Eloquent** (`app/Models/**`, migrations):
+  - Может: persistence-focused models, casts, relations, scopes.
+  - Не должен: request/HTTP leakage; AuthZ role checks that belong in Policies.
+- **Policies** (`app/Policies/**`): AuthZ via Policies / gates — not ad-hoc role checks in controllers.
+- **Providers** (`app/Providers/**`): bindings/singletons only — no business rules.
+- **Jobs / Events / Listeners**: deferred / async side effects — not a substitute for clear sync Actions.
+
+# Зависимости
+
+- Направление: **HTTP → Actions/Services → Eloquent**; Policies at HTTP edge; Providers wire the container.
+- Cross-module access — public APIs / facades only (`module-public-api`); no deep sibling imports.
+
+# Edit bundles (load on matching paths)
+
+- `app/Http/**`, Resources → `http-layer` + `form-requests` + `architecture-boundaries`
+- `routes/**` → `routes-api`; `app/Models/**`, migrations → `eloquent-persistence`
+- `app/Actions/**`, `app/Services/**` → `actions-services`; `app/Providers/**` → `service-providers`
+- `app/Policies/**` → `policies-authorization`; `app/Jobs/**` → `jobs-queues`
+- `app/Events/**`, `app/Listeners/**` → `events-listeners`; after `*.php` → `post-change-test` (+ `php-tooling`)
+
+# Требование к агенту
+
+- Класть файлы в правильный слой; thin controllers; DI wiring только в Providers.

package/presets/claude/php-laravel/rules/architecture/domain-layer.md

@@ -0,0 +1,24 @@
+---
+description: Optional modular domain folders note (flat app/ remains default)
+paths:
+  - "**/Domain/**/*"
+  - "**/domain/**/*"
+---
+# Domain layer (optional modular note)
+
+**Default for this preset:** flat Laravel `app/` (Controllers, Actions, Models, …). Do **not** invent `app/Domain/**` for every feature.
+
+When the **target repo already** uses modular / domain folders (`app/Domain/<Module>/`, modules packages, etc.):
+
+- Keep module-local Models/Actions/Policies cohesive under that module's public surface.
+- Cross-module access via public APIs only (`module-public-api`) — no deep imports of another module's internals.
+- Still prefer Laravel primitives (Form Requests at HTTP edge, Eloquent models, Policies) inside the module.
+
+## Thin alias rationale
+
+This stem is intentionally **thin**: v1 locks flat `app/` as default; modular layout is an optional documented variant only.
+
+## Forbidden
+
+- Mandating hexagonal `Domain/` / ports purity in Laravel consumer apps.
+- Moving HTTP types into a “domain” folder to simulate hexagonal without need.

package/presets/claude/php-laravel/rules/architecture/feature-delivery.md

@@ -0,0 +1,51 @@
+---
+description: End-to-end delivery checklist for Laravel features
+paths:
+  - "**/*.php"
+  - "**/composer.json"
+---
+<!-- shared-core: architecture/feature-delivery-workflow.md -->
+
+# Feature delivery (Laravel)
+
+Order of work:
+
+1. **Routes** — `routes/api.php` / `web.php` (`routes-api`).
+2. **Form Request + Policy** — validation + AuthZ (`form-requests`, `policies-authorization`).
+3. **Action / Service** — application logic (`actions-services`).
+4. **Eloquent** — model + migration/factory as needed (`eloquent-persistence`).
+5. **Controller + Resource** — thin HTTP edge (`http-layer`).
+6. **Optional async** — Job / Event / Listener (`jobs-queues`, `events-listeners`).
+7. **Provider bindings** — only if new interfaces/bindings (`service-providers`).
+8. **Tests** — Feature (HTTP/DB) + Unit (Actions) as valuable.
+9. **Gate** — `post-change-test` (+ `php-tooling`) → `php artisan test` / `composer test`.
+
+```mermaid
+flowchart LR
+  R[Routes] --> C[Controller]
+  C --> FR[Form Request]
+  C --> P[Policy]
+  C --> A[Action/Service]
+  A --> M[Eloquent]
+  A --> J[Job/Event]
+```
+
+## Matrix
+
+| Path | Rules |
+|------|-------|
+| `app/Http/**`, Resources | `http-layer`, `form-requests`, `architecture-boundaries` |
+| `routes/**` | `routes-api` |
+| `app/Models/**`, migrations | `eloquent-persistence` |
+| `app/Actions/**`, `app/Services/**` | `actions-services` |
+| `app/Providers/**` | `service-providers` |
+| `app/Policies/**` | `policies-authorization` |
+| `app/Jobs/**` | `jobs-queues` |
+| `app/Events/**`, `app/Listeners/**` | `events-listeners` |
+| After `*.php` edits | `post-change-test` (+ `php-tooling`) |
+
+## Anti-patterns
+
+- Fat controllers; Form Requests in Models; AuthZ via ad-hoc roles; skipping Feature tests for API writes.
+- Mandating hexagonal ports/adapters folders in a Laravel-first app.
+- Load `design-guidance` when assessing structure, smells, or pattern fit.

package/presets/claude/php-laravel/rules/architecture/module-public-api.md

@@ -0,0 +1,29 @@
+---
+description: Public module API and package boundaries for Laravel apps
+paths:
+  - "**/composer.json"
+  - "**/app/**/*.php"
+---
+# Module public API
+
+- Published types under a package/module's public namespaces are a compatibility surface — change carefully; prefer additive APIs.
+- Prefer narrow exports; expose only what other modules/features need.
+- Do not deep-import another module's internal namespaces; depend on its published API / facade only.
+- Document breaking PHP API changes in CHANGELOG when the repo publishes libraries.
+
+## Flat app/ default / modular variant
+
+- **Default:** one Laravel app with flat `app/` namespaces (see `dogfood/php-laravel`).
+- **Modular:** when the repo already uses `app/Domain/<Module>/` or Composer path packages, each module exposes a narrow public API; other modules depend inward only.
+- Do not invent multi-package scaffolding unless the repo already uses it.
+
+## composer.json
+
+- Package name, PHP/Laravel versions, and PSR-4 map are SoT for toolchain/autoload.
+- Prefer minimal direct deps; pin via committed `composer.lock` the repo already uses.
+- Dev-only tools (PHPUnit, Pint, PHPStan) stay in `require-dev`.
+
+## Cross-feature
+
+- Features communicate via Actions/Services public methods or small facades — not by importing sibling Feature private helpers.
+- Form Request / Resource DTOs stay local to the HTTP edge of that feature.