@bonesofspring/ai-rules 0.2.11 → 0.2.13

package/presets/cursor/java/rules/README.md

@@ -97,3 +97,9 @@ Claude twins + Cursor→Claude map: `presets/claude/java/rules/README.md`. Cross
 - gRPC = documented stub in v1; messaging adapters = full (broker-agnostic)
 - MCP = Context7 only
 - Static analysis = discover from repo/CI (no mandated Checkstyle/SpotBugs/Error Prone)
+
+## Metrics policy mapping
+
+| Shared core | Runtime integration | Loading |
+|-------------|---------------------|---------|
+| `agent-team/agent-task-metrics.md` | `agent-team-orchestrator` + `hooks/chain-team-phases.sh` | requestable/on-demand; never session-start |

package/presets/cursor/java/rules/agent-team-orchestrator.mdc

@@ -35,7 +35,7 @@ Roster of specialists is **stack-specific** (agent names and write scopes differ
 
 **Cursor frontmatter:** all team pipeline agents use `readonly: false` so they can write team artifacts. Production/app restrictions live in the agent prompt body — do **not** set `readonly: true`.
 
-Full prompts: stack `agents/*.md`. Artifact conventions: stack `team/README.md`.
+Full prompts: stack `agents/*.md`. Artifact conventions: stack `team/README.md`; schema SoT: **agent-artifact-contracts**.
 
 ## Dynamic pipeline
 
@@ -61,6 +61,22 @@ flowchart TD
 
 **Source of truth for order:** `pipeline.json` → `steps[]`. Never hardcode analyst → dev → review → QA when `pipeline.json` exists.
 
+New pipelines retain top-level `profile` and include `routingDecision` with `complexity`, `riskFlags`, non-empty `routingReasons`, `estimatedWorkPackages`, and `openDecisionCount`. The stack `task-router` owns heuristics; this metadata is auditable evidence and does not change hook semantics.
+
+## Metrics lifecycle
+
+Use the local `metrics.json` ledger described by **agent-task-metrics**: the orchestration runtime initializes attempts before invocation, hooks record host-clock ends, and agents never guess a parallel completion from `currentAgent`.
+
+## Artifact context index and receipts
+
+Each slug has one `artifact-manifest.json`: `.cursor/team/tasks/<slug>/` or `.claude/team/tasks/<slug>/`. Schema SoT: **agent-artifact-contracts**.
+
+- Read the manifest before broad prior-artifact discovery. Each step receives authoritative input entry IDs, owns named output entry IDs, and finishes with one terminal receipt linked to AC/task IDs.
+- Markdown remains detailed evidence; the manifest records producer, status, authoritative paths, timestamps, outcome, and evidence paths.
+- Agents upsert only entries they own and preserve foreign entries. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges.
+- The orchestration runtime/hook is the single writer for `status.json` lifecycle fields and `metrics.json`. Agents read status for eligibility but never rewrite state, gate, retry, attempt, timestamp, or metrics fields.
+- Missing/stale manifests are reported as a handoff gap; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` rather than inventing authority.
+
 ## status.json (pipeline mode)
 
 ```json
@@ -71,10 +87,23 @@ flowchart TD
   "currentAgent": "task-analyst",
   "phase": "executing",
   "state": "in_progress",
-  "awaitingHumanGate": false
+  "awaitingHumanGate": false,
+  "activeAttempts": {},
+  "lastCompletedAttempt": null,
+  "parallelCompleted": [],
+  "parallelOutcomes": {}
 }
 ```
 
+| Field | Meaning |
+|-------|---------|
+| `activeAttempts` | Transient timing bridge keyed by `attemptId` |
+| `lastCompletedAttempt` | Diagnostic pointer to the latest finished attempt |
+| `parallelCompleted` | Agents that have stopped in the current parallel step |
+| `parallelOutcomes` | Per-agent `{ outcome, attemptId, confidence }` for the current parallel join; cleared when the step advances or retries |
+
+On each `subagentStop`, the hook reconciles `status.state` from the completing producer's terminal `artifact-manifest.json` receipt when agents left lifecycle fields untouched. Wait for that handoff before invoking the next step.
+
 | state | Meaning |
 |-------|---------|
 | `in_progress` | Current step running |
@@ -98,7 +127,7 @@ flowchart TD
 2. Read `pipeline.json` before every subagent invocation.
 3. One role per Task call — **except** parallel steps: multiple Task calls in one message.
 4. **Never** skip `humanGates` without `/task-continue` or explicit user approval.
-5. Persist handoffs to disk (`brief.md`, `decomposition.md`, `debug-report.md`, `validation-report.md`, `architecture.md`, `migration-plan.md`, `ci-report.md`, `a11y-review.md`, `perf-report.md`, `security-review.md`, `api-contract-review.md`, `unit-test-plan.md`, `documentation.md`, `review.md`).
+5. Persist handoffs to disk and update the producer-owned terminal receipt in `artifact-manifest.json`; Markdown remains detailed evidence.
 6. On `changes_requested` from reviewers: hook sets `retryAfterFix` → developer → same reviewer.
 7. On `validation_failed` from `build-verifier`: hook sets `retryAfterFix: build-verifier` → developer → build-verifier.
 8. When all steps complete, suggest `/technical-retro <slug>`.
@@ -123,7 +152,7 @@ Use Task tool or `/agent-name`. Pass: slug, artifact paths, step `scope` if set.
    - **`strong`** → **never** pass `fast`; rely on agent pin or parent Max model.
 3. Parallel steps: apply the step-level `model` to **each** agent in the array (or omit → each agent’s own frontmatter).
 
-After each agent completes, ensure `status.json` has `state: completed` (or `awaiting_approval` if gate applies).
+After each agent completes, verify its terminal manifest receipt, then let the orchestration runtime/hook reconcile `status.json` (`completed`, a blocking outcome, or `awaiting_approval`) from that receipt. Do not ask the agent to mutate shared lifecycle fields, and do not invoke the next specialist until the hook has written the handoff / updated `status.json`.
 
 ## Legacy mode
 

package/presets/cursor/java/rules/preset-layering.mdc

@@ -24,7 +24,7 @@ alwaysApply: false
 ## Куда класть новое правило
 
 1. Общие принципы для всех стеков → **core** + адаптеры с `<!-- shared-core: … -->`.
-2. Только один из installable стеков (`next` / `ios-swift` / `go` / `java`) → **stack-specific** (не в `_shared`).
+2. Только один из installable стеков (`next` / `ios-swift` / `go` / `java` / `mcp-ts` / `php-hexagonal` / `php-laravel`) → **stack-specific** (не в `_shared`).
 3. Только Cursor или только Claude packaging → platform artifact / frontmatter, не дублировать семантику.
 
 ## SoT

package/presets/cursor/java/rules/preset-no-cross-stack-leakage.mdc

@@ -17,7 +17,7 @@ alwaysApply: false
 
 - `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
 - `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
-- `go` / `java` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
 - `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
 - Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
 
@@ -36,16 +36,16 @@ Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild`
 - `xcuitest-test-` as handoff stems
 - Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
 
-## Forbidden in go / java hooks/agents (FAIL)
+## Forbidden in go / java / php-hexagonal / php-laravel hooks/agents (FAIL)
 
-Shared backend-stack bans (both `go` and `java`):
+Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
 
 - `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
 - Positive yarn recipes `lint:js` / `lint:css`
 - `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
 - Agent file `accessibility-reviewer` (no UI surface)
 
-Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`) or `java-tooling` (`mvn test` / `./gradlew test`).
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
 
 ## Forbidden in mcp-ts hooks/agents (FAIL)
 
@@ -66,4 +66,4 @@ Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`,
 
 ## Chain fork
 
-`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, `go`, `java`, and `mcp-ts` (per platform).
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, `go`, `java`, `mcp-ts`, `php-hexagonal`, and `php-laravel` (per platform).

package/presets/cursor/java/rules/preset-pr-checklist.mdc

@@ -17,7 +17,7 @@ alwaysApply: false
 
 - [ ] **SoT:** правки в `packages/…` (не только root `.cursor/`)
 - [ ] **Core:** если менялся `_shared/core/**` — обновлены все `<!-- shared-core: … -->` consumers (или documented intentional fork)
-- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, go, and java — см. `preset-twin-sync`)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel — см. `preset-twin-sync`)
 - [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table актуален
 - [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
 - [ ] **Leakage:** нет чужих stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)

package/presets/cursor/java/rules/preset-twin-sync.mdc

@@ -22,6 +22,8 @@ Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
 | `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
 | `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
 | `mcp-ts` | `presets/cursor/mcp-ts/rules/*.mdc` | `presets/claude/mcp-ts/rules/<topic>/` | Keep in `claude/mcp-ts/rules/README.md` |
+| `php-hexagonal` | `presets/cursor/php-hexagonal/rules/*.mdc` | `presets/claude/php-hexagonal/rules/<topic>/` | Keep in `claude/php-hexagonal/rules/README.md` |
+| `php-laravel` | `presets/cursor/php-laravel/rules/*.mdc` | `presets/claude/php-laravel/rules/<topic>/` | Keep in `claude/php-laravel/rules/README.md` |
 
 ## Same-PR checklist
 
@@ -42,5 +44,7 @@ Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
 - **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
 - **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
 - **mcp-ts:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java; mapping table required).
+- **php-hexagonal:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts; mapping table required).
+- **php-laravel:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts / php-hexagonal; mapping table required).
 
 Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/cursor/java/rules/technical-retro.mdc

@@ -11,4 +11,6 @@ alwaysApply: false
 
 **`commands/technical-retro.md`** → `/technical-retro`
 
+When a task has `metrics.json`, use the local aggregation script and state the cohort, sample size, incomplete artifacts, attribution confidence, active attempt duration, and human-gate wait separately. Do not score malformed artifacts or gate wait as agent work.
+
 Используй rule только если command недоступен. Не дублируй содержимое command в ответе — следуй command-файлу и skill `technical-retro`.

package/presets/cursor/java/team/README.md

@@ -29,3 +29,22 @@
 ## Creating task dirs
 
 Bootstrap `tasks/<slug>/` by **writing** artifacts (Write tool), not Shell `mkdir`. Cursor sandbox → `Operation not permitted` otherwise (worse on Desktop/Documents).
+
+## Artifact manifest and receipts
+
+Each slug stores one context index at `.cursor/team/tasks/<slug>/artifact-manifest.json`. Schema v1 is defined by shared core `agent-team/agent-artifact-contracts.md`: every entry declares its producer, status, authoritative paths, acceptance-criteria IDs, decomposition task IDs, timestamps, and a terminal completion receipt.
+
+Producer/consumer rules:
+
+- Read the manifest first and use only the authoritative inputs needed by the current step; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` when it is missing or stale, and report that gap.
+- Producers upsert only their stable entry IDs, preserve foreign entries, and finish with `completed`, `blocked`, `changes_requested`, or `validation_failed` receipt evidence.
+- The router owns `pipeline.json` and its routing entry; analyst, developer, verifier, and reviewer own their named outputs and receipts. Consumers do not edit another producer's receipt.
+- Agents do not mutate `status.json` or `metrics.json`. The orchestration runtime/hook is their single writer. Parallel receipt merges are serialized by the parent/orchestrator.
+
+## Local metrics ledger
+
+`metrics.json` is an append-only schema-v1 event ledger for one task run. It contains only allowlisted IDs, task dimensions, timestamps, outcomes, and attribution confidence—never prompts, secrets, file paths, or contents. The orchestration runtime writes `task_started` / `attempt_started`; the hook records host-clock completion and human-gate edges under a per-task lock with temp-and-rename.
+
+`status.json.activeAttempts` is a transient timing bridge keyed by `attemptId`; `lastCompletedAttempt` is diagnostic; `parallelOutcomes` holds per-agent outcomes for the current parallel join until the step advances. For parallel stops, the hook must use a stable payload identity or the sole active attempt. Otherwise an explicit `.metrics-receipts.json` receipt is fallback data marked `source: agent`, `attributionConfidence: fallback`; it must never guess from `currentAgent`.
+
+Aggregate with `node packages/ai-rules/scripts/aggregate-agent-task-metrics.mjs --team-root .cursor/team`. It reports role/agent count, completed count, total/average duration, distinct completed run IDs, separate human-gate wait, and incomplete artifacts.

package/presets/cursor/mcp-ts/agents/build-verifier.md

@@ -14,7 +14,7 @@ You are the build verifier for **TypeScript MCP servers** (and for **ai-rules pr
 3. Run tests (project `test` / Vitest / Jest / scoped).
 4. Optional Inspector smoke — not required.
 5. Write `.cursor/team/tasks/<slug>/validation-report.md` with commands + results.
-6. On failure: set status `validation_failed` — do **not** patch production code.
+6. On failure: emit receipt outcome `validation_failed` — do **not** patch production code.
 
 **Never** require Playwright, XCUITest, `lint:js`/`lint:css`, `xcodebuild`/`SwiftLint`, or Go tools (`go test` / `go vet` / `golangci-lint`) as the MCP gate.
 
@@ -26,14 +26,21 @@ From `packages/ai-rules/`:
 yarn check:preset-structure
 ```
 
-Hard gates: twin-map (stacks include **mcp-ts**), token-budget (alwaysApply/session-start = 3), leakage (`MCP_TS_FORBIDDEN_IN_CHAIN`, `MCP_TS_FORBIDDEN_AGENT_STEMS`, chain forks mcp-ts≠next≠ios-swift≠go≠java), shared-core drift (`AI_RULES_DRIFT_FAIL=1` via `check:preset-structure`).
+Hard gates: twin-map (stacks include **mcp-ts**), token-budget (alwaysApply/session-start = 3), leakage (`MCP_TS_FORBIDDEN_IN_CHAIN`, `MCP_TS_FORBIDDEN_AGENT_STEMS`, chain forks mcp-ts≠next≠ios-swift≠go≠java≠php-hexagonal≠php-laravel), shared-core drift (`AI_RULES_DRIFT_FAIL=1` via `check:preset-structure`).
 
 Document PASS/FAIL in `validation-report.md`. Soft leakage output:
 
 - **Negation** of forbidden stems in agents → suppressed (INFO count). **Not** a merge blocker.
 - **WARN** only for non-negation packaging mentions in this verifier (and rare chain-skip WARNs). Do not treat INFO/WARN counts as FAIL.
 
-1. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go|java|mcp-ts`) must ship `REPO_AGENTS.md` when validating preset packaging → **FAIL** if missing.
+1. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go|java|mcp-ts|php-hexagonal`) must ship `REPO_AGENTS.md` when validating preset packaging → **FAIL** if missing.
 2. **Hooks cookbook:** default `hooks.json` must **not** reference `hooks/examples/` → **FAIL** if it does.
 3. **Forbidden agent filenames** (Playwright / XCUITest / integration-test / accessibility-reviewer / contract-test): must be absent → **FAIL** via `check:preset-leakage`.
 4. **Rule eval (WARN):** optional maintainer smoke — not part of default `check:preset-structure`.
+
+## Artifact contract
+
+- **Authoritative inputs:** read `.cursor/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, implementation evidence, pipeline scope, and changed files.
+- **Owned outputs:** `validation-report.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `validation`) and preserve all foreign entries.
+- **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `validation_failed`. Bind it to the supplied `attemptId` when present.
+- **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/cursor/mcp-ts/agents/feature-developer.md

@@ -44,4 +44,10 @@ Implement MCP server features following **mcp-ts** boundaries.
 
 - Load `design-guidance` and `anti-sycophancy-discipline` when writing or changing code.
 
-Update `.cursor/team/tasks/<slug>/status.json` when done.
+
+## Artifact contract
+
+- **Authoritative inputs:** read `.cursor/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for `brief.md`, `decomposition.md`, current scope, and applicable prior findings.
+- **Owned outputs:** `implementation.md` plus changed implementation/test paths; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `implementation`) and preserve all foreign entries.
+- **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
+- **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/cursor/mcp-ts/agents/task-analyst.md

@@ -10,7 +10,7 @@ Analyze MCP server work requests for the **mcp-ts** preset.
 
 1. `brief.md` — goal, AC, out of scope, assumptions, risks.
 2. `decomposition.md` — ordered tasks (contract → schema → handler → register → test → package).
-3. Update `status.json` (`awaiting_approval` when human gate applies).
+3. Emit the analysis receipt; the runtime applies any configured human gate.
 
 ## Focus
 
@@ -23,3 +23,10 @@ Analyze MCP server work requests for the **mcp-ts** preset.
 - Implement production code.
 - Schedule Phase 2-only agents.
 - Prescribe Go hexagonal or Next app layers.
+
+## Artifact contract
+
+- **Authoritative inputs:** read `.cursor/team/tasks/<slug>/artifact-manifest.json` first; consume `pipeline.json`, the manifest routing entry, user-approved decisions, and any authoritative architecture/approval entries.
+- **Owned outputs:** `brief.md` and `decomposition.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign entries.
+- **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
+- **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/cursor/mcp-ts/agents/task-router.md

@@ -46,6 +46,27 @@ Append **`security-reviewer` after `build-verifier`** for `feature` / `bugfix` /
 
 **Never skip `build-verifier`** after developer when TypeScript sources changed.
 
+## Routing decision rubric
+
+Keep top-level `profile` and emit this top-level object in every new `pipeline.json`:
+
+```json
+"routingDecision": {
+  "complexity": "low | moderate | high",
+  "riskFlags": [],
+  "routingReasons": ["Concrete request signal and its routing consequence."],
+  "estimatedWorkPackages": 1,
+  "openDecisionCount": 0
+}
+```
+
+- `low`: one bounded schema/handler scope, explicit AC, reversible, no FS/network/auth expansion or open decisions → `light`.
+- `moderate`: adjacent concerns or a regression/refactor with known boundaries → usually `standard`.
+- `high`: public tool contract, FS/network/auth capability expansion, migration/destructive or concurrency/state risk, broad test surface, unclear AC, or multiple work packages → usually `full`.
+- Use concrete flags: `public-contract`, `cross-layer`, `security-sensitive`, `migration`, `destructive`, `concurrency-state`, `external-dependency`, `unclear-acceptance-criteria`, `broad-test-surface`, `behavior-regression`.
+- `routingReasons` must be non-empty and explain profile, gates, specialists, skips, or checkpoints; never write “standard by default.”
+- `estimatedWorkPackages` is an integer ≥1; `openDecisionCount` is an integer ≥0. Do not lower complexity because implementation is familiar.
+
 ## Model tiers (`steps[].model`)
 
 Optional: `"model": "cheap" | "standard" | "strong"`.
@@ -66,8 +87,19 @@ Fixtures: `.cursor/team/fixtures/` (feature-full, feature-light, bugfix-standard
 
 ## Output
 
-Write `.cursor/team/tasks/<slug>/pipeline.json` and initial `status.json` via the **Write** tool; set `.cursor/team/active-task.json`.
+Write `.cursor/team/tasks/<slug>/pipeline.json` and initialize the routing entry in `artifact-manifest.json`; set `.cursor/team/active-task.json`. The orchestration runtime creates and owns `status.json`.
 
 ## Handoff
 
 Intent + steps table + skipped + gates → invoke `steps[0].agent` (unless retro).
+
+## Runtime initialization
+
+Return the routing receipt to the orchestrator. The orchestration runtime/hook exclusively initializes and updates `status.json`, `metrics.json`, attempt identities, and gate lifecycle; the router does not write those shared runtime files.
+
+## Artifact contract
+
+- **Authoritative inputs:** read `.cursor/team/tasks/<slug>/artifact-manifest.json` first; consume the user request and any existing authoritative task/decision entries.
+- **Owned outputs:** `pipeline.json` and the routing manifest entry; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `routing`) and preserve all foreign entries.
+- **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
+- **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/cursor/mcp-ts/commands/task-continue.md

@@ -22,22 +22,19 @@ description: Continue an agent-team task after a human gate, pause, or review ch
 ## Алгоритм
 
 1. Запиши `.cursor/team/active-task.json` → `{ "slug": "<slug>" }`.
-2. Сбрось gate: `awaitingHumanGate: false`.
-3. Определи **следующий шаг**:
-   - После approval analyst/architect: `pipelineIndex + 1` → следующий agent в `steps`.
-   - После `changes_requested`: снова **feature-developer** (тот же index или найди developer в steps).
-4. Обнови `status.json`:
-   ```json
-   {
-     "pipelineIndex": <n>,
-     "currentAgent": "<steps[n].agent>",
-     "phase": "executing",
-     "state": "in_progress",
-     "awaitingHumanGate": false
-   }
-   ```
-5. Вызови subagent для `currentAgent` с контекстом slug и артефактов.
-6. Hook `chain-team-phases.sh` продолжит цепочку по `pipeline.json`, если `autoChain: true`.
+2. **Human gate resume** (`awaitingHumanGate` / `awaiting_approval`):
+   1. **Do not** manually increment `pipelineIndex` or invent `currentAgent` first.
+   2. Close the gate + activate the next attempt via the **installed** hook (single authority for ledger + status):
+
+```bash
+printf '%s\n' '{"status":"completed","action":"end_human_gate","activateNext":true}' | bash .cursor/hooks/chain-team-phases.sh
+```
+
+   3. Re-read `status.json` (and the hook `followup_message`).
+   4. Invoke the subagent named in `status.currentAgent` / followup — do **not** advance the pipeline a second time.
+3. **Review `changes_requested`** (not a human gate): set `currentAgent` to `feature-developer` (same index / find developer in steps), `state: in_progress`, then invoke developer. Do **not** call `end_human_gate` unless `activeHumanGateEventId` is set.
+4. **Other resume**: restore `pipelineIndex` / `currentAgent` from status and invoke that agent.
+5. After the invoked agent completes, `chain-team-phases.sh` on `subagentStop` continues the chain when `autoChain: true`.
 
 ## Артефакты для handoff
 
@@ -45,5 +42,9 @@ description: Continue an agent-team task after a human gate, pause, or review ch
 |-------|-----------|
 | feature-developer | brief.md, decomposition.md, validation-report.md (if retry), review.md (if retry), architecture.md |
 | build-verifier | git diff, decomposition.md |
-| security-reviewer | brief.md, validation-report.md, git diff |
-| code-review (skill / Phase 2 agent) | brief.md, validation-report.md, git diff → write `review.md` |
+| code-reviewer | brief.md, validation-report.md, git diff |
+| qa-tester | brief.md, decomposition.md, scope from pipeline step |
+
+## Metrics
+
+On human-gate resume, the hook action above appends `human_gate_ended` under the per-task lock **before** any new `attempt_started`. Agents must not calculate durations.

package/presets/cursor/mcp-ts/commands/task.md

@@ -24,14 +24,16 @@ description: Route a natural-language task through the agent-team pipeline: task
 
 ## Алгоритм
 
-1. **Slug** — kebab-case из описания (≤48 символов). Создай `.cursor/team/tasks/<slug>/` через **Write** (например сразу `status.json` или пустой placeholder) — **не** через Shell `mkdir` (песочница → `Operation not permitted`).
+1. **Slug** — kebab-case из описания (≤48 символов). Создай `.cursor/team/tasks/<slug>/` через **Write** (например placeholder `pipeline.json` или пустой marker) — runtime/hook владеет `status.json` — **не** через Shell `mkdir` (песочница → `Operation not permitted`).
 2. **Router** — вызови subagent **task-router** с описанием задачи и путём к slug.
 3. **План** — покажи пользователю таблицу из `pipeline.json`: intent, steps, skipped, humanGates.
 4. **Intent retro** — если `intent === "retro"`, выполни `/technical-retro` и **остановись**.
-5. **Старт** — вызови subagent для `pipeline.steps[0].agent`:
-   - передай slug, пути к артефактам, scope из step (если есть);
-   - обнови `status.json`: `pipelineIndex: 0`, `currentAgent`, `state: in_progress`.
-6. **Human gate** — если после текущего шага есть gate в `humanGates` (`after:<agent>`), после завершения агента **остановись** и попроси `/task-continue <slug>` (или `/feature-continue <slug>`).
+5. **Старт** — после router:
+   - подтверди `pipeline.json` и `active-task.json`;
+   - **не** пиши lifecycle-поля `status.json` / `metrics.json` сам — их владеет orchestration runtime/hook (см. **agent-artifact-contracts**). Если `status.json` отсутствует, допустим только минимальный bootstrap (`slug`, `intent`, `pipelineIndex: 0`, `currentAgent: steps[0]`, `state: in_progress`) — **не** увеличивай `pipelineIndex` вручную;
+   - вызови subagent для `pipeline.steps[0].agent` (slug, пути к артефактам, scope).
+6. **После каждого агента** — дождись hook handoff / reconciliation terminal receipt → `status.state`; не запускай следующий шаг, пока `status.json` не отражает handoff (или пока нет `followup_message` от hook).
+7. **Human gate** — если после текущего шага есть gate в `humanGates` (`after:<agent>`), после завершения агента **остановись** и попроси `/task-continue <slug>` (или `/feature-continue <slug>`).
 
 ## Не делать
 
@@ -47,3 +49,7 @@ description: Route a natural-language task through the agent-team pipeline: task
 ## Legacy
 
 `/feature-start` и `/feature-continue` остаются совместимыми; для новых задач предпочитай `/task`.
+
+## Metrics
+
+Runtime/hook owns `metrics.json` and `status.json` attempt ledgers. Before the first invocation ensure `task_started` and one `activeAttempts[attemptId]` + `attempt_started` exist (router/runtime bootstrap — parent must not invent parallel indices). On `/task-continue`, run the installed chain hook `end_human_gate` action (or wrapper) so `human_gate_ended` lands before the next attempt. Do not calculate durations in agents.

package/presets/cursor/mcp-ts/commands/technical-retro.md

@@ -79,3 +79,7 @@ description: Facilitate a technical retrospective for a period, incident, releas
 - Не приписывать цитаты и факты без входа.
 - Не выдавать HR‑рекомендации.
 - Если просят только шаблон — **шаблон повестки** без выдуманного контента.
+
+### Metrics evidence
+
+When `metrics.json` exists, run the local aggregation script and report the cohort, sample size, incomplete artifacts, attribution confidence, active attempt duration, and human-gate wait separately. Do not treat gate wait or malformed ledgers as agent duration.