@bonesofspring/ai-rules 0.2.11 → 0.2.13

package/presets/cursor/php-laravel/rules/code-quality-and-refactoring.mdc

@@ -0,0 +1,54 @@
+---
+description: Code quality and light refactoring for Laravel backends
+alwaysApply: true
+---
+
+<!-- shared-core: quality/code-quality-and-refactoring.md -->
+
+# Поддержка существующего стиля
+
+- Следовать существующим паттернам (имена, структура, типизация / DI / error handling); минимизировать стилистический шум (лишний format/rename).
+- Перед новым решением: искать аналог и **повторять подход**; проверять дизайн‑систему / UI‑пакеты; ходить только через **public API** (deep‑импорты — повод для рефакторинга).
+
+# Принципы
+
+- **KISS:** самое простое изменение в паттернах репозитория.
+- **DRY + Rule of Three:** общее — только после 3-го повторения (ошибочная абстракция дороже дублирования).
+- **YAGNI:** без API, флагов, слоёв «на будущее» без текущего требования.
+- **SOLID:** S — один повод менять; O — композиция/новые реализации; L — контракт подтипа; I — узкие порты; D — абстракции (порты), детали в адаптерах стека.
+- **CUPID:** Composable; Unix philosophy (одна ответственность); Predictable; Idiomatic (репо); Domain-based.
+- **Composition over inheritance;** Law of Demeter — без цепочек `a.b.c.d`; через public API / facade.
+
+# Рефакторинг при изменениях
+
+- Лёгкий refactor OK, если меньше дублирования, выше читаемость, без ломки публичных контрактов.
+- Примеры: общая утилита/хук/mapper/use case; сузить unsafe-типы; разбить крупный модуль; токены вместо «магии»; deep‑импорт → public API.
+- Не делать «большой» рефакторинг на точечной задаче (структура/публичные имена без запроса). Крупное — минимальными шагами; код остаётся собираемым.
+
+# Требование к агенту
+
+- **Boy scout:** оставлять модуль немного лучше; не жертвовать архитектурой и слоями ради краткости.
+
+## Agent discipline (anti-sycophancy)
+
+Essentials below. Full procedural set (~17 rules) → load **`anti-sycophancy-discipline`**.
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent); never invent signatures.
+- Before «is this correct?» — ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose characterization test; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential «added for issue Y».
+- Urgency/authority: name the trade-off once, then comply — no apology loops.
+- Match verification to risk; report by what was **verified**, not attempted.
+
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**.
+
+> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
+
+## Stack notes
+
+- **No UI layer in this preset** — ignore shared-core bullets about дизайн‑система / UI‑пакеты / CSS‑токены; apply public-API and boy-scout rules to Laravel Actions/Models/Providers instead.
+- Prefer thin controllers + single-purpose Actions; Services for multi-step orchestration — avoid fat controllers and god Services.
+- Repository interfaces **only when justified** (multiple backends / test seams) — not required for every Eloquent model.
+- Prefer Laravel exceptions + Form Request / Policy mapping at the HTTP edge; do not leak raw persistence exceptions as HTTP bodies.
+- Post-change gate: **`post-change-test.mdc`** + **`php-tooling.mdc`** (`php artisan test` / `composer test` — not yarn lint / xcodebuild / Playwright).
+- Style/static analysis: use **repository/CI** Pint/PHPStan/Psalm — do not invent a parallel bible in rules.

package/presets/cursor/php-laravel/rules/code-review-mr.mdc

@@ -0,0 +1,56 @@
+---
+description: Code review checklist for Laravel merge requests
+alwaysApply: false
+---
+
+<!-- shared-core: review/code-review-mr.md -->
+
+# Code review merge requests
+
+On-demand rule for review flows. **Procedure and output format:** skill `code-review`.
+
+## When to load
+
+- User asks for review/MR/diff
+- Pipeline step `code-reviewer`
+- Platform automated review (e.g. BUGBOT) when present
+
+## Checklist references (abstract)
+
+- Architecture layers and stack core rules
+- Public imports / module boundaries
+- UI conventions of the stack
+- Unit and e2e/UI test conventions
+- Post-change lint/build gate before final report
+- Design smells **in MR diff scope** — load `design-guidance`; не разворачивать полный каталог Fowler вне диффа
+- Pattern name (GoF) — только если репозиторий уже использует эту форму или match минимален
+- Principles (KISS / DRY+Ro3 / YAGNI / SOLID / CUPID) — через always-on `code-quality-and-refactoring`, не дублировать эссе в review
+
+Concrete rule stems — in **Stack notes**.
+
+## Constraints
+
+- Focus on MR diff, not the whole repo.
+- Use local `git diff` — do not invent hosting metadata.
+- Boy scout rule: suggest fixes feasible within the MR scope.
+- No «большие рефакторинги» without an explicit request (`code-quality-and-refactoring`).
+
+## Output contract
+
+Procedure details live in skill `code-review`. Required shape:
+
+- Each finding cites **`path:line`**, the problem, impact, and a concrete fix direction.
+- Rank by severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding file context.
+- End with a verdict on its own line: **`Safe to merge | needs changes | reject`**.
+
+## Stack notes
+
+- Laravel boundaries: `architecture-boundaries` — HTTP → Actions/Services → Eloquent; Policies at the edge; Providers wire only.
+- HTTP edge: `http-layer`, `form-requests`, `routes-api` — thin Controllers, Form Request validation, API Resources.
+- Application + persistence: `actions-services`, `eloquent-persistence`, `policies-authorization`, `service-providers`.
+- Paths: `app/Http/**`, `app/Actions|Services/**`, `app/Models/**`, `app/Policies/**`, `app/Providers/**`, `routes/**`.
+- Tests: `tests-unit` (Actions/pure PHP); `tests-integration` (Feature HTTP/DB); post-change: `post-change-test` / `php-tooling`.
+- Security: secrets/PII/`security-php`; AuthZ via Policies — not ad-hoc role checks in Controllers/Models.
+- Never require Playwright, XCUITest, `lint:js`, or `xcodebuild` for Laravel MRs.
+

package/presets/cursor/php-laravel/rules/design-guidance.mdc

@@ -0,0 +1,112 @@
+---
+description: Design smells (Fowler) and curated GoF patterns for agents. Load when assessing structure, smells, or pattern fit.
+globs:
+  - "**/*.php"
+alwaysApply: false
+---
+
+<!-- shared-core: quality/design-guidance.md -->
+
+# Design guidance (smells & patterns)
+
+Словарь **code smells** (Fowler) и **design patterns** (GoF) для агентов при implement / review / debug.
+
+Применять только в scope задачи или MR. Лёгкий refactor — да; «большой» rewrite без явного запроса — нет.
+
+Называть паттерн **только если** репозиторий уже так делает или это минимальный match. Иначе — extract/split/move без ярлыка GoF.
+
+Не заменяет always-on Principles в `code-quality-and-refactoring` (KISS, DRY + Rule of Three, YAGNI, SOLID, CUPID, composition, Demeter).
+
+## When to load
+
+- **Feature delivery / implement** — оценка структуры модулей, границ и дублирования.
+- **Code review** — smells и pattern fit **в диффе MR**, не по всему репо.
+- **Debug** — root-cause похож на wrong abstraction, Feature Envy, Message Chains, Shotgun Surgery.
+- **Light refactor only** — улучшения в рамках boy-scout / MR scope; не расширять задачу ради каталога.
+
+Агенты и skills подгружают stem по one-liner wiring — не копировать этот каталог в промпт агента.
+
+## How to use (agent rules of thumb)
+
+1. Сначала сверить с Principles (always-on): проще ли решение, нет ли ранней абстракции, соблюдён ли public API.
+2. Затем отметить smells **в изменённых файлах** задачи/MR; предложить fix только если он укладывается в light refactor.
+3. Паттерн GoF — опциональный ярлык после того, как структура уже ясна; не начинать дизайн с выбора паттерна.
+4. Если smell и паттерн конфликтуют с границами слоёв стека — побеждают stack boundaries и existing repo patterns.
+5. Не требовать переименования «под GoF», если поведение уже корректно и читаемо.
+
+## Code smells (Fowler, curated ≤12)
+
+Таблица: smell → detect hint → fix hint (одна линия каждый). Без механических меню рефакторинга.
+
+| # | Smell | Detect | Fix hint |
+|---|-------|--------|----------|
+| 1 | Duplicate Code | одинаковая логика в ≥2 местах | dedupe после Rule of Three |
+| 2 | Long Method / Long Module | единица делает слишком много | extract в рамках scope; без big rewrite |
+| 3 | Feature Envy | метод чаще трогает чужие данные, чем свои | сдвинуть логику к данным / public API |
+| 4 | Data Clumps | одни и те же группы аргументов кочуют вместе | сгруппировать в type / value object |
+| 5 | Primitive Obsession | сырые string/int вместо доменных понятий | typed ids / value objects при нужде домена |
+| 6 | Speculative Generality | неиспользуемые хуки, флаги, абстракции «на будущее» | удалить (YAGNI) |
+| 7 | Message Chains | цепочки `a.b.c.d` | Demeter; facade / public API модуля |
+| 8 | Middle Man | класс почти только прокидывает вызовы | убрать pass-through **или** оставить как boundary |
+| 9 | Divergent Change | один модуль меняется по разным причинам | split по поводам изменения |
+| 10 | Shotgun Surgery | одно смысловое изменение разъезжается по многим файлам | consolidate ответственность |
+| 11 | Inappropriate Intimacy | доступ к чужим internals / private деталям | только public API / ports / facades |
+| 12 | Refused Bequest / Parallel Inheritance | подтип игнорирует базу; зеркальные иерархии классов | composition; не плодить параллельные деревья |
+
+**Skip Fowler (не в core):** Lazy Class, Incomplete Library Class, Comments-as-smell dogma, полный каталог 70+, пошаговые recipe-меню.
+
+Приоритет при конфликте smells: Inappropriate Intimacy и Message Chains (границы модулей) > Duplicate Code (после Rule of Three) > Long Method внутри уже правильного модуля.
+
+## Design patterns (GoF, curated ≤8)
+
+Suggest only when repo already uses the shape or the match is minimal. Prefer extract-function over naming Strategy ради ярлыка.
+
+Паттерны ниже — **разрешённый минимум** для агентов; остальной GoF по умолчанию в Skip.
+
+| Pattern | When to suggest | Anti-trigger |
+|---------|-----------------|--------------|
+| Strategy | взаимозаменяемые алгоритмы уже (или явно скоро) выбираются политикой | один алгоритм без ветвления политики |
+| Adapter | обернуть внешний / чужой API под локальный port | лишняя обёртка вокруг своего же API |
+| Facade | упростить multi-step subsystem за public API | facade превращается в god-object |
+| Factory Method | полиморфное создание уже принято в стиле репо | factory на каждый тривиальный `new` |
+| Decorator | аддитивное поведение без взрыва subclass-иерархий | decorator «для слоёв» без реальной нужды |
+| Observer | events / subscriptions уже есть в архитектуре | самодельный pub/sub без прецедента в репо |
+| Template Method | общий algorithm skeleton + вариативные hooks | наследование ради пары отличающихся строк |
+| Composite | дерево однородных узлов (UI/domain), как уже в репо | Composite на плоский список без иерархии |
+
+Если сомневаешься между двумя паттернами — выбери более простой extract/compose без имени; ярлык можно добавить на review, если репо уже так говорит.
+
+## Skip / avoid by default
+
+| Catalog | Skip |
+|---------|------|
+| GoF | Singleton, Abstract Factory, Flyweight, Memento, Interpreter, Visitor, Bridge, Prototype |
+| GoF (conditional) | Command, Chain of Responsibility, State — упоминать **только если** репо уже использует |
+| Fowler | всё сверх 12 smells выше |
+| DDD | Aggregates, bounded-context maps, event sourcing, CQRS — **не в core** |
+| DDD (pointer) | ubiquitous language anti-pattern — расширять в `feature-delivery-workflow`, не здесь |
+| GRASP | список Larman как отдельные правила — skip (перекрывается SOLID/CUPID) |
+| Clean Code dogma | жёсткие caps на строки функции / «ровно один assert» — skip |
+
+Не вводить второй stem (`refactoring-smells` / `design-patterns-for-agents`) — один каталог: `design-guidance`.
+
+## Out of scope for this stem
+
+- Полный GoF (23) и полный Fowler catalog.
+- Stack-specific рецепты (пути модулей, lint-команды) — только в **Stack notes** адаптера.
+- Security, a11y, perf — отдельные review-правила; здесь только структурные smells/patterns.
+- Четвёртое always-on правило — запрещено; этот stem только requestable / agent-load.
+
+## Cross-refs
+
+- Always-on Principles: `code-quality-and-refactoring`.
+- DIP / ports vs adapters: stack `architecture-boundaries` (детали стека — в Stack notes адаптеров).
+- Ubiquitous language: `feature-delivery-workflow` (lineage).
+- MR checklist (smells in scope; pattern name only if repo uses it): `code-review-mr`.
+- Token / twin policy for authors: `preset-token-budget`, `preset-twin-sync` (meta, not consumer always-on).
+
+## Stack notes
+
+- Prefer small interfaces / repository contracts only when justified; keep Actions/Services and Eloquent within Laravel layers (`architecture-boundaries`).
+- Suggest Facade at package public API when the repo uses it; prefer Service Provider bindings over Singleton / ad-hoc static wiring.
+- Prefer immutable value objects / DTOs for Strategy inputs when the repo already uses them — do not invent patterns mid-module.

package/presets/cursor/php-laravel/rules/domain-layer.mdc

@@ -0,0 +1,27 @@
+---
+description: Optional modular domain folders note (flat app/ remains default)
+globs:
+  - "**/Domain/**/*"
+  - "**/domain/**/*"
+alwaysApply: false
+---
+
+
+# Domain layer (optional modular note)
+
+**Default for this preset:** flat Laravel `app/` (Controllers, Actions, Models, …). Do **not** invent `app/Domain/**` for every feature.
+
+When the **target repo already** uses modular / domain folders (`app/Domain/<Module>/`, modules packages, etc.):
+
+- Keep module-local Models/Actions/Policies cohesive under that module's public surface.
+- Cross-module access via public APIs only (`module-public-api`) — no deep imports of another module's internals.
+- Still prefer Laravel primitives (Form Requests at HTTP edge, Eloquent models, Policies) inside the module.
+
+## Thin alias rationale
+
+This stem is intentionally **thin**: v1 locks flat `app/` as default; modular layout is an optional documented variant only.
+
+## Forbidden
+
+- Mandating hexagonal `Domain/` / ports purity in Laravel consumer apps.
+- Moving HTTP types into a “domain” folder to simulate hexagonal without need.

package/presets/cursor/php-laravel/rules/eloquent-persistence.mdc

@@ -0,0 +1,34 @@
+---
+description: Eloquent models, migrations, and persistence conventions
+globs:
+  - "**/Models/**/*"
+  - "**/database/migrations/**/*"
+  - "**/database/factories/**/*"
+  - "**/database/seeders/**/*"
+alwaysApply: false
+---
+
+
+# Eloquent persistence
+
+- Models stay **persistence-focused**: fillable/guarded, casts, relations, scopes, accessors already used by the repo.
+- Prefer mass-assignment protection (`$fillable` / `$guarded`) consistent with neighbors; never `$guarded = []` casually on user-facing models.
+- Migrations are the schema SoT; keep them additive and reversible when the repo expects `down()`.
+- Factories/seeders for Feature tests — match existing factory patterns.
+- Repository / query object interfaces **only when justified** (swap backends, heavy query seams) — default is Eloquent on the Action/Service.
+
+## Forbidden
+
+- Importing `Illuminate\Http\Request` / Form Requests into models.
+- AuthZ role checks inside model boot hooks when Policies exist.
+- Returning models directly from controllers when the repo uses API Resources.
+- Raw SQL in controllers; prefer Eloquent/query builder in Actions or dedicated query classes.
+
+## Testing
+
+- Feature tests use `RefreshDatabase` / `DatabaseMigrations` as the repo does (SQLite in-memory preferred for dogfood/CI).
+- Unit-test custom casts/scopes when non-trivial; otherwise Feature coverage is enough.
+
+## Related
+
+- Actions calling models: `actions-services`; HTTP mapping: `http-layer` + `form-requests`.

package/presets/cursor/php-laravel/rules/events-listeners.mdc

@@ -0,0 +1,34 @@
+---
+description: Laravel Events and Listeners
+globs:
+  - "**/Events/**/*"
+  - "**/Listeners/**/*"
+  - "**/*Event.php"
+  - "**/*Listener.php"
+alwaysApply: false
+---
+
+
+# Events / Listeners
+
+- Domain/application events signal that **something happened**; Listeners react (notify, project, enqueue).
+- Dispatch from Actions/Services (`TodoCreated::dispatch($todo)`); keep event payloads small (IDs / models via SerializesModels).
+- Prefer dedicated Listener classes over closures in `EventServiceProvider` when neighbors use classes.
+- Queued listeners (`ShouldQueue`) for slow side effects; sync listeners for cheap in-process reactions.
+- Discover listeners via attributes / provider registration matching the Laravel version + repo.
+
+## Structure
+
+- `app/Events/TodoCreated.php`, `app/Listeners/SendTodoCreatedNotification.php`.
+- One listener ≈ one reaction; split when a listener grows multiple unrelated side effects.
+
+## Testing
+
+- `Event::fake()`; `Event::assertDispatched(TodoCreated::class)`.
+- Feature tests may assert listener effects when not faked — match repo style.
+
+## Forbidden
+
+- Business rules that belong in Actions living only inside Listeners (harder to test/sync).
+- Circular event storms (Listener dispatches the same event without guard).
+- Using Events as a mandatory hexagonal port layer — optional async pattern only.

package/presets/cursor/php-laravel/rules/feature-delivery-workflow.mdc

@@ -0,0 +1,50 @@
+---
+description: End-to-end delivery checklist for Laravel features
+alwaysApply: false
+---
+
+<!-- shared-core: architecture/feature-delivery-workflow.md -->
+
+# Feature delivery (Laravel)
+
+Order of work:
+
+1. **Routes** — `routes/api.php` / `web.php` (`routes-api`).
+2. **Form Request + Policy** — validation + AuthZ (`form-requests`, `policies-authorization`).
+3. **Action / Service** — application logic (`actions-services`).
+4. **Eloquent** — model + migration/factory as needed (`eloquent-persistence`).
+5. **Controller + Resource** — thin HTTP edge (`http-layer`).
+6. **Optional async** — Job / Event / Listener (`jobs-queues`, `events-listeners`).
+7. **Provider bindings** — only if new interfaces/bindings (`service-providers`).
+8. **Tests** — Feature (HTTP/DB) + Unit (Actions) as valuable.
+9. **Gate** — `post-change-test` (+ `php-tooling`) → `php artisan test` / `composer test`.
+
+```mermaid
+flowchart LR
+  R[Routes] --> C[Controller]
+  C --> FR[Form Request]
+  C --> P[Policy]
+  C --> A[Action/Service]
+  A --> M[Eloquent]
+  A --> J[Job/Event]
+```
+
+## Matrix
+
+| Path | Rules |
+|------|-------|
+| `app/Http/**`, Resources | `http-layer`, `form-requests`, `architecture-boundaries` |
+| `routes/**` | `routes-api` |
+| `app/Models/**`, migrations | `eloquent-persistence` |
+| `app/Actions/**`, `app/Services/**` | `actions-services` |
+| `app/Providers/**` | `service-providers` |
+| `app/Policies/**` | `policies-authorization` |
+| `app/Jobs/**` | `jobs-queues` |
+| `app/Events/**`, `app/Listeners/**` | `events-listeners` |
+| After `*.php` edits | `post-change-test` (+ `php-tooling`) |
+
+## Anti-patterns
+
+- Fat controllers; Form Requests in Models; AuthZ via ad-hoc roles; skipping Feature tests for API writes.
+- Mandating hexagonal ports/adapters folders in a Laravel-first app.
+- Load `design-guidance` when assessing structure, smells, or pattern fit.

package/presets/cursor/php-laravel/rules/form-requests.mdc

@@ -0,0 +1,32 @@
+---
+description: Laravel Form Request validation at the HTTP edge
+globs:
+  - "**/Http/Requests/**/*"
+  - "**/*Request.php"
+alwaysApply: false
+---
+
+
+# Form Requests
+
+- Validate untrusted input in **Form Requests** (or the repo's established validator) — not ad-hoc `$request->validate` sprinkled in Actions when neighbors use Form Requests.
+- `rules()` / `messages()` / `attributes()` stay at the HTTP edge; Actions receive already-validated arrays or typed props — **not** the Form Request object when avoidable.
+- Prefer `authorize()` on the Form Request **or** Policy/`$this->authorize` in the controller — pick the pattern neighbors use; do not double-authorize inconsistently.
+- Keep rules focused: required/types/uniqueness; complex cross-field domain rules may live in Action after validation basics pass.
+- Use `$request->validated()` (or `safe()->only(...)`) — never trust raw `$request->all()` into persistence.
+
+## Structure
+
+- `app/Http/Requests/<Feature>/StoreXRequest.php` (or flat `StoreXRequest`) matching repo nesting.
+- Shared rule fragments: extract only after Rule of Three; prefer Laravel Rule objects already in the repo.
+
+## Testing
+
+- Feature tests assert 422 validation envelopes for missing/invalid fields.
+- Do not unit-test every rule string in isolation unless the repo already does.
+
+## Forbidden
+
+- Importing Form Requests into Models or Jobs as a validation substitute.
+- Putting Eloquent queries that belong in Actions into Form Request `prepareForValidation` without need.
+- Inventing a custom validation framework when Laravel Form Requests suffice.

package/presets/cursor/php-laravel/rules/http-layer.mdc

@@ -0,0 +1,35 @@
+---
+description: Thin Laravel controllers, API Resources, and HTTP edge mapping
+globs:
+  - "**/Http/Controllers/**/*"
+  - "**/Http/Resources/**/*"
+  - "**/Http/Middleware/**/*"
+  - "**/*Controller.php"
+alwaysApply: false
+---
+
+
+# HTTP layer (Laravel)
+
+- Controllers are **thin**: authorize → validate (Form Request) → call one Action/Service → return Resource / response.
+- Prefer invokable or resource controllers matching existing repo style; do not invent a new controller taxonomy mid-feature.
+- Map status + body at the edge; use API Resources (or repo-equivalent) for JSON — do not return Eloquent models raw when neighbors use Resources.
+- Keep business orchestration in Actions/Services — not private methods that grow into a second service layer inside the controller.
+- Middleware owns cross-cutting HTTP concerns (auth, throttle, locale) already used by the repo.
+
+## Resilience
+
+- Side-effect endpoints: accept/propagate an **idempotency key** when the domain already uses one; document if intentionally omitted.
+- Soft size hint: split when a controller grows past ~200 LOC or owns more than one use case.
+
+## Testing
+
+- Prefer Feature tests through the HTTP kernel (`tests/Feature`) with SQLite / repo test DB.
+- Unit-test Actions separately when logic is non-trivial; mock Eloquent only if the repo already does.
+
+## Forbidden
+
+- Business SQL / multi-model workflows in controllers.
+- Skipping Form Requests when neighbors validate via Form Requests.
+- Ad-hoc role/`if ($user->isAdmin)` AuthZ when a Policy exists or should.
+- Blade/Livewire/Filament concerns — **out of this preset**.

package/presets/cursor/php-laravel/rules/jobs-queues.mdc

@@ -0,0 +1,44 @@
+---
+description: Laravel queued Jobs conventions
+globs:
+  - "**/Jobs/**/*"
+  - "**/*Job.php"
+alwaysApply: false
+---
+
+
+# Jobs / queues
+
+- Use Jobs for **deferred / async** work (email, fan-out, slow I/O) — not as a substitute for a clear sync Action.
+- Dispatch from Actions/Services after the sync write succeeds (or inside the same transaction only when the repo already uses `afterCommit`).
+- Implement `ShouldQueue` when neighbors queue; keep `handle()` focused.
+- Configure `$tries`, `$backoff`, `$timeout` only when the job needs them or neighbors set them.
+- Fail closed: don't swallow exceptions; use failed-job handling the repo already has.
+
+## Serialization / DI (queued jobs)
+
+Queued Job **constructors and public properties are serialized** onto the queue. Put only **serializable payloads** there:
+
+- Primitives, IDs, arrays of scalars, DTOs that serialize cleanly.
+- Eloquent models only when using `SerializesModels` carefully (prefer IDs when the model may change or be large).
+
+**Resolve services / repositories / collaborators via `handle()` method injection** (or container resolve inside `handle`). Do **not** inject app services, repositories, mailers, HTTP clients, or other container collaborators through the queued Job constructor — they are not reliable queue payloads.
+
+Sync-only jobs that never implement `ShouldQueue` may use constructor DI if that matches neighbors; prefer the same `handle()` injection pattern for consistency.
+
+## Structure
+
+- `app/Jobs/SendTodoCreatedNotification.php` (verb + subject naming).
+- Prefer serializing models via `SerializesModels` as Laravel defaults when models are the payload.
+
+## Testing
+
+- `Bus::fake()` / `Queue::fake()` in Feature tests; assert `Bus::assertDispatched(…)`.
+- Optionally `Bus::dispatchSync` in integration when asserting side effects end-to-end.
+
+## Forbidden
+
+- Injecting services / repositories / other collaborators via the queued Job constructor.
+- HTTP Request types inside Jobs.
+- Huge Jobs that re-implement the whole Action — pass IDs / minimal payloads.
+- Requiring external brokers in dogfood when `sync` / `array` / `database` driver suffices.

package/presets/cursor/php-laravel/rules/laravel-app-core.mdc

@@ -0,0 +1,35 @@
+---
+description: Laravel stack, app layout, artisan, and agent entry points
+alwaysApply: true
+---
+
+
+# Стек и окружение
+
+Версии PHP и Laravel — **из `composer.json` / `composer.lock` целевого репозитория**. Рамка preset:
+
+- **Язык / платформа:** PHP **8.2+** + **Composer** + **PSR-4** (`App\…`).
+- **Framework:** **Laravel 11+** baseline in Stack notes; read exact constraint from the target repo.
+- **Архитектура:** Laravel-first (HTTP → Actions/Services → Eloquent); not mandatory hexagonal ports purity.
+- **Тесты:** PHPUnit default; Pest — если уже в репо/CI; gate = `php artisan test` / `composer test`.
+- **Static / format:** Pint / PHPStan / Psalm — только если уже сконфигурированы.
+- **HTTP:** thin controllers; Form Requests; API Resources; Policies for AuthZ.
+
+# Структура (default: flat `app/`)
+
+```text
+app/
+  Http/Controllers|Requests|Resources|Middleware/
+  Actions/   and/or   Services/
+  Models/
+  Policies/
+  Providers/
+  Jobs/  Events/  Listeners/
+routes/api.php  routes/web.php
+tests/Unit/  tests/Feature/
+artisan  composer.json
+```
+
+**Modular variant (optional):** `app/Domain/<Module>/` — short requestable note in `domain-layer` only; default remains flat Laravel `app/`.
+
+Границы — **`architecture-boundaries.mdc`**. Tooling — requestable **`php-tooling.mdc`**. После правок PHP — **`post-change-test.mdc`**.

package/presets/cursor/php-laravel/rules/laravel-conventions.mdc

@@ -0,0 +1,41 @@
+---
+description: Idiomatic Laravel / PHP conventions for this preset
+globs:
+  - "**/*.php"
+alwaysApply: false
+---
+
+
+# Laravel conventions
+
+- Follow PSR-12 / Pint config when present; naming: `PascalCase` classes, `camelCase` methods, namespaces match Composer PSR-4 (`App\…`).
+- Prefer typed properties, return types, and `strict_types=1` when neighboring files use them.
+- Prefer `final` / `readonly` where the repo already uses them; do not invent a new style mid-module.
+- Artisan generators (`php artisan make:…`) OK when they match target layout; tidy generated stubs to repo style.
+- Do not invent Laravel APIs — verify against `composer.json` / framework docs for the installed major (`// VERIFY:` when unsure).
+- Prefer Form Requests, Policies, Actions, Resources — the Laravel toolkit — over inventing hexagonal DTO trees.
+
+## Errors / exceptions
+
+- Prefer domain/application exceptions or Laravel's HTTP exceptions at the edge (`abort`, `AuthorizationException`).
+- Chain causes; never empty-catch without logging or rethrowing.
+- Map to HTTP statuses in controllers / exception handler — not inside Models.
+
+## Container / facades
+
+- Constructor injection preferred in new code; Facades OK when neighbors use them (`Route`, `DB`, `Event`).
+- Avoid service-locator `app(Foo::class)` mid-Action when constructor injection fits.
+
+## Anti-hallucination
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Invented packages not in `composer.json` | Add dependency explicitly or copy existing import |
+| Fat controllers | Thin controller → Action |
+| Blade/Livewire in API tasks | Out of preset scope |
+| Hexagonal folder mandates | Flat `app/` Laravel layout |
+| Empty `catch` | Handle, wrap, or declare |
+
+## Agent requirement
+
+New PHP code must stay idiomatic Laravel and verifiable against `composer.json` and neighboring `app/` packages.

package/presets/cursor/php-laravel/rules/module-public-api.mdc

@@ -0,0 +1,31 @@
+---
+description: Public module API and package boundaries for Laravel apps
+globs:
+  - "**/composer.json"
+  - "**/app/**/*.php"
+alwaysApply: false
+---
+
+# Module public API
+
+- Published types under a package/module's public namespaces are a compatibility surface — change carefully; prefer additive APIs.
+- Prefer narrow exports; expose only what other modules/features need.
+- Do not deep-import another module's internal namespaces; depend on its published API / facade only.
+- Document breaking PHP API changes in CHANGELOG when the repo publishes libraries.
+
+## Flat app/ default / modular variant
+
+- **Default:** one Laravel app with flat `app/` namespaces (see `dogfood/php-laravel`).
+- **Modular:** when the repo already uses `app/Domain/<Module>/` or Composer path packages, each module exposes a narrow public API; other modules depend inward only.
+- Do not invent multi-package scaffolding unless the repo already uses it.
+
+## composer.json
+
+- Package name, PHP/Laravel versions, and PSR-4 map are SoT for toolchain/autoload.
+- Prefer minimal direct deps; pin via committed `composer.lock` the repo already uses.
+- Dev-only tools (PHPUnit, Pint, PHPStan) stay in `require-dev`.
+
+## Cross-feature
+
+- Features communicate via Actions/Services public methods or small facades — not by importing sibling Feature private helpers.
+- Form Request / Resource DTOs stay local to the HTTP edge of that feature.

package/presets/cursor/php-laravel/rules/php-tooling.mdc

@@ -0,0 +1,39 @@
+---
+description: Laravel/PHP toolchain (artisan, Composer, Pint, PHPStan) — requestable
+globs:
+  - "**/*.php"
+  - "**/composer.json"
+  - "**/composer.lock"
+  - "**/phpunit.xml*"
+  - "**/artisan"
+  - "**/pint.json"
+  - "**/phpstan*"
+alwaysApply: false
+---
+
+# PHP / Laravel tooling (requestable)
+
+Before running commands, discover from the repository:
+
+1. Require **`composer.json` / `composer.lock`** — Composer is the package manager.
+2. PHP / Laravel versions — from `composer.json`; do not invent.
+3. Tests: prefer **`php artisan test`**; else Composer script `test`; else `vendor/bin/phpunit`; use **Pest** only if already in repo/CI.
+4. If both PHPUnit and Pest exist, follow CI/README — do not guess.
+
+## Typical commands
+
+| Goal | Command |
+|------|---------|
+| Feature/unit tests | `php artisan test` or `composer test` |
+| Pest (if present) | via `artisan test` / `vendor/bin/pest` per repo |
+| Autoload refresh | `composer dump-autoload` |
+| Static analysis | `vendor/bin/phpstan` or `vendor/bin/psalm` **only if** config exists |
+| Format | `vendor/bin/pint` or `php-cs-fixer` **only if** configured |
+
+Do not introduce a new static/format tool as a hard gate.
+
+## Agent requirements
+
+- Mandatory after PHP edits: **`post-change-test.mdc`**.
+- Never require Playwright, XCUITest, `lint:js`, `lint:css`, `xcodebuild`, `mvn`, or `gradlew` as Laravel handoffs.
+- Integration/Feature tests: agents `integration-test-*` + skill `integration-testing` (Laravel Feature ≈ integration).