@bonesofspring/ai-rules 0.2.13 → 0.2.15

package/presets/cursor/nuxt/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **nuxt** — recipes must stay stack-safe (no cross-stack lint/test commands).

package/presets/cursor/nuxt/hooks/examples/format-edited.example.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Optional: format/lint edited JS/TS under app/ after save.
+# NOT in default hooks.json. Requires yarn scripts in app/.
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT/app" 2>/dev/null || cd "$ROOT"
+# Prefer project scripts; adjust names to match package.json
+if command -v yarn >/dev/null 2>&1; then
+  yarn lint:js --fix 2>/dev/null || yarn eslint --fix . 2>/dev/null || true
+fi
+exit 0

package/presets/cursor/nuxt/hooks/examples/secret-guard.example.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Optional cookbook: block committing likely secrets in staged diffs.
+# NOT wired in default hooks.json — copy to hooks/ and register manually.
+set -euo pipefail
+PATTERN='(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----|api[_-]?key\s*[:=]\s*['\''\"][^'\''\"]{12,})'
+if git diff --cached -U0 2>/dev/null | grep -Eiq "$PATTERN"; then
+  echo "secret-guard: possible secret in staged diff — review before commit" >&2
+  exit 1
+fi
+exit 0

package/presets/cursor/nuxt/hooks/examples/test-on-save.example.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Optional: scoped unit tests for changed files under app/src.
+# NOT in default hooks.json. No Playwright here.
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT/app" 2>/dev/null || exit 0
+yarn test --findRelatedTests --passWithNoTests 2>/dev/null || yarn test --passWithNoTests 2>/dev/null || true
+exit 0

package/presets/cursor/nuxt/hooks/guard-shell-command.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Lightweight shell guard for Cursor projects using this preset.
+
+set -euo pipefail
+
+input=$(cat)
+
+INPUT="$input" node <<'NODE'
+const fs = require('fs');
+
+const raw = process.env.INPUT || '';
+let event;
+try {
+  event = JSON.parse(raw);
+} catch {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const command = String(event.command || event.input?.command || '');
+if (!command.trim()) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+function out(permission, userMessage, agentMessage) {
+  process.stdout.write(JSON.stringify({
+    permission,
+    user_message: userMessage,
+    agent_message: agentMessage || userMessage,
+  }));
+}
+
+const dangerousGit = /\bgit\s+(reset\s+--hard|clean\s+-[^\n]*f|push\s+--force|push\s+-f|checkout\s+--\s+)/;
+if (dangerousGit.test(command)) {
+  out(
+    'ask',
+    'This command looks destructive for git state. Review it before continuing.',
+    'A project hook flagged a destructive git command. Ask the user before running it.',
+  );
+  process.exit(0);
+}
+
+const managerByFile = [
+  ['yarn.lock', 'yarn'],
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['package-lock.json', 'npm'],
+].find(([file]) => fs.existsSync(file));
+
+let expected = managerByFile?.[1];
+if (!expected && fs.existsSync('package.json')) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+    const pm = typeof pkg.packageManager === 'string' ? pkg.packageManager : '';
+    expected = pm.split('@')[0] || undefined;
+  } catch {
+    // Ignore invalid package.json in the hook; the agent can diagnose it later.
+  }
+}
+
+if (!expected) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const used = command.match(/(^|[;&|]\s*)(npm|yarn|pnpm)\s+/)?.[2];
+if (used && used !== expected) {
+  out(
+    'ask',
+    `This repository appears to use ${expected}, but the command uses ${used}. Confirm before continuing.`,
+    `Use ${expected} for package scripts and installs unless the user explicitly approves ${used}.`,
+  );
+  process.exit(0);
+}
+
+process.stdout.write('{ "permission": "allow" }');
+NODE

package/presets/cursor/nuxt/hooks.json

@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "hooks": {
+    "beforeShellExecution": [
+      {
+        "command": ".cursor/hooks/guard-shell-command.sh",
+        "failClosed": true
+      }
+    ],
+    "subagentStop": [
+      {
+        "command": ".cursor/hooks/chain-team-phases.sh",
+        "loop_limit": 15
+      }
+    ]
+  }
+}

package/presets/cursor/nuxt/mcp.json

@@ -0,0 +1,19 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": ["-y", "@upstash/context7-mcp"]
+    },
+    "playwright": {
+      "command": "npx",
+      "args": ["-y", "@playwright/mcp@latest"]
+    },
+    "chrome-devtools": {
+      "command": "npx",
+      "args": ["-y", "chrome-devtools-mcp@latest"]
+    },
+    "figma": {
+      "url": "https://mcp.figma.com/mcp"
+    }
+  }
+}

package/presets/cursor/nuxt/rules/README.md

@@ -0,0 +1,108 @@
+### Difference between .mdc and .md in `.cursor/rules`
+
+#### .md
+Ordinary markdown file. Cursor sees it as documentation/content, not as a rule to apply automatically.
+
+#### .mdc
+Special Cursor Rule format:
+- YAML frontmatter is required at the top with fields like description, globs, alwaysApply;
+- the file lives in `.cursor/rules/`;
+- Cursor treats it as assistant behavior config for this repo (automatically mixes the contents into context when the rule matches).
+
+- So `.mdc` = “markdown + config for Cursor”, `.md` = plain text with no control meaning for the assistant.
+
+### Starting a new task
+
+- **Agent team (recommended):** `/task <description>` — the router picks roles and order; after a human gate — `/task-continue <slug>`. See **`agent-team-orchestrator.mdc`** and `.cursor/team/README.md`.
+- **Legacy:** `/feature-start` → `/feature-continue`.
+- **End-to-end layer checklist (for developer):** **`feature-delivery-workflow.mdc`**.
+
+### Loading strategy
+
+- **`alwaysApply: true`** (Cursor) / **without `paths:`** (Claude) — base invariants only (**3**):
+  - `nuxt-app-core`, `package-manager`, `code-quality-and-refactoring`
+- **On-demand / requestable** — `post-change-lint` (**required after code edits**, not always-on), `agent-team-intake` (via orchestrator/commands), `agent-team-orchestrator`, architecture, imports, UI, tests, feature-delivery-workflow, `design-guidance`, `anti-sycophancy-discipline`, `vue-nuxt-anti-hallucination`, reference-features, nuxt-pages-routing, `security-nuxt`, vue-a11y-coding, `technical-retro`
+- **Preset author meta** (globs `packages/ai-rules/presets/**`, never alwaysApply): `preset-layering`, `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`
+- **Skills** — long procedures (`feature-delivery`, `code-review`, …)
+
+### Shared core → stack mapping
+
+SoT prose: `packages/ai-rules/presets/_shared/core/**` (see `_shared/README.md`). Adapters carry `<!-- shared-core: … -->`.
+
+| Shared core | This stack adapter | Delta |
+|-------------|--------------------|-------|
+| `quality/code-quality-and-refactoring.md` | `code-quality-and-refactoring.mdc` | Stack notes: ESLint/stylelint, CSS tokens |
+| `quality/anti-sycophancy-discipline.md` | `anti-sycophancy-discipline.mdc` | requestable full VERIFY/discipline set; globs `**/*.{ts,tsx}` |
+| `quality/design-guidance.md` | `design-guidance.mdc` | requestable smells/GoF; globs `**/*.{ts,tsx}` |
+| `agent-team/agent-team-orchestrator.md` | `agent-team-orchestrator.mdc` | Roles (Playwright trio); preset PR pointer |
+| `agent-team/agent-team-intake.md` | `agent-team-intake.mdc` | thin |
+| `architecture/feature-delivery-workflow.md` | `feature-delivery-workflow.mdc` | Nuxt layer checklist |
+| `architecture/reference-features.template.md` | `reference-features.mdc` | path table |
+| `review/code-review-mr.md` | `code-review-mr.mdc` | Nuxt checklist refs |
+| `review/technical-retro.md` | `technical-retro.mdc` | thin alias |
+| `meta/preset-*.md` | `preset-*.mdc` | author-only globs |
+
+Claude twins + Cursor→Claude map: `presets/claude/nuxt/rules/README.md`.
+
+### UI edit bundle (consolidated globs)
+
+When editing `components/**/*.vue`, a **reduced** set loads (not the full `**`):
+
+| Rule | Globs | Purpose |
+|------|-------|---------|
+| `vue-ui.mdc` | `components/**/*.{vue,ts}` | Structure, styles, props |
+| `architecture-boundaries-ui.mdc` | `components/**/*.{vue,ts}` | Slim UI-layer boundaries |
+| `vue-a11y-coding.mdc` | `components/**/*.{vue,ts}` | A11y |
+| `navigation-router-ui.mdc` | `components/**` | Short navigation guide |
+| `no-v-bind-spread.mdc` | `**/*.{vue,tsx,jsx}` | Explicit props |
+| `script-setup-conventions.mdc` | `**/*.{vue,ts}` | Syntax |
+
+**Not loaded on a typical UI edit:** `architecture-boundaries` (api/stores/types/lib), `layer-barrel-exports` (only `index.ts`), `navigation-router-stack` (pages/layouts/middleware). Colocated styles — in `vue-ui.mdc` (deprecated stub `no-cross-component-styles-import` removed).
+
+`css-property-order-stylelint.mdc` — on `**/*.{css,scss,vue}`.
+
+### Reference features
+
+Fill in **`reference-features.mdc`** (TBD → real paths) after `init` in the target repo.
+
+### Key rules catalog
+
+| File | Purpose |
+|------|---------|
+| `reference-features.mdc` | Reference paths for UI/store/API/types/tests |
+| `nuxt-pages-routing.mdc` | Nuxt file-based routing, SSR/payload, loading/error, focused anti-hallucination banlist |
+| `vue-nuxt-anti-hallucination.mdc` | Requestable Next/React/RTK phantom-import banlist (≥15 ❌/✅ rows) |
+| `security-nuxt.mdc` | Secrets, auth, XSS, Server Actions (coding-time) |
+| `vue-a11y-coding.mdc` | A11y while writing UI |
+| `feature-delivery-workflow.mdc` | End-to-end checklist (on-demand, not always-on) |
+| `agent-team-intake.mdc` | `/task` hint on a work request (on-demand, via orchestrator) |
+| `package-manager.mdc` | Before `install` / `run` in the terminal, detect the repo package manager (lockfile, `packageManager`) and use only that one |
+| `agent-team-orchestrator.mdc` | `/task`, router, `pipeline.json`, build-verifier, parallel steps |
+| `preset-pr-checklist.mdc` (+ sibling `preset-*`) | PR checklist for preset authors (twin, budget, leakage) |
+| `nuxt-app-core.mdc` | Stack, layers, directory map (alwaysApply) |
+| `post-change-lint.mdc` | Run ESLint + Stylelint after code changes (**requestable**, required after code edits) |
+| `architecture-boundaries-ui.mdc` | Slim UI boundaries when editing components |
+| `architecture-boundaries.mdc` | Full UI / store / API map (api, store, types, lib) |
+| `navigation-router-ui.mdc` | Navigation in UI components (slim) |
+| `navigation-router-stack.mdc` | Full navigation stack audit (Nuxt file-based routing / SPA) |
+| `http-client.mdc` | One HTTP stack, contracts from `@/types`, no scattered low-level API |
+| `api-services.mdc` | Services, mappers, calls via application API clients |
+| `store-pinia.mdc` | Pinia (`defineStore`), actions, error/response typing as in repo code |
+| `public-imports.mdc` | Imports `@/types`, `@/types/enums`, `@/api` (outside `api/**`) |
+| `layer-barrel-exports.mdc` | Two-level barrels for layers with a public API (`@/api`, `@/types`, `@/core`, …) |
+| `types-jsdoc.mdc` | JSDoc for types in `types` (Russian text, `[computed]`, no `@param`/`@returns`) |
+| `no-type-assertion-as-import-export.mdc` | Limit `as`, incl. `instanceof` for transport errors in `catch` |
+| `code-review-mr.mdc` | MR review checklist + output contract (`path:line`, severity, verdict) |
+| `tests-unit.mdc` | Unit tests and HTTP-client behavior tests |
+| `playwright-agents.mdc`, `tests-e2e-structure.mdc` | E2E |
+| `vue-ui.mdc` | Vue UI: SFC structure, neighboring `ComponentName.data.ts` / `.utils.ts`, styles, props |
+
+**Wording collisions:** type and API imports — source of truth **`public-imports.mdc`**; mirrors ESLint `no-restricted-imports` in `eslint.config.mjs`.
+
+Tasks about **networking, replacing the HTTP library, new endpoints**: rely on **`http-client.mdc`** + **`api-services.mdc`** + **`store-pinia.mdc`**.
+
+## Metrics policy mapping
+
+| Shared core | Runtime integration | Loading |
+|-------------|---------------------|---------|
+| `agent-team/agent-task-metrics.md` | `agent-team-orchestrator` + `hooks/chain-team-phases.sh` | requestable/on-demand; never session-start |

package/presets/cursor/nuxt/rules/agent-team-intake.mdc

@@ -0,0 +1,16 @@
+---
+description: Use when user posts a work request without /task — suggest or use /task to run the agent team router. Lightweight intake hint only.
+alwaysApply: false
+---
+
+<!-- shared-core: agent-team/agent-team-intake.md -->
+
+# Agent team intake
+
+When the user message looks like a **work request** (implement, add, fix, refactor, review MR, write tests, spike) — not a question about how code works:
+
+1. Prefer **`/task <their request>`** or invoke **task-router** first.
+2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
+3. Pure questions (“how does X work”, “explain”) — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
+
+Exceptions: user explicitly says “no pipeline”, “just do it”, or continues an active slug.

package/presets/cursor/nuxt/rules/agent-team-orchestrator.mdc

@@ -0,0 +1,192 @@
+---
+description: Orchestrates the agent team via task-router and pipeline.json. Use for /task, /task-continue, /feature-start, task decomposition, or when the user describes a feature, bug, or review request.
+alwaysApply: false
+---
+
+<!-- shared-core: agent-team/agent-team-orchestrator.md -->
+
+# Agent team orchestrator
+
+Parent agent = **manager**. Router plans; specialists execute. Artifacts: `.cursor/team/tasks/<slug>/`.
+
+Work request without `/task` — see **`agent-team-intake.mdc`** (when to suggest the router instead of coding directly).
+
+## Entry points
+
+| Command | When |
+|---------|------|
+| **`/task <desc>`** | **Preferred** — router → dynamic pipeline → first agent |
+| `/task-continue <slug>` | After human gate or pause |
+| `/feature-start <desc>` | Legacy: analyst-only start (no router) |
+| `/feature-continue <slug>` | Alias of task-continue |
+| `/technical-retro [slug]` | Retro with agent team block |
+
+## Stack notes
+
+### Roles
+
+| Agent | App / prod writes | Typical intent |
+|-------|-------------------|----------------|
+| `task-router` | no (team only) | Every `/task` — writes `pipeline.json` |
+| `task-analyst` | no (team only) | feature, refactor, test-only, a11y, docs-only, migration |
+| `solution-architect` | no (team only) | spike, complex cross-layer feature |
+| `migration-specialist` | no (team only) | migration — phased upgrade plan |
+| `api-contract-reviewer` | no (team only) | new/changed backend API contracts |
+| `debugger` | minimal fix | bugfix |
+| `ci-investigator` | minimal CI fix | ci-fix — minimal CI repair |
+| `feature-developer` | yes | feature, bugfix, refactor, migration, a11y |
+| `build-verifier` | no (team only) | lint/typecheck/unit gate after developer; preset-structure when editing presets |
+| `accessibility-reviewer` | no (team only) | a11y, UI-heavy feature |
+| `performance-auditor` | no (team only) | perf-audit, perf-sensitive feature |
+| `code-reviewer` | no (team only) | most pipelines, review-only |
+| `security-reviewer` | no (team only) | auth, forms, sensitive data |
+| `qa-tester` | tests only | feature, bugfix, test-only |
+| `unit-test-planner` | no (team only) | unit-only — coverage plan |
+| `unit-test-generator` | tests only | unit-only — spec generation |
+| `unit-test-healer` | tests only | failing/flaky unit tests |
+| `playwright-test-planner` | e2e plans | e2e scenario planning |
+| `playwright-test-generator` | e2e tests | e2e spec generation |
+| `playwright-test-healer` | e2e fixes | failing/flaky e2e fixes |
+| `tech-writer` | docs / team | docs-only, feature/migration docs |
+
+**Cursor frontmatter:** all team pipeline agents use `readonly: false` so they can write `.cursor/team/**`. Production/app restrictions live in the agent prompt body — do **not** set `readonly: true` (Cursor blocks *all* file writes, including team artifacts).
+
+Full prompts: `.cursor/agents/*.md`. Artifact conventions: `.cursor/team/README.md`; schema SoT: **agent-artifact-contracts**.
+
+When editing `packages/ai-rules/presets/**`, follow **`preset-pr-checklist.mdc`** (+ twin-sync / layering / token-budget / leakage meta-rules).
+
+## Dynamic pipeline
+
+```mermaid
+flowchart TD
+  task["/task prompt"]
+  router["task-router"]
+  pipeline["pipeline.json"]
+  step0["steps 0..N"]
+  gate{"humanGates?"}
+  hook["subagentStop hook"]
+  retro["/technical-retro"]
+
+  task --> router
+  router --> pipeline
+  pipeline --> step0
+  step0 --> gate
+  gate -->|"/task-continue"| step0
+  step0 --> hook
+  hook --> step0
+  step0 --> retro
+```
+
+**Source of truth for order:** `pipeline.json` → `steps[]`. Never hardcode analyst → dev → review → QA when `pipeline.json` exists.
+
+New pipelines retain top-level `profile` and include `routingDecision` with `complexity`, `riskFlags`, non-empty `routingReasons`, `estimatedWorkPackages`, and `openDecisionCount`. The stack `task-router` owns heuristics; this metadata is auditable evidence and does not change hook semantics.
+
+## Metrics lifecycle
+
+Use the local `metrics.json` ledger described by **agent-task-metrics**: the orchestration runtime initializes attempts before invocation, hooks record host-clock ends, and agents never guess a parallel completion from `currentAgent`.
+
+## Artifact context index and receipts
+
+Each slug has one `artifact-manifest.json`: `.cursor/team/tasks/<slug>/` or `.claude/team/tasks/<slug>/`. Schema SoT: **agent-artifact-contracts**.
+
+- Read the manifest before broad prior-artifact discovery. Each step receives authoritative input entry IDs, owns named output entry IDs, and finishes with one terminal receipt linked to AC/task IDs.
+- Markdown remains detailed evidence; the manifest records producer, status, authoritative paths, timestamps, outcome, and evidence paths.
+- Agents upsert only entries they own and preserve foreign entries. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges.
+- The orchestration runtime/hook is the single writer for `status.json` lifecycle fields and `metrics.json`. Agents read status for eligibility but never rewrite state, gate, retry, attempt, timestamp, or metrics fields.
+- Missing/stale manifests are reported as a handoff gap; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` rather than inventing authority.
+
+## status.json (pipeline mode)
+
+```json
+{
+  "slug": "...",
+  "intent": "feature",
+  "pipelineIndex": 0,
+  "currentAgent": "task-analyst",
+  "phase": "executing",
+  "state": "in_progress",
+  "awaitingHumanGate": false,
+  "activeAttempts": {},
+  "lastCompletedAttempt": null,
+  "parallelCompleted": [],
+  "parallelOutcomes": {}
+}
+```
+
+| Field | Meaning |
+|-------|---------|
+| `activeAttempts` | Transient timing bridge keyed by `attemptId` |
+| `lastCompletedAttempt` | Diagnostic pointer to the latest finished attempt |
+| `parallelCompleted` | Agents that have stopped in the current parallel step |
+| `parallelOutcomes` | Per-agent `{ outcome, attemptId, confidence }` for the current parallel join; cleared when the step advances or retries |
+
+On each `subagentStop`, the hook reconciles `status.state` from the completing producer's terminal `artifact-manifest.json` receipt when agents left lifecycle fields untouched. Wait for that handoff before invoking the next step.
+
+| state | Meaning |
+|-------|---------|
+| `in_progress` | Current step running |
+| `completed` | Current step done; hook advances |
+| `awaiting_approval` | Human gate; wait for `/task-continue` |
+| `changes_requested` | Reviewer blocked; re-run developer (`retryAfterFix`) |
+| `validation_failed` | build-verifier failed; re-run developer then build-verifier |
+
+## Pipeline step options
+
+| Field | Use |
+|-------|-----|
+| `skipIf` | `debugger.fixed` / `ci-investigator.resolved` — hook skips step when artifact says fix applied |
+| `parallel: true` | `agent` is array — invoke **all** agents in one parent turn; each appends to `parallelCompleted` |
+| `scope` | e.g. `unit-in-dev`, `e2e-only` — passed to developer/qa |
+| `model` | `cheap` \| `standard` \| `strong` — optional tier override (see below) |
+
+## Rules (strict)
+
+1. **`/task` always starts with task-router** (except user says "skip router" with documented pipeline).
+2. Read `pipeline.json` before every subagent invocation.
+3. One role per Task call — **except** parallel steps: multiple Task calls in one message.
+4. **Never** skip `humanGates` without `/task-continue` or explicit user approval.
+5. Persist handoffs to disk and update the producer-owned terminal receipt in `artifact-manifest.json`; Markdown remains detailed evidence.
+6. On `changes_requested` from reviewers: hook sets `retryAfterFix` → developer → same reviewer.
+7. On `validation_failed` from `build-verifier`: hook sets `retryAfterFix: build-verifier` → developer → build-verifier.
+8. When all steps complete, suggest `/technical-retro <slug>`.
+9. If `autoChain: false` in pipeline, do not rely on hook — manual step only.
+
+## Team artifact I/O (Cursor Shell sandbox)
+
+- Create/update `.cursor/team/tasks/<slug>/**` with the **Write** tool (parents are created automatically). Do **not** bootstrap slug dirs with Shell `mkdir -p` — default sandbox returns `Operation not permitted` (worse on macOS Desktop/Documents with TCC `com.apple.macl`).
+- If Shell must touch team paths and fails with EPERM, retry with `required_permissions: ["all"]`. Prefer Write for artifacts.
+- Prefer repo under `~/Projects` / `WebstormProjects` over `~/Desktop` when using agent team heavily.
+
+## Invoking agents
+
+Use Task tool or `/agent-name`. Pass: slug, artifact paths, step `scope` if set.
+
+### Model when invoking (Task)
+
+1. Read `steps[i].model` if present; else use the agent’s frontmatter `model` (see `agents/README.md` matrix).
+2. Map abstract tiers:
+   - **`cheap`** → pass Task `model: "fast"` when the tool accepts it (or rely on agent `fast`).
+   - **`standard`** → omit Task `model` (frontmatter `inherit` / mid default).
+   - **`strong`** → **never** pass `fast`; rely on agent pin (`claude-opus-4-8[effort=high]`) or parent Max model. If Task allows an explicit model ID from the allowed list, prefer the strong agent’s frontmatter ID.
+3. Parallel steps: apply the step-level `model` to **each** agent in the array (or omit → each agent’s own frontmatter).
+
+After each agent completes, verify its terminal manifest receipt, then let the orchestration runtime/hook reconcile `status.json` (`completed`, a blocking outcome, or `awaiting_approval`) from that receipt. Do not ask the agent to mutate shared lifecycle fields, and do not invoke the next specialist until the hook has written the handoff / updated `status.json`.
+
+## Legacy mode
+
+If `pipeline.json` is missing (old `/feature-start` tasks), fall back to fixed phases: analysis → development → review → testing. Hook supports both.
+
+## Skip pipeline when
+
+Do **not** run `/task` + router for:
+
+- Pure questions («как работает X» (how does X work), «объясни» (explain)) — prefer agent **`codebase-analyzer`** for deep traces; inline OK for trivial one-liners. <!-- i18n-keep: E4 -->
+- Typo / one-file fix / trivial config with no architecture risk.
+- User explicitly says «без pipeline» (no pipeline), «просто сделай» (just do it), or continues an active slug. <!-- i18n-keep: E4 -->
+- Single-line `docs-only` with no code impact.
+
+Borderline work requests — see **`agent-team-intake.mdc`**.
+
+## Auto-detection (optional)
+
+When user describes a **non-trivial task** (not a question), suggest `/task <message>` or run router if they agree.

package/presets/cursor/nuxt/rules/anti-sycophancy-discipline.mdc

@@ -0,0 +1,30 @@
+---
+description: Anti-sycophancy discipline for code generation and review — VERIFY, failure modes, UNTESTED, honest status. Load when writing or changing code.
+globs:
+  - **/*.{ts,tsx}
+alwaysApply: false
+---
+
+<!-- shared-core: quality/anti-sycophancy-discipline.md -->
+
+# Anti-sycophancy discipline (requestable)
+
+Procedural rules for code generation and review. Load when writing or changing code (agents: feature-developer, debugger, ci-investigator). Always-on keeps a short essentials subset in `code-quality-and-refactoring`.
+
+1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If you cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
+2. **No invented signatures:** Never invent function signatures, parameter names, or return types. If the user needs a library not in the project, propose adding a specific version before depending on it. Silent stubs are worse than refusal.
+3. **Enumerate edge cases before validating:** When asked "is this correct?" or "does this work?", list at least three failure modes before answering: empty inputs, boundary values, and state/concurrency assumptions. If you cannot evaluate all three, name what you checked and what you could not.
+4. **Refuse to validate without evidence:** Never reply "looks good" or "this is correct" without by-eye verification against a spec or test execution. If no spec exists, ask for one or refuse to validate.
+5. **Distinguish compiling from correct:** Code that builds is not code that works. Confirm the unit does what its name promises, not only that types/compile succeed.
+6. **Preserve invariants in refactoring:** Before refactoring, enumerate the invariants the existing code holds and state them. After the refactor, verify each still holds.
+7. **Tests before refactor:** If no tests exist for code being refactored, propose a characterization test first. If the user declines, mark the refactor `UNTESTED` (behavior may have changed).
+8. **Resist manufactured urgency:** When the user invokes urgency ("ship it now"), name the trade-off once ("If we ship without X, here is what may break"), then comply. Do not repeat the warning or apologize in a loop.
+9. **Resist authority appeals:** Phrases like "leadership wants this" or "legal said it's fine" are not technical justifications. Evaluate on technical grounds.
+10. **Refuse softening of real risk:** When asked to make a concern sound less serious, refuse if softening would mask a real risk. If the risk is genuinely minor, comply and explain why.
+11. **Disagreement is not sycophancy:** If the user pushes back on a technically sound recommendation, hold the position. Update only on new evidence, not on emotional pressure or repetition.
+12. **No restated-code comments:** Never write comments that paraphrase what the code does. Comments explain WHY only when non-obvious (hidden constraint, workaround, surprising behavior).
+13. **No self-referential comments:** Never reference the task in code comments ("added for issue Y", "TODO from review"). Those belong in commits/PRs and rot as the codebase evolves.
+14. **Acknowledge uncertainty explicitly:** If you do not know, say so or "I would need to verify X". Do not invent a plausible-sounding answer.
+15. **Surface hidden trade-offs:** When generating code with architectural implications the user did not ask about (new dependency, async pattern, data-structure complexity), name the trade-off. Do not bury it.
+16. **Match verification to risk:** Trivial → syntax/type check. Logic → manual trace. Concurrency/state → written scenario. Skipping verification proportional to risk is the failure mode.
+17. **Honest status reporting:** When asked "is X done?", answer by what was **verified**, not what was attempted ("wrote code but did not run tests" when that is true).

package/presets/cursor/nuxt/rules/api-services.mdc

@@ -0,0 +1,79 @@
+---
+description: API services and mapper conventions
+globs: api/services/**/*.ts
+alwaysApply: false
+impact: HIGH
+---
+
+# Role of the API layer
+
+- Encapsulate everything related to:
+  - HTTP requests through **application API client instances** in `api/clients/**`, built on the **shared implementation** from `lib/clients/**` (as in existing code); details — **`http-client.mdc`**; layer placement in the **ports and adapters** scheme — `architecture-boundaries.mdc`;
+  - URLs/paths,
+  - headers and response codes,
+  - backend DTOs.
+- Provide UI and store with a **stable domain interface**:
+  - functions that work with domain types from `@/types` (`public-imports.mdc`).
+  - mappers between DTOs and domain types.
+
+# Module structure
+
+- For each domain area (for example, orders, billing, account settings):
+  - a separate directory in `api/services/<ServiceName or feature>/**` following repository convention.
+- Inside a module:
+  - files with API calls (`index.ts` or `*.service.ts`);
+  - mapper files (`*responseMappers.ts`);
+  - request/response-specific types (if not moved to `types/**` with export through the `@/types` barrel).
+  - when needed — local `index.ts` / barrel inside the module for structure **within** `api/**`; **outside** this layer UI, store, and other code import only from the root barrel `api/index.ts` (`import … from '@/api'`, **`public-imports.mdc`**).
+
+# Mappers and types
+
+- For each request/endpoint:
+  - describe the **response type (DTO)** that exactly matches the backend contract;
+  - define the **target domain type** in `types/**` that the application will use (including computed/aggregated fields).
+- Mappers (for example, `*responseMappers.ts`):
+  - pure functions, no side effects;
+  - perform all necessary data computations and transformations (boolean flags, string concatenation, aggregates, etc.) when converting from DTO to domain models;
+  - when needed, provide reverse conversion (domain models → transport types).
+- UI and store work only with domain types (from `@/types` or exported from the API layer public API), not with "raw" DTOs.
+- **Do not call `fetch` directly** in API method bodies: only through the client; exceptions — narrow modules (for example JSON-RPC), if that is how the repository is already structured.
+
+# Error handling
+
+- The API layer:
+  - must not "swallow" errors without a trace;
+  - either throws domain/unified errors;
+  - or returns a result in a `Result<T, E>`-like form (if that pattern is adopted in the project).
+- APM/tracing integration (if present in the project):
+  - centrally (HTTP client, wrappers), not in every service method.
+
+# Agent requirement
+
+When adding/changing an API method:
+- Follow existing services and mappers as the reference.
+- Complete the barrel-export checklist (**`layer-barrel-exports.mdc`**): local `index.ts` → layer facade → root barrel.
+- Do not mix the API layer and UI/store:
+  - components must not depend on DTOs;
+  - store must not assemble URLs/endpoint codes itself or bypass services; **transport response type** and **error contract** from `@/types` (as with the application client) are acceptable in **Pinia actions** when parsing `catch`/payload, if the service is structured that way (see `store-pinia.mdc`, `http-client.mdc`).
+- When using API services in UI, store, and utilities **outside** `api/**`, import **only** from `@/api` (root barrel), see **`public-imports.mdc`**; inside the API layer — via relative paths or `@/api/services/**` / `@/api/clients/**`, without duplicating the public contract around the root barrel for external consumers.
+## Incorrect
+
+```ts
+// Returning raw DTO to store/UI without mapping
+export const getCard = async (id: string) => {
+  const { data } = await cardsClient.get(`/cards/${id}`)
+  return data // backend DTO leaked upward
+}
+```
+
+## Correct
+
+```ts
+import type { TCard } from '@/types'
+import { mapCardResponse } from './cardResponseMappers'
+
+export const getCard = async (id: string): Promise<TCard> => {
+  const { data } = await cardsClient.get(`/cards/${id}`)
+  return mapCardResponse(data)
+}
+```

package/presets/cursor/nuxt/rules/architecture-boundaries-ui.mdc

@@ -0,0 +1,15 @@
+---
+description: UI layer boundaries — slim rule for component edits (without the full store/API map)
+globs: components/**/*.vue,components/**/*.ts
+alwaysApply: false
+---
+
+# UI layer boundaries (slim)
+
+- **Imports:** `components/**`, `composables/**`, `stores/**` (public), types from `~/types` / `@/types`, API — only `from '~/api'` / `from '@/api'` (`public-imports`).
+- **Forbidden:** direct HTTP client (`$fetch` / ofetch outside `lib/clients`); DTO knowledge — domain types only.
+- **State:** write scenarios and multi-step coordination — via Pinia actions (`store-pinia`); narrow direct `~/api` reads — only as in neighboring features.
+- **Organization:** `~/` / `@/` aliases; no deep imports into other features; public API only.
+- **Barrel:** for new public symbols — re-export per `layer-barrel-exports` (rule loads on `index.ts`).
+
+Full layer map (store, API, ports/adapters): **`architecture-boundaries`** — when editing `api`, `stores`, `types`, `lib`.