@bonesofspring/ai-rules 0.2.14 → 0.2.16

package/presets/cursor/android-kotlin/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **android-kotlin** — recipes must stay stack-safe (no cross-stack lint/test commands).

package/presets/cursor/android-kotlin/hooks/examples/format-edited.example.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Optional cookbook: ktlint / detekt on edited Kotlin files.
+# NOT wired in default hooks.json — copy into a custom hook if desired.
+
+set -euo pipefail
+
+if command -v ktlint >/dev/null 2>&1; then
+  git diff --name-only --diff-filter=ACMR HEAD 2>/dev/null | grep -E '\.(kt|kts)$' | while read -r f; do
+    [[ -f "$f" ]] && ktlint -F "$f" || true
+  done
+fi
+
+# detekt — only if the repo already configures it; do not invent a gate here.

package/presets/cursor/android-kotlin/hooks/examples/secret-guard.example.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Optional cookbook: block committing likely secrets in staged diffs.
+# NOT wired in default hooks.json — copy to hooks/ and register manually.
+set -euo pipefail
+PATTERN='(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----|api[_-]?key\s*[:=]\s*['\''\"][^'\''\"]{12,})'
+if git diff --cached -U0 2>/dev/null | grep -Eiq "$PATTERN"; then
+  echo "secret-guard: possible secret in staged diff — review before commit" >&2
+  exit 1
+fi
+exit 0

package/presets/cursor/android-kotlin/hooks/examples/test-on-save.example.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Optional: ./gradlew test slice for the active scheme (adjust SCHEME/DEST).
+# NOT in default hooks.json. No Playwright / yarn lint.
+set -euo pipefail
+SCHEME="${XCODE_SCHEME:-App}"
+DEST="${XCODE_DESTINATION:-platform=Android Simulator,name=iPhone 16}"
+./gradlew test -scheme "$SCHEME" -destination "$DEST" -quiet 2>/dev/null || true
+exit 0

package/presets/cursor/android-kotlin/hooks/guard-shell-command.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Lightweight shell guard for Android Kotlin preset projects.
+# Android: do NOT blanket-block mvn test / ./gradlew test / compiler/IDE inspections / configured static analysis / repo static analysis.
+# Package-manager mismatch checks apply only when a JS lockfile/package.json exists.
+
+set -euo pipefail
+# ANDROID_PRESET_GUARD: allow ./gradlew compile/test; no Playwright/XCUITest assumptions
+
+input=$(cat)
+
+INPUT="$input" node <<'NODE'
+const fs = require('fs');
+
+const raw = process.env.INPUT || '';
+let event;
+try {
+  event = JSON.parse(raw);
+} catch {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const command = String(event.command || event.input?.command || '');
+if (!command.trim()) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+function out(permission, userMessage, agentMessage) {
+  process.stdout.write(JSON.stringify({
+    permission,
+    user_message: userMessage,
+    agent_message: agentMessage || userMessage,
+  }));
+}
+
+const dangerousGit = /\bgit\s+(reset\s+--hard|clean\s+-[^\n]*f|push\s+--force|push\s+-f|checkout\s+--\s+)/;
+if (dangerousGit.test(command)) {
+  out(
+    'ask',
+    'This command looks destructive for git state. Review it before continuing.',
+    'A project hook flagged a destructive git command. Ask the user before running it.',
+  );
+  process.exit(0);
+}
+
+const managerByFile = [
+  ['yarn.lock', 'yarn'],
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['package-lock.json', 'npm'],
+].find(([file]) => fs.existsSync(file));
+
+let expected = managerByFile?.[1];
+if (!expected && fs.existsSync('package.json')) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+    const pm = typeof pkg.packageManager === 'string' ? pkg.packageManager : '';
+    expected = pm.split('@')[0] || undefined;
+  } catch {
+    // Ignore invalid package.json in the hook; the agent can diagnose it later.
+  }
+}
+
+if (!expected) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const used = command.match(/(^|[;&|]\s*)(npm|yarn|pnpm)\s+/)?.[2];
+if (used && used !== expected) {
+  out(
+    'ask',
+    `This repository appears to use ${expected}, but the command uses ${used}. Confirm before continuing.`,
+    `Use ${expected} for package scripts and installs unless the user explicitly approves ${used}.`,
+  );
+  process.exit(0);
+}
+
+process.stdout.write('{ "permission": "allow" }');
+NODE

package/presets/cursor/android-kotlin/hooks.json

@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "hooks": {
+    "beforeShellExecution": [
+      {
+        "command": ".cursor/hooks/guard-shell-command.sh",
+        "failClosed": true
+      }
+    ],
+    "subagentStop": [
+      {
+        "command": ".cursor/hooks/chain-team-phases.sh",
+        "loop_limit": 15
+      }
+    ]
+  }
+}

package/presets/cursor/android-kotlin/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": ["-y", "@upstash/context7-mcp"]
+    },
+    "figma": {
+      "url": "https://mcp.figma.com/mcp"
+    }
+  }
+}

package/presets/cursor/android-kotlin/rules/README.md

@@ -0,0 +1,61 @@
+# `.cursor/rules` (preset android-kotlin)
+
+Flat Cursor SoT. Claude twins live under `presets/claude/android-kotlin/rules/<topic>/`.
+
+## Loading strategy
+
+| Kind | Mechanism | Budget |
+|------|-----------|--------|
+| Always-on trio | `alwaysApply: true` | exactly **3**; bodies ≤140 lines combined |
+| Domain | `globs` / requestable | not always-on |
+| Meta `preset-*` | globs `packages/ai-rules/presets/**` | never always-on |
+
+## Always-on
+
+| Stem | Role |
+|------|------|
+| `android-app-core.mdc` | Stack + placeholder multimodule layout |
+| `architecture-boundaries.mdc` | CA + api/impl + DI summary (no Hilt by default) |
+| `code-quality-and-refactoring.mdc` | Quality (shared-core embed) + Kotlin Stack notes |
+
+## Domain catalog
+
+| Stem | Trigger | Notes |
+|------|---------|-------|
+| `kotlin-conventions.mdc` | `**/*.{kt,kts}` | Null-safety, coroutines |
+| `feature-delivery-workflow.mdc` | requestable | Feature checklist |
+| `reference-features.mdc` | `features/**` | Placeholder path table |
+| `module-public-api.mdc` | `**/api/**` | Public contracts |
+| `di-dagger-feature-holders.mdc` | `**/di/**`, holders/components | No Hilt by default |
+| `networking-data.mdc` | data/network | DTO→domain |
+| `persistence-data.mdc` | local/database | Persistence |
+| `compose-ui.mdc` | presentation/ui | Compose Material 3 + design-system |
+| `state-and-viewmodels.mdc` | `*ViewModel*` | MVI/UDF |
+| `navigation-feature-launcher.mdc` | navigation/launchers | Cross-feature ports |
+| `tests-unit.mdc` | `**/test/**` | JVM unit |
+| `tests-ui.mdc` | `**/androidTest/**` | Instrumentation (+ `instrumentation-test-*`) |
+| `gradle-tooling.mdc` | kt/kts/catalog/wrapper | Discovery |
+| `post-change-build.mdc` | requestable | Required after edits |
+| `security-android.mdc` | security/network | Secrets/TLS |
+| `design-guidance.mdc` | requestable | Smells/GoF |
+| `anti-sycophancy-discipline.mdc` | requestable | VERIFY discipline |
+| `code-review-mr.mdc` | requestable | MR checklist |
+| `agent-team-intake.mdc` | requestable | thin `/task` hint |
+| `agent-team-orchestrator.mdc` | requestable | Pipeline |
+| `technical-retro.mdc` | requestable | thin retro alias |
+| `preset-*.mdc` (×5) | author globs | Meta only |
+
+## Core → stack mapping
+
+| Shared core | Cursor adapter | Notes |
+|-------------|----------------|-------|
+| `quality/code-quality-and-refactoring.md` | `code-quality-and-refactoring.mdc` | Stack notes: Kotlin / Gradle gate |
+| `quality/anti-sycophancy-discipline.md` | `anti-sycophancy-discipline.mdc` | requestable |
+| `quality/design-guidance.md` | `design-guidance.mdc` | requestable |
+| `agent-team/agent-team-orchestrator.md` | `agent-team-orchestrator.mdc` | instrumentation roles in Stack notes |
+| `agent-team/agent-team-intake.md` | `agent-team-intake.mdc` | thin alias |
+| `architecture/feature-delivery-workflow.md` | `feature-delivery-workflow.mdc` | Android checklist |
+| `architecture/reference-features.template.md` | `reference-features.mdc` | placeholders |
+| `review/code-review-mr.md` | `code-review-mr.mdc` | Android checklist |
+| `review/technical-retro.md` | `technical-retro.mdc` | thin alias |
+| `meta/preset-*.md` | `preset-*.mdc` | author globs only |

package/presets/cursor/android-kotlin/rules/agent-team-intake.mdc

@@ -0,0 +1,16 @@
+---
+description: Use when user posts a work request without /task — suggest or use /task to run the agent team router. Lightweight intake hint only.
+alwaysApply: false
+---
+
+<!-- shared-core: agent-team/agent-team-intake.md -->
+
+# Agent team intake
+
+When the user message looks like a **work request** (implement, add, fix, refactor, review MR, write tests, spike) — not a question about how code works:
+
+1. Prefer **`/task <their request>`** or invoke **task-router** first.
+2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
+3. Pure questions (“how does X work”, “explain”) — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
+
+Exceptions: user explicitly says “no pipeline”, “just do it”, or continues an active slug.

package/presets/cursor/android-kotlin/rules/agent-team-orchestrator.mdc

@@ -0,0 +1,124 @@
+---
+description: Orchestrates the agent team via task-router and pipeline.json. Use for /task, /task-continue, /feature-start, task decomposition, or when the user describes a feature, bug, or review request.
+alwaysApply: false
+---
+
+<!-- shared-core: agent-team/agent-team-orchestrator.md -->
+
+# Agent team orchestrator
+
+Parent agent = **manager**. Router plans; specialists execute. Artifacts: `.cursor/team/tasks/<slug>/`.
+
+Work request without `/task` — see **`agent-team-intake.mdc`**.
+
+## Entry points
+
+| Command | When |
+|---------|------|
+| **`/task <desc>`** | **Preferred** — router → dynamic pipeline → first agent |
+| `/task-continue <slug>` | After human gate or pause |
+| `/feature-start <desc>` | Legacy: analyst-only start (no router) |
+| `/feature-continue <slug>` | Alias of task-continue |
+| `/technical-retro [slug]` | Retro with agent team block |
+
+## Stack notes
+
+### Roles (Android)
+
+| Agent | Prod writes | Typical intent |
+|-------|-------------|----------------|
+| `task-router` | no (team) | Every `/task` |
+| `task-analyst` | no | feature, refactor, test-only, a11y, docs, migration |
+| `solution-architect` | no | spike, cross-layer Feature |
+| `migration-specialist` | no | Android Studio / AGP/Gradle modules/Android upgrades |
+| `api-contract-reviewer` | no | OpenAPI / Kotlin codegen contracts |
+| `debugger` | minimal | bugfix |
+| `ci-investigator` | minimal CI | ci-fix |
+| `feature-developer` | yes | feature, bugfix, refactor, migration, a11y |
+| `build-verifier` | no | ./gradlew + ktlint/detekt/Format + unit smoke; preset-structure for preset PRs |
+| `accessibility-reviewer` | no | TalkBack / font scale / semantics |
+| `performance-auditor` | no | launch / Profiler / Macrobenchmark |
+| `code-reviewer` | no | most pipelines, review-only |
+| `security-reviewer` | no | Android Keystore / encrypted storage, network security / cleartext, PII |
+| `qa-tester` | tests | feature, bugfix, test-only |
+| `unit-test-planner` / `generator` / `healer` | tests | unit-only |
+| `instrumentation-test-planner` / `generator` / `healer` | UI tests | e2e-only (Android instrumentation) |
+| `tech-writer` | docs | docs-only |
+
+**Never use Playwright stems** in this preset — substitute Android instrumentation trio. Document Playwright skips when copying next templates.
+
+**Cursor frontmatter:** all team agents use `readonly: false` (team writes). Production restrictions live in prompt bodies.
+
+Full prompts: `.cursor/agents/*.md`. Artifact conventions: `.cursor/team/README.md`; schema SoT: **agent-artifact-contracts**.
+
+When editing `packages/ai-rules/presets/**`, follow **`preset-pr-checklist.mdc`** (+ twin-sync / layering / token-budget / leakage meta-rules).
+
+## Dynamic pipeline
+
+**Source of truth for order:** `pipeline.json` → `steps[]`. Never hardcode analyst → dev → review → QA when `pipeline.json` exists.
+
+New pipelines retain top-level `profile` and include `routingDecision` with `complexity`, `riskFlags`, non-empty `routingReasons`, `estimatedWorkPackages`, and `openDecisionCount`. The stack `task-router` owns heuristics; this metadata is auditable evidence and does not change hook semantics.
+
+## Metrics lifecycle
+
+Use the local `metrics.json` ledger described by **agent-task-metrics**: the orchestration runtime initializes attempts before invocation, hooks record host-clock ends, and agents never guess a parallel completion from `currentAgent`.
+
+## Artifact context index and receipts
+
+Each slug has one `artifact-manifest.json`: `.cursor/team/tasks/<slug>/` or `.claude/team/tasks/<slug>/`. Schema SoT: **agent-artifact-contracts**.
+
+- Read the manifest before broad prior-artifact discovery. Each step receives authoritative input entry IDs, owns named output entry IDs, and finishes with one terminal receipt linked to AC/task IDs.
+- Markdown remains detailed evidence; the manifest records producer, status, authoritative paths, timestamps, outcome, and evidence paths.
+- Agents upsert only entries they own and preserve foreign entries. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges.
+- The orchestration runtime/hook is the single writer for `status.json` lifecycle fields and `metrics.json`. Agents read status for eligibility but never rewrite state, gate, retry, attempt, timestamp, or metrics fields.
+- Missing/stale manifests are reported as a handoff gap; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` rather than inventing authority.
+
+## status.json (pipeline mode)
+
+| Field | Meaning |
+|-------|---------|
+| `activeAttempts` | Transient timing bridge keyed by `attemptId` |
+| `lastCompletedAttempt` | Diagnostic pointer to the latest finished attempt |
+| `parallelCompleted` | Agents that have stopped in the current parallel step |
+| `parallelOutcomes` | Per-agent `{ outcome, attemptId, confidence }` for the current parallel join; cleared when the step advances or retries |
+
+On each `subagentStop`, the hook reconciles `status.state` from the completing producer's terminal `artifact-manifest.json` receipt when agents left lifecycle fields untouched. Wait for that handoff before invoking the next step.
+
+| state | Meaning |
+|-------|---------|
+| `in_progress` | Current step running |
+| `completed` | Current step done; hook advances |
+| `awaiting_approval` | Human gate; wait for `/task-continue` |
+| `changes_requested` | Reviewer blocked; re-run developer |
+| `validation_failed` | build-verifier failed; re-run developer then verifier |
+
+## Rules (strict)
+
+1. **`/task` always starts with task-router** (unless user skips with documented pipeline).
+2. Read `pipeline.json` before every subagent invocation.
+3. One role per Task call — except parallel steps.
+4. **Never** skip `humanGates` without `/task-continue` or explicit approval.
+5. Persist handoffs to disk under `.cursor/team/tasks/<slug>/` via **Write** (not Shell `mkdir`).
+6. On `changes_requested`: developer → same reviewer.
+7. On `validation_failed`: developer → build-verifier.
+8. When all steps complete, suggest `/technical-retro <slug>`.
+9. If `autoChain: false`, do not rely on hook.
+
+## Model when invoking (Task)
+
+Honor optional `steps[i].model` (`cheap` \| `standard` \| `strong`); else agent frontmatter (matrix in `agents/README.md`).
+
+- `cheap` → Task `model: "fast"` when accepted.
+- `standard` → omit Task model.
+- `strong` → never pass `fast`; use agent pin `claude-opus-4-8[effort=high]` / parent Max.
+
+## Team artifact I/O (Cursor Shell sandbox)
+
+- Create/update `.cursor/team/tasks/<slug>/**` with the **Write** tool. Do **not** bootstrap slug dirs with Shell `mkdir -p` — sandbox → `Operation not permitted` (esp. macOS Desktop/Documents + TCC).
+- If Shell must touch team paths and fails with EPERM, retry with `required_permissions: ["all"]`.
+
+## Skip pipeline when
+
+- Pure questions (“how does X work?”) — prefer **`codebase-analyzer`**; typo / one-file trivial fix; user “no pipeline”; single-line docs-only.
+
+Borderline — **`agent-team-intake.mdc`**.

package/presets/cursor/android-kotlin/rules/android-app-core.mdc

@@ -0,0 +1,28 @@
+---
+description: Core principles, stack, and structure for an Android Kotlin multimodule app (preset)
+alwaysApply: true
+---
+
+# Stack and environment
+
+Versions come **from the consumer repo** (`gradle/libs.versions.toml`, AGP, Kotlin plugin, CI). Frame: Kotlin, Android Gradle Plugin; Jetpack Compose Material 3 + project design-system preferred; coroutines/Flow; product flavors/variants as configured; JVM unit tests + `androidTest` instrumentation; networking/persistence — as already chosen in the repo.
+
+# Project structure (placeholders)
+
+```text
+applications/                 # app shells / product entry modules
+core/                         # shared kernels / design-system host
+features/<name>/
+  api/                        # public contracts, navigation ports
+  impl/                       # data / domain / presentation / di
+build-logic/                  # convention plugins (includeBuild)
+gradle/libs.versions.toml
+gradlew | documented wrapper
+```
+
+Place new files next to analogs. Boundaries/DI — **`architecture-boundaries`**. Tooling — **`gradle-tooling`**. After Kotlin/Android edits — **invoke** **`post-change-build`**.
+
+# Agent work
+
+- Features: `feature-delivery-workflow`; UI tests: `instrumentation-ui-e2e` + `instrumentation-test-*`.
+- Local type names (ViewModel base, DI holders, design-system package) — consumer `team/conventions.md` only.

package/presets/cursor/android-kotlin/rules/anti-sycophancy-discipline.mdc

@@ -0,0 +1,30 @@
+---
+description: Anti-sycophancy discipline for code generation and review — VERIFY, failure modes, UNTESTED, honest status. Load when writing or changing code.
+globs:
+  - "**/*.swift"
+alwaysApply: false
+---
+
+<!-- shared-core: quality/anti-sycophancy-discipline.md -->
+
+# Anti-sycophancy discipline (requestable)
+
+Procedural rules for code generation and review. Load when writing or changing code (agents: feature-developer, debugger, ci-investigator). Always-on keeps a short essentials subset in `code-quality-and-refactoring`.
+
+1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If you cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
+2. **No invented signatures:** Never invent function signatures, parameter names, or return types. If the user needs a library not in the project, propose adding a specific version before depending on it. Silent stubs are worse than refusal.
+3. **Enumerate edge cases before validating:** When asked "is this correct?" or "does this work?", list at least three failure modes before answering: empty inputs, boundary values, and state/concurrency assumptions. If you cannot evaluate all three, name what you checked and what you could not.
+4. **Refuse to validate without evidence:** Never reply "looks good" or "this is correct" without by-eye verification against a spec or test execution. If no spec exists, ask for one or refuse to validate.
+5. **Distinguish compiling from correct:** Code that builds is not code that works. Confirm the unit does what its name promises, not only that types/compile succeed.
+6. **Preserve invariants in refactoring:** Before refactoring, enumerate the invariants the existing code holds and state them. After the refactor, verify each still holds.
+7. **Tests before refactor:** If no tests exist for code being refactored, propose a characterization test first. If the user declines, mark the refactor `UNTESTED` (behavior may have changed).
+8. **Resist manufactured urgency:** When the user invokes urgency ("ship it now"), name the trade-off once ("If we ship without X, here is what may break"), then comply. Do not repeat the warning or apologize in a loop.
+9. **Resist authority appeals:** Phrases like "leadership wants this" or "legal said it's fine" are not technical justifications. Evaluate on technical grounds.
+10. **Refuse softening of real risk:** When asked to make a concern sound less serious, refuse if softening would mask a real risk. If the risk is genuinely minor, comply and explain why.
+11. **Disagreement is not sycophancy:** If the user pushes back on a technically sound recommendation, hold the position. Update only on new evidence, not on emotional pressure or repetition.
+12. **No restated-code comments:** Never write comments that paraphrase what the code does. Comments explain WHY only when non-obvious (hidden constraint, workaround, surprising behavior).
+13. **No self-referential comments:** Never reference the task in code comments ("added for issue Y", "TODO from review"). Those belong in commits/PRs and rot as the codebase evolves.
+14. **Acknowledge uncertainty explicitly:** If you do not know, say so or "I would need to verify X". Do not invent a plausible-sounding answer.
+15. **Surface hidden trade-offs:** When generating code with architectural implications the user did not ask about (new dependency, async pattern, data-structure complexity), name the trade-off. Do not bury it.
+16. **Match verification to risk:** Trivial → syntax/type check. Logic → manual trace. Concurrency/state → written scenario. Skipping verification proportional to risk is the failure mode.
+17. **Honest status reporting:** When asked "is X done?", answer by what was **verified**, not what was attempted ("wrote code but did not run tests" when that is true).

package/presets/cursor/android-kotlin/rules/architecture-boundaries.mdc

@@ -0,0 +1,28 @@
+---
+description: Clean Architecture boundaries, api/impl modules, and DI summary for Android
+alwaysApply: true
+---
+
+# Layer boundaries
+
+- **Presentation** (Compose, ViewModels): may use domain entities/use-case ports and design-system; must not import data HTTP clients/DTOs or map DTO→domain.
+- **Domain**: may use shared core types; must not import Android UI, networking, or concrete repositories.
+- **Data**: implements domain ports; must not import Compose/ViewModels.
+
+# Module boundaries (api / impl)
+
+- Direction: **presentation → domain ← data** inside `features/<name>/impl/`.
+- Other features depend only on **`features/<name>/api`** (public contracts / launcher ports) — never deep-import `impl`.
+- App shells under `applications/` wire graphs; navigation across features via public launcher-style ports.
+- Shared kernels live under `core/` — do not put feature business rules there.
+
+# DI summary
+
+- Feature-scoped **Dagger** holders/components (see `di-dagger-feature-holders`).
+- **No Hilt by default** unless the consumer repo already standardized on it.
+- ViewModels receive ports/use cases, not concrete data types.
+
+# Agent requirement
+
+- Place files in matching layers/modules; do not short-circuit api/impl for speed.
+- Load `module-public-api` and `navigation-feature-launcher` when editing public contracts.

package/presets/cursor/android-kotlin/rules/code-quality-and-refactoring.mdc

@@ -0,0 +1,53 @@
+---
+description: Maintain and improve Android Kotlin code quality and architecture
+alwaysApply: true
+---
+
+<!-- shared-core: quality/code-quality-and-refactoring.md -->
+
+# Match existing style
+
+- Follow existing patterns (names, structure, typing / DI / error handling); avoid drive-by formatting or renames.
+- Before a new solution: find an analog and **repeat the approach**; check the design system / UI packages; go only through the **public API** (deep imports are a reason to refactor).
+
+# Principles
+
+- **KISS:** the simplest change in the repository’s patterns.
+- **DRY + Rule of Three:** share only after the 3rd repetition (wrong abstraction costs more than duplication).
+- **YAGNI:** no APIs, flags, or “for later” layers without a current requirement.
+- **SOLID:** S — one reason to change; O — composition/new implementations; L — subtype contract; I — narrow ports; D — abstractions (ports), details in stack adapters.
+- **CUPID:** Composable; Unix philosophy (one responsibility); Predictable; Idiomatic (repo); Domain-based.
+- **Composition over inheritance;** Law of Demeter — no `a.b.c.d` chains; via public API / facade.
+
+# Refactoring during changes
+
+- Light refactor is OK if it reduces duplication, improves readability, and does not break public contracts.
+- Examples: shared utility/hook/mapper/use case; narrow unsafe types; split a large module; tokens instead of “magic”; deep import → public API.
+- Do not do a “big” refactor on a point task (structure/public names without a request). Break large work into minimal steps; keep the repo buildable after each step.
+
+# Agent requirement
+
+- **Boy scout:** leave the module a bit better; do not sacrifice architecture and layers for brevity.
+
+## Agent discipline (anti-sycophancy)
+
+Essentials below. Full procedural set (~17 rules) → load **`anti-sycophancy-discipline`**.
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent); never invent signatures.
+- Before "is this correct?" — ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose characterization test; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential "added for issue Y".
+- Urgency/authority: name the trade-off once, then comply — no apology loops.
+- Match verification to risk; report by what was **verified**, not attempted.
+
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**.
+
+> Stack-specific lint gates, examples, and toolchain — in the preset adapter **Stack notes** section.
+
+## Stack notes
+
+- Before adding a new UI control, check the project design-system and existing Compose components.
+- Public API: `features/<name>/api` contracts and launcher ports — not deep `impl` imports.
+- Acceptable examples: shared mapper/validation; replace `!!`; split an overloaded ViewModel; design tokens instead of magic colors; remove UI→data short-circuits.
+- Post-change gate: **`post-change-build`** + **`gradle-tooling`** (not yarn `lint:js`/`lint:css`).
+- Style: **ktlint / detekt / Android Lint** only when the repo/CI already configures them.

package/presets/cursor/android-kotlin/rules/code-review-mr.mdc

@@ -0,0 +1,84 @@
+---
+description: Code review requirements for Android merge requests. Use when reviewing MR/diff/PR, evaluating a branch, or when the user asks for code review.
+alwaysApply: false
+---
+
+<!-- shared-core: review/code-review-mr.md -->
+
+# Code review merge requests
+
+On-demand rule for review flows. **Procedure and output format:** skill `code-review`.
+
+## When to load
+
+- User asks for review/MR/diff
+- Pipeline step `code-reviewer`
+- Platform automated review (e.g. BUGBOT) when present
+
+## Checklist references (abstract)
+
+- Architecture layers and stack core rules
+- Public imports / module boundaries
+- UI conventions of the stack
+- Unit and e2e/UI test conventions
+- Post-change lint/build gate before final report
+- Design smells **in MR diff scope** — load `design-guidance`; do not expand the full Fowler catalog outside the diff
+- Pattern name (GoF) — only if the repository already uses that shape or the match is minimal
+- Principles (KISS / DRY+Ro3 / YAGNI / SOLID / CUPID) — via always-on `code-quality-and-refactoring`, do not duplicate the essay in review
+
+Concrete rule stems — in **Stack notes**.
+
+## Constraints
+
+- Focus on MR diff, not the whole repo.
+- Use local `git diff` — do not invent hosting metadata.
+- Boy scout rule: suggest fixes feasible within the MR scope.
+- No “big refactors” without an explicit request (`code-quality-and-refactoring`).
+
+## Output contract
+
+Procedure details live in skill `code-review`. Required shape:
+
+- Each finding cites **`path:line`**, the problem, impact, and a concrete fix direction.
+- Rank by severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding file context.
+- End with a verdict on its own line: **`Safe to merge | needs changes | reject`**.
+
+## Stack notes
+
+On-demand rule for review flows (not always-on).
+
+- **When to apply**
+  - Requests: “review this”, “evaluate the MR/branch/diff”, “look at the changes”.
+  - Rely on the local repository: branch, `git diff`, open files.
+
+- **What the agent must check**
+  - **Architecture and layers** (`architecture-boundaries.mdc`, `android-app-core.mdc`):
+    - View does not call APIs and does not know DTOs.
+    - ViewModel does not depend on Data implementations directly.
+    - Domain does not import Jetpack Compose/Android View system.
+    - Data does not pull Presentation.
+  - **Dependencies and modules**:
+    - DI via protocols; composition / holders in `applications/` + feature DI.
+    - No deep-import between features.
+    - Files in the correct layers (`presentation`, `domain`, `data`, design-system / `api`/`impl`).
+  - **Kotlin and concurrency** (`kotlin-conventions.mdc`):
+    - `main-safe / viewModelScope` on UI; no unjustified `!!`s.
+    - Typed errors; structured concurrency / cancellation where needed.
+  - **UI** (`compose-ui.mdc`):
+    - Thin Views; Design System tokens; semantics / content descriptions for testable elements.
+  - **Networking and data** (`networking-data.mdc`):
+    - DTOs separated from domain; mappers cover edge cases.
+  - **Tests**:
+    - Non-trivial logic — unit (`tests-unit.mdc`); user flows — UI (`tests-ui.mdc`).
+    - State which tests to add or update.
+
+- **Depth and format**
+  - Focus on the **MR diff**, not the whole project.
+  - Overview first (MR goal, risks), then concrete comments with file and a fix suggestion matching repo patterns.
+  - No “big refactors” without a request (`code-quality-and-refactoring.mdc`).
+
+- **Constraints**
+  - Do not invent CI/MR hosting metadata without local data.
+  - Boy scout rule within the MR.
+  - BUGBOT automated review — see root `BUGBOT.md` (Cursor).

package/presets/cursor/android-kotlin/rules/compose-ui.mdc

@@ -0,0 +1,32 @@
+---
+description: Jetpack Compose Material 3 and design-system UI conventions
+globs:
+  - "**/presentation/**"
+  - "**/ui/**"
+  - "**/*Screen*.kt"
+alwaysApply: false
+---
+
+# Compose UI
+
+- Prefer **Jetpack Compose Material 3** plus the project **design-system** components/tokens.
+- Screens stay thin: collect state from ViewModels; emit intents/events upward; no repository/HTTP calls in composables.
+- Reuse existing design-system building blocks before inventing one-off styling.
+- Accessibility: content descriptions, semantics, focus order — match repo a11y conventions; `accessibility-reviewer` when UI changes.
+- Previews/fakes for UI states when the module already uses them.
+
+# Boundaries
+
+- Composables depend on presentation state models — not data DTOs.
+- Navigation calls go through feature launcher ports / nav APIs — see `navigation-feature-launcher`.
+
+# Agent requirements
+
+- Place UI under presentation/ui packages next to analogs.
+- Do not add a second design system or raw Material overrides that fight tokens.
+
+# State rendering
+
+- Render loading / empty / error / content from ViewModel state — no hidden local business rules.
+- Hoist state as the repo does; avoid duplicating ViewModel state in remember blocks.
+- Side-effect APIs (`LaunchedEffect`, etc.) only for UI concerns, not repository calls.