@bonesofspring/ai-rules 0.2.14 → 0.2.16

package/presets/cursor/android-kotlin/rules/design-guidance.mdc

@@ -0,0 +1,111 @@
+---
+description: Design smells (Fowler) and curated GoF patterns for agents. Load when assessing structure, smells, or pattern fit.
+globs:
+  - "**/*.swift"
+alwaysApply: false
+---
+
+<!-- shared-core: quality/design-guidance.md -->
+
+# Design guidance (smells & patterns)
+
+Glossary of **code smells** (Fowler) and **design patterns** (GoF) for agents during implement / review / debug.
+
+Apply only within the task or MR scope. Light refactor — yes; a “big” rewrite without an explicit request — no.
+
+Name a pattern **only if** the repository already does it that way or the match is minimal. Otherwise — extract/split/move without a GoF label.
+
+Does not replace always-on Principles in `code-quality-and-refactoring` (KISS, DRY + Rule of Three, YAGNI, SOLID, CUPID, composition, Demeter).
+
+## When to load
+
+- **Feature delivery / implement** — assess module structure, boundaries, and duplication.
+- **Code review** — smells and pattern fit **in the MR diff**, not across the whole repo.
+- **Debug** — root cause looks like wrong abstraction, Feature Envy, Message Chains, Shotgun Surgery.
+- **Light refactor only** — improvements within boy-scout / MR scope; do not expand the task for the catalog.
+
+Agents and skills load this stem via one-liner wiring — do not copy this catalog into the agent prompt.
+
+## How to use (agent rules of thumb)
+
+1. First check against Principles (always-on): is the solution simpler, is there no premature abstraction, is the public API respected.
+2. Then mark smells **in the changed files** of the task/MR; propose a fix only if it fits a light refactor.
+3. A GoF pattern is an optional label after the structure is already clear; do not start design by picking a pattern.
+4. If a smell or pattern conflicts with stack layer boundaries — stack boundaries and existing repo patterns win.
+5. Do not require renaming “for GoF” if behavior is already correct and readable.
+
+## Code smells (Fowler, curated ≤12)
+
+Table: smell → detect hint → fix hint (one line each). No mechanical refactoring menus.
+
+| # | Smell | Detect | Fix hint |
+|---|-------|--------|----------|
+| 1 | Duplicate Code | same logic in ≥2 places | dedupe after Rule of Three |
+| 2 | Long Method / Long Module | unit does too much | extract within scope; no big rewrite |
+| 3 | Feature Envy | method touches foreign data more than its own | move logic toward the data / public API |
+| 4 | Data Clumps | the same argument groups travel together | group into a type / value object |
+| 5 | Primitive Obsession | raw string/int instead of domain concepts | typed ids / value objects when the domain needs them |
+| 6 | Speculative Generality | unused hooks, flags, “for later” abstractions | remove (YAGNI) |
+| 7 | Message Chains | `a.b.c.d` chains | Demeter; facade / module public API |
+| 8 | Middle Man | class almost only forwards calls | remove pass-through **or** keep as a boundary |
+| 9 | Divergent Change | one module changes for different reasons | split by reasons to change |
+| 10 | Shotgun Surgery | one semantic change spreads across many files | consolidate responsibility |
+| 11 | Inappropriate Intimacy | access to foreign internals / private details | public API / ports / facades only |
+| 12 | Refused Bequest / Parallel Inheritance | subtype ignores base; mirrored class hierarchies | composition; do not grow parallel trees |
+
+**Skip Fowler (not in core):** Lazy Class, Incomplete Library Class, Comments-as-smell dogma, full 70+ catalog, step-by-step recipe menus.
+
+Smell conflict priority: Inappropriate Intimacy and Message Chains (module boundaries) > Duplicate Code (after Rule of Three) > Long Method inside an already correct module.
+
+## Design patterns (GoF, curated ≤8)
+
+Suggest only when repo already uses the shape or the match is minimal. Prefer extract-function over naming Strategy for the label alone.
+
+Patterns below are the **allowed minimum** for agents; the rest of GoF is Skip by default.
+
+| Pattern | When to suggest | Anti-trigger |
+|---------|-----------------|--------------|
+| Strategy | interchangeable algorithms already (or clearly soon) chosen by policy | one algorithm with no policy branching |
+| Adapter | wrap external / foreign API under a local port | extra wrapper around your own API |
+| Facade | simplify a multi-step subsystem behind a public API | facade turns into a god-object |
+| Factory Method | polymorphic creation already accepted in repo style | factory for every trivial `new` |
+| Decorator | additive behavior without exploding subclass hierarchies | decorator “for layers” with no real need |
+| Observer | events / subscriptions already exist in the architecture | homemade pub/sub with no repo precedent |
+| Template Method | shared algorithm skeleton + variable hooks | inheritance for a couple of differing lines |
+| Composite | tree of homogeneous nodes (UI/domain), as already in the repo | Composite on a flat list with no hierarchy |
+
+If unsure between two patterns — choose the simpler extract/compose without a name; the label may be added on review if the repo already speaks that way.
+
+## Skip / avoid by default
+
+| Catalog | Skip |
+|---------|------|
+| GoF | Singleton, Abstract Factory, Flyweight, Memento, Interpreter, Visitor, Bridge, Prototype |
+| GoF (conditional) | Command, Chain of Responsibility, State — mention **only if** the repo already uses them |
+| Fowler | everything beyond the 12 smells above |
+| DDD | Aggregates, bounded-context maps, event sourcing, CQRS — **not in core** |
+| DDD (pointer) | ubiquitous language anti-pattern — expand in `feature-delivery-workflow`, not here |
+| GRASP | Larman list as separate rules — skip (covered by SOLID/CUPID) |
+| Clean Code dogma | hard caps on function lines / “exactly one assert” — skip |
+
+Do not introduce a second stem (`refactoring-smells` / `design-patterns-for-agents`) — one catalog: `design-guidance`.
+
+## Out of scope for this stem
+
+- Full GoF (23) and full Fowler catalog.
+- Stack-specific recipes (module paths, lint commands) — only in the adapter **Stack notes**.
+- Security, a11y, perf — separate review rules; here only structural smells/patterns.
+- A fourth always-on rule — forbidden; this stem is requestable / agent-load only.
+
+## Cross-refs
+
+- Always-on Principles: `code-quality-and-refactoring`.
+- DIP / ports vs adapters: stack `architecture-boundaries` (stack details — in adapter Stack notes).
+- Ubiquitous language: `feature-delivery-workflow` (lineage).
+- MR checklist (smells in scope; pattern name only if repo uses it): `code-review-mr`.
+- Token / twin policy for authors: `preset-token-budget`, `preset-twin-sync` (meta, not consumer always-on).
+
+## Stack notes
+
+- Prefer protocol + composition over class inheritance hierarchies.
+- Suggest Adapter/Facade at Feature public API / DI boundaries — not inside Views.

package/presets/cursor/android-kotlin/rules/di-dagger-feature-holders.mdc

@@ -0,0 +1,35 @@
+---
+description: Feature-scoped Dagger holders/components; no Hilt by default
+globs:
+  - "**/di/**"
+  - "**/*Holder*.kt"
+  - "**/*Component*.kt"
+alwaysApply: false
+---
+
+# Dagger feature holders
+
+- Prefer **feature-scoped** Dagger components / holders owned by `features/<name>/impl` (or the repo’s equivalent DI package).
+- Expose only what the feature needs; do not create god-components that wire the whole app.
+- App shells under `applications/` provide application-wide dependencies; features pull those via component dependencies / holder APIs already used in the repo.
+- ViewModels and use cases are constructed via the holder/component — not via static globals.
+
+# No Hilt by default
+
+- **Do not introduce Hilt** unless the consumer repository already standardized on it.
+- If the repo is Dagger-manual / holders, keep that pattern; do not “migrate to Hilt” as drive-by work.
+
+# Boundaries
+
+- DI graph assembly may import adapters for wiring only — no business rules inside modules/components.
+- Other features consume public `api` contracts, not another feature’s DI internals.
+
+# Agent requirements
+
+- Follow neighboring `*Holder*` / `*Component*` patterns before inventing a new DI shape.
+- Local holder type names belong in consumer `team/conventions.md`, not in this preset.
+
+# Testing
+
+- Provide test/fake holders or override bindings using the repo’s existing test DI pattern.
+- Do not construct production graphs inside unit tests when a lightweight fake port suffices.

package/presets/cursor/android-kotlin/rules/feature-delivery-workflow.mdc

@@ -0,0 +1,36 @@
+---
+description: End-to-end checklist for Android features (domain → data → DI → presentation)
+alwaysApply: false
+---
+
+<!-- shared-core: architecture/feature-delivery-workflow.md -->
+
+# Feature delivery (Android Kotlin)
+
+Deliver features in layer order. Prefer neighboring `features/<name>/` analogs.
+
+## Checklist
+
+1. **Public API** — contracts / launcher ports in `features/<name>/api` when other modules will depend on them (`module-public-api`).
+2. **Domain** — entities, use-case ports; no Android UI / HTTP DTOs (`architecture-boundaries`).
+3. **Data** — repository implementations, DTO mappers, persistence (`networking-data`, `persistence-data`).
+4. **DI** — feature Dagger holder/component wiring (`di-dagger-feature-holders`); **no Hilt by default**.
+5. **Presentation** — ViewModel MVI/UDF + Compose screens (`state-and-viewmodels`, `compose-ui`).
+6. **Navigation** — wire launcher ports / host (`navigation-feature-launcher`).
+7. **Tests** — JVM unit tests; instrumentation when UI AC requires (`tests-unit`, `tests-ui`).
+8. **Gate** — invoke **`post-change-build`** + **`gradle-tooling`**.
+
+## Layer → rule matrix
+
+| Layer | Rules |
+|-------|-------|
+| api / contracts | `module-public-api`, `navigation-feature-launcher` |
+| domain / data | `architecture-boundaries`, `networking-data`, `persistence-data` |
+| di | `di-dagger-feature-holders` |
+| presentation | `state-and-viewmodels`, `compose-ui` |
+| tests | `tests-unit`, `tests-ui`, `instrumentation-ui-e2e` |
+
+## Agent requirements
+
+- Skill `feature-delivery` owns the end-to-end path; do not skip api/impl boundaries for speed.
+- Local type names only in consumer `team/conventions.md`.

package/presets/cursor/android-kotlin/rules/gradle-tooling.mdc

@@ -0,0 +1,31 @@
+---
+description: Gradle wrapper, version catalog, and task discovery for Android
+globs:
+  - "**/*.{kt,kts}"
+  - "**/libs.versions.toml"
+  - "**/gradlew*"
+alwaysApply: false
+---
+
+# Gradle tooling (requestable)
+
+Discover commands from the consumer repository — never invent a private wrapper path as the only option.
+
+1. Prefer `./gradlew` at the Gradle root; else a **documented** wrapper script from README/CI.
+2. Modules, product flavors, and variants — from Gradle + `gradle/libs.versions.toml` + convention plugins under `build-logic/`.
+3. JDK / AGP / Kotlin versions — from toolchain config or CI images.
+
+## Typical goals
+
+| Goal | Discovery approach |
+|------|--------------------|
+| Compile affected modules | `./gradlew :module:compile<Variant>Kotlin` (or project alias tasks) |
+| Android Lint / ktlint / detekt | Run **only if** repo/CI already configures them |
+| Unit tests | Narrowest `./gradlew :module:test<Variant>UnitTest` / `*Test` |
+| Instrumentation | Connected/managed device tasks as configured in CI |
+
+## Agent requirements
+
+- Mandatory after Kotlin/Android edits: **`post-change-build`**.
+- Never require Playwright, XCUITest, `xcodebuild`, or yarn `lint:js`/`lint:css` as Android handoffs.
+- Full gate: agent `build-verifier` with the same discovery rules.

package/presets/cursor/android-kotlin/rules/kotlin-conventions.mdc

@@ -0,0 +1,31 @@
+---
+description: Kotlin style, null-safety, and coroutine conventions for Android
+globs:
+  - "**/*.{kt,kts}"
+alwaysApply: false
+---
+
+# Kotlin conventions
+
+- Prefer idiomatic Kotlin already used in neighboring files (naming, package layout, visibility).
+- **Null-safety:** avoid `!!` in production paths; use `?.`, `?:`, early `return`, or typed errors.
+- Prefer `val` / immutability for state snapshots; mutate only behind clear owners (ViewModel, repository).
+- Coroutines: structured concurrency (`viewModelScope` / supervised scopes); cancel cooperatively; no fire-and-forget globals.
+- Flow/StateFlow for streams; collect in lifecycle-aware scopes (Compose / lifecycle owners).
+- Sealed classes/interfaces for UI events and domain errors when the repo pattern uses them.
+- Do not invent new style tooling — follow ktlint/detekt/Android Lint **if** configured in the repo.
+
+# Agent requirements
+
+- Match neighboring module conventions before introducing a new pattern.
+- Unverifiable third-party APIs → `// VERIFY:` comment (see `anti-sycophancy-discipline`).
+
+# Packages and visibility
+
+- Prefer `internal` for feature-impl helpers; public only at `api` module boundaries.
+- Avoid wildcard imports that fight the repo’s ktlint/detekt settings.
+- Extension functions stay near the type they extend or in established util packages.
+
+# Errors
+
+- Prefer typed results / sealed errors already used in the feature over bare exceptions in domain code.

package/presets/cursor/android-kotlin/rules/module-public-api.mdc

@@ -0,0 +1,30 @@
+---
+description: Public api module contracts for Android multimodule features
+globs:
+  - "**/api/**"
+  - "**/*Api.kt"
+alwaysApply: false
+---
+
+# Module public API
+
+- `features/<name>/api` (or equivalent) holds **public** contracts: models safe to share, navigation/launcher ports, public facades.
+- Implementation details stay in `impl` — other modules must not depend on `impl`.
+- Prefer stable, minimal surfaces; expanding a public API is a deliberate contract change.
+- Do not leak DTOs, database entities, or Compose UI types through `api` unless the repo already does so intentionally.
+
+# Cross-feature access
+
+- Consume another feature only via its `api` artifacts (Gradle dependency on the api module).
+- Navigation between features uses launcher-style ports declared in `api` (`navigation-feature-launcher`).
+
+# Agent requirements
+
+- When adding a symbol used outside the feature, place it in `api` and keep `impl` private.
+- Breaking api changes need explicit AC / review — do not silently widen visibility.
+
+# Versioning mindset
+
+- Treat api module changes as consumer-facing even inside a monorepo.
+- Prefer additive changes; renames/removals need migration notes in the task brief.
+- Keep Gradle `api` vs `implementation` dependencies consistent with visibility intent.

package/presets/cursor/android-kotlin/rules/navigation-feature-launcher.mdc

@@ -0,0 +1,31 @@
+---
+description: Cross-feature navigation via public launcher-style ports
+globs:
+  - "**/navigation/**"
+  - "**/*Launcher*.kt"
+alwaysApply: false
+---
+
+# Navigation / feature launchers
+
+- Cross-feature navigation goes through **public launcher-style ports** declared in `features/<name>/api` (or equivalent).
+- App shells / hosts implement or wire those ports; features must not deep-import another feature’s screens.
+- Arguments and results are explicit, serializable contracts — avoid leaking impl types across modules.
+- Intra-feature navigation may use the repo’s local NavHost/router patterns.
+
+# Boundaries
+
+- Do not navigate by hard-coded activity/class names across feature boundaries when a launcher port exists.
+- Keep Compose destinations thin; navigation side effects originate from ViewModel effects or host wiring as in the repo.
+
+# Agent requirements
+
+- When adding a new entry point, extend the public api contract first, then wire the host.
+- Document deep-link / flavor-specific entry points next to existing analogs.
+
+# Testing & previews
+
+- Host wiring should remain mockable in JVM tests where the repo already tests navigation ports.
+- Do not embed feature impl screens into another feature’s navigation graph.
+
+- Deep links and app-link filters stay with the host/`applications/` wiring unless the feature api owns them.

package/presets/cursor/android-kotlin/rules/networking-data.mdc

@@ -0,0 +1,31 @@
+---
+description: Networking and DTO→domain mapping in the data layer
+globs:
+  - "**/data/**"
+  - "**/network/**"
+alwaysApply: false
+---
+
+# Networking / data
+
+- HTTP clients, serializers, and DTOs live in the **data** layer (or data packages under `features/<name>/impl`).
+- Map DTO → domain at the data boundary; domain and presentation must not see transport DTOs.
+- Prefer the stack already in the repo (OkHttp, Ktor, Retrofit, etc.) — do not introduce a second client “for cleanliness”.
+- Errors: translate transport failures into domain/application error types used by the feature.
+- Timeouts, interceptors, and auth headers follow existing client configuration.
+
+# Boundaries
+
+- No Compose / ViewModel imports in networking code.
+- No business rules beyond mapping and orchestration already established in repositories/use cases.
+
+# Agent requirements
+
+- Colocate new endpoints/mappers next to analogs.
+- Secrets and TLS policy — see `security-android`; never hard-code tokens.
+
+# Resilience
+
+- Retries/backoff only when the repo already has a shared policy — do not invent per-call retries.
+- Cancellation must propagate with coroutines; do not swallow `CancellationException`.
+- Pagination/cursors follow neighboring repository patterns.

package/presets/cursor/android-kotlin/rules/persistence-data.mdc

@@ -0,0 +1,30 @@
+---
+description: Local persistence and datastore patterns in the data layer
+globs:
+  - "**/data/local/**"
+  - "**/database/**"
+alwaysApply: false
+---
+
+# Persistence / local data
+
+- Room / DataStore / SQLDelight / file cache — **use what the repo already uses**.
+- Persistence models stay in data; map to domain entities before crossing upward.
+- Migrations and schema changes follow existing migration patterns and CI checks.
+- Do not block the main thread; use the repo’s dispatcher / coroutine patterns.
+
+# Boundaries
+
+- Domain defines repository ports; data implements them with local + remote sources as needed.
+- UI must not query DAOs directly.
+
+# Agent requirements
+
+- Prefer the narrowest change that preserves schema compatibility.
+- Cover mappers and critical repository branches with JVM unit tests when feasible.
+
+# Consistency
+
+- Transactions follow existing DAO/helper patterns.
+- Cache invalidation belongs with the repository that owns the source of truth.
+- Prefer idempotent writes when syncing remote → local.

package/presets/cursor/android-kotlin/rules/post-change-build.mdc

@@ -0,0 +1,30 @@
+---
+description: Compile, lint, and unit-test after Android/Kotlin edits (requestable, required)
+alwaysApply: false
+---
+
+# Post-change build (requestable, required after code edits)
+
+After editing Kotlin/Android sources or Gradle build files:
+
+1. Load **`gradle-tooling`** and discover wrapper + module/variant tasks.
+2. Compile the **affected** modules for the relevant variant/flavor.
+3. Run configured static checks (Android Lint / ktlint / detekt) **only if** present in repo/CI.
+4. Run the narrowest unit-test suite for touched modules.
+5. Record commands and outcomes for handoff to `build-verifier`.
+
+## Do not
+
+- Require Playwright, XCUITest, `xcodebuild`, or yarn `lint:js`/`lint:css`.
+- Skip the gate because “it looks fine”.
+- Introduce new lint tools as hard gates.
+
+## Full validation
+
+Agent `build-verifier` repeats discovery at CI parity when the pipeline schedules it.
+
+# Scope selection
+
+- Prefer module-local tasks over full-project builds when CI allows.
+- If flavor/variant is ambiguous, read CI and neighboring scripts before guessing.
+- Surface failures with the exact command for `build-verifier` / the user.

package/presets/cursor/android-kotlin/rules/preset-layering.mdc

@@ -0,0 +1,36 @@
+---
+description: Preset authoring: Core → Stack → Platform layering. Use when editing packages/ai-rules/presets/**.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-layering.md -->
+
+# Preset layering
+
+Rules for **preset authors** (`packages/ai-rules/presets/**`). Not always-on in consumer apps.
+
+## Layers
+
+| Layer | Where | What to put |
+|-------|-------|-------------|
+| **Core** | `presets/_shared/core/**` | Stack-agnostic prose + checklists; no frontmatter; no paths `app/**`, `Features/**`, Playwright, xcodebuild |
+| **Stack** | `presets/{cursor\|claude}/<stack>/` | Domain/tooling, stack always-on trio, stack examples in **Stack notes** |
+| **Platform** | Cursor `.mdc` / Claude `.md` | Frontmatter (`alwaysApply`/`globs` vs `paths:`), platform-only (`BUGBOT.md`, `CLAUDE.md`) |
+
+## Where to put a new rule
+
+1. Shared principles for all stacks → **core** + adapters with `<!-- shared-core: … -->`.
+2. Only one of the installable stacks (`next` / `nuxt` / `svelte` / `ios-swift` / `android-kotlin` / `go` / `java` / `mcp-ts` / `php-hexagonal` / `php-laravel`) → **stack-specific** (not in `_shared`).
+3. Only Cursor or only Claude packaging → platform artifact / frontmatter; do not duplicate semantics.
+
+## SoT
+
+- Packages path — SoT; root `.cursor/` — dogfood sync.
+- Per stack: **Cursor** `presets/cursor/<stack>/` → Claude twin same PR.
+- `_shared` is **not** a `--preset` and is not copied by CLI `init`.
+
+See also: `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`.

package/presets/cursor/android-kotlin/rules/preset-no-cross-stack-leakage.mdc

@@ -0,0 +1,100 @@
+---
+description: Preset authoring: forbid cross-stack agent/path leakage in hooks and agents.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-no-cross-stack-leakage.md -->
+
+# Preset no cross-stack leakage
+
+Ban leakage of stack-specific names, paths, and handoff stems across presets.
+
+## Principles
+
+- `next` must not require iOS-only or Android-only agents/tooling (`xcuitest-*`, `instrumentation-test-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `nuxt` must not require iOS-only or Android-only agents/tooling (`xcuitest-*`, `instrumentation-test-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `svelte` must not require iOS-only or Android-only agents/tooling (`xcuitest-*`, `instrumentation-test-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `ios-swift` must not ship Playwright handoffs, Android `instrumentation-test-*` handoffs, or Next lint recipes as required commands.
+- `android-kotlin` must not ship Playwright, XCUITest, `xcodebuild`, or Next lint recipes as required handoffs.
+- `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Android instrumentation agents, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
+- Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
+
+## Forbidden in ios-swift hooks/agents (FAIL)
+
+In ios-swift `chain-team-phases.sh` / agent handoffs (Cursor + Claude):
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`
+- `instrumentation-test-` as required Android handoffs
+- `app/__tests__/e2e` as a required path
+- Positive yarn recipes `lint:js` / `lint:css` as commands to run (negation prose alone is weak — prefer zero occurrences)
+
+Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild` or `post-change-build` / `xcode-tooling`.
+
+## Forbidden in android-kotlin hooks/agents (FAIL)
+
+In android-kotlin `chain-team-phases.sh` / agent handoffs (Cursor + Claude):
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`
+- `app/__tests__/e2e` as a required path
+- `xcuitest-test-`, positive `xcodebuild` / `SwiftLint` as required handoffs
+- Positive yarn recipes `lint:js` / `lint:css` as commands to run
+
+Required instead: `instrumentation-test-*` stems; build-verifier mentions `gradle-tooling` and/or `post-change-build` (Gradle wrapper discovery — not `xcodebuild` as the default gate).
+
+## Forbidden in next hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` / `instrumentation-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
+
+## Forbidden in nuxt hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` / `instrumentation-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Nuxt app work
+- Frontend profile mirrors `next`: Playwright / `lint:js` / `lint:css` allowed
+
+## Forbidden in svelte hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` / `instrumentation-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for SvelteKit app work
+- Frontend profile mirrors `next` / `nuxt`: Playwright / `lint:js` / `lint:css` allowed
+
+## Forbidden in go / java / php-hexagonal / php-laravel hooks/agents (FAIL)
+
+Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
+
+- `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css`
+- `xcuitest-test-`, `instrumentation-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Agent file `accessibility-reviewer` (no UI surface)
+
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
+
+## Forbidden in mcp-ts hooks/agents (FAIL)
+
+Same UI/mobile bans as backend stacks, plus:
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css` as required gates
+- `xcuitest-test-`, `instrumentation-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Go tool commands as required MCP delivery gates: `go test`, `go vet`, `golangci-lint`
+- Agent files: `playwright-test-*`, `xcuitest-test-*`, `instrumentation-test-*`, `integration-test-*`, `accessibility-reviewer`
+
+Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`, `post-change-test`); Phase 1 gates `build-verifier` + `security-reviewer`.
+
+## Soft / document
+
+- Mentioning the other stack in **docs** comparing presets is OK.
+- `build-verifier` may reference other stacks when validating **preset packaging** (`scope: preset-structure-validation`).
+
+## Chain fork
+
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `nuxt`, `svelte`, `ios-swift`, `android-kotlin`, `go`, `java`, `mcp-ts`, `php-hexagonal`, and `php-laravel` (per platform).
+
+## Stack notes
+
+- **Authoring meta:** forbidden/required sections above describe **other stacks** (and this one) for preset authors. Consumer installs of `android-kotlin` must still keep foreign agent stems out of required handoffs.

package/presets/cursor/android-kotlin/rules/preset-pr-checklist.mdc

@@ -0,0 +1,39 @@
+---
+description: Preset authoring: PR checklist for twin sync, budget, leakage, README. Use on preset PRs.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-pr-checklist.md -->
+
+# Preset PR checklist
+
+Checklist for PRs that touch `packages/ai-rules/presets/**` (and dogfood `.cursor/` sync).
+
+## Before merge
+
+- [ ] **SoT:** edits in `packages/…` (not only root `.cursor/`)
+- [ ] **Core:** if `_shared/core/**` changed — all `<!-- shared-core: … -->` consumers updated (or documented intentional fork)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, nuxt, svelte, ios-swift, android-kotlin, go, java, mcp-ts, php-hexagonal, and php-laravel — see `preset-twin-sync`)
+- [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table is current
+- [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
+- [ ] **Leakage:** no foreign stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
+- [ ] **Twin depth:** domain ≥15 lines; thin aliases documented
+- [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
+- [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
+- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (or document intentional skip) when maintaining this monorepo
+- [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
+
+## Pointers
+
+- Layering: `preset-layering`
+- Sync: `preset-twin-sync`
+- Budget: `preset-token-budget`
+- Leakage: `preset-no-cross-stack-leakage`
+- Validation: stack `agents/build-verifier.md` → preset-structure section
+- Dogfood script: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`
+- Drift script: `packages/ai-rules/scripts/check-shared-core-drift.sh`
+- Orchestrator: when editing presets, load this checklist + twin-sync

package/presets/cursor/android-kotlin/rules/preset-token-budget.mdc

@@ -0,0 +1,41 @@
+---
+description: Preset authoring: ≤3 always-on / session-start; meta rules never alwaysApply.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-token-budget.md -->
+
+# Preset token budget
+
+Invariants for rule loading in an **installed** preset (consumer app).
+
+## Hard caps
+
+| Platform | Always-on | Cap |
+|----------|-----------|-----|
+| Cursor | `alwaysApply: true` | **≤ 3** |
+| Claude | rules **without** `paths:` | **exactly 3** |
+
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+
+Session-start body budget (where documented): ≤140 lines total (stretch ≤120).
+
+## Meta / author rules
+
+Rules for preset authors (`preset-layering`, `preset-twin-sync`, …):
+
+- **Never** `alwaysApply: true` on consumer installs.
+- Cursor: `globs` limited to `packages/ai-rules/presets/**` (and dogfood `.cursor/**` where useful).
+- Claude: `paths:` limited to `packages/ai-rules/presets/**` (and `.claude/**` dogfood if present).
+
+## Heavy workflows
+
+Orchestrator, feature-delivery, code-review, post-change gates, domain globs — **requestable / paths**, not always-on.
+
+## Verifier
+
+build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.