@bonesofspring/ai-rules 0.2.17 → 0.2.19

package/presets/cursor/android-kotlin/agents/task-analyst.md

@@ -34,6 +34,15 @@ Do not invent architecture or persistence stacks — frame “as in the repo”.
 
 **Author mode (Generate / Bootstrap):** When the user runs `/spec-start`, router intent is `spec-gen` / bootstrap, or brief/AC requests generation: load **`product-specs`** + **`product-specs-authoring`** and skill **`spec-authoring`**. You are the **primary author** (INDEX bootstrap included). Follow frontmatter v1 + required headings; update INDEX in the **same change set**; default `status: draft`. Block handoff via `open_questions` until the authoring self-check passes.
 
+
+**Spec mode:** Write `## Spec mode` in `brief.md` with exactly one of `consume` | `generate` | `none`. Infer if unset: spike/research/preset-only → `none`; `/spec-start` or router `spec-gen` → `generate`; otherwise `consume`. Router may echo `specMode` on `pipeline.json`.
+
+**`none`:** skip INDEX row requirement and author mode; do not invent a dummy INDEX.
+
+**Research-before-spec (opt-in):** load skill **`spec-discovery`** only when the user/AC asks research before authoring (not default consume `/task`). Run a **subset** of methods; **`claim-ledger` is mandatory** whenever the skill loads. Append chronological notes to `.cursor/team/tasks/<slug>/.memlog.md` (append-only; do not mutate `status.json`).
+
+**applyReadiness (author blocked):** if specs are drafted but the human gate has not passed, or a required named spec is missing, emit `applyReadiness: { "state": "blocked", "contextFiles": ["…"] }` on the analysis receipt. Do not invoke feature-developer.
+
 ### Brief sections (when author mode or INDEX exists)
 
 Add to `brief.md`:
@@ -47,9 +56,34 @@ Add to `brief.md`:
 ```
 
 
+## UX design (behavioral)
+
+Load requestable skill **`ux-design`** and rule **`ux-design`** when:
+- standalone router intent `ux-design`, or
+- **required-signal:** the user asked for UX, **or** AC explicitly require flows/states, **or** `spec-gen` / `/spec-start` for a **page/feature**, or
+- advisory UI AC on this UI stack (notes only; skip if no UI surface).
+
+**Order:** write `ux-design.md` **before** author mode / skill `spec-authoring` when both apply. You remain the only INDEX writer.
+
+Write `.cursor/team/tasks/<slug>/ux-design.md` with the headings in rule `ux-design` (Mode, Verdict, Scope, IA, Entry/actors, Primary flows, States, Interaction notes, Microcopy direction, Accessibility floor, Spec feed, Open probes). Modes: `synthesize` | `review`.
+
+**Required vs advisory:** required-signal + missing named primary flows **or** empty/error/loading matrix → DoR not met (`open_questions` / blocked analysis). Isolated missing microcopy never blocks. Advisory `INCOMPLETE` → notes only. Do **not** copy the mockup FAIL-only hook.
+
+**Forbidden:** Figma MCP tools (`get_metadata`, `get_design_context`, `get_screenshot`, `search_design_system`, `get_variable_defs`, `use_figma`, `create_new_file`, `generate_*`). When Figma is present and required-signal fires, emit a **thin** `ux-design.md` from AC only (no visual claims). Only `mockup-reviewer` reads Figma.
+
+When produced, append `ux-design.md` to this step's **`analysis`** `authoritativePaths` / `evidencePaths`. No new manifest producer row.
+
+
+## MCP usage
+
+Load requestable rule `mcp-usage` when verifying third-party library APIs (Context7) or when a local overlay MCP is present and the task fits. Discover tools at runtime; do not invent schemas. Overlay absence is not a blocker unless the user required that MCP as source of truth.
+
+If the prompt/brief has a tracker URL (Linear/Jira/Notion/…) and that MCP is ready, pull AC **read-only**. Task-folder artifacts remain SoT.
+
+
 ## Artifact contract
 
 - **Authoritative inputs:** read `.cursor/team/tasks/<slug>/artifact-manifest.json` first; consume `pipeline.json`, the manifest routing entry, user-approved decisions, and any authoritative architecture/approval entries.
-- **Owned outputs:** `brief.md` and `decomposition.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign entries.
+- **Owned outputs:** `brief.md` and `decomposition.md` (plus `ux-design.md` when produced); upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign entries.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/cursor/android-kotlin/agents/task-router.md

@@ -23,6 +23,8 @@ You are a task router for an **Android Kotlin/Jetpack Compose** agent team. You
 | `migration` | “migration”, “upgrade”, “update Android Studio / AGP/Gradle modules” | task-analyst → migration-specialist → feature-developer → build-verifier → code-reviewer |
 | `perf-audit` | “performance”, “Profiler”, “Macrobenchmark”, “launch”, “slow” | performance-auditor |
 | `a11y` | “a11y”, “TalkBack”, “font scale”, “semantics”, “contentDescription”, “accessibility” | task-analyst → feature-developer → build-verifier → accessibility-reviewer → code-reviewer |
+| `mockup-review` | “mockup review”, “check Figma”, “figma review”, mockup + review verb, `figma.com` + review-not-implement | mockup-reviewer |
+| `ux-design` | «разработай UX» (design UX), «спроектируй» (design) flows, “journey”, “IA”, “state matrix”, «ревью UX» (UX review) without Figma | task-analyst | <!-- i18n-keep: E4 -->
 | `review-only` | “review”, “review MR”, “check the diff” | code-reviewer |
 | `test-only` | “cover with tests” (unit+UI, no impl) | task-analyst → qa-tester |
 | `unit-only` | “unit”, “JUnit”, “cover mapper” | unit-test-planner → unit-test-generator, or unit-test-healer |
@@ -33,10 +35,15 @@ You are a task router for an **Android Kotlin/Jetpack Compose** agent team. You
 | `retro` | “retro”, “postmortem” | (orchestrator → `/technical-retro`) |
 
 **Never schedule Playwright agents** (`playwright-test-*`). If a next template mentions them, put in `skipped` with reason "Android uses Android instrumentation" and use instrumentation-test trio.
+**Light by intent:** `mockup-review` → only `mockup-reviewer` (`model: "strong"`, never `cheap`). `ux-design` → only `task-analyst` (skill `ux-design`; analyst default model, not `strong`). Classify `mockup-review` **before** `ux-design` **before** `review-only`. A `figma.com` URL with review-not-implement language remains `mockup-review` even if the user said «ревью UX». <!-- i18n-keep: E4 -->
+**Embed UX:** on `feature` / `refactor` / `spike` / `spec-gen` with required-signal or advisory UI AC, instruct **task-analyst** to load skill `ux-design` (no new pipeline step).
+
+**Embed `figma.com`:** on `feature` / `refactor` / `spike` / `spec-gen`, insert `mockup-reviewer` after `task-analyst` (when present) and before `solution-architect` and `feature-developer`. Do **not** add static `humanGates: ["after:mockup-reviewer"]` (FAIL-only gate is a hook exception). Never put `mockup-reviewer` in a `parallel: true` step.
+
 
 ## Pipeline profiles
 
-`"profile": "full" | "standard" | "light"`. Default: **standard** for feature/refactor/bugfix; **light** for review-only/perf; **full** when cross-layer or UI-test AC.
+`"profile": "full" | "standard" | "light"`. Default: **standard** for feature/refactor/bugfix; **light** for review-only/perf/mockup-review/ux-design; **full** when cross-layer or UI-test AC.
 
 **Never skip `build-verifier`** after developer when Kotlin/Android Studio / AGP sources changed.
 
@@ -66,7 +73,7 @@ Keep top-level `profile` and emit this top-level object in every new `pipeline.j
 Optional: `"model": "cheap" | "standard" | "strong"`. Same policy as **cursor/next** `task-router.md`:
 
 - `light` → `cheap` on all steps (debugger unclear root cause → `strong`)
-- `full` / `spike` / security|perf specialists → `strong` on architect, migration, security, perf steps
+- `full` / `spike` / security|perf|mockup specialists → `strong` on architect, migration, security, perf, and `mockup-reviewer` steps
 - never `strong` on build-verifier / tech-writer / task-router
 - omit on `standard` → agent frontmatter (`fast` / `inherit` / `claude-opus-4-8[effort=high]`)
 
@@ -77,10 +84,13 @@ Fixtures: `.cursor/team/fixtures/` (feature-full, feature-light, bugfix-standard
 | Intent | Default humanGates |
 |--------|-------------------|
 | feature, refactor, test-only, a11y | `["after:task-analyst"]` |
+| spec-gen | `["after:task-analyst"]` |
 | migration | `["after:migration-specialist"]` |
 | unit-only | `["after:unit-test-planner"]` when new plan |
 | e2e-only | `["after:instrumentation-test-planner"]` when new plan |
 | bugfix, review-only, ci-fix | `[]` |
+| mockup-review | `[]` |
+| ux-design | `[]` |
 | spike | `["after:solution-architect"]` |
 
 ## Output
@@ -102,6 +112,11 @@ Detect and set routing reasons when the user asks to **generate / bootstrap prod
 
 Do **not** add a dedicated `spec-author` agent. Do not require solution-architect for routine spec authoring.
 
+
+**specMode (optional `pipeline.json` field):** `none` for spike/research; `generate` for `spec-gen` / `/spec-start`; `consume` default when INDEX exists. Echo top-level `specMode`. Brief `## Spec mode` wins on conflict.
+
+Do **not** add a pipeline step for `spec-discovery`. Instruct analyst to load that skill only when the user/AC asks research-before-spec.
+
 ## Runtime initialization
 
 Return the routing receipt to the orchestrator. The orchestration runtime/hook exclusively initializes and updates `status.json`, `metrics.json`, attempt identities, and gate lifecycle; the router does not write those shared runtime files.

package/presets/cursor/android-kotlin/commands/spec-start.md

@@ -14,7 +14,7 @@ Routes intent **`spec-gen`** (or bootstrap) → **task-analyst** in **author mod
 3. Ensure `.cursor/team/tasks/<slug>/` exists (Write artifacts; not Shell mkdir).
 4. Write `.cursor/team/active-task.json` → `{ "slug": "<slug>" }`.
 5. Write minimal `pipeline.json`: task-analyst → (optional stop) → feature-developer only if user asked implement-after. **No separate spec-author agent.**
-6. Invoke **task-analyst** with: author mode; load **`product-specs`** + **`product-specs-authoring`** + skill **`spec-authoring`**; Bootstrap if `docs/specs/` absent, else Generate.
+6. Invoke **task-analyst** with: author mode; load **`product-specs`** + **`product-specs-authoring`** + skill **`spec-authoring`**; Bootstrap if `docs/specs/` absent, else Generate. Optional: if arguments/AC ask research-before-spec, also load skill **`spec-discovery`** (not default).
 7. Wait for analyst. **Do not** invoke feature-developer until human gate passes.
 
 ## Human gate

package/presets/cursor/android-kotlin/commands/task-continue.md

@@ -32,17 +32,19 @@ printf '%s\n' '{"status":"completed","action":"end_human_gate","activateNext":tr
 
    3. Re-read `status.json` (and the hook `followup_message`).
    4. Invoke the subagent named in `status.currentAgent` / followup — do **not** advance the pipeline a second time.
-3. **Review `changes_requested`** (not a human gate): set `currentAgent` to `feature-developer` (same index / find developer in steps), `state: in_progress`, then invoke developer. Do **not** call `end_human_gate` unless `activeHumanGateEventId` is set.
-4. **Other resume**: restore `pipelineIndex` / `currentAgent` from status and invoke that agent.
-5. After the invoked agent completes, `chain-team-phases.sh` on `subagentStop` continues the chain when `autoChain: true`.
+3. **Review `changes_requested`** (not a human gate): if `currentAgent` is **`mockup-reviewer`**, this is the FAIL-only mockup gate — do **not** retry `feature-developer`. Read `mockup-review.md` and resume via the human-gate path (`end_human_gate` / `activateNext`). Otherwise: set `currentAgent` to `feature-developer` (same index / find developer in steps), `state: in_progress`, then invoke developer. Do **not** call `end_human_gate` unless `activeHumanGateEventId` is set.
+4. **`blocked` + `currentAgent: mockup-reviewer`** (`BLOCKED_MCP`): skip-forward via the same `end_human_gate`/`activateNext` path (explicit «proceed without MCP»). Do not invent DS claims.
+5. **Other resume**: restore `pipelineIndex` / `currentAgent` from status and invoke that agent.
+6. After the invoked agent completes, `chain-team-phases.sh` on `subagentStop` continues the chain when `autoChain: true`.
 
 ## Artifacts for handoff
 
 | Agent | Read |
 |-------|------|
-| feature-developer | brief.md (incl. **Related specs**), decomposition.md, validation-report.md (if retry), review.md (if retry), architecture.md; if `docs/specs/INDEX.md` exists → load **`product-specs`** |
+| feature-developer | brief.md (incl. **Related specs**), decomposition.md, ux-design.md (if present), mockup-review.md (if present), validation-report.md (if retry), review.md (if retry), architecture.md; if `docs/specs/INDEX.md` exists → load **`product-specs`** |
 | build-verifier | git diff, decomposition.md |
 | code-reviewer | brief.md, validation-report.md, git diff |
+| mockup-reviewer | mockup-review.md |
 | qa-tester | brief.md, decomposition.md, scope from pipeline step |
 
 ## Product specs (docs/specs)

package/presets/cursor/android-kotlin/commands/task.md

@@ -22,6 +22,8 @@ Examples:
 - `/task Write a changelog for the filters release`
 - `/task Review my changes in features/Orders`
 - `/task Write an Android instrumentation for the payment flow`
+- `/task Review mockup https://figma.com/design/...`
+- `/task Design UX flows for Order History` (no Figma)
 
 ## Algorithm
 

package/presets/cursor/android-kotlin/hooks/chain-team-phases.sh

@@ -135,6 +135,7 @@ const DEFAULT_ARTIFACT_OUTPUT_IDS = {
   'security-reviewer': 'security-review',
   'accessibility-reviewer': 'a11y-review',
   'performance-auditor': 'perf-report',
+  'mockup-reviewer': 'mockup-review',
   'api-contract-reviewer': 'api-contract-review',
   'tech-writer': 'documentation',
 };
@@ -313,6 +314,8 @@ const AGENT_HANDOFF = {
     `Invoke accessibility-reviewer (readonly) for slug "${s}". Review Presentation/Jetpack Compose (or Android View system) diff for TalkBack/font scale/semantics/testTag; write a11y-review.md. Upsert the owned terminal receipt in artifact-manifest.json; do not mutate status.json lifecycle fields.`,
   'performance-auditor': (s) =>
     `Invoke performance-auditor (readonly) for slug "${s}". Audit launch/Jetpack Compose performance risks; write perf-report.md. Upsert the owned terminal receipt in artifact-manifest.json; do not mutate status.json lifecycle fields.`,
+  'mockup-reviewer': (s) =>
+    `Invoke mockup-reviewer (readonly) for slug "${s}". Write mockup-review.md. Load requestable mockup-review skill/rule. Upsert the owned terminal receipt in artifact-manifest.json; do not mutate status.json lifecycle fields.`,
   'code-reviewer': (s) =>
     `Invoke code-reviewer subagent (readonly) for slug "${s}". Review git diff vs brief.md per code-review-mr.mdc. ` +
     `Upsert the owned terminal receipt in artifact-manifest.json; do not mutate status.json lifecycle fields.`,
@@ -597,6 +600,18 @@ if (currentStep?.parallel && stepAgents.length > 1) {
   }
 
   const retryReviewer = stepAgents.find((agent) => outcomes[agent]?.outcome === 'changes_requested');
+  if (retryReviewer === 'mockup-reviewer') {
+    beginHumanGate();
+    writeStatus({
+      awaitingHumanGate: true,
+      state: 'awaiting_approval',
+      currentAgent: 'mockup-reviewer',
+      parallelCompleted: [],
+      parallelOutcomes: {},
+    });
+    out(`Mockup review FAIL for slug "${slug}". Read mockup-review.md. Resume only via /task-continue. Do not retry feature-developer.`);
+    process.exit(0);
+  }
   if (retryReviewer) {
     const retryAfterFixStepIndex = idx;
     const predecessor = outcomes[retryReviewer]
@@ -628,6 +643,17 @@ if (status.state === 'blocked') {
   process.exit(0);
 }
 
+if (status.state === 'changes_requested' && (completedAgent === 'mockup-reviewer' || status.currentAgent === 'mockup-reviewer')) {
+  beginHumanGate();
+  writeStatus({
+    awaitingHumanGate: true,
+    state: 'awaiting_approval',
+    currentAgent: 'mockup-reviewer',
+  });
+  out(`Mockup review FAIL for slug "${slug}". Read mockup-review.md. Resume only via /task-continue. Do not retry feature-developer.`);
+  process.exit(0);
+}
+
 if (status.state === 'changes_requested') {
   const reviewer = status.currentAgent || finishedAttempt?.entry?.agent;
   if (!reviewer) {

package/presets/cursor/android-kotlin/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "context7": {
       "command": "npx",
-      "args": ["-y", "@upstash/context7-mcp"]
+      "args": ["-y", "@upstash/context7-mcp@4.0.2"]
     },
     "figma": {
       "url": "https://mcp.figma.com/mcp"

package/presets/cursor/android-kotlin/rules/README.md

@@ -39,11 +39,14 @@ Flat Cursor SoT. Claude twins live under `presets/claude/android-kotlin/rules/<t
 | `post-change-build.mdc` | requestable | Required after edits |
 | `security-android.mdc` | security/network | Secrets/TLS |
 | `design-guidance.mdc` | requestable | Smells/GoF |
+| `mcp-usage.mdc` | requestable | Context7 + overlay MCP |
 | `anti-sycophancy-discipline.mdc` | requestable | VERIFY discipline |
 | `code-review-mr.mdc` | requestable | MR checklist |
 | `agent-team-intake.mdc` | requestable | thin `/task` hint |
 | `agent-team-orchestrator.mdc` | requestable | Pipeline |
 | `technical-retro.mdc` | requestable | thin retro alias |
+| `mockup-review.mdc` | requestable | Figma mockup checklist + Stack notes breakpoints |
+| `ux-design.mdc` | requestable | Behavioral UX checklist + Stack notes form-factor |
 | `preset-*.mdc` (×5) | author globs | Meta only |
 
 ## Core → stack mapping
@@ -53,6 +56,7 @@ Flat Cursor SoT. Claude twins live under `presets/claude/android-kotlin/rules/<t
 | `quality/code-quality-and-refactoring.md` | `code-quality-and-refactoring.mdc` | Stack notes: Kotlin / Gradle gate |
 | `quality/anti-sycophancy-discipline.md` | `anti-sycophancy-discipline.mdc` | requestable |
 | `quality/design-guidance.md` | `design-guidance.mdc` | requestable |
+| `quality/mcp-usage.md` | `mcp-usage.mdc` | requestable Context7 + overlay MCP |
 | `agent-team/agent-team-orchestrator.md` | `agent-team-orchestrator.mdc` | instrumentation roles in Stack notes |
 | `agent-team/agent-team-intake.md` | `agent-team-intake.mdc` | thin alias |
 | `architecture/feature-delivery-workflow.md` | `feature-delivery-workflow.mdc` | Android checklist |
@@ -61,4 +65,6 @@ Flat Cursor SoT. Claude twins live under `presets/claude/android-kotlin/rules/<t
 | `architecture/product-specs-authoring.md` | `product-specs-authoring.mdc` | Generate/Bootstrap contract; requestable |
 | `review/code-review-mr.md` | `code-review-mr.mdc` | Android checklist |
 | `review/technical-retro.md` | `technical-retro.mdc` | thin alias |
+| `review/mockup-review.md` | `mockup-review.mdc` | Stack notes breakpoints; requestable |
+| `review/ux-design.md` | `ux-design.mdc` | Stack notes form-factor; requestable |
 | `meta/preset-*.md` | `preset-*.mdc` | author globs only |

package/presets/cursor/android-kotlin/rules/agent-team-orchestrator.mdc

@@ -19,6 +19,7 @@ Work request without `/task` — see **`agent-team-intake.mdc`**.
 | `/task-continue <slug>` | After human gate or pause |
 | `/feature-start <desc>` | Legacy: analyst-only start (no router) |
 | `/feature-continue <slug>` | Alias of task-continue |
+| `/spec-start [desc]` | Generate/bootstrap `docs/specs` — router intent `spec-gen` → analyst author mode → human gate |
 | `/technical-retro [slug]` | Retro with agent team block |
 
 ## Stack notes
@@ -28,7 +29,7 @@ Work request without `/task` — see **`agent-team-intake.mdc`**.
 | Agent | Prod writes | Typical intent |
 |-------|-------------|----------------|
 | `task-router` | no (team) | Every `/task` |
-| `task-analyst` | no | feature, refactor, test-only, a11y, docs, migration |
+| `task-analyst` | no | feature, refactor, test-only, a11y, docs, migration, ux-design, spec-gen |
 | `solution-architect` | no | spike, cross-layer Feature |
 | `migration-specialist` | no | Android Studio / AGP/Gradle modules/Android upgrades |
 | `api-contract-reviewer` | no | OpenAPI / Kotlin codegen contracts |
@@ -38,6 +39,7 @@ Work request without `/task` — see **`agent-team-intake.mdc`**.
 | `build-verifier` | no | ./gradlew + ktlint/detekt/Format + unit smoke; preset-structure for preset PRs |
 | `accessibility-reviewer` | no | TalkBack / font scale / semantics |
 | `performance-auditor` | no | launch / Profiler / Macrobenchmark |
+| `mockup-reviewer` | no (team only) | mockup-review, feature/refactor/spike/spec-gen with `figma.com` |
 | `code-reviewer` | no | most pipelines, review-only |
 | `security-reviewer` | no | Android Keystore / encrypted storage, network security / cleartext, PII |
 | `qa-tester` | tests | feature, bugfix, test-only |
@@ -51,6 +53,8 @@ Work request without `/task` — see **`agent-team-intake.mdc`**.
 
 Full prompts: `.cursor/agents/*.md`. Artifact conventions: `.cursor/team/README.md`; schema SoT: **agent-artifact-contracts**.
 
+**Behavioral UX:** `task-analyst` loads requestable skill `ux-design` for standalone intent `ux-design` and embedded required-signal / advisory UI AC. No `ux-designer` agent in v1.
+
 **Product specs:** When `/task`, `/feature-start`, or `/spec-start` touches pages/features/`docs/specs`: if INDEX exists and no generate intent → instruct next agent to load requestable **`product-specs`** (consume; soft-fail; never invent). If generate/bootstrap/`spec-gen` → load **`product-specs-authoring`** + skill **`spec-authoring`** inside **task-analyst** (not a separate pipeline step); pass created spec paths + INDEX diff in handoff; human gate must approve before feature-developer. No-op if INDEX absent and no author intent.
 
 When editing `packages/ai-rules/presets/**`, follow **`preset-pr-checklist.mdc`** (+ twin-sync / layering / token-budget / leakage meta-rules).
@@ -100,8 +104,8 @@ On each `subagentStop`, the hook reconciles `status.state` from the completing p
 2. Read `pipeline.json` before every subagent invocation.
 3. One role per Task call — except parallel steps.
 4. **Never** skip `humanGates` without `/task-continue` or explicit approval.
-5. Persist handoffs to disk under `.cursor/team/tasks/<slug>/` via **Write** (not Shell `mkdir`).
-6. On `changes_requested`: developer → same reviewer.
+5. Persist handoffs to disk under `.cursor/team/tasks/<slug>/` via **Write** (not Shell `mkdir`), including `mockup-review.md` / `ux-design.md` when those producers ran.
+6. On `changes_requested`: developer → same reviewer. Exception: embedded `mockup-reviewer` FAIL → `awaiting_approval` / `/task-continue` only (no developer retry).
 7. On `validation_failed`: developer → build-verifier.
 8. When all steps complete, suggest `/technical-retro <slug>`.
 9. If `autoChain: false`, do not rely on hook.

package/presets/cursor/android-kotlin/rules/anti-sycophancy-discipline.mdc

@@ -11,7 +11,7 @@ alwaysApply: false
 
 Procedural rules for code generation and review. Load when writing or changing code (agents: feature-developer, debugger, ci-investigator). Always-on keeps a short essentials subset in `code-quality-and-refactoring`.
 
-1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If you cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
+1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If that is not enough and Context7 MCP is available, load **`mcp-usage`** and query docs for the **installed major**. If you still cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
 2. **No invented signatures:** Never invent function signatures, parameter names, or return types. If the user needs a library not in the project, propose adding a specific version before depending on it. Silent stubs are worse than refusal.
 3. **Enumerate edge cases before validating:** When asked "is this correct?" or "does this work?", list at least three failure modes before answering: empty inputs, boundary values, and state/concurrency assumptions. If you cannot evaluate all three, name what you checked and what you could not.
 4. **Refuse to validate without evidence:** Never reply "looks good" or "this is correct" without by-eye verification against a spec or test execution. If no spec exists, ask for one or refuse to validate.

package/presets/cursor/android-kotlin/rules/code-quality-and-refactoring.mdc

@@ -33,7 +33,7 @@ alwaysApply: true
 
 Essentials below. Full procedural set (~17 rules) → load **`anti-sycophancy-discipline`**.
 
-- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent); never invent signatures.
+- Unverifiable third-party API → if Context7 is up, load **`mcp-usage`** and query the installed major; else mark `// VERIFY: lib.symbol @ version` (or stack equivalent); never invent signatures.
 - Before "is this correct?" — ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
 - Refactor without tests → propose characterization test; if declined, label `UNTESTED`.
 - Comments = WHY only when non-obvious; ban self-referential "added for issue Y".

package/presets/cursor/android-kotlin/rules/feature-delivery-workflow.mdc

@@ -3,6 +3,8 @@ description: End-to-end checklist for Android features (domain → data → DI
 alwaysApply: false
 ---
 
+When the prompt or `brief.md` contains a `figma.com` URL, **mockup review** (`mockup-reviewer` / skill `mockup-review`) must complete — or the user must continue past FAIL/`BLOCKED_MCP` via `/task-continue` — **before UI implementation**. Non-UI tasks no-op this gate. When required-signal and **no** `figma.com`, **`ux-design.md`** (on the analysis manifest entry) must exist and not be `INCOMPLETE` before UI work — else **blocked**, hand back to `task-analyst`. Parallel to the mockup gate.
+
 <!-- shared-core: architecture/feature-delivery-workflow.md -->
 
 # Feature delivery (Android Kotlin)
@@ -18,7 +20,7 @@ Deliver features in layer order. Prefer neighboring `features/<name>/` analogs.
 5. **Presentation** — ViewModel MVI/UDF + Compose screens (`state-and-viewmodels`, `compose-ui`).
 6. **Navigation** — wire launcher ports / host (`navigation-feature-launcher`).
 7. **Tests** — JVM unit tests; instrumentation when UI AC requires (`tests-unit`, `tests-ui`).
-8. **Gate** — invoke **`post-change-build`** + **`gradle-tooling`**.
+8. **Gate** — invoke **`post-change-build`** + **`gradle-tooling`**. When the current WP spans **more than one** layer or module, `implementation.md` includes a **Code Map** (3–8 annotated paths) and **Suggested Review Order** (`concern | path:line | ≤15 word note`). Omit both for a single-file or single-layer WP.
 
 ## Layer → rule matrix
 
@@ -37,4 +39,6 @@ Deliver features in layer order. Prefer neighboring `features/<name>/` analogs.
 
 ## Related
 
+- Do not mutate pipeline `status.json` / `metrics.json`; the orchestration hook is the single writer. Skills upsert the owned terminal receipt in `artifact-manifest.json`.
+
 - Product behavior discovery: requestable **`product-specs`** (`docs/specs/INDEX.md`) — do not paste the discovery algorithm here.

package/presets/cursor/android-kotlin/rules/mcp-usage.mdc

@@ -0,0 +1,99 @@
+---
+description: When to call shipped Context7 and local overlay MCP — detect presence, use if the task fits, degrade.
+alwaysApply: false
+---
+
+<!-- shared-core: quality/mcp-usage.md -->
+
+# MCP usage
+
+Requestable protocol for **shipped** and **local-overlay** MCP servers. Agents load this stem via one-liner wiring — do not copy tool schemas into prompts; discover them at runtime.
+
+Does not replace Figma mockup-review (that checklist stays on `mockup-review`). Does not add pipeline agents or required handoff stems.
+
+## Presence (runtime catalog is SoT)
+
+1. Inspect the **session MCP catalog** (server names + `serverStatus`). Project `mcp.json` / `.mcp.json` is a hint, not proof the server is up (user-level and plugin servers never appear there).
+2. Treat `error`, `needsAuth`, and `loading` as **unavailable**. Authenticate only when this task needs that server.
+3. **Discover tool schemas before calling.** Never invent tool names or arguments from memory.
+4. Match overlay servers by **documented aliases** or exact catalog ids. Prefer a ready `plugin-*` id over an unknown similarly named server; if several match, ask rather than guessing.
+5. If two servers expose the same product (plugin + project entry), use the **ready** one; do not call both.
+
+## Classes
+
+| Class | Who adds it | Policy |
+|-------|-------------|--------|
+| **Shipped** | Preset `mcp.json` | Assume it should be there; call when the task fits; degrade if down (do not block unless noted below) |
+| **Local overlay** | Consumer project or user MCP | Use only when present **and** the task fits. Never a required pipeline step |
+
+Shipped in every preset: **Context7** (library docs). Other shipped servers are stack-specific — see adapter **Stack notes**.
+
+## Context7 (shipped)
+
+**When to call** (after lockfile / manifest + sibling files still do not confirm the symbol):
+
+- Third-party API that would otherwise get `// VERIFY: lib.symbol @ version`
+- Version-sensitive framework or SDK APIs
+- Migrations / major upgrades
+- Library is in the lockfile but the signature is unclear
+
+**When not to call:** repo public API; a sibling file already imports the symbol; a trivial call already in this module.
+
+**Flow:**
+
+1. Discover server `context7`.
+2. Resolve a library id, then query docs (read the live schema; typical names `resolve-library-id` then `query-docs`).
+3. Put the **installed major** from the project manifest into the query.
+4. Cap: **≤3 doc queries per question**.
+5. Source priority: lockfile / sibling code **>** Context7 **>** training data. If docs disagree with the installed major, keep the installed API.
+6. If Context7 is down: `// VERIFY` (or stack equivalent) and say MCP was unavailable. **Do not block** the task.
+
+## Local overlay protocol
+
+If a matching server is ready and a **task signal** fires → discover and use. Otherwise continue from files / native tools (`gh`, repo docs, source).
+
+Absence of an overlay is **not** `BLOCKED` unless the user required that MCP as source of truth.
+
+### Observability (Sentry, Datadog, similar)
+
+**Signal:** production error, event/trace id, APM / latency, pasted dashboard or issue URL.
+
+Use the **first ready** observability MCP. Do not invent metrics or stack traces. Do not require two observability servers.
+
+### Tickets (Linear, Jira, Notion, similar)
+
+**Signal:** ticket/page URL in the prompt or brief, or an explicit “pull from \<tracker\>”.
+
+Read-only by default. Task-folder artifacts (`brief.md`, `decomposition.md`) remain SoT — do not replace them with a tracker page. Write back to the tracker **only** if the user asked.
+
+### Component-library overlay
+
+**Signal:** UI component public API, stories, controls, or explicit component-docs MCP.
+
+If such a server is ready, use it for documented props/variants instead of inventing them. If it is down, read story/source files. **Block** only when the user required that MCP as SoT.
+
+Usual aliases and runtime needs live in frontend **Stack notes**. Do not ship this server in preset `mcp.json`.
+
+### GitHub MCP
+
+Native `gh` / git remain SoT for PRs and checks. A GitHub MCP may be used when present; do not require it.
+
+## Figma
+
+Policy is stack-class-specific — see adapter **Stack notes**. If a Figma **plugin** and a project `figma` server are both present, use the ready one and do not duplicate calls.
+
+## Forbidden
+
+- Secrets in `mcp.json` / `.mcp.json`
+- New pipeline agents or required handoffs for overlay MCP
+- Treating overlay absence as blocked (except user-required SoT)
+- Tracker/admin write tools without an explicit ask
+- Calling overlay MCP “just in case” on unrelated tasks
+
+## Stack notes
+
+- Pipeline **`mockup-reviewer`** is the only agent that reads Figma for mockup review. See `mockup-review`.
+- Shipped besides Context7: Figma (mockup-review pipeline). See `mockup-review`.
+- Do **not** require Storybook, Playwright, or Chrome DevTools MCP as handoffs or delivery gates.
+- Observability and ticket overlays still apply when present.
+- `init` **merges** `mcpServers`: preset keys update; extra local servers are kept.

package/presets/cursor/android-kotlin/rules/mockup-review.mdc

@@ -0,0 +1,116 @@
+---
+description: Figma mockup review checklist (DS, coverage, viewports). On-demand — load via mockup-reviewer / skill mockup-review.
+alwaysApply: false
+---
+
+<!-- shared-core: review/mockup-review.md -->
+
+# Mockup review checklist
+
+On-demand reviewer checklist for Figma mockups. **Procedure:** skill `mockup-review`. **Agent:** `mockup-reviewer`. Do not inline this checklist into the agent prompt.
+
+Stack-agnostic: no app-source globs, Playwright, or `xcodebuild`. Breakpoint **examples** live in adapter **Stack notes** only — do not FAIL on exact pixels.
+
+## When to load
+
+- Pipeline step `mockup-reviewer` (standalone intent `mockup-review` or embedded after analyst)
+- Prompt or `brief.md` contains a `figma.com` URL on a UI-capable stack
+- User asks to review a mockup / Figma file (not a code MR)
+
+## Inputs
+
+1. Task `artifact-manifest.json`, then prompt Figma URL(s); `brief.md` / `decomposition.md` when present
+2. Skill `mockup-review` + this rule
+3. If plugin skills `figma-use` / `figma-design-to-code` are installed: **reference** them for URL parse and MCP invocation only — do not copy their bodies; do not run design-to-code
+
+## MCP-first
+
+Required when MCP is up: `get_metadata`, `get_design_context`, `search_design_system`, `get_variable_defs`, `get_screenshot`. Optional: `get_libraries`, `get_code_connect_map`.
+
+**Forbidden:** `use_figma`, `create_new_file`, `generate_*`, `weave_*`, `upload_assets`, `send_code_connect_mappings`. FigJam URL → `BLOCKED_MCP` / out of scope (do not call `get_figjam` unless the URL is a FigJam board — then still `BLOCKED_MCP`).
+
+Cite `fileKey` + node IDs. Screenshots are supporting evidence, not a second reviewer. No screenshot-only path.
+
+**Node caps:** ≤12 screen-level frames; `get_metadata` depth ≤3 named-frame levels; ≤3 screenshots (prefer one per small/medium/large). `search_design_system` once; `get_variable_defs` once per file. No node-id on URL: pick top-level frames matching the feature name; if still unbounded → `BLOCKED_MCP` (or `PASS_WITH_NOTES` only if MCP returned a tiny file) — do not dump the whole file.
+
+**Degradation:** MCP unavailable or OAuth fail → verdict `BLOCKED_MCP`. Do **not** invent DS compliance claims.
+
+## Review dimensions
+
+### DS components (AC-4)
+
+When an attached library is detectable (`search_design_system` / `get_metadata`): list **library component instances vs custom frames** with file/node references. Flag substitutions where a DS equivalent exists.
+
+- Critical DS reimplementation (custom frame where an attached-library component exists) → **FAIL**
+- One-off frame, no DS equivalent; mixed/unpublished library → WARN or notes (`PASS_WITH_NOTES`)
+- No attached library detectable → notes only; do not invent DS claims (`PASS_WITH_NOTES`)
+
+Confidence: `high` (MCP library match) / `low` (unpublished or mixed) — prefer `PASS_WITH_NOTES` over FAIL when confidence is low.
+
+### Tokens (AC-5)
+
+When variables/styles are available (`get_variable_defs`, style metadata): flag fills, strokes, spacing, or typography that use raw values instead of bound variables/styles.
+
+- Isolated unbound values → **WARN** (`PASS_WITH_NOTES`)
+- Wholesale token ignore on a library-attached file (systemic; treat as critical DS with AC-4) → **FAIL**
+
+### Quality (AC-6)
+
+Cover at minimum, each item PASS / WARN / FAIL eligible:
+
+- Layer/frame naming hygiene
+- Auto-layout vs absolute positioning for responsive regions
+- Text style usage
+- Component variant/property correctness
+- Detached or orphaned component instances
+
+Naming hygiene, minor detached instances, text-style drift → **WARN**. Detached **core** DS component that is a substitution → **FAIL** (same as AC-4 critical). Absolute layout on a region that is the only «responsive» evidence → WARN unless it also fails viewports.
+
+### Feature coverage (AC-7)
+
+Map **flows → screens/frames**, **actions → interactive elements**, and **states** (empty, loading, error, success, disabled/validation). List explicit **missing** items. Label scope **`inferred`** when only a URL is provided (no brief AC).
+
+- Missing **core** flow or primary action from brief AC (or labeled `inferred` primary flow from the URL) → **FAIL**
+- Missing empty/loading/error/success on a form/list called out in AC → **FAIL**
+- Missing secondary states (disabled/validation) not in AC → **WARN**
+
+### Viewports (AC-8)
+
+Verify **≥3 viewport representations** (small / medium / large) via dedicated frames, Figma viewport presets, or responsive component variants.
+
+- Fewer than 3 → **FAIL**
+- 3 exist but sizes ≠ stack example buckets → **WARN** only (no exact pixel enforcement in core)
+
+## Severity (v1)
+
+Isolated **WARN** never blocks. Overall verdict = worst FAIL > BLOCKED_MCP > PASS_WITH_NOTES > PASS. Multiple WARNs without FAIL → `PASS_WITH_NOTES`, not FAIL.
+
+## Report headings
+
+Write `mockup-review.md` with these headings (must match the agent template):
+
+```markdown
+# Mockup review: <slug>
+
+## Verdict
+PASS | PASS_WITH_NOTES | FAIL | BLOCKED_MCP
+
+## Scope
+- Figma fileKey / node IDs
+- MCP: available | unavailable (reason)
+- Feature scope source: brief AC | prompt | inferred
+
+## Critical (must fix)
+## Warnings (should fix)
+## Suggestions
+## DS compliance (AC-4, AC-5)
+## Quality (AC-6)
+## Feature coverage (AC-7)
+## Viewport matrix (AC-8)
+## AC coverage
+| Criterion | Status | Notes |
+```
+
+## Stack notes
+
+Illustrative Android buckets (not enforced pixels): ~sw360 / sw600 / sw840 (phone / tablet / large) mapped to small / medium / large.

package/presets/cursor/android-kotlin/rules/preset-no-cross-stack-leakage.mdc

@@ -23,6 +23,7 @@ Ban leakage of stack-specific names, paths, and handoff stems across presets.
 - `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Android instrumentation agents, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
 - `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
 - Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
+- Storybook / Chrome DevTools MCP must **not** be required handoffs or agent stems (`storybook-reviewer`) on backend or mobile stacks. Frontend overlay mentions in `MCP.md` / `mcp-usage` Stack notes are OK.
 
 ## Forbidden in ios-swift hooks/agents (FAIL)
 
@@ -70,7 +71,8 @@ Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
 - `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
 - Positive yarn recipes `lint:js` / `lint:css`
 - `xcuitest-test-`, `instrumentation-test-`, `xcodebuild`, `SwiftLint` as required handoffs
-- Agent file `accessibility-reviewer` (no UI surface)
+- Agent files `accessibility-reviewer`, `mockup-reviewer`, `ux-designer` (no UI surface)
+- Required `skills/ux-design`, required `rules/ux-design`, or required pipeline handoff stem `ux-design`
 
 Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
 
@@ -82,7 +84,8 @@ Same UI/mobile bans as backend stacks, plus:
 - Positive yarn recipes `lint:js` / `lint:css` as required gates
 - `xcuitest-test-`, `instrumentation-test-`, `xcodebuild`, `SwiftLint` as required handoffs
 - Go tool commands as required MCP delivery gates: `go test`, `go vet`, `golangci-lint`
-- Agent files: `playwright-test-*`, `xcuitest-test-*`, `instrumentation-test-*`, `integration-test-*`, `accessibility-reviewer`
+- Agent files: `playwright-test-*`, `xcuitest-test-*`, `instrumentation-test-*`, `integration-test-*`, `accessibility-reviewer`, `mockup-reviewer`, `ux-designer`
+- Required `skills/ux-design`, required `rules/ux-design`, or required pipeline handoff stem `ux-design`
 
 Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`, `post-change-test`); Phase 1 gates `build-verifier` + `security-reviewer`.
 
@@ -97,4 +100,4 @@ Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`,
 
 ## Stack notes
 
-- **Authoring meta:** forbidden/required sections above describe **other stacks** (and this one) for preset authors. Consumer installs of `android-kotlin` must still keep foreign agent stems out of required handoffs.
+- **Authoring meta:** forbidden/required sections above describe **other stacks** (and this one) for preset authors. Consumer installs of `android-kotlin` must still keep foreign agent stems out of required handoffs.