@bonesofspring/ai-rules 0.2.19 → 0.2.21

package/presets/cursor/nuxt/rules/ai-local-overlay.mdc

@@ -0,0 +1,43 @@
+---
+description: Local overlay from .ai.local/ (consumer-owned rules with priority over preset rules) — MANDATORY
+alwaysApply: true
+impact: CRITICAL
+---
+
+# Local overlay (`.ai.local/`) — MANDATORY
+
+This rule is mandatory. **You MUST** obey it on every turn, without exception.
+
+## On every turn
+
+1. **Probe** — before answering, run `ls -la .ai.local` from the repository root.
+2. **Walk** — if `.ai.local/` exists at multiple levels (monorepo), read every level from root to leaf. **Deeper wins** in practice: more specific rules appear later in the assembled context and take precedence.
+3. **Apply** — treat every `.ai.local/rules/*.md` and `.ai.local/conventions.md` as a higher-priority rule for this repo. The block below ("Authoring `.ai.local/rules/*.md`") defines the conventions.
+4. **Conflict** — if a local rule conflicts with a preset rule, **the local rule wins**. If a local rule body contains `override: kill <preset-rule-name>`, drop that preset rule from your context window entirely.
+5. **Acknowledge** — when answering a user question, briefly state which `.ai.local/` rules apply to the current task (one line is enough). Format: `Using .ai.local: <rule-name>(, <rule-name>)*`. If no `.ai.local/` exists, do NOT mention this rule.
+
+If `.ai.local/` does not exist → **no-op**, do not error. Do not produce any log line about its absence.
+
+## Authoring `.ai.local/rules/*.md` (consumer-side reference)
+
+Each `.ai.local/rules/<name>.md` is a plain-markdown rule body. The model parses it as:
+
+- Lines before `## Body` are scope metadata. Only `glob:` / `globs:` / `override:` lines are recognised.
+- Everything from `## Body` onward is the rule body.
+- `glob: always` → always-on. Counts against your context budget.
+- `globs: <comma-separated globs>` → on-demand; applies only when matching files are in focus.
+- `override: kill <preset-rule-name>` → drop that preset rule from context.
+
+Keep files ≤ 120 lines. Match the style of preset rules (short sections, bullets, code examples).
+
+## Limitations (read this)
+
+- Cursor/Claude do **not** natively read `.ai.local/`. This rule is a **prompt-only** mechanism: it asks you, the model, to read and apply the files. Reliability is high but not 100%.
+- If a user adds a file to `.ai.local/` mid-session, **restart the session** to be sure it is picked up.
+- "Priority" is **contextual**, not enforced. Always re-read the local rule before answering questions that touch it.
+
+## Pointers
+
+- Authoring guide: `docs/LOCAL-OVERLAY.md` in the `@bonesofspring/ai-rules` package.
+- Living gotchas alternative: `.cursor/team/conventions.md`.
+- Root `AGENTS.md` reinforces this rule with a `MANDATORY` section.

package/presets/cursor/nuxt/rules/preset-pr-checklist.mdc

@@ -19,11 +19,15 @@ Checklist for PRs that touch `packages/ai-rules/presets/**` (and dogfood `.curso
 - [ ] **Core:** if `_shared/core/**` changed — all `<!-- shared-core: … -->` consumers updated (or documented intentional fork)
 - [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, nuxt, svelte, ios-swift, android-kotlin, go, java, mcp-ts, php-hexagonal, and php-laravel — see `preset-twin-sync`)
 - [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table is current
-- [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
+- [ ] **Token budget:** Cursor `alwaysApply` ≤ 4 (4th slot reserved for `ai-local-overlay`); Claude session-start exactly 3; meta rules not always-on
+- [ ] **Local overlay coverage:** every installable stack ships `ai-local-overlay.mdc` (Cursor) and `ai-local-overlay.md` (Claude) with `MANDATORY` + acknowledgement format + `docs/LOCAL-OVERLAY.md` pointer; Claude twin listed in `claude/<stack>/rules/README.md` mapping table. Run `packages/ai-rules/scripts/check-local-overlay.sh`.
 - [ ] **Leakage:** no foreign stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
+- [ ] **Hook-only lifecycle:** `status.json` / `metrics.json` writes happen only inside `hooks/`; agents read but never rewrite lifecycle fields. Run `packages/ai-rules/scripts/check-hook-only-lifecycle.sh`.
+- [ ] **Chain fork:** the byte-wise MD5 uniqueness of `chain-team-phases.sh` across the 10 stacks × 2 platforms (20 hooks) holds. Run `packages/ai-rules/scripts/check-chain-hook-coverage.sh` and `packages/ai-rules/scripts/test-chain-team-phases-coverage.mjs`.
 - [ ] **Twin depth:** domain ≥15 lines; thin aliases documented
 - [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
 - [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
+- [ ] **i18n anchors:** kept-marked Cyrillic fragments in `tests-unit.md(c)` stay consistent with their English counterparts. Run `packages/ai-rules/scripts/check-preset-i18n.sh`.
 - [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (or document intentional skip) when maintaining this monorepo
 - [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
 

package/presets/cursor/nuxt/rules/preset-token-budget.mdc

@@ -17,12 +17,16 @@ Invariants for rule loading in an **installed** preset (consumer app).
 
 | Platform | Always-on | Cap |
 |----------|-----------|-----|
-| Cursor | `alwaysApply: true` | **≤ 3** |
+| Cursor | `alwaysApply: true` | **≤ 4** |
 | Claude | rules **without** `paths:` | **exactly 3** |
 
+**Cursor 4th slot is reserved for `ai-local-overlay`** (consumer-owned `.ai.local/` rules). If you do not need local overlay, demote that rule to `globs: ["**/.ai.local/**"]` and revert to ≤3.
+
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (where documented): ≤140 lines total (stretch ≤120).
+Session-start body budget:
+- Claude trio: ≤140 lines total (stretch ≤120).
+- Cursor 4-set: ≤170 lines total (4 rules including `ai-local-overlay`).
 
 ## Meta / author rules
 
@@ -38,4 +42,4 @@ Orchestrator, feature-delivery, code-review, post-change gates, domain globs —
 
 ## Verifier
 
-build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.
+build-verifier **FAIL** if Cursor `alwaysApply` count exceeds 4, Claude session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/cursor/nuxt/rules/preset-twin-sync.mdc

@@ -39,6 +39,8 @@ Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
 
 - **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
 - **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+- **Slim-companion rules** (UI-edit bundle, slim app-cores, slim tooling): may be shorter than 15 lines **if and only if** the body is a pointer into shared-core / stack-prose (no standalone prose). Examples live in stack `rules/README.md` (e.g. `cursor/next/rules/README.md` "UI-edit bundle" intent).
+  - **Mechanical enforcement is pending.** Today build-verifier excludes only `agent-team-intake` / `technical-retro` / `preset-layering`; slim-companion rules currently pass under the same human-judgement path as thin aliases. Follow-up: add `allow_slim_stems` to `packages/ai-rules/scripts/check-preset-token-budget.sh` analogous to `trio_stems_allowlist`.
 
 ## Severity (build-verifier)
 

package/presets/cursor/nuxt/rules/tests-e2e-structure.mdc

@@ -1,50 +1,94 @@
 ---
-description: Structure of e2e tests and plans (Playwright)
+description: E2E test and plan structure (Playwright)
 globs: tests/e2e/**/*
 alwaysApply: false
 ---
 
-# E2E structure in the project
+<!-- shared-core: testing/testing-principles.md -->
 
+# Testing principles
+
+Stack-agnostic; concrete paths, runners, and selectors live in the stack adapter (`## Stack notes`).
+
+## Behavior vs. implementation
+
+- Verify **behavior and business rules**, not implementation or internal details.
+
+## File naming
+
+- For **new** tests use `*.spec.ts` / `*.spec.tsx`. Do not rename existing `*.test.ts` / `*.test.tsx` without a separate task (legacy).
+
+## Runner and matchers
+
+- Use the project's runner (Jest or Vitest are common); components — the project's Testing Library integration. Reuse existing matchers — no new micro-framework.
+
+## Test title locale
+
+- Consumer apps **may use the project locale** (often Russian) — clear business phrases stating what is checked and the expected outcome.
+- When ESLint enforces the locale (e.g. `jest/valid-title`): each sentence must start with a **capital letter** (including after `.`, `!`, `?`); a space after `.` followed by a lowercase letter is forbidden ("capital after period" violation).
+
+Good (Russian locale in consumer app):
+
+- `it('Возвращает пустой список. Пользователь не авторизован', () => {})` <!-- i18n-keep: E5 --> (Returns empty list. User is not authorized)
+
+Bad (no capital after period; or wrong locale for configured ESLint):
+
+- `it('Возвращает пустой список. пользователь не авторизован', () => {})` <!-- i18n-keep: E5 -->
+- `it('Returns empty list when user is guest', () => {})` (wrong locale if ESLint enforces Russian)
+
+## Isolation and mocks
+
+- Mock at the **public-contract boundary**; use the project's accepted HTTP/API/store mock approach. Do not mock what is part of the feature's public contract if that breaks the test's meaning.
+
+## Coverage of cross-cutting modules
+
+- When changing a **shared cross-cutting module** (e.g. HTTP client body parsing, headers, error / auth handling) — **update or add behavior tests** covering success, error, and edge branches relevant to the module under change.
+
+## Data transformation coverage
+
+- Data transformation functions with computed fields and branches must have unit tests covering edge cases (boundary values, missing fields, unexpected value combinations).
+
+## Reuse fixtures over ad-hoc random data
+
+- Prefer shared fixtures / handlers from the project's accepted mocks module; do not duplicate interfaces in tests. Use the API response types (DTO types) and the **target domain types** from the project's public type surface.
+
+## E2E: one canonical scenario plan per feature
+
+- For each feature keep a **single canonical scenario plan** (distinct from implementation specs; the stack adapter names the file — typically `*.cases.md`).
+
+## E2E: scenario ↔ test traceability
+
+- Every scenario has a corresponding test. **Do not weaken** assertions to match an outdated implementation — tests must reflect business expectations from the plan. Colocate plan and executable tests in the same directory.
+
+## E2E: page objects / shared helpers
+
+- Prefer page objects and shared helpers over scattered selectors and per-test setup duplication.
+
+## E2E: stable identifiers (PREFIX-XXX)
+
+- When scenarios need stable IDs, prefix the title with `PREFIX-XXX`: `PREFIX` = first letters of words in the entity under test (Latin uppercase); `XXX` = sequential number with three digits and leading zeros. Within one `PREFIX`, numbers must form a consistent sequence with no duplicates.
+- Example: `test('OH-001 Отображается список заказов', async ({ page }) => { ... })` <!-- i18n-keep: E5 --> (Order list is displayed)
+
+## E2E: selector priority
+
+- Prefer role/label selectors for accessibility and forms; fall back to `data-testid` for stable elements. Use a **hierarchical naming convention** on page roots and key interactive elements (stack adapter defines the scheme — typically `{parent}__{element}`).
+
+## E2E: keep plans and selectors in sync with UI
+
+- When changing UI: update selectors in page objects and cross-check with the scenario plan. When adding/changing tests: read the matching plan and sync scenario titles first.
+
+## Stack notes
+
+- Runner: Playwright (`@playwright/test`).
 - E2E folder: `tests/e2e/**`.
-- Scenario plans:
-  - `*.cases.md` files — **canonical source of scenarios**.
-- Tests:
-  - `*.spec.ts` files — Playwright scenario implementation.
-- Shared utilities and abstractions:
-  - `tests/e2e/_shared/**` — constants, fluent interfaces, helpers.
-
-# Principles
-
-- Every scenario from `*.cases.md` must have a matching test (or set of tests).
-- **Do not** weaken assertions in tests if that contradicts business expectations from the plans.
-- Prefer:
-  - page objects (e.g. `OrderHistoryPage.ts`);
-  - shared helpers from `_shared`.
-
-# E2E test naming
-
-- Language:
-  - all `test` / `it` names, `describe` blocks, and steps in `*.cases.md` must be formulated **in Russian**, describing behavior and the expected result. <!-- i18n-keep: E5 -->
-- E2E title format (`test(...)` / `it(...)`):
-  - before the scenario description, put a **numbered prefix** in the form: `PREFIX-XXX Scenario description`.
-  - `PREFIX` — abbreviation from the **first letters of the words** of the entity under test, written in **Latin uppercase**.
-    - example: `OrderHistory` → `OH`, `BillingReport` → `BR`.
-  - `XXX` — sequential test number **with three digits and leading zeros**: `001`, `002`, `010`, `123`, etc.
-  - full e2e title example:
-    - `test('OH-001 Отображается список заказов', async ({ page }) => { ... })` <!-- i18n-keep: E5 -->
-  - within one entity (`PREFIX`), test numbers must form a **consistent sequence** without duplicate numbers.
-
-# data-testid for e2e
-
-- **Selector priority:** `data-testid` for stable elements; `getByRole` and `getByLabel` for forms and accessible elements.
-- **Naming:** scheme `{parent}__{element}` (e.g. `history-page__title`, `history-page__recognition-banner__attach-files-button`).
-- **Where to add:** on page root containers and key interactive elements (buttons, links, fields) that page objects target.
-- **When UI changes:** update data-testid in components and matching selectors in page objects; align with `*.cases.md`.
-
-# Agent requirement
-
-When adding/changing e2e tests:
-- First look at the matching `*.cases.md` and sync scenario names.
-- Place specs next to plans in the same directory.
-- Reuse shared page objects and helpers; do not copy selectors into every test.
+- Scenario plans: `*.cases.md` — canonical source.
+- Tests: `*.spec.ts` — Playwright implementations.
+- Shared utilities: `tests/e2e/_shared/**`.
+- **Russian-locale HARD policy:** all `test` / `it` titles, `describe` blocks, and `*.cases.md` steps MUST be in Russian, describing behavior + expected result. <!-- i18n-keep: E5 -->
+- `data-testid` priority: `data-testid` for stable; `getByRole` / `getByLabel` for forms.
+- `data-testid` naming scheme `{parent}__{element}` — example `history-page__title`, `history-page__recognition-banner__attach-files-button`.
+- `PREFIX-XXX` example: `OrderHistory` → `OH`, `BillingReport` → `BR`.
+- Russian example: `test('OH-001 Отображается список заказов', async ({ page }) => { ... })` <!-- i18n-keep: E5 --> (Order list is displayed).
+- Page object example filename: `OrderHistoryPage.ts`.
+- Cross-reference: See also **`playwright-agents.mdc`** for planner / generator / healer.
+- `## Stack notes` content is stripped by `scripts/check-shared-core-drift.sh` before byte-comparing this file against `_shared/core/testing/testing-principles.md`; keep prose above (core content) verbatim against the core file.

package/presets/cursor/nuxt/rules/tests-unit.mdc

@@ -1,77 +1,92 @@
 ---
 description: Unit and integration tests (Testing Library and project runner)
 globs:
-  - **/*.spec.{ts,tsx}
-  - **/*.test.{ts,tsx}
+  - "**/*.spec.{ts,tsx}"
+  - "**/*.test.{ts,tsx}"
 alwaysApply: false
 impact: MEDIUM
 ---
 
-# General testing rules
+<!-- shared-core: testing/testing-principles.md -->
 
-- **File names:** for **new** tests use the **`*.spec.ts` / `*.spec.ts`** suffix. Do not rename existing **`*.test.ts` / `*.test.tsx`** without a separate task (legacy).
-- **Runner and matchers** — as in the project (often Jest or Vitest); for components — **@vue/test-utils**.
-- Primary goal of tests:
-  - verify **behavior and business rules**, not implementation or internal details.
-- **Unit test naming** (strings in `describe` / `it` / `test`):
-  - consumer apps **may use Russian locale** for titles — clear business phrases (what is checked and expected outcome);
-  - when ESLint enforces Russian (see below), each sentence in the title **must start with a capital letter** (including after `.`, `!`, `?` and with multiple sentences on one line); the first letter of the whole string is capitalized too.
-  - **CI check (when configured):** ESLint (`jest/valid-title` in `eslint.config.mjs`) may require titles to start with a Russian capital letter and forbid a space after `.` followed immediately by a lowercase letter (typical "capital after period" violation).
+# Testing principles
+
+Stack-agnostic; concrete paths, runners, and selectors live in the stack adapter (`## Stack notes`).
+
+## Behavior vs. implementation
+
+- Verify **behavior and business rules**, not implementation or internal details.
+
+## File naming
+
+- For **new** tests use `*.spec.ts` / `*.spec.tsx`. Do not rename existing `*.test.ts` / `*.test.tsx` without a separate task (legacy).
+
+## Runner and matchers
+
+- Use the project's runner (Jest or Vitest are common); components — the project's Testing Library integration. Reuse existing matchers — no new micro-framework.
+
+## Test title locale
+
+- Consumer apps **may use the project locale** (often Russian) — clear business phrases stating what is checked and the expected outcome.
+- When ESLint enforces the locale (e.g. `jest/valid-title`): each sentence must start with a **capital letter** (including after `.`, `!`, `?`); a space after `.` followed by a lowercase letter is forbidden ("capital after period" violation).
 
 Good (Russian locale in consumer app):
 
 - `it('Возвращает пустой список. Пользователь не авторизован', () => {})` <!-- i18n-keep: E5 --> (Returns empty list. User is not authorized)
-- `it('При ошибке сети показывается сообщение об ошибке', () => {})` <!-- i18n-keep: E5 --> (On network error, an error message is shown)
 
 Bad (no capital after period; or wrong locale for configured ESLint):
 
 - `it('Возвращает пустой список. пользователь не авторизован', () => {})` <!-- i18n-keep: E5 -->
-- `it('Returns empty list when user is guest', () => {})`
+- `it('Returns empty list when user is guest', () => {})` (wrong locale if ESLint enforces Russian)
 
-# Component tests
+## Isolation and mocks
 
-- Use `render` from `@vue/test-utils`.
-- Assertions:
-  - DOM matchers for Testing Library as wired in the project (`toBeInTheDocument`, `toHaveTextContent`, etc.).
-- Interactions:
-  - `userEvent` from `@testing-library/user-event`.
+- Mock at the **public-contract boundary**; use the project's accepted HTTP/API/store mock approach. Do not mock what is part of the feature's public contract if that breaks the test's meaning.
 
-# Isolation and mocks
+## Coverage of cross-cutting modules
 
-- For API/store work:
-  - mock the store (via test-store) or use the project's accepted HTTP/API mock approach.
-- Do not mock what is part of the feature's public contract if that breaks the test's meaning.
+- When changing a **shared cross-cutting module** (e.g. HTTP client body parsing, headers, error / auth handling) — **update or add behavior tests** covering success, error, and edge branches relevant to the module under change.
 
-# HTTP client
+## Data transformation coverage
 
-- When changing the **shared HTTP client implementation** (body parsing, headers, error branches, 401/refresh, `FormData`, `blob`, etc.) — **update or add behavior tests** next to the client module in `lib/clients/**` (prefer `*.spec.ts`; legacy `*.test.ts` — do not touch without a task).
-- Cover meaningful branches: successful JSON, HTTP error, network, auth scenarios relevant to the project.
+- Data transformation functions with computed fields and branches must have unit tests covering edge cases (boundary values, missing fields, unexpected value combinations).
 
-# Mappers and data transformation
+## Reuse fixtures over ad-hoc random data
 
-- Data mapping functions (DTO → domain model and back), especially with computed fields and branches, must have unit tests.
-- In mapper tests, pay special attention to edge cases and business-rule regression (for example, boundary values, missing fields, unexpected value combinations).
+- Prefer shared fixtures / handlers from the project's accepted mocks module; do not duplicate interfaces in tests. Use the API response types (DTO types) and the **target domain types** from the project's public type surface.
 
-# Agent requirement
+## E2E: one canonical scenario plan per feature
 
-When adding tests:
-- Follow existing test structure and patterns in the repository: `*.spec.ts(x)` next to the module or in a shared test directory — as in neighboring features.
-- Add tests for critical logic branches and edge cases.
- - When working with data:
-   - use **response types** from the API (DTO types) and **target domain types** from `@/types`; do not duplicate interfaces in tests;
-   - when possible, rely on data and handlers from `mocks/**` (or repo equivalent), not ad-hoc random test data.
- - Placement:
-   - for **UI components** — **do not create** a `__tests__` subdirectory inside the component folder; the test is a sibling `*.spec.ts`.
-   - in **other modules** (for example `api/services`) an existing `__tests__` layout is acceptable — do not break it for UI uniformity.
-   - **new** files — `*.spec.ts` / `*.spec.ts` (see "File names" above).
-## Incorrect
+- For each feature keep a **single canonical scenario plan** (distinct from implementation specs; the stack adapter names the file — typically `*.cases.md`).
 
-```ts
-it('returns empty list when guest', () => {})
-```
+## E2E: scenario ↔ test traceability
 
-- `it('Возвращает пустой список. пользователь не авторизован', () => {})` <!-- i18n-keep: E5 -->
+- Every scenario has a corresponding test. **Do not weaken** assertions to match an outdated implementation — tests must reflect business expectations from the plan. Colocate plan and executable tests in the same directory.
+
+## E2E: page objects / shared helpers
+
+- Prefer page objects and shared helpers over scattered selectors and per-test setup duplication.
+
+## E2E: stable identifiers (PREFIX-XXX)
+
+- When scenarios need stable IDs, prefix the title with `PREFIX-XXX`: `PREFIX` = first letters of words in the entity under test (Latin uppercase); `XXX` = sequential number with three digits and leading zeros. Within one `PREFIX`, numbers must form a consistent sequence with no duplicates.
+- Example: `test('OH-001 Отображается список заказов', async ({ page }) => { ... })` <!-- i18n-keep: E5 --> (Order list is displayed)
+
+## E2E: selector priority
+
+- Prefer role/label selectors for accessibility and forms; fall back to `data-testid` for stable elements. Use a **hierarchical naming convention** on page roots and key interactive elements (stack adapter defines the scheme — typically `{parent}__{element}`).
+
+## E2E: keep plans and selectors in sync with UI
+
+- When changing UI: update selectors in page objects and cross-check with the scenario plan. When adding/changing tests: read the matching plan and sync scenario titles first.
 
-## Correct
+## Stack notes
 
-- `it('Возвращает пустой список. Пользователь не авторизован', () => {})` <!-- i18n-keep: E5 -->
+- `render` and DOM matchers (`toBeInTheDocument`, `toHaveTextContent`, …) from `@vue/test-utils`.
+- `userEvent` from `@testing-library/user-event`.
+- `jest/valid-title` ESLint rule in `eslint.config.mjs` (Nuxt project root; no `app/` prefix) — capital-after-period.
+- HTTP-client behavior tests next to `lib/clients/**` (Nuxt convention, no `app/` prefix).
+- Shared fixtures live in `mocks/**`; DTO types from API + `@/types` for domain types — never duplicate interfaces in tests.
+- Mock the store via `test-store` (Pinia) or the project's accepted HTTP/API mock approach.
+- UI placement: sibling `*.spec.ts` (no `__tests__/` inside component folder); `api/services` `__tests__` layout is acceptable.
+- `## Stack notes` content is stripped by `scripts/check-shared-core-drift.sh` before byte-comparing this file against `_shared/core/testing/testing-principles.md`; keep prose above (core content) verbatim against the core file.

package/presets/cursor/nuxt/skills/code-review/SKILL.md

@@ -33,6 +33,12 @@ Lead with findings ordered by severity. Required shape (also in `code-review-mr`
 
 For agent team tasks, write `.cursor/team/tasks/<slug>/review.md` and upsert the owned terminal receipt (`completed` or `changes_requested`); do not mutate `status.json`.
 
+## Receiving review feedback
+
+<!-- shared-core: review/receiving-code-review.md -->
+
+When **implementing** review comments (not when issuing them): verify each item against the codebase before changing code; do not perform agreement (`You're absolutely right!`). Unclear items → ask, do not guess.
+
 ## Design guidance
 
 - Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/nuxt/skills/debug-investigation/SKILL.md

@@ -3,19 +3,36 @@ name: debug-investigation
 description: Investigates bugs, failing tests, crashes, and incorrect behavior with runtime evidence before applying minimal fixes. Use for bugfix tasks, debugger agent runs, regressions, and flaky test diagnosis.
 ---
 
-# Debug Investigation
+<!-- shared-core: quality/debug-investigation.md -->
 
-## Process
+# Debug investigation
 
-1. Reproduce the issue or collect the closest available evidence: error output, failing test, browser snapshot, logs, or user steps.
-2. Define expected vs actual behavior in one sentence.
-3. Trace the failing path through the smallest relevant slice of the codebase.
-4. Identify the root cause before editing. Avoid broad refactors during bugfixes.
-5. Apply the smallest fix that preserves existing architecture and public contracts.
-6. Add or update a regression test when the behavior is user-facing or likely to recur.
-7. Run the narrow failing check first, then relevant lint/type/test validation.
+Stack-agnostic root-cause loop. Consumed by skill `debug-investigation` and agent `debugger`. Platform paths, MCP, and stack commands belong in adapter **Stack notes**.
 
-## Artifacts
+## When
+
+Any bug, test failure, build failure, or unexpected behavior — **before** proposing a fix.
+
+## Phases (in order)
+
+1. **Evidence** — reproduce, or collect the closest evidence (error output, failing test, logs, user steps).
+2. **Isolate** — expected vs actual in one sentence; smallest relevant slice of the codebase.
+3. **Root cause** — name the cause before editing. One hypothesis at a time; do not stack speculative fixes.
+4. **Minimal fix + verify** — smallest change that preserves architecture and public contracts. Add a regression test when the behavior is user-facing or likely to recur. Re-run the **failing** check first, then the relevant lint/type/test slice.
+
+## 3-fix architecture gate
+
+If **three** fix attempts fail, or the same symptom returns after two supposed fixes: **STOP**. Do not attempt fix #4. Escalate — the design is likely wrong (human partner or `solution-architect`). Chasing symptoms is the failure mode.
+
+## Do not
+
+- Broad refactor during a bugfix.
+- Fix only where the error surfaces if invalid data originates elsewhere.
+- Claim `fixApplied: true` without re-running the failing check (see `quality/verification-before-completion.md`).
+
+## Stack notes
+
+### Artifacts
 
 For agent team tasks, write `.cursor/team/tasks/<slug>/debug-report.md` with:
 
@@ -28,7 +45,7 @@ For agent team tasks, write `.cursor/team/tasks/<slug>/debug-report.md` with:
 Agent team: upsert the owned terminal receipt in `artifact-manifest.json`; do not mutate `status.json`.
 
 
-## MCP usage
+### MCP usage
 
 Load requestable rule `mcp-usage` when verifying third-party library APIs (Context7) or when a local overlay MCP is present and the task fits. Discover tools at runtime; do not invent schemas. Overlay absence is not a blocker unless the user required that MCP as source of truth.
 
@@ -39,6 +56,6 @@ Shipped browser split: Playwright MCP for e2e specs/selectors; Chrome DevTools M
 If a Sentry/Datadog (or similar) MCP is ready and the task is a production error, event, or trace, use it. Do not invent telemetry.
 
 
-## Design guidance
+### Design guidance
 
 - Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/nuxt/team/README.md

@@ -106,8 +106,6 @@ Prefer **`executing`** for pipeline mode. Legacy: `analysis`, `development`, `re
 /technical-retro <slug>
 ```
 
-Legacy: `/feature-start`, `/feature-continue`.
-
 ## Creating task dirs
 
 Bootstrap `<slug>/` by **writing** `pipeline.json` (Write tool). Runtime/hook owns `status.json` lifecycle; parent may only create a minimal bootstrap if missing. Do **not** use Shell `mkdir -p` — Cursor’s default sandbox returns `Operation not permitted` (especially for repos on macOS Desktop/Documents).
@@ -116,7 +114,6 @@ Bootstrap `<slug>/` by **writing** `pipeline.json` (Write tool). Runtime/hook ow
 
 Commit task artifacts if you want them to survive `ai-rules clean cursor`. Or copy finished tasks to `docs/agent-workflow/tasks/<slug>/`.
 
-
 ## specMode, applyReadiness, memlog
 
 - **`specMode`:** `consume` | `generate` | `none` — primary in `brief.md` `## Spec mode`; optional top-level `pipeline.json` `specMode`. `none` skips INDEX/author mode (spike/research).

package/presets/cursor/php-hexagonal/AGENTS.md

@@ -26,7 +26,7 @@ Copies rules/agents/hooks/skills/commands/team + `REPO_AGENTS.md` → root `AGEN
 
 - **21 agents** — see `agents/README.md` (no a11y / Playwright / XCUITest)
 - **10 skills** — `feature-delivery`, `spec-authoring`, `spec-discovery`, `unit-testing`, `integration-testing`, `ci-investigation`, `debug-investigation`, `code-review`, `technical-retro`, `write-adr`
-- **5 commands** — `/task`, `/task-continue`, `/feature-start`, `/feature-continue`, `/technical-retro`
+- **3 commands** — `/task`, `/task-continue`, `/technical-retro`
 
 ## Dogfood (5 scenarios)
 

package/presets/cursor/php-hexagonal/agents/README.md

@@ -8,7 +8,7 @@ Role subagents for the Cursor agent-team pipeline (PHP hexagonal).
 |-------|------|-----------------|
 | Codebase analyzer | `codebase-analyzer.md` | no (explain-as-is only) |
 
-## Roster (21)
+## Roster (22)
 
 | Agent | Production writes |
 |-------|-------------------|
@@ -19,6 +19,7 @@ Role subagents for the Cursor agent-team pipeline (PHP hexagonal).
 | debugger, ci-investigator | minimal |
 | code-reviewer, security-reviewer, performance-auditor | team only |
 | migration-specialist, api-contract-reviewer, tech-writer | team / docs |
+| openspec-author | `openspec/**` only — used only when the consumer repo has `openspec/` initialized |
 | qa-tester, unit-test-*, integration-test-* | tests |
 
 **No** `accessibility-reviewer`, Playwright, or XCUITest stems. Replace those intents with **`integration-test-*`**.
@@ -32,5 +33,5 @@ All agents use **`readonly: false`** (need writes under `.cursor/team/**`). Prod
 | Tier | Frontmatter | Agents |
 |------|-------------|--------|
 | **cheap** | `fast` | router, analyst, build-verifier, code-reviewer, tech-writer, codebase-analyzer |
-| **standard** | `inherit` | developer, debugger, ci-investigator, api-contract, qa, unit-*, integration-* |
+| **standard** | `inherit` | developer, debugger, ci-investigator, api-contract, qa, unit-*, integration-*, openspec-author |
 | **strong** | `claude-opus-4-8[effort=high]` | solution-architect, migration-specialist, security-reviewer, performance-auditor |

package/presets/cursor/php-hexagonal/agents/build-verifier.md

@@ -17,6 +17,12 @@ You are the build verifier for **PHP hexagonal** services (and for **ai-rules pr
 
 **Never** require Playwright, XCUITest, `lint:js`/`lint:css`, `xcodebuild`/`SwiftLint`, `mvn`, or `gradlew` as the PHP gate.
 
+## Verification before completion
+
+<!-- shared-core: quality/verification-before-completion.md -->
+
+Before writing `validation-report.md` or claiming PASS: IDENTIFY the commands, RUN them, READ exit codes, VERIFY they match the verdict, THEN claim. Do not mark PASS from memory of a prior developer run.
+
 ## Preset-structure validation (when editing `packages/ai-rules/presets/**`)
 
 From `packages/ai-rules/`:

package/presets/cursor/php-hexagonal/agents/ci-investigator.md

@@ -27,3 +27,4 @@ If a Sentry/Datadog (or similar) MCP is ready and the task is a production error
 ## Anti-sycophancy discipline
 
 - When writing or changing code, load / follow rule `anti-sycophancy-discipline`.
+- When acting on review feedback (`changes_requested` / human comments): verify each item against the codebase before implementing; no performative agreement.

package/presets/cursor/php-hexagonal/agents/code-reviewer.md

@@ -16,6 +16,8 @@ You are a senior PHP hexagonal code reviewer. Write only review artifacts under
 
 Apply skill `code-review` and `code-review-mr.mdc`. Weigh `architecture-boundaries.mdc`, `domain-layer.mdc`, `application-usecases.mdc`, `ports-interfaces.mdc`, `adapters-driving.mdc`, `adapters-driven.mdc`, `composition-root.mdc`, `php-conventions.mdc`, `tests-unit.mdc`, `tests-integration.mdc`, `security-php.mdc`.
 
+You **issue** reviews. Implementers acting on your findings must verify each item against the codebase and must not perform agreement. Do not require gratitude in replies.
+
 ## Review focus (PHP hexagonal)
 
 - If the MR touches `docs/specs/**`, load **`product-specs`** (+ **`product-specs-authoring`** when new/changed specs): **WARN** code/spec drift; **FAIL** broken INDEX `path` link or missing required frontmatter keys/arrays on touched spec files; required body headings missing → **FAIL** on touched files. Do not invent missing product behavior.

package/presets/cursor/php-hexagonal/agents/debugger.md

@@ -6,6 +6,8 @@ readonly: false
 
 Investigate with **runtime evidence**: failing `composer test` / `vendor/bin/phpunit` output, logs, stack traces, minimal repro.
 
+Use the **`debug-investigation` skill** for the investigation loop.
+
 ## Approach
 
 1. Reproduce with `composer test` / `vendor/bin/phpunit` / focused class/package tests.
@@ -21,6 +23,10 @@ Investigate with **runtime evidence**: failing `composer test` / `vendor/bin/php
 Write `.cursor/team/tasks/<slug>/debug-report.md`.
 
 
+## 3-fix architecture gate
+
+After **three** unsuccessful fix attempts (or the same symptom returning twice): STOP. Do not attempt fix #4. Escalate architecture with the human or `solution-architect`. Follow skill `debug-investigation`. Before `fixApplied: true`, re-run the failing check.
+
 ## MCP usage
 
 Load requestable rule `mcp-usage` when verifying third-party library APIs (Context7) or when a local overlay MCP is present and the task fits. Discover tools at runtime; do not invent schemas. Overlay absence is not a blocker unless the user required that MCP as source of truth.
@@ -35,3 +41,4 @@ If a Sentry/Datadog (or similar) MCP is ready and the task is a production error
 ## Anti-sycophancy discipline
 
 - When writing or changing code, load / follow rule `anti-sycophancy-discipline`.
+- When acting on review feedback (`changes_requested` / human comments): verify each item against the codebase before implementing; no performative agreement.

package/presets/cursor/php-hexagonal/agents/feature-developer.md

@@ -45,6 +45,13 @@ Update `.cursor/team/tasks/<slug>/implementation.md` and the owned implementatio
 ## Anti-sycophancy discipline
 
 - When writing or changing code, load / follow rule `anti-sycophancy-discipline`.
+- When acting on review feedback (`changes_requested` / human comments): verify each item against the codebase before implementing; no performative agreement.
+
+## Verification before completion
+
+<!-- shared-core: quality/verification-before-completion.md -->
+
+Before handoff, IDENTIFY→RUN→READ→VERIFY the scoped checks for this WP, THEN claim. Do not say the work is done without that evidence in the same turn. Full-project lint is `build-verifier`.
 
 ## Product specs (docs/specs)