@bonesofspring/ai-rules 0.2.26 → 0.2.28

package/presets/cursor/next/ai-local/rules-library/pre-pr-checklist.md

@@ -0,0 +1,16 @@
+glob: always
+
+## Body
+
+# Pre-PR checklist
+
+Before opening a PR / finishing a branch, acknowledge: `Using .ai.local: pre-pr-checklist(, …)*`.
+
+## Checklist
+
+- [ ] Commits split: source / artifacts / docs; one area each; no mixed trees
+- [ ] `git status` clean of temp dumps, `* (1).*` copies, debug flags
+- [ ] Lint + type-check + targeted unit + storybook vitest green
+- [ ] e2e plan executed for user-flow AC; mock-path regexes match ≥1 route
+- [ ] L2/L3 `proposal.md` claims reconcile with the shipped diff
+- [ ] Review artifacts cite the reviewed revision (sha)

package/presets/cursor/next/ai-local/rules-library/router-pages.md

@@ -0,0 +1,23 @@
+override: kill next-app-router
+globs: src/pages/**/*.{ts,tsx},src/ui/**/*.{ts,tsx},next.config.ts
+
+## Body
+
+# Routing — Pages Router (not App Router)
+
+When doing routing / page / navigation work, acknowledge: `Using .ai.local: router-pages(, …)*`.
+
+This rule drops the preset's `next-app-router` rule from context for repos using the **Next.js Pages Router**. Enable by moving this file into `.ai.local/rules/` (it is staged-inactive in `.ai.local/rules-library/` by default).
+
+## Rules
+
+- Route files live in `src/pages/<route>/index.tsx` (or `<route>.tsx`), thin wrappers.
+- Domain UI lives in `src/ui/pages/<Name>Page`; route files do not contain layout/business logic.
+- Navigation: `next/router` (`useRouter`) and `next/link`. **Never** `next/navigation`.
+- `_app.tsx` / `_document.tsx` stay in `src/pages/`.
+
+## Forbidden
+
+- Creating App Router files (`src/app/**`, `page.tsx`, `layout.tsx`, `loading.tsx`, `error.tsx`, `route.ts`).
+- Importing `next/navigation` or App Router server APIs (`cookies()`, `headers()`, `redirect()`).
+- `getServerSideProps` / `getStaticProps` — the app is a client-rendered static export; data goes through the store/`@/api`.

package/presets/cursor/next/ai-local/rules-library/single-source-copy-constants.md

@@ -0,0 +1,16 @@
+globs: src/**/*.{ts,tsx}
+
+## Body
+
+# Single source for copy, constants, enums, routes
+
+When editing `src/**`, acknowledge: `Using .ai.local: single-source-copy-constants(, …)*`.
+
+Copy (button labels, headings, alt text, aria-labels), constants, enums, and route paths live in **one** owner module. Components import from that module — they do not redeclare literals.
+
+## Rules
+
+- User-visible copy: inline unless the same string is used in ≥2 distinct places OR is consumed by tests/stories that need a shared reference. Multi-instance refactors belong to a dedicated task.
+- Numeric / pixel / token aliases: inline directly; do not re-wrap into a named constant when used exactly once in the same file.
+- Counters and derived single-use values: inline (`array.length`, computed expressions).
+- Layout sizes of one component (skeleton `height`/`width`/`maxWidth`, one-off `px`) stay as literals in the JSX prop or in `styles.ts`. Do not hoist them into named constants or a `*.data.ts`, even when the same number is repeated in that component's JSX and its styles.

package/presets/cursor/next/commands/task.md

@@ -1,6 +1,6 @@
 ---
 name: task
-description: Route a natural-language task through the agent-team pipeline: task-router, pipeline.json, and the first planned specialist.
+description: "Route a natural-language task through the agent-team pipeline: task-router, pipeline.json, and the first planned specialist."
 ---
 
 # Task — unified entry point (router + pipeline)

package/presets/cursor/next/hooks/chain-team-phases.sh

@@ -42,7 +42,10 @@ try {
 }
 
 const slug = active.slug;
-if (!slug) {
+// Reject non-kebab / traversal slugs: the runtime writes status.json and
+// metrics.json under tasks/<slug>, so an unchecked slug could escape the tree.
+const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+if (typeof slug !== 'string' || slug.length > 48 || !SLUG_RE.test(slug)) {
   process.stdout.write('{}');
   process.exit(0);
 }
@@ -69,6 +72,9 @@ function waitForMetricsLock() {
   // and never blocked on the lock file, so two concurrent subagentStop events
   // could both acquire the lock and corrupt metrics.json. Retry EEXIST with a
   // 10 ms sleep up to 200 attempts (2 s ceiling). On any other error, throw.
+  // A lock left behind by a killed process is reclaimed once its mtime is older
+  // than STALE_LOCK_MS, so one crash cannot brick the task forever.
+  const STALE_LOCK_MS = 30000;
   for (let attempt = 0; attempt < 200; attempt += 1) {
     try {
       const fd = fs.openSync(METRICS_LOCK, 'wx');
@@ -76,6 +82,13 @@ function waitForMetricsLock() {
       return;
     } catch (error) {
       if (!error || error.code !== 'EEXIST') throw error;
+      try {
+        const lockStat = fs.statSync(METRICS_LOCK);
+        if (Date.now() - lockStat.mtimeMs > STALE_LOCK_MS) {
+          fs.unlinkSync(METRICS_LOCK);
+          continue;
+        }
+      } catch {}
       const until = Date.now() + 10;
       while (Date.now() < until) { /* 10 ms busy-wait */ }
     }
@@ -495,7 +508,10 @@ function legacyFlow() {
 
 
 if (hookInput.action === 'end_human_gate') {
-    status.awaitingHumanGate = false;
+  // Only advance when a gate was actually open. A duplicate or retried
+  // end_human_gate must be a no-op, not a silent pipeline skip.
+  const gateWasOpen = Boolean(status.activeHumanGateEventId) || status.awaitingHumanGate === true;
+  status.awaitingHumanGate = false;
   // A2 (retro §8): pin a single runId per pipeline so subsequent events don't
   // fragment the metrics ledger across multiple runId sequences. Prefer
   // metrics.json.task.runId when metrics already exist, then status.metricsRunId,
@@ -522,7 +538,7 @@ if (hookInput.action === 'end_human_gate') {
     });
     delete status.activeHumanGateEventId;
   }
-  if (hookInput.activateNext && fs.existsSync(pipelinePath)) {
+  if (gateWasOpen && hookInput.activateNext && fs.existsSync(pipelinePath)) {
     let resumePipeline = null;
     try { resumePipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); } catch {}
     if (resumePipeline) {
@@ -544,6 +560,19 @@ if (hookInput.action === 'end_human_gate') {
         else out(handoffForAgent(resumeAgents[0], resumeNext.step.scope, resumeNext.step));
         process.exit(0);
       }
+      // Gate on the final step: no executable step remains. Complete the
+      // pipeline instead of leaving it in_progress forever.
+      status.state = 'completed';
+      completeTaskMetrics();
+      writeStatus({
+        pipelineIndex: resumeSteps.length,
+        phase: 'done',
+        state: 'completed',
+        currentAgent: null,
+        awaitingHumanGate: false,
+      });
+      out(`Pipeline complete for "${slug}". Run /technical-retro ${slug}.`);
+      process.exit(0);
     }
   }
   // A2 (retro §8): if gate closes the final human gate of the pipeline

package/presets/cursor/next/rules/README.md

@@ -9,7 +9,7 @@
 
 ### Loading strategy
 
-- **`alwaysApply: true`** (Cursor) / **without `paths:`** (Claude) — base invariants (**Cursor ≤4**, Claude exactly 3):
+- **`alwaysApply: true`** (Cursor) / **without `paths:`** (Claude) — base invariants (Cursor/Claude 3–5):
   - Cursor: `next-app-core`, `package-manager`, `code-quality-and-refactoring`, `ai-local-overlay`
   - Claude: `next-app-core`, `package-manager`, `code-quality`
 - **On-demand / requestable** — `post-change-lint` (**required after code edits**, not always-on), `agent-team-intake` (via orchestrator/commands), `agent-team-orchestrator`, architecture, imports, UI, tests, feature-delivery-workflow, `design-guidance`, `mcp-usage`, `anti-sycophancy-discipline`, `react-next-anti-hallucination`, reference-features, product-specs, product-specs-authoring, next-app-router, `security-next`, react-a11y-coding, `technical-retro`, `mockup-review`, `ux-design`

package/presets/cursor/next/rules/api-services.mdc

@@ -21,8 +21,8 @@ impact: HIGH
 - For each domain area (for example, orders, billing, account settings):
   - a separate directory in `app/src/api/services/<ServiceName or feature>/**` following repository convention.
 - Inside a module:
-  - files with API calls (`index.ts` or `*.service.ts`);
-  - mapper files (`*responseMappers.ts`);
+  - files with API calls — follow the repo's shape: `index.ts` / `*.service.ts`, **or** a per-domain module exporting an object (`XxxApiMethods` in `<Domain>.apiMethods.ts` with `<Domain>.endpoints.ts` and `<Domain>.responseTypes.ts`) as in neighboring services;
+  - mapper files (`*responseMappers.ts`) — pure `format…` / `map…` functions named as in the repo;
   - request/response-specific types (if not moved to `app/src/types/**` with export through the `@/types` barrel).
   - when needed — local `index.ts` / barrel inside the module for structure **within** `app/src/api/**`; **outside** this layer UI, store, and other code import only from the root barrel `app/src/api/index.ts` (`import … from '@/api'`, **`public-imports.mdc`**).
 
@@ -70,10 +70,12 @@ export const getCard = async (id: string) => {
 
 ```ts
 import type { TCard } from '@/types'
-import { mapCardResponse } from './cardResponseMappers'
+import { formatCardResponse } from './cardResponseMappers'
 
 export const getCard = async (id: string): Promise<TCard> => {
   const { data } = await cardsClient.get(`/cards/${id}`)
-  return mapCardResponse(data)
+  return formatCardResponse(data)
 }
 ```
+
+Mapper function verb (`format…` vs `map…`) follows the repo — match neighboring mappers.

package/presets/cursor/next/rules/code-quality-and-refactoring.mdc

@@ -19,6 +19,12 @@ alwaysApply: true
 - **CUPID:** Composable; Unix philosophy (one responsibility); Predictable; Idiomatic (repo); Domain-based.
 - **Composition over inheritance;** Law of Demeter — no `a.b.c.d` chains; via public API / facade.
 
+# Over-abstraction guardrails
+
+- **No unnecessary constants:** do not hoist a one-off literal, string, or boolean into a named constant. Inline it, or use an existing token/enum when the value is meaningful and reused. Named constants are for shared, semantic, or repeated values.
+- **No invented utilities:** do not add a `utils`/helper for a single call site or a thin pass-through wrapper. Inline it or extend the existing helper; a new shared utility is justified only after the Rule of Three.
+- **Decompose over conditionals:** a unit (function, component, hook) that accumulates several branches (`if` / ternary / `switch`) should be split into smaller units with one reason to change instead of piling up conditions.
+
 # Refactoring during changes
 
 - Light refactor is OK if it reduces duplication, improves readability, and does not break public contracts.

package/presets/cursor/next/rules/feature-delivery-workflow.mdc

@@ -11,6 +11,10 @@ alwaysApply: false
 
 When the prompt or `brief.md` contains a `figma.com` URL, **mockup review** (`mockup-reviewer` / skill `mockup-review`) must complete — or the user must continue past FAIL/`BLOCKED_MCP` via `/task-continue` — **before UI implementation**. Non-UI tasks no-op this gate. When required-signal and **no** `figma.com`, **`ux-design.md`** (on the analysis manifest entry) must exist and not be `INCOMPLETE` before UI work — else **blocked**, hand back to `task-analyst`. Parallel to the mockup gate.
 
+## Style discovery (mandatory)
+
+Before writing a new file in a layer, open **1–2 analog files** in the same layer and mirror: export shape, name prefixes (`T` / `I` where the repo uses them), file suffixes (`.apiMethods.ts`, `.endpoints.ts`, `.data.ts`, `.hooks.ts`, `styles.ts`), mapper / selector / thunk naming, and barrel shape. Record the analogs in the handoff. Where this preset's examples differ from the repo, **the repo wins**.
+
 Typical feature with backend data and shared state. Layer details — `architecture-boundaries.mdc`, `next-app-core.mdc`.
 
 ## Checklist (work order)

package/presets/cursor/next/rules/next-app-core.mdc

@@ -10,8 +10,9 @@ Concrete versions come **from `package.json` and configs of the target repositor
 # Project structure
 
 - `app/` — Next.js root; `app/src/**` — code; `app/__tests__/e2e/**` — e2e.
-- `app/tsconfig.json`: `baseUrl: "."`, `paths: { "@/*": ["./src/*"] }`.
+- `app/tsconfig.json`: `paths: { "@/*": ["./src/*"] }` (`baseUrl` may be absent with TS ≥5 / `moduleResolution: bundler` — check the file, do not add it blindly).
 - **Requirement:** `@/*` instead of relative imports that climb the tree.
+- **Router mode:** detect from the repo before adding routes — App Router (`app/src/app/**`, `page.tsx`) vs Pages Router (`app/src/pages/**`, `_app.tsx`). Do **not** assume App Router; follow the mode already in use (`next-app-router.mdc`, `navigation-router-stack.mdc`).
 
 # Architectural layers
 

package/presets/cursor/next/rules/preset-layering.mdc

@@ -1,5 +1,5 @@
 ---
-description: Preset authoring: Core → Stack → Platform layering. Use when editing packages/ai-rules/presets/**.
+description: "Preset authoring: Core → Stack → Platform layering. Use when editing packages/ai-rules/presets/**."
 globs:
   - packages/ai-rules/presets/**/*
   - .cursor/rules/**/*
@@ -18,7 +18,7 @@ Rules for **preset authors** (`packages/ai-rules/presets/**`). Not always-on in
 | Layer | Where | What to put |
 |-------|-------|-------------|
 | **Core** | `presets/_shared/core/**` | Stack-agnostic prose + checklists; no frontmatter; no paths `app/**`, `Features/**`, Playwright, xcodebuild |
-| **Stack** | `presets/{cursor\|claude\|mavis\|opencode}/<stack>/` | Domain/tooling, stack always-on trio, stack examples in **Stack notes** |
+| **Stack** | `presets/{cursor\|claude\|mavis\|opencode}/<stack>/` | Domain/tooling, stack always-on set (3–5), stack examples in **Stack notes** |
 | **Platform** | Cursor `.mdc` / Claude `.md` / Mavis `.md` / OpenCode `.md` | Frontmatter (`alwaysApply`/`globs` vs `paths:` vs OpenCode `mode`/`permission`), platform-only (`BUGBOT.md`, `CLAUDE.md`) |
 
 ## Where to put a new rule

package/presets/cursor/next/rules/preset-no-cross-stack-leakage.mdc

@@ -1,5 +1,5 @@
 ---
-description: Preset authoring: forbid cross-stack agent/path leakage in hooks and agents.
+description: "Preset authoring: forbid cross-stack agent/path leakage in hooks and agents."
 globs:
   - packages/ai-rules/presets/**/*
   - .cursor/rules/**/*

package/presets/cursor/next/rules/preset-pr-checklist.mdc

@@ -1,5 +1,5 @@
 ---
-description: Preset authoring: PR checklist for twin sync, budget, leakage, README. Use on preset PRs.
+description: "Preset authoring: PR checklist for twin sync, budget, leakage, README. Use on preset PRs."
 globs:
   - packages/ai-rules/presets/**/*
   - .cursor/rules/**/*
@@ -21,7 +21,7 @@ Checklist for PRs that touch `packages/ai-rules/presets/**` (and dogfood `.curso
 - [ ] **Mavis derive:** mapped `cursor/<stack>/` change → `mavis/<stack>/` + `adapter-map.json` **same PR** when the stack is in `releasedStacks` (run `generate-mavis.mjs --stack <stack>` + `check-mavis-adapter-map.mjs`; see `preset-twin-sync` § Mavis derivation)
 - [ ] **OpenCode derive:** mapped `cursor/<stack>/` change → `opencode/<stack>/` + `adapter-map.json` **same PR** when the stack is in `releasedStacks` (run `generate-opencode.mjs --stack <stack>` + `check-opencode-adapter-map.mjs`; see `preset-twin-sync` § OpenCode derivation)
 - [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table is current
-- [ ] **Token budget:** Cursor `alwaysApply` ≤ 4 (4th slot reserved for `ai-local-overlay`); Claude session-start exactly 3; meta rules not always-on
+- [ ] **Token budget:** Cursor `alwaysApply` and Claude session-start both **3–5** (extra slots reserved for `ai-local-overlay`); body sum ≤200 (stretch ≤170); meta rules not always-on
 - [ ] **Local overlay coverage:** every installable stack ships `ai-local-overlay.mdc` (Cursor) and `ai-local-overlay.md` (Claude) with `MANDATORY` + acknowledgement format + `docs/LOCAL-OVERLAY.md` pointer; Claude twin listed in `claude/<stack>/rules/README.md` mapping table. Run `packages/ai-rules/scripts/check-local-overlay.sh`.
 - [ ] **Leakage:** no foreign stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
 - [ ] **Hook-only lifecycle:** `status.json` / `metrics.json` writes happen only inside `hooks/`; agents read but never rewrite lifecycle fields. Run `packages/ai-rules/scripts/check-hook-only-lifecycle.sh`.

package/presets/cursor/next/rules/preset-token-budget.mdc

@@ -1,5 +1,5 @@
 ---
-description: Preset authoring: ≤3 always-on / session-start; meta rules never alwaysApply.
+description: "Preset authoring: ≤3 always-on / session-start; meta rules never alwaysApply."
 globs:
   - packages/ai-rules/presets/**/*
   - .cursor/rules/**/*
@@ -17,19 +17,19 @@ Invariants for rule loading in an **installed** preset (consumer app).
 
 | Platform | Always-on | Cap |
 |----------|-----------|-----|
-| Cursor | `alwaysApply: true` | **≤ 4** |
-| Claude | rules **without** `paths:` | **exactly 3** |
-| Mavis | `adapter-map` rules with `loadMode: root-entry` | **≤ 4** |
-| OpenCode | `adapter-map` rules with `loadMode: root-entry` | **≤ 4** |
+| Cursor | `alwaysApply: true` | **3–5** |
+| Claude | rules **without** `paths:` | **3–5** |
+| Mavis | `adapter-map` rules with `loadMode: root-entry` | **3–5** |
+| OpenCode | `adapter-map` rules with `loadMode: root-entry` | **3–5** |
 
-**Cursor 4th slot is reserved for `ai-local-overlay`** (consumer-owned `.ai.local/` rules). If you do not need local overlay, demote that rule to `globs: ["**/.ai.local/**"]` and revert to ≤3.
+Caps are **aligned** across platforms: minimum **3** (base invariants), maximum **5**. Slots beyond the base invariants are reserved for `ai-local-overlay` (consumer-owned `.ai.local/` rules). If you do not need local overlay, demote that rule to `globs: ["**/.ai.local/**"]` / Claude `paths:`, or a non-root load mode on Mavis / OpenCode.
 
-**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). Body budget sums only the intended session-start rules (≤5).
 
 Session-start body budget:
-- Claude trio: ≤140 lines total (stretch ≤120).
-- Cursor 4-set: ≤170 lines total (4 rules including `ai-local-overlay`).
-- Mavis / OpenCode: ≤4 root-entry rule files; combined root `AGENTS.md` + platform entry ≤170 nonempty lines. Do not dump the full rule catalog into `AGENTS.md`.
+- Claude session-start: ≤200 lines total (stretch ≤170).
+- Cursor always-on: ≤200 lines total (stretch ≤170).
+- Mavis / OpenCode: ≤5 root-entry rule files; combined root `AGENTS.md` + platform entry ≤200 nonempty lines. Do not dump the full rule catalog into `AGENTS.md`.
 
 ## Meta / author rules
 
@@ -45,4 +45,4 @@ Orchestrator, feature-delivery, code-review, post-change gates, domain globs —
 
 ## Verifier
 
-build-verifier **FAIL** if Cursor `alwaysApply` count exceeds 4, Claude session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.
+build-verifier **FAIL** if Cursor `alwaysApply` count or Claude session-start count is outside **3–5** (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/cursor/next/rules/preset-twin-sync.mdc

@@ -1,5 +1,5 @@
 ---
-description: Preset authoring: Cursor SoT → Claude twin same PR. Use when editing preset rules.
+description: "Preset authoring: Cursor SoT → Claude twin same PR. Use when editing preset rules."
 globs:
   - packages/ai-rules/presets/**/*
   - .cursor/rules/**/*

package/presets/cursor/next/rules/react-ui.mdc

@@ -8,6 +8,7 @@ impact: HIGH
 # General component rules
 
 - Use **functional components** with hooks, no classes.
+- Export as `export const ComponentName = ({ ... }: IProps) => …` (arrow + props type). No `FC` / `React.FC`.
 - A component should:
   - stay as "thin" as possible on business logic;
   - delegate state to store/hooks when needed in multiple places;
@@ -16,6 +17,41 @@ impact: HIGH
 - For repeated logic, create `useSomething` hooks nearby or in `src/ui/hooks/**`.
  - When accessing store, API, shared helpers, and utilities, components and hooks must use only their **public API** (for example, `@/store`, `@/store/slices/Foo`, `@/lib/utils`), not internal implementation files of other modules.
 
+# Conditional rendering
+
+- Prefer **decomposition over conditionals**: a component with more than one or two branches (nested ternaries, long `&&` chains, several early returns) should extract each branch into a child under `./components/<Name>/`, keeping the parent a thin switch.
+- Keep the condition in the parent; the child receives resolved props.
+- No nested ternaries in JSX. For not-ready / empty / error, use an early return or a dedicated `EmptyState` / `ErrorState` component.
+- A `variant` / `mode` flag that renders two unrelated layouts is **two** components, not one.
+
+## Incorrect
+
+```tsx
+export const OrderPanel = ({ order }: Props) => (
+  <div>
+    {order == null ? (
+      <Spinner />
+    ) : order.items.length === 0 ? (
+      <p>No items</p>
+    ) : order.status === 'paid' ? (
+      <PaidList items={order.items} />
+    ) : (
+      <UnpaidList items={order.items} />
+    )}
+  </div>
+)
+```
+
+## Correct
+
+```tsx
+export const OrderPanel = ({ order }: Props) => {
+  if (order == null) return <Spinner />
+  if (order.items.length === 0) return <EmptyState />
+  return <OrderItems order={order} />
+}
+```
+
 # File structure
 
 For a page/large block:
@@ -70,7 +106,7 @@ For a reusable component:
 # Props and typing
 
 - **Do not pass props via spread** (`<Foo {...x} />`). Only explicit attributes; details and exceptions — `no-props-spread.mdc` (in `app/src/ui` ESLint catches this too).
-- Describe props with `type Props = { ... }` or `interface Props { ... }`.
+- Describe props with a local `interface` / `type` named as the repo does (`interface IProps` / `type TProps`); match the neighboring component. No `FC` / `React.FC`.
 - Do not use `any`; when needed:
   - generics (`<T>`), `unknown`, type predicates and user-defined type guards.
 - For domain entities use types from `@/types` (and enums from `@/types/enums`), not redefined locally (`public-imports.mdc`).

package/presets/cursor/next/rules/reference-features.mdc

@@ -16,7 +16,7 @@ alwaysApply: false
 
 Before implementing, find a feature of the same type and **mirror its structure**; do not invent a new file organization.
 
-Taxonomy / shared core: [`presets/_shared/README.md`](../../../../_shared/README.md) · [Preset contribution guide](../../../../docs/PRESET-CONTRIBUTION.md).
+Taxonomy / shared core: [`presets/_shared/README.md`](../../../_shared/README.md) · [Preset contribution guide](../../../../docs/PRESET-CONTRIBUTION.md).
 
 ## Reference table
 

package/presets/cursor/next/rules/store-rtk.mdc

@@ -18,13 +18,14 @@ impact: HIGH
 # Slice structure
 
 - Each domain module — its own slice in `app/src/store/slices/**`.
-- A slice exports:
-  - default `reducer`;
-  - `actions` as named exports;
-  - selectors `selectSomething(state: RootState): Type`.
+- A slice exports — follow the repo's shape:
+  - a named slice (`xxxSlice`) re-exported through a per-slice barrel (`index.ts`), **or** a default `reducer`;
+  - actions as named exports;
+  - selectors named as in the repo (`selectSomething(state: RootState): Type`, or a curried `xxxSelector = (args) => (state) => …`); memoize derived values with `createSelector`.
 - State:
   - explicit state type;
-  - careful `initialState` initialization.
+  - careful `initialState` initialization;
+  - typed root state — use the repo's `RootState` if present, otherwise the local `IRootState` interface neighboring slices use.
 
 # Async and side effects
 

package/presets/cursor/next/rules/tests-unit.mdc

@@ -4,6 +4,7 @@ globs:
   - app/__tests__/unit/**/*.spec.{ts,tsx}
   - app/__tests__/unit/**/*.test.{ts,tsx}
 alwaysApply: false
+impact: HIGH
 ---
 
 <!-- shared-core: testing/testing-principles.md -->

package/presets/cursor/nuxt/README.md

@@ -13,4 +13,4 @@ npx @bonesofspring/ai-rules init cursor --preset nuxt
 | `rules/`, `agents/`, `skills/`, `commands/`, `hooks/` | `.cursor/<dir>/` |
 | `team/` | **`.ai.local/team/`** (templates; slugs preserved) |
 
-Always-on (≤4): `nuxt-app-core`, `package-manager`, `code-quality-and-refactoring`, `ai-local-overlay`. Skill `vue-performance`. Twin: `presets/claude/nuxt/`. Catalog: [`rules/README.md`](./rules/README.md).
+Always-on (3–5): `nuxt-app-core`, `package-manager`, `code-quality-and-refactoring`, `ai-local-overlay`. Skill `vue-performance`. Twin: `presets/claude/nuxt/`. Catalog: [`rules/README.md`](./rules/README.md).

package/presets/cursor/nuxt/agents/build-verifier.md

@@ -38,12 +38,12 @@ When validating **preset packaging** changes (paths under `packages/ai-rules/pre
 
 ### FAIL (all stacks)
 
-1. **Token budget:** Cursor `alwaysApply: true` count ≤ **3**; Claude rules without `paths:` === **3** (**exclude `**/README.md`** — Option A). Meta `preset-*` rules must **not** be `alwaysApply: true`.
+1. **Token budget:** Cursor `alwaysApply: true` count 3–5; Claude rules without `paths:` 3–5 (**exclude `**/README.md`** — Option A). Meta `preset-*` rules must **not** be `alwaysApply: true`.
 2. **Leakage (nuxt):** hooks/agents must not require `xcuitest-test-*` handoffs or `xcodebuild` as the default Nuxt post-change gate. See `preset-no-cross-stack-leakage.mdc`.
 3. **Mapping / README:** `claude/nuxt/rules/README.md` must include a Cursor→Claude mapping table; stack `rules/README.md` should document core→stack mapping when `_shared` consumers exist.
 4. **shared-core consumers:** if `_shared/core/**` changed, every file with matching `<!-- shared-core: … -->` in this PR must be updated (or intentional fork documented in validation-report).
 5. **Twin presence:** Cursor rule change without Claude twin same PR → **FAIL** (next, nuxt, svelte, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel). Domain twin body ≥15 lines; thin aliases (`agent-team-intake`, `technical-retro`) may be shorter.
-6. **Session-start body budget (soft→document, FAIL if grossly over):** sum body lines of the **3** intended always-on / session-start rules ≤ **140** (stretch ≤120); do **not** include `**/README.md`. Record the sum in validation-report.
+6. **Session-start body budget (soft→document, FAIL if grossly over):** sum body lines of the intended always-on / session-start rules ≤ **200** (stretch ≤170); do **not** include `**/README.md`. Record the sum in validation-report.
 7. **Embed drift (hard in `check:preset-structure`):** run `packages/ai-rules/scripts/check-shared-core-drift.sh` with `AI_RULES_DRIFT_FAIL=1` (bundled by the structure orchestrator). Lineage stems are excluded from body equality.
 8. **Dogfood (monorepo soft):** if root `.cursor/` is in the PR, prefer sync via `packages/ai-rules/scripts/sync-dogfood-cursor.sh`; mass deletion of tracked dogfood without migration doc → note as risk / FAIL for maintainers.
 

package/presets/cursor/nuxt/commands/task.md

@@ -1,6 +1,6 @@
 ---
 name: task
-description: Route a natural-language task through the agent-team pipeline: task-router, pipeline.json, and the first planned specialist.
+description: "Route a natural-language task through the agent-team pipeline: task-router, pipeline.json, and the first planned specialist."
 ---
 
 # Task — single entry point (router + pipeline)

package/presets/cursor/nuxt/hooks/chain-team-phases.sh

@@ -42,7 +42,10 @@ try {
 }
 
 const slug = active.slug;
-if (!slug) {
+// Reject non-kebab / traversal slugs: the runtime writes status.json and
+// metrics.json under tasks/<slug>, so an unchecked slug could escape the tree.
+const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+if (typeof slug !== 'string' || slug.length > 48 || !SLUG_RE.test(slug)) {
   process.stdout.write('{}');
   process.exit(0);
 }
@@ -69,6 +72,9 @@ function waitForMetricsLock() {
   // and never blocked on the lock file, so two concurrent subagentStop events
   // could both acquire the lock and corrupt metrics.json. Retry EEXIST with a
   // 10 ms sleep up to 200 attempts (2 s ceiling). On any other error, throw.
+  // A lock left behind by a killed process is reclaimed once its mtime is older
+  // than STALE_LOCK_MS, so one crash cannot brick the task forever.
+  const STALE_LOCK_MS = 30000;
   for (let attempt = 0; attempt < 200; attempt += 1) {
     try {
       const fd = fs.openSync(METRICS_LOCK, 'wx');
@@ -76,6 +82,13 @@ function waitForMetricsLock() {
       return;
     } catch (error) {
       if (!error || error.code !== 'EEXIST') throw error;
+      try {
+        const lockStat = fs.statSync(METRICS_LOCK);
+        if (Date.now() - lockStat.mtimeMs > STALE_LOCK_MS) {
+          fs.unlinkSync(METRICS_LOCK);
+          continue;
+        }
+      } catch {}
       const until = Date.now() + 10;
       while (Date.now() < until) { /* 10 ms busy-wait */ }
     }
@@ -495,7 +508,10 @@ function legacyFlow() {
 
 
 if (hookInput.action === 'end_human_gate') {
-    status.awaitingHumanGate = false;
+  // Only advance when a gate was actually open. A duplicate or retried
+  // end_human_gate must be a no-op, not a silent pipeline skip.
+  const gateWasOpen = Boolean(status.activeHumanGateEventId) || status.awaitingHumanGate === true;
+  status.awaitingHumanGate = false;
   // A2 (retro §8): pin a single runId per pipeline so subsequent events don't
   // fragment the metrics ledger across multiple runId sequences. Prefer
   // metrics.json.task.runId when metrics already exist, then status.metricsRunId,
@@ -522,7 +538,7 @@ if (hookInput.action === 'end_human_gate') {
     });
     delete status.activeHumanGateEventId;
   }
-  if (hookInput.activateNext && fs.existsSync(pipelinePath)) {
+  if (gateWasOpen && hookInput.activateNext && fs.existsSync(pipelinePath)) {
     let resumePipeline = null;
     try { resumePipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); } catch {}
     if (resumePipeline) {
@@ -544,6 +560,19 @@ if (hookInput.action === 'end_human_gate') {
         else out(handoffForAgent(resumeAgents[0], resumeNext.step.scope, resumeNext.step));
         process.exit(0);
       }
+      // Gate on the final step: no executable step remains. Complete the
+      // pipeline instead of leaving it in_progress forever.
+      status.state = 'completed';
+      completeTaskMetrics();
+      writeStatus({
+        pipelineIndex: resumeSteps.length,
+        phase: 'done',
+        state: 'completed',
+        currentAgent: null,
+        awaitingHumanGate: false,
+      });
+      out(`Pipeline complete for "${slug}". Run /technical-retro ${slug}.`);
+      process.exit(0);
     }
   }
   // A2 (retro §8): if gate closes the final human gate of the pipeline

package/presets/cursor/nuxt/hooks/examples/format-edited.example.sh

@@ -1,11 +1,12 @@
 #!/usr/bin/env bash
-# Optional: format/lint edited JS/TS under app/ after save.
-# NOT in default hooks.json. Requires yarn scripts in app/.
+# Optional: format/lint edited JS/TS/Vue at the Nuxt project root after save.
+# NOT in default hooks.json. Cwd: directory with nuxt.config.* (not a Next-style app/ wrapper).
 set -euo pipefail
 ROOT="${CURSOR_PROJECT_DIR:-.}"
-cd "$ROOT/app" 2>/dev/null || cd "$ROOT"
-# Prefer project scripts; adjust names to match package.json
-if command -v yarn >/dev/null 2>&1; then
-  yarn lint:js --fix 2>/dev/null || yarn eslint --fix . 2>/dev/null || true
-fi
+cd "$ROOT" 2>/dev/null || exit 0
+[[ -f nuxt.config.js || -f nuxt.config.ts || -f nuxt.config.mjs ]] || exit 0
+# Prefer project scripts; adjust names to match package.json (see package-manager).
+yarn lint:js --fix 2>/dev/null \
+  || yarn eslint --fix . 2>/dev/null \
+  || true
 exit 0

package/presets/cursor/nuxt/hooks/examples/test-on-save.example.sh

@@ -1,8 +1,13 @@
 #!/usr/bin/env bash
-# Optional: scoped unit tests for changed files under app/src.
+# Optional: scoped unit tests at the Nuxt project root.
 # NOT in default hooks.json. No Playwright here.
+# Cwd: directory with nuxt.config.* (not a Next-style app/ wrapper).
 set -euo pipefail
 ROOT="${CURSOR_PROJECT_DIR:-.}"
-cd "$ROOT/app" 2>/dev/null || exit 0
-yarn test --findRelatedTests --passWithNoTests 2>/dev/null || yarn test --passWithNoTests 2>/dev/null || true
+cd "$ROOT" 2>/dev/null || exit 0
+[[ -f nuxt.config.js || -f nuxt.config.ts || -f nuxt.config.mjs ]] || exit 0
+# Prefer Vitest related/run; fall back to the package `test` script (see package-manager).
+yarn vitest related --run --passWithNoTests 2>/dev/null \
+  || yarn test --run --passWithNoTests 2>/dev/null \
+  || true
 exit 0

package/presets/cursor/nuxt/rules/anti-sycophancy-discipline.mdc

@@ -1,7 +1,7 @@
 ---
 description: Anti-sycophancy discipline for code generation and review — VERIFY, failure modes, UNTESTED, honest status. Load when writing or changing code.
 globs:
-  - **/*.{ts,tsx}
+  - "**/*.{ts,tsx}"
 alwaysApply: false
 ---
 

package/presets/cursor/nuxt/rules/code-quality-and-refactoring.mdc

@@ -19,6 +19,12 @@ alwaysApply: true
 - **CUPID:** Composable; Unix philosophy (one responsibility); Predictable; Idiomatic (repo); Domain-based.
 - **Composition over inheritance;** Law of Demeter — no `a.b.c.d` chains; via public API / facade.
 
+# Over-abstraction guardrails
+
+- **No unnecessary constants:** do not hoist a one-off literal, string, or boolean into a named constant. Inline it, or use an existing token/enum when the value is meaningful and reused. Named constants are for shared, semantic, or repeated values.
+- **No invented utilities:** do not add a `utils`/helper for a single call site or a thin pass-through wrapper. Inline it or extend the existing helper; a new shared utility is justified only after the Rule of Three.
+- **Decompose over conditionals:** a unit (function, component, hook) that accumulates several branches (`if` / ternary / `switch`) should be split into smaller units with one reason to change instead of piling up conditions.
+
 # Refactoring during changes
 
 - Light refactor is OK if it reduces duplication, improves readability, and does not break public contracts.

package/presets/cursor/nuxt/rules/design-guidance.mdc

@@ -1,7 +1,7 @@
 ---
 description: Design smells (Fowler) and curated GoF patterns for agents. Load when assessing structure, smells, or pattern fit.
 globs:
-  - **/*.{ts,tsx}
+  - "**/*.{ts,tsx}"
 alwaysApply: false
 ---
 

package/presets/cursor/nuxt/rules/layer-barrel-exports.mdc

@@ -1,6 +1,6 @@
 ---
 description: Two-level barrel exports for layers with a regulated public API
-globs: **/index.ts
+globs: "**/index.ts"
 alwaysApply: false
 impact: MEDIUM
 ---

package/presets/cursor/nuxt/rules/preset-layering.mdc

@@ -1,5 +1,5 @@
 ---
-description: Preset authoring: Core → Stack → Platform layering. Use when editing packages/ai-rules/presets/**.
+description: "Preset authoring: Core → Stack → Platform layering. Use when editing packages/ai-rules/presets/**."
 globs:
   - packages/ai-rules/presets/**/*
   - .cursor/rules/**/*
@@ -18,7 +18,7 @@ Rules for **preset authors** (`packages/ai-rules/presets/**`). Not always-on in
 | Layer | Where | What to put |
 |-------|-------|-------------|
 | **Core** | `presets/_shared/core/**` | Stack-agnostic prose + checklists; no frontmatter; no paths `app/**`, `Features/**`, Playwright, xcodebuild |
-| **Stack** | `presets/{cursor\|claude\|mavis\|opencode}/<stack>/` | Domain/tooling, stack always-on trio, stack examples in **Stack notes** |
+| **Stack** | `presets/{cursor\|claude\|mavis\|opencode}/<stack>/` | Domain/tooling, stack always-on set (3–5), stack examples in **Stack notes** |
 | **Platform** | Cursor `.mdc` / Claude `.md` / Mavis `.md` / OpenCode `.md` | Frontmatter (`alwaysApply`/`globs` vs `paths:` vs OpenCode `mode`/`permission`), platform-only (`BUGBOT.md`, `CLAUDE.md`) |
 
 ## Where to put a new rule