@bonesofspring/ai-rules 0.2.26 → 0.2.28

package/presets/mavis/php-laravel/agents/build-verifier.md

@@ -1,3 +1,20 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/php-tooling.md`
+- `.mavis/rules/post-change-test.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are the build verifier for **Laravel** services (and for **ai-rules preset packaging** when scope says so).
 
 ## Consumer Laravel / PHP repos
@@ -29,7 +46,7 @@ Hard gates for the **php-laravel** stack (and peers):
 | Gate | FAIL when |
 |------|-----------|
 | **twin-map** | `php-laravel` missing from `STACKS`, or Cursor↔Claude orphan/missing twins |
-| **token-budget** | Cursor `alwaysApply` ≠ 3 or Claude session-start (excl. README) ≠ 3, or trio body sum > 140 |
+| **token-budget** | Cursor/Claude always-on count outside 3–5 (extra slots = `ai-local-overlay`), or body sum > 200 |
 | **leakage** | `PHP_FORBIDDEN_*` hits (Playwright/XCUITest/`lint:js`/`accessibility-reviewer` / `mockup-reviewer` as required handoffs) |
 | **chain fork** | `hooks/chain-team-phases.sh` byte-identical to **next**, **ios-swift**, **go**, **java**, **mcp-ts**, or **php-hexagonal** (same platform) |
 

package/presets/mavis/php-laravel/agents/ci-investigator.md

@@ -1,3 +1,32 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/domain-layer.md`
+- `.mavis/rules/actions-services.md`
+- `.mavis/rules/eloquent-persistence.md`
+- `.mavis/rules/events-listeners.md`
+- `.mavis/rules/jobs-queues.md`
+- `.mavis/rules/laravel-conventions.md`
+- `.mavis/rules/module-public-api.md`
+- `.mavis/rules/policies-authorization.md`
+- `.mavis/rules/service-providers.md`
+- `.mavis/rules/http-layer.md`
+- `.mavis/rules/routes-api.md`
+- `.mavis/rules/form-requests.md`
+- `.mavis/rules/php-tooling.md`
+- `.mavis/rules/post-change-test.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Triage red CI for PHP repos (and ai-rules preset-structure when relevant).
 
 ## Steps

package/presets/mavis/php-laravel/agents/code-reviewer.md

@@ -1,3 +1,19 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/code-review-mr.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are a senior Laravel code reviewer. Write only review artifacts under `.ai.local/team/**`; do not modify production code.
 
 ## Inputs

package/presets/mavis/php-laravel/agents/codebase-analyzer.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are a specialist at understanding HOW this Laravel service works. Document implementation details with precise `path:line` references.
 
 ## CRITICAL — explain as-is only

package/presets/mavis/php-laravel/agents/debugger.md

@@ -1,3 +1,32 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/domain-layer.md`
+- `.mavis/rules/actions-services.md`
+- `.mavis/rules/eloquent-persistence.md`
+- `.mavis/rules/events-listeners.md`
+- `.mavis/rules/jobs-queues.md`
+- `.mavis/rules/laravel-conventions.md`
+- `.mavis/rules/module-public-api.md`
+- `.mavis/rules/policies-authorization.md`
+- `.mavis/rules/service-providers.md`
+- `.mavis/rules/http-layer.md`
+- `.mavis/rules/routes-api.md`
+- `.mavis/rules/form-requests.md`
+- `.mavis/rules/php-tooling.md`
+- `.mavis/rules/post-change-test.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Investigate with **runtime evidence**: failing `composer test` / `vendor/bin/phpunit` output, logs, stack traces, minimal repro.
 
 Use the **`debug-investigation` skill** for the investigation loop.

package/presets/mavis/php-laravel/agents/feature-developer.md

@@ -1,3 +1,32 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/domain-layer.md`
+- `.mavis/rules/actions-services.md`
+- `.mavis/rules/eloquent-persistence.md`
+- `.mavis/rules/events-listeners.md`
+- `.mavis/rules/jobs-queues.md`
+- `.mavis/rules/laravel-conventions.md`
+- `.mavis/rules/module-public-api.md`
+- `.mavis/rules/policies-authorization.md`
+- `.mavis/rules/service-providers.md`
+- `.mavis/rules/http-layer.md`
+- `.mavis/rules/routes-api.md`
+- `.mavis/rules/form-requests.md`
+- `.mavis/rules/php-tooling.md`
+- `.mavis/rules/post-change-test.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Implement Laravel features following Laravel-first layer boundaries.
 
 ## Order

package/presets/mavis/php-laravel/agents/integration-test-generator.md

@@ -1,3 +1,20 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/tests-integration.md`
+- `.mavis/rules/tests-e2e.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are the **integration-test-generator** for Laravel services.
 
 ## Scope

package/presets/mavis/php-laravel/agents/integration-test-healer.md

@@ -1,3 +1,20 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/tests-integration.md`
+- `.mavis/rules/tests-e2e.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are the **integration-test-healer** for Laravel services.
 
 ## Scope

package/presets/mavis/php-laravel/agents/integration-test-planner.md

@@ -1,3 +1,20 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/tests-integration.md`
+- `.mavis/rules/tests-e2e.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are the **integration-test-planner** for Laravel services.
 
 ## Scope

package/presets/mavis/php-laravel/agents/migration-specialist.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You plan migrations for **PHP modules** (toolchain, deps, layout refactors). Do not edit production code.
 
 ## Inputs

package/presets/mavis/php-laravel/agents/openspec-author.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are an **OpenSpec** (Fission AI spec-driven SDD) author for a frontend/backend agent team.
 
 Your only writes target `openspec/**` (and team artifact manifests). Production code lives behind `feature-developer`; you are **docs / spec only**.

package/presets/mavis/php-laravel/agents/performance-auditor.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Audit Laravel performance risks on the task scope.
 
 ## Focus

package/presets/mavis/php-laravel/agents/qa-tester.md

@@ -1,3 +1,21 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/tests-unit.md`
+- `.mavis/rules/tests-integration.md`
+- `.mavis/rules/tests-e2e.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Ensure test coverage for the Laravel task scope.
 
 ## Prefer

package/presets/mavis/php-laravel/agents/security-reviewer.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Review Laravel/PHP diffs against `security-php.md` (and `jobs-queues.md` when Jobs are in scope).
 
 ## Checklist

package/presets/mavis/php-laravel/agents/solution-architect.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Design solutions for **Laravel** services.
 
 ## Deliverable

package/presets/mavis/php-laravel/agents/task-analyst.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Analyze and decompose work for **Laravel** backends.
 
 ## Classify first

package/presets/mavis/php-laravel/agents/task-router.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are a task router for a **Laravel backend** agent team. You **do not** implement tasks — you classify intent and plan the agent pipeline.
 
 ## Inputs

package/presets/mavis/php-laravel/agents/tech-writer.md

@@ -1,3 +1,18 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Write documentation from task artifacts (brief, architecture, implementation, review).
 
 ## Laravel preset / services

package/presets/mavis/php-laravel/agents/unit-test-generator.md

@@ -1,3 +1,19 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/tests-unit.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Generate `*Test.php` / `*Tests.php` from the plan. Prefer parameterized PHPUnit tests and port fakes/mocks (PHPUnit mocks if present).
 
 ## Rules

package/presets/mavis/php-laravel/agents/unit-test-healer.md

@@ -1,3 +1,19 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/tests-unit.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Heal failing `composer test` / `vendor/bin/phpunit` unit failures. Prefer fixing tests/fakes; only change production if assertion proves a bug and brief allows.
 
 Follow `tests-unit.md`. Never introduce Playwright/XCUITest.

package/presets/mavis/php-laravel/agents/unit-test-planner.md

@@ -1,3 +1,19 @@
+## Rules to load (subagent context)
+
+This subagent runs standalone (`mcode exec --file`) and inherits no global context. Read these rules explicitly before acting:
+
+- `.mavis/rules/laravel-app-core.md`
+- `.mavis/rules/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.mavis/rules/code-quality-and-refactoring.md`
+- `.mavis/rules/ai-local-overlay.md`
+- `.mavis/rules/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.mavis/rules/reference-features.md` — analog files first
+- `.mavis/rules/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.mavis/rules/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.mavis/rules/tests-unit.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Plan **Laravel unit tests** (PHPUnit/Pest `@dataProvider`, PHPUnit assertions). No production edits.
 
 ## Focus

package/presets/mavis/php-laravel/commands/spec-start.md

@@ -4,7 +4,7 @@ Routes intent **`spec-gen`** (or bootstrap) → **task-analyst** in **author mod
 
 ## What to do
 
-1. Extract description from arguments after the spec-start procedure in `.mavis/commands/spec-start.md` (domain, page/feature ids, sources).
+1. Extract description from arguments after `/spec-start` (domain, page/feature ids, sources).
 2. Generate a **slug** (kebab-case, ≤48 chars), e.g. `spec-<domain>-<id>`.
 3. Ensure `.ai.local/team/tasks/<slug>/` exists (Write artifacts; not Shell mkdir).
 4. Write `.ai.local/team/active-task.json` → `{ "slug": "<slug>" }`.
@@ -16,7 +16,7 @@ Routes intent **`spec-gen`** (or bootstrap) → **task-analyst** in **author mod
 
 - Show created/updated spec paths and INDEX diff.
 - Ask user to approve drafts (`status: draft` → promote) or send edits.
-- Continue: continue `<slug>` using `.mavis/commands/task-continue.md` only after approval when implementation follows; otherwise stop after docs.
+- Continue: `/task-continue <slug>` only after approval when implementation follows; otherwise stop after docs.
 
 ## Notes
 

package/presets/mavis/php-laravel/commands/task.md

@@ -1,10 +1,10 @@
 # Task — unified entry point (router + pipeline)
 
-Main command for task intake. Parent agent = orchestrator (`agent-team-orchestrator.md`). Intake for work requests without the task procedure in `.mavis/commands/task.md` — `agent-team-intake.md`.
+Main command for task intake. Parent agent = orchestrator (`agent-team-orchestrator.md`). Intake for work requests without `/task` — `agent-team-intake.md`.
 
 ## Arguments
 
-Everything after the task procedure in `.mavis/commands/task.md` is the task description in natural language.
+Everything after `/task` is the task description in natural language.
 
 Examples:
 
@@ -22,13 +22,13 @@ Examples:
 1. **Slug** — kebab-case from the description (≤48 characters). Create `.ai.local/team/tasks/<slug>/` via **Write** (e.g. placeholder `pipeline.json` or empty marker) — runtime/hook owns `status.json` — **not** via Shell `mkdir` (sandbox → `Operation not permitted`).
 2. **Router** — invoke subagent **task-router** with the task description and slug path.
 3. **Plan** — show the user the table from `pipeline.json`: intent, steps, skipped, humanGates.
-4. **Intent retro** — if `intent === "retro"`, run the technical-retro procedure in `.mavis/commands/technical-retro.md` and **stop**.
+4. **Intent retro** — if `intent === "retro"`, run `/technical-retro` and **stop**.
 5. **Start** — after router:
    - confirm `pipeline.json` and `active-task.json`;
    - **do not** write lifecycle fields in `status.json` / `metrics.json` yourself — orchestration runtime/hook owns them (see **agent-artifact-contracts**). If `status.json` is missing, only minimal bootstrap is allowed (`slug`, `intent`, `pipelineIndex: 0`, `currentAgent: steps[0]`, `state: in_progress`) — **do not** increment `pipelineIndex` manually;
    - invoke subagent for `pipeline.steps[0].agent` (slug, artifact paths, scope).
 6. **After each agent** — wait for hook handoff / reconciliation terminal receipt → `status.state`; do not start the next step until `status.json` reflects handoff (or until there is a `followup_message` from the hook).
-7. **Human gate** — if after the current step there is a gate in `humanGates` (`after:<agent>`), after the agent finishes **stop** and ask for continue `<slug>` using `.mavis/commands/task-continue.md`.
+7. **Human gate** — if after the current step there is a gate in `humanGates` (`after:<agent>`), after the agent finishes **stop** and ask for `/task-continue <slug>`.
 
 ## Do not
 
@@ -38,10 +38,10 @@ Examples:
 
 ## If slug is taken
 
-- `awaitingHumanGate` / `state: awaiting_approval` → offer artifact review or continue `<slug>` using `.mavis/commands/task-continue.md`.
+- `awaitingHumanGate` / `state: awaiting_approval` → offer artifact review or `/task-continue <slug>`.
 - `in_progress` → ask: continue or new slug.
 
 
 ## Metrics
 
-Runtime/hook owns `metrics.json` and `status.json` attempt ledgers. Before the first invocation ensure `task_started` and one `activeAttempts[attemptId]` + `attempt_started` exist (router/runtime bootstrap — parent must not invent parallel indices). On the task-continue procedure in `.mavis/commands/task-continue.md`, run the installed chain hook `end_human_gate` action (or wrapper) so `human_gate_ended` lands before the next attempt. Do not calculate durations in agents.
+Runtime/hook owns `metrics.json` and `status.json` attempt ledgers. Before the first invocation ensure `task_started` and one `activeAttempts[attemptId]` + `attempt_started` exist (router/runtime bootstrap — parent must not invent parallel indices). On `/task-continue`, run the installed chain hook `end_human_gate` action (or wrapper) so `human_gate_ended` lands before the next attempt. Do not calculate durations in agents.

package/presets/mavis/php-laravel/hooks/chain-team-phases.sh

@@ -44,7 +44,10 @@ try {
 }
 
 const slug = active.slug;
-if (!slug) {
+// Reject non-kebab / traversal slugs: the runtime writes status.json and
+// metrics.json under tasks/<slug>, so an unchecked slug could escape the tree.
+const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+if (typeof slug !== 'string' || slug.length > 48 || !SLUG_RE.test(slug)) {
   process.stdout.write('{}');
   process.exit(0);
 }
@@ -71,6 +74,9 @@ function waitForMetricsLock() {
   // and never blocked on the lock file, so two concurrent subagentStop events
   // could both acquire the lock and corrupt metrics.json. Retry EEXIST with a
   // 10 ms sleep up to 200 attempts (2 s ceiling). On any other error, throw.
+  // A lock left behind by a killed process is reclaimed once its mtime is older
+  // than STALE_LOCK_MS, so one crash cannot brick the task forever.
+  const STALE_LOCK_MS = 30000;
   for (let attempt = 0; attempt < 200; attempt += 1) {
     try {
       const fd = fs.openSync(METRICS_LOCK, 'wx');
@@ -78,6 +84,13 @@ function waitForMetricsLock() {
       return;
     } catch (error) {
       if (!error || error.code !== 'EEXIST') throw error;
+      try {
+        const lockStat = fs.statSync(METRICS_LOCK);
+        if (Date.now() - lockStat.mtimeMs > STALE_LOCK_MS) {
+          fs.unlinkSync(METRICS_LOCK);
+          continue;
+        }
+      } catch {}
       const until = Date.now() + 10;
       while (Date.now() < until) { /* 10 ms busy-wait */ }
     }
@@ -491,7 +504,10 @@ function legacyFlow() {
 
 
 if (hookInput.action === 'end_human_gate') {
-    status.awaitingHumanGate = false;
+  // Only advance when a gate was actually open. A duplicate or retried
+  // end_human_gate must be a no-op, not a silent pipeline skip.
+  const gateWasOpen = Boolean(status.activeHumanGateEventId) || status.awaitingHumanGate === true;
+  status.awaitingHumanGate = false;
   // A2 (retro §8): pin a single runId per pipeline so subsequent events don't
   // fragment the metrics ledger across multiple runId sequences. Prefer
   // metrics.json.task.runId when metrics already exist, then status.metricsRunId,
@@ -518,7 +534,7 @@ if (hookInput.action === 'end_human_gate') {
     });
     delete status.activeHumanGateEventId;
   }
-  if (hookInput.activateNext && fs.existsSync(pipelinePath)) {
+  if (gateWasOpen && hookInput.activateNext && fs.existsSync(pipelinePath)) {
     let resumePipeline = null;
     try { resumePipeline = JSON.parse(fs.readFileSync(pipelinePath, 'utf8')); } catch {}
     if (resumePipeline) {
@@ -540,6 +556,19 @@ if (hookInput.action === 'end_human_gate') {
         else out(handoffForAgent(resumeAgents[0], resumeNext.step.scope, resumeNext.step));
         process.exit(0);
       }
+      // Gate on the final step: no executable step remains. Complete the
+      // pipeline instead of leaving it in_progress forever.
+      status.state = 'completed';
+      completeTaskMetrics();
+      writeStatus({
+        pipelineIndex: resumeSteps.length,
+        phase: 'done',
+        state: 'completed',
+        currentAgent: null,
+        awaitingHumanGate: false,
+      });
+      out(`Pipeline complete for "${slug}". Run /technical-retro ${slug}.`);
+      process.exit(0);
     }
   }
   // A2 (retro §8): if gate closes the final human gate of the pipeline

package/presets/mavis/php-laravel/rules/agent-team-intake.md

@@ -9,3 +9,7 @@ When the user message looks like a **work request** (implement, add, fix, refact
 3. Pure questions (“how does X work”, “explain”) — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
 
 Exceptions: user explicitly says “no pipeline”, “just do it”, or continues an active slug.
+
+## Stack notes
+
+- Scope: Laravel (`app/**`, `routes/**`, `tests/**`) — Controllers, Actions/Services, Eloquent, Policies — not Playwright/XCUITest UI flows.