@bonesofspring/ai-rules 0.2.27 → 0.2.29

package/presets/claude/nuxt/agents/unit-test-healer.md

@@ -4,6 +4,24 @@ description: Unit test healer. Fixes failing or flaky unit tests after refactors
 model: inherit
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/nuxt-app-core.md`
+- `.claude/rules/tooling-and-review/package-manager.md`
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/architecture/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/post-change-lint.md` — lint/type-check after code edits
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/testing/tests-unit.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You debug and fix failing unit tests.
 
 ## Inputs

package/presets/claude/nuxt/agents/unit-test-planner.md

@@ -4,6 +4,24 @@ description: Unit test planning specialist. Creates coverage plans for mappers,
 model: inherit
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/nuxt-app-core.md`
+- `.claude/rules/tooling-and-review/package-manager.md`
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/architecture-boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/architecture/feature-delivery-workflow.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/post-change-lint.md` — lint/type-check after code edits
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/testing/tests-unit.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are a unit test planner for a Nuxt 3 frontend with Jest/Vitest and Testing Library.
 
 Use the **`unit-testing` skill** and **`rules/testing/tests-unit.md`**.

package/presets/claude/nuxt/hooks/README.md

@@ -5,10 +5,13 @@
 | `chain-team-phases.sh` | Pipeline chaining after subagent stop; `skipIf`, parallel, `validation_failed`, `retryAfterFix` |
 | `guard-shell-command.sh` | Destructive git / package-manager guard |
 
-Wire into Claude Code hooks per project documentation when enabling agent team auto-chain.
+No `hooks.json`. Default chain and shell guard are registered in `.claude/settings.json` (see **Shipped wiring**). Cookbook scripts in `hooks/examples/` stay unwired; keep stack-safe recipes (this preset: **nuxt**).
 
-## Optional cookbook
+## Shipped wiring (Claude Code settings)
 
-Example scripts live in `hooks/examples/` (secret-guard, format-edited, test-on-save). They are **not** auto-enabled.
+`.claude/settings.json` `hooks` (https://code.claude.com/docs/en/hooks) registers:
 
-To wire in Claude Code: copy an `.example.sh` into `hooks/`, make executable, and register per [Claude Code hooks](https://code.claude.com/docs/en/hooks) for your project. Keep stack-safe recipes (this preset: **nuxt**). Cursor twin examples under `presets/cursor/nuxt/hooks/examples/` are the same allowlist forks.
+- `PreToolUse` matcher `Bash` → `guard-shell-command.sh` (reads `tool_input.command`; emits `permissionDecision` `ask` or `allow`)
+- `SubagentStop` → `chain-team-phases.sh` (kebab-case `agent_type` maps to `status: completed`; empty or non-kebab types are ignored; `stop_hook_active` does not recurse)
+
+There is no `hooks.json`. Cookbook scripts under `hooks/examples/` stay unwired. A hook crash is not a deny (Cursor `failClosed` has no Claude field); `ask` is the supported review decision.

package/presets/claude/nuxt/hooks/chain-team-phases.sh

@@ -21,6 +21,24 @@ try {
   process.exit(0);
 }
 
+// Claude Code SubagentStop has hook_event_name / agent_type / stop_hook_active, not status.
+// Kebab-case agent_type (preset roles) is the completed signal. Empty or non-kebab
+// types (Claude internal agents) do not advance the pipeline. stop_hook_active
+// means this hook already continued the turn — do not recurse.
+// Manual pipes of {"status":"completed"} skip this block.
+if (hookInput.hook_event_name === 'SubagentStop') {
+  if (hookInput.stop_hook_active === true) {
+    process.stdout.write('{}');
+    process.exit(0);
+  }
+  const agentType = typeof hookInput.agent_type === 'string' ? hookInput.agent_type : '';
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(agentType)) {
+    process.stdout.write('{}');
+    process.exit(0);
+  }
+  if (hookInput.status == null) hookInput.status = 'completed';
+}
+
 if (hookInput.status !== 'completed') {
   process.stdout.write('{}');
   process.exit(0);

package/presets/claude/nuxt/hooks/examples/README.md

@@ -10,6 +10,8 @@ Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks
 
 ## Wiring (Claude Code)
 
+Default `.claude/settings.json` already registers `guard-shell-command.sh` on `PreToolUse` (matcher `Bash`) and `chain-team-phases.sh` on `SubagentStop`. Cookbook scripts are not in that default set.
+
 Claude Code has no preset `hooks.json`; hooks are registered in `.claude/settings.json` and fire on events such as `PreToolUse`, `PostToolUse`, and `Stop`.
 
 1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.

package/presets/claude/nuxt/hooks/guard-shell-command.sh

@@ -17,20 +17,43 @@ try {
   process.exit(0);
 }
 
-const command = String(event.command || event.input?.command || '');
-if (!command.trim()) {
-  process.stdout.write('{ "permission": "allow" }');
-  process.exit(0);
-}
+const claudePreTool = event.hook_event_name === 'PreToolUse';
+const command = String(
+  event.command
+  || (event.input && event.input.command)
+  || (event.tool_input && event.tool_input.command)
+  || '',
+);
 
-function out(permission, userMessage, agentMessage) {
+function out(permission, userMessage) {
+  if (claudePreTool) {
+    const decision = permission === 'ask' || permission === 'deny' ? permission : 'allow';
+    const hookSpecificOutput = {
+      hookEventName: 'PreToolUse',
+      permissionDecision: decision,
+    };
+    if (userMessage && decision !== 'allow') {
+      hookSpecificOutput.permissionDecisionReason = userMessage;
+    }
+    process.stdout.write(JSON.stringify({ hookSpecificOutput }));
+    return;
+  }
+  if (!userMessage) {
+    process.stdout.write('{ "permission": "allow" }');
+    return;
+  }
   process.stdout.write(JSON.stringify({
     permission,
     user_message: userMessage,
-    agent_message: agentMessage || userMessage,
+    agent_message: userMessage,
   }));
 }
 
+if (!command.trim()) {
+  out('allow');
+  process.exit(0);
+}
+
 const dangerousGit = /\bgit\s+(reset\s+--hard|clean\s+-[^\n]*f|push\s+--force|push\s+-f|checkout\s+--\s+)/;
 if (dangerousGit.test(command)) {
   out(
@@ -59,7 +82,7 @@ if (!expected && fs.existsSync('package.json')) {
 }
 
 if (!expected) {
-  process.stdout.write('{ "permission": "allow" }');
+  out('allow');
   process.exit(0);
 }
 
@@ -73,5 +96,5 @@ if (used && used !== expected) {
   process.exit(0);
 }
 
-process.stdout.write('{ "permission": "allow" }');
+out('allow');
 NODE

package/presets/claude/nuxt/rules/README.md

@@ -14,7 +14,7 @@ In Claude Code all `.md` files under `rules/` are **discovered recursively**. Bo
 
 ## Loading strategy
 
-- **Session start (no `paths:`):** 3–5 — `nuxt-app-core`, `package-manager`, `code-quality`
+- **Session start (no `paths:`):** 3–5 — `nuxt-app-core`, `package-manager`, `code-quality`, `ai-local-overlay`
 - **On-demand (`paths:` or via commands):** `post-change-lint`, `security-nuxt`, architecture, UI, tests, `vue-nuxt-anti-hallucination`, **preset-*** meta, …
 - **Skills:** `feature-delivery`, `vue-performance`, `code-review`, …
 

package/presets/claude/nuxt/rules/tooling-and-review/ai-local-overlay.md

@@ -1,10 +1,5 @@
 ---
 description: Local overlay from .ai.local/ (consumer-owned rules with priority over preset rules) — MANDATORY
-paths:
-  - "**/.ai.local/**"
-  - "**/AGENTS.md"
-  - "**/CLAUDE.md"
-alwaysApply: false
 impact: CRITICAL
 ---
 

package/presets/claude/nuxt/rules/tooling-and-review/preset-pr-checklist.md

@@ -26,7 +26,7 @@ Checklist for PRs that touch `packages/ai-rules/presets/**` (and dogfood `.curso
 - [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
 - [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
 - [ ] **i18n anchors:** kept-marked Cyrillic fragments in `tests-unit.md(c)` stay consistent with their English counterparts. Run `packages/ai-rules/scripts/check-preset-i18n.sh`.
-- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (and `sync-dogfood-mavis.sh` / `sync-dogfood-opencode.sh` when those platforms changed), or document an intentional skip, when maintaining this monorepo
+- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh`, `sync-dogfood-claude.sh`, `sync-dogfood-mavis.sh`, and `sync-dogfood-opencode.sh` when those platforms changed, or document an intentional skip, when maintaining this monorepo
 - [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
 
 ## Pointers
@@ -36,6 +36,6 @@ Checklist for PRs that touch `packages/ai-rules/presets/**` (and dogfood `.curso
 - Budget: `preset-token-budget`
 - Leakage: `preset-no-cross-stack-leakage`
 - Validation: stack `agents/build-verifier.md` → preset-structure section
-- Dogfood scripts: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`, `sync-dogfood-mavis.sh`, `sync-dogfood-opencode.sh`
+- Dogfood scripts: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`, `sync-dogfood-claude.sh`, `sync-dogfood-mavis.sh`, `sync-dogfood-opencode.sh`
 - Drift script: `packages/ai-rules/scripts/check-shared-core-drift.sh`
 - Orchestrator: when editing presets, load this checklist + twin-sync

package/presets/claude/nuxt/settings.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "deny": [
+      "Bash(git commit *)",
+      "Bash(git push *)",
+      "Bash(npx jest*)"
+    ],
+    "ask": [
+      "Bash(bun *)",
+      "Bash(npm *)",
+      "Bash(npx *)",
+      "Bash(pnpm *)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/guard-shell-command.sh"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/chain-team-phases.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/presets/claude/php-hexagonal/CLAUDE.md

@@ -4,7 +4,8 @@ Preset for PHP backends using ports & adapters (PSR / Composer-first).
 
 **Repo-root agents:** see [`AGENTS.md`](../../AGENTS.md) at the project root.
 
-- Session-start: `php-app-core`, `architecture/boundaries`, `code-quality` (3–5).
+- Session-start: `php-app-core`, `architecture/boundaries`, `code-quality`, `ai-local-overlay` (3–5).
+- **Local overlay (session-start):** `ai-local-overlay` has no `paths:` and counts in the 3–5 budget. On every turn, probe `ls -la .ai.local`, apply `.ai.local/rules/*.md` and `.ai.local/conventions.md`, and acknowledge `Using .ai.local: <rule-name>`. Guide: `docs/LOCAL-OVERLAY.md`.
 - Delivery: `architecture/feature-delivery.md` + skill `feature-delivery`.
 - After PHP edits: `tooling-and-review/post-change-test.md` (+ `php-tooling`).
 - Integration tests: agents `integration-test-*` + skill `integration-testing` (never Playwright/XCUITest).
@@ -29,3 +30,16 @@ Host: `dogfood/php-hexagonal`.
 5. Secrets/authz logging — `security-reviewer` + `security-php`.
 
 Init: `npx @bonesofspring/ai-rules init claude --preset php-hexagonal` (also copies `REPO_AGENTS.md` → root `AGENTS.md`).
+
+## Harness wiring
+
+- **Subagent rules** are re-declared inside every `.claude/agents/*.md` via
+  the `## Rules to load (subagent context)` block (always-on + zone rules
+  filtered to stems that exist for this stack, using the nested
+  `.claude/rules/<topic>/<stem>.md` paths). Claude Code subagents inherit
+  no parent context, so this block is the authoritative mechanism.
+- `.claude/settings.json` ships harness-level denials (universal
+  `git commit/push deny`; JS stacks also `npx jest* deny` and `npm/npx/pnpm/bun`
+  ask). Re-init overwrites the file (consumer can edit afterwards); mirror
+  with root `AGENTS.md` if you change the harness.
+- **Pipeline hooks:** `.claude/settings.json` `hooks` wires `guard-shell-command.sh` (`PreToolUse` / `Bash`, `permissionDecision` `ask` or `allow`) and `chain-team-phases.sh` (`SubagentStop` for kebab-case `agent_type`). See `hooks/README.md`. No `hooks.json`.

package/presets/claude/php-hexagonal/REPO_AGENTS.md

@@ -70,4 +70,4 @@ A `.ai.local/` directory MAY exist at the repo root or at any nesting depth in m
 
 Plain markdown rules under `.ai.local/rules/*.md` are read by the agent with higher priority than preset rules. Living gotchas live in `.ai.local/conventions.md`.
 
-Authoring guide: `docs/LOCAL-OVERLAY.md` in the `@bonesofspring/ai-rules` package. The `ai-local-overlay` rule (always-on for Cursor, on-demand for Claude) is the mechanism; this `MANDATORY` section is the reinforcement.
+On every turn, probe `ls -la .ai.local`, apply `.ai.local/rules/*.md` and `.ai.local/conventions.md`, and acknowledge `Using .ai.local: <rule-name>`. Authoring guide: `docs/LOCAL-OVERLAY.md` in the `@bonesofspring/ai-rules` package. The `ai-local-overlay` rule is always-on on Cursor and session-start on Claude (no `paths:`). Mavis and OpenCode have no native `alwaysApply`; this section plus the platform entry's essential-rules list is the reinforcement.

package/presets/claude/php-hexagonal/agents/api-contract-reviewer.md

@@ -4,6 +4,23 @@ description: API contract review specialist. Validates OpenAPI/Protobuf DTOs, ma
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/api-and-data/api-http.md`
+- `.claude/rules/api-and-data/api-grpc.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Review **HTTP/gRPC contract alignment** for PHP hexagonal services.
 
 ## Focus

package/presets/claude/php-hexagonal/agents/build-verifier.md

@@ -5,6 +5,23 @@ readonly: false
 model: fast
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/tooling-and-review/php-tooling.md`
+- `.claude/rules/tooling-and-review/post-change-test.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are the build verifier for **PHP hexagonal** services (and for **ai-rules preset packaging** when scope says so).
 
 ## Consumer PHP repos

package/presets/claude/php-hexagonal/agents/ci-investigator.md

@@ -4,6 +4,35 @@ description: Investigates failing CI checks on PRs and branches — composer tes
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/architecture/domain-layer.md`
+- `.claude/rules/architecture/application-usecases.md`
+- `.claude/rules/architecture/ports-interfaces.md`
+- `.claude/rules/api-and-data/adapters-driven.md`
+- `.claude/rules/api-and-data/adapters-driving.md`
+- `.claude/rules/architecture/composition-root.md`
+- `.claude/rules/architecture/module-public-api.md`
+- `.claude/rules/api-and-data/persistence-adapters.md`
+- `.claude/rules/api-and-data/messaging-adapters.md`
+- `.claude/rules/stack/php-conventions.md`
+- `.claude/rules/api-and-data/api-http.md`
+- `.claude/rules/api-and-data/api-grpc.md`
+- `.claude/rules/tooling-and-review/php-tooling.md`
+- `.claude/rules/tooling-and-review/post-change-test.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Triage red CI for PHP repos (and ai-rules preset-structure when relevant).
 
 ## Steps

package/presets/claude/php-hexagonal/agents/code-reviewer.md

@@ -5,6 +5,22 @@ readonly: false
 model: fast
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/tooling-and-review/code-review.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are a senior PHP hexagonal code reviewer. Write only review artifacts under `.ai.local/team/**`; do not modify production code.
 
 ## Inputs

package/presets/claude/php-hexagonal/agents/codebase-analyzer.md

@@ -5,6 +5,21 @@ readonly: false
 model: fast
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are a specialist at understanding HOW this PHP hexagonal service works. Document implementation details with precise `path:line` references.
 
 ## CRITICAL — explain as-is only

package/presets/claude/php-hexagonal/agents/debugger.md

@@ -4,6 +4,35 @@ description: Debugging specialist for errors, test failures, and unexpected beha
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/architecture/domain-layer.md`
+- `.claude/rules/architecture/application-usecases.md`
+- `.claude/rules/architecture/ports-interfaces.md`
+- `.claude/rules/api-and-data/adapters-driven.md`
+- `.claude/rules/api-and-data/adapters-driving.md`
+- `.claude/rules/architecture/composition-root.md`
+- `.claude/rules/architecture/module-public-api.md`
+- `.claude/rules/api-and-data/persistence-adapters.md`
+- `.claude/rules/api-and-data/messaging-adapters.md`
+- `.claude/rules/stack/php-conventions.md`
+- `.claude/rules/api-and-data/api-http.md`
+- `.claude/rules/api-and-data/api-grpc.md`
+- `.claude/rules/tooling-and-review/php-tooling.md`
+- `.claude/rules/tooling-and-review/post-change-test.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Investigate with **runtime evidence**: failing `composer test` / `vendor/bin/phpunit` output, logs, stack traces, minimal repro.
 
 Use the **`debug-investigation` skill** for the investigation loop.

package/presets/claude/php-hexagonal/agents/feature-developer.md

@@ -4,6 +4,35 @@ description: Feature implementation specialist for PHP hexagonal services. Imple
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/architecture/domain-layer.md`
+- `.claude/rules/architecture/application-usecases.md`
+- `.claude/rules/architecture/ports-interfaces.md`
+- `.claude/rules/api-and-data/adapters-driven.md`
+- `.claude/rules/api-and-data/adapters-driving.md`
+- `.claude/rules/architecture/composition-root.md`
+- `.claude/rules/architecture/module-public-api.md`
+- `.claude/rules/api-and-data/persistence-adapters.md`
+- `.claude/rules/api-and-data/messaging-adapters.md`
+- `.claude/rules/stack/php-conventions.md`
+- `.claude/rules/api-and-data/api-http.md`
+- `.claude/rules/api-and-data/api-grpc.md`
+- `.claude/rules/tooling-and-review/php-tooling.md`
+- `.claude/rules/tooling-and-review/post-change-test.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Implement PHP features following hexagonal boundaries.
 
 ## Order

package/presets/claude/php-hexagonal/agents/integration-test-generator.md

@@ -4,6 +4,23 @@ description: Generates PHP integration tests from plans. Tests only — no produ
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/testing/integration.md`
+- `.claude/rules/testing/e2e.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are the **integration-test-generator** for PHP hexagonal services.
 
 ## Scope

package/presets/claude/php-hexagonal/agents/integration-test-healer.md

@@ -4,6 +4,23 @@ description: Heals flaky/failing PHP integration tests while preserving assertio
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/testing/integration.md`
+- `.claude/rules/testing/e2e.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are the **integration-test-healer** for PHP hexagonal services.
 
 ## Scope

package/presets/claude/php-hexagonal/agents/integration-test-planner.md

@@ -4,6 +4,23 @@ description: Plans PHP integration/adapter contract tests (HTTP controller tests
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+- `.claude/rules/testing/integration.md`
+- `.claude/rules/testing/e2e.md`
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are the **integration-test-planner** for PHP hexagonal services.
 
 ## Scope

package/presets/claude/php-hexagonal/agents/migration-specialist.md

@@ -4,6 +4,21 @@ description: Migration planning specialist for PHP build/toolchain upgrades, dep
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You plan migrations for **PHP modules** (toolchain, deps, layout refactors). Do not edit production code.
 
 ## Inputs

package/presets/claude/php-hexagonal/agents/openspec-author.md

@@ -4,6 +4,21 @@ description: OpenSpec (spec-driven SDD) specialist. Explores openspec/specs/**,
 model: inherit
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 You are an **OpenSpec** (Fission AI spec-driven SDD) author for a frontend/backend agent team.
 
 Your only writes target `openspec/**` (and team artifact manifests). Production code lives behind `feature-developer`; you are **docs / spec only**.

package/presets/claude/php-hexagonal/agents/performance-auditor.md

@@ -4,6 +4,21 @@ description: Performance audit specialist for PHP services. Reviews hot paths, a
 readonly: false
 ---
 
+## Rules to load (subagent context)
+
+This subagent does **not** inherit the parent session context or `CLAUDE.md`. Read these rules explicitly before acting:
+
+- `.claude/rules/stack/php-app-core.md`
+- `.claude/rules/architecture/boundaries.md` — layer boundaries and allowed imports
+- `.claude/rules/tooling-and-review/code-quality.md`
+- `.claude/rules/tooling-and-review/ai-local-overlay.md`
+- `.claude/rules/architecture/feature-delivery.md` — layer order, mockup gate, ux-design gate
+- `.claude/rules/architecture/reference-features.md` — analog files first
+- `.claude/rules/tooling-and-review/anti-sycophancy-discipline.md` — procedural anti-sycophancy rules
+- `.claude/rules/tooling-and-review/mcp-usage.md` — when verifying third-party APIs (Context7)
+
+Also read matching `.ai.local/rules/*.md` (local overlay) for the active zone, and the project strict rules if present.
+
 Audit PHP performance risks on the task scope.
 
 ## Focus