@bonesofspring/ai-rules 0.2.30 → 0.2.32

package/presets/mavis/mcp-ts/agents/feature-developer.md

@@ -101,8 +101,8 @@ Load requestable rule `mcp-usage` when verifying third-party library APIs (Conte
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for `brief.md`, `decomposition.md`, current scope, and applicable prior findings.
-- **Owned outputs:** `implementation.md` plus changed implementation/test paths; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `implementation`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for `brief.md`, `decomposition.md`, current scope, and applicable prior findings.
+- **Owned outputs:** `implementation.md` plus changed implementation/test paths; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `implementation`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/mcp-ts/agents/task-analyst.md

@@ -84,6 +84,6 @@ If the prompt/brief has a tracker URL (Linear/Jira/Notion/…) and that MCP is r
 ## Artifact contract
 
 - **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume `pipeline.json`, the manifest routing entry, user-approved decisions, and any authoritative architecture/approval entries.
-- **Owned outputs:** `brief.md` and `decomposition.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign entries.
+- **Owned outputs:** `brief.md` and `decomposition.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/mavis/mcp-ts/agents/task-router.md

@@ -139,6 +139,6 @@ Return the routing receipt to the orchestrator. The orchestration runtime/hook e
 ## Artifact contract
 
 - **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume the user request and any existing authoritative task/decision entries.
-- **Owned outputs:** `pipeline.json` and the routing manifest entry; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `routing`) and preserve all foreign entries.
+- **Owned outputs:** `pipeline.json` and the routing entry in `manifest.artifacts[]`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `routing`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/mavis/mcp-ts/rules/agent-team-orchestrator.md

@@ -109,7 +109,7 @@ Each slug has one `artifact-manifest.json` at `.ai.local/team/tasks/<slug>/`. Th
 
 - Read the manifest before broad prior-artifact discovery. Each step receives authoritative input entry IDs, owns named output entry IDs, and finishes with one terminal receipt linked to AC/task IDs.
 - Markdown remains detailed evidence; the manifest points to authoritative paths and records producer, status, timestamps, outcome, and evidence paths.
-- Agents upsert only entries they own and preserve foreign entries. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges.
+- Agents upsert only the items they own in `manifest.artifacts[]` and preserve all foreign items in that array. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges. The top-level array key is `artifacts` — not `entries`; see `agent-artifact-contracts.md` for the schema callout.
 - The orchestration runtime/hook is the single writer for `status.json` lifecycle fields and `metrics.json`. Agents read status for eligibility but never rewrite unrelated state, gate, retry, attempt, timestamp, or metrics fields.
 - Missing/stale manifests are reported as a handoff gap; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` rather than inventing authority.
 
@@ -145,6 +145,8 @@ Each slug has one `artifact-manifest.json` at `.ai.local/team/tasks/<slug>/`. Th
 | `awaiting_approval` | Human gate; wait for `/task-continue` |
 | `changes_requested` | Reviewer blocked; re-run developer (`retryAfterFix`) |
 | `validation_failed` | build-verifier failed; re-run developer then build-verifier |
+| `blocked` | Pipeline / step cannot proceed (e.g. `pipeline_parse_error`, completion of a parallel step whose producer's receipt was missing — see `agent-artifact-contracts.md` § Completion receipts) |
+| `awaiting_artifact_receipt` | Producer stopped but the bound or assigned-output receipt was missing or stale; hook keeps the attempt active and does not advance. See `agent-artifact-contracts.md` (Schema field name + Receipt binding) for the silent-bug class that lands here. |
 
 On each `subagentStop`, the hook reconciles `status.state` from the completing producer's terminal `artifact-manifest.json` receipt (`completed` \| `changes_requested` \| `validation_failed`) when agents left lifecycle fields untouched. Parent orchestrators must wait for that handoff before invoking the next step.
 

package/presets/mavis/next/REPO_AGENTS.md

@@ -43,6 +43,8 @@ Working directory for app scripts: **`app/`**. Detect the package manager from l
 
 After code edits: invoke **`post-change-lint`** (requestable). Full gate: agent `build-verifier`.
 
+Repositories with more than one package (e.g. `app/` + `storybook/`) run each package's own scripts from its own directory; do not conflate runners.
+
 ## Security basics
 
 - Do not commit secrets (`.env`, tokens, credentials).
@@ -65,10 +67,18 @@ Skills: `.cursor/skills/`, `.claude/skills/`, `.mavis/skills/`, or `.opencode/sk
 
 Gotchas, local patterns, and team decisions: **`.ai.local/conventions.md`** (fill after init; `init` does not overwrite it).
 
+## Seed library (`.ai.local/rules-library/`)
+
+`init` seeds **staged-inactive** rule templates here (Cursor `.mdc` sources analog: `presets/cursor/next/ai-local/rules-library/**`). They are **not** active until moved into `.ai.local/rules/`. When a seed matches the task scope, apply it and tell the owner to move it. Typical seeds: `router-pages` (Pages Router override), `no-react-fc`, `component-child-decomposition`, `single-source-copy-constants`, `commit-hygiene`, `pre-pr-checklist`, `api-contract-source`, `agent-pipeline-gates`, `task-levels`, `analytics-events`, `feature-flags-experiments`, `pwa-service-worker`, `qa-test-cases`, `forms-validation`, and the `storybook-*` set.
+
+## Managed vs preserved
+
+`init` owns `.cursor/**`, `.claude/**`, `.mavis/**`, `.opencode/**`, root `AGENTS.md`, and the tool MCP config; it **overwrites/merges** them. Durable project config and authoritative specs belong **outside** those trees: `.ai.local/**`, `.ai/context/**`, `docs/specs/**`, `openspec/**`, repo-root `.mcp.json`. After a re-init, re-check any consumer-owned block added to a managed file.
+
 ## Local overlay (`.ai.local/`) — MANDATORY
 
 A `.ai.local/` directory MAY exist at the repo root or at any nesting depth in monorepos. **All agents MUST read and apply it on every turn.** Rules there override preset rules; in conflicts, the local rule wins. `override: kill <preset-rule-name>` drops the named preset rule from the agent's context entirely.
 
-Plain markdown rules under `.ai.local/rules/*.md` are read by the agent with higher priority than preset rules. Living gotchas live in `.ai.local/conventions.md`.
+Plain markdown rules under `.ai.local/rules/*.md` are read by the agent with higher priority than preset rules. Living gotchas live in `.ai.local/conventions.md`. Staged seeds live in `.ai.local/rules-library/**`; a matching seed must be moved into `.ai.local/rules/` to activate.
 
 On every turn, probe `ls -la .ai.local`, apply `.ai.local/rules/*.md` and `.ai.local/conventions.md`, and acknowledge `Using .ai.local: <rule-name>`. Authoring guide: `docs/LOCAL-OVERLAY.md` in the `@bonesofspring/ai-rules` package. The `ai-local-overlay` rule is always-on on Cursor and session-start on Claude (no `paths:`). Mavis and OpenCode have no native `alwaysApply`; this section plus the platform entry's essential-rules list is the reinforcement.

package/presets/mavis/next/adapter-map.json

@@ -3,7 +3,7 @@
   "platform": "mavis",
   "stack": "next",
   "semanticSource": "cursor/next",
-  "sourceRevision": "be3247c939b52878a3d3d93245cd63c02e259418104111458f04ef0b737e5d27",
+  "sourceRevision": "be4e35ed4a2c1a3f44e976c64eb4ba9dc9940f91b5c440e72ac1375f62e4a481",
   "entries": [
     {
       "source": "AGENTS.md",
@@ -250,7 +250,47 @@
       "category": "ai-local",
       "disposition": "transform",
       "loadMode": "manual",
-      "reason": "Consumer-owned overlay template; seeded to .ai.local/conventions.md on init"
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/agent-pipeline-gates.md",
+      "target": "ai-local/rules-library/agent-pipeline-gates.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/analytics-events.md",
+      "target": "ai-local/rules-library/analytics-events.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/api-contract-source.md",
+      "target": "ai-local/rules-library/api-contract-source.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/artifact-lifecycle.md",
+      "target": "ai-local/rules-library/artifact-lifecycle.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/code-style.md",
+      "target": "ai-local/rules-library/code-style.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
     },
     {
       "source": "ai-local/rules-library/commit-hygiene.md",
@@ -258,7 +298,23 @@
       "category": "ai-local",
       "disposition": "transform",
       "loadMode": "manual",
-      "reason": "Consumer-owned overlay template; seeded to .ai.local/conventions.md on init"
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/component-child-decomposition.md",
+      "target": "ai-local/rules-library/component-child-decomposition.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/feature-flags-experiments.md",
+      "target": "ai-local/rules-library/feature-flags-experiments.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
     },
     {
       "source": "ai-local/rules-library/mcp-required-for-ui-layout.md",
@@ -266,7 +322,15 @@
       "category": "ai-local",
       "disposition": "transform",
       "loadMode": "manual",
-      "reason": "Consumer-owned overlay template; seeded to .ai.local/conventions.md on init"
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/no-react-fc.md",
+      "target": "ai-local/rules-library/no-react-fc.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
     },
     {
       "source": "ai-local/rules-library/no-test-driven-behavior-change.md",
@@ -274,7 +338,7 @@
       "category": "ai-local",
       "disposition": "transform",
       "loadMode": "manual",
-      "reason": "Consumer-owned overlay template; seeded to .ai.local/conventions.md on init"
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
     },
     {
       "source": "ai-local/rules-library/pre-pr-checklist.md",
@@ -282,7 +346,23 @@
       "category": "ai-local",
       "disposition": "transform",
       "loadMode": "manual",
-      "reason": "Consumer-owned overlay template; seeded to .ai.local/conventions.md on init"
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/pwa-service-worker.md",
+      "target": "ai-local/rules-library/pwa-service-worker.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/qa-test-cases.md",
+      "target": "ai-local/rules-library/qa-test-cases.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
     },
     {
       "source": "ai-local/rules-library/router-pages.md",
@@ -290,7 +370,7 @@
       "category": "ai-local",
       "disposition": "transform",
       "loadMode": "manual",
-      "reason": "Consumer-owned overlay template; seeded to .ai.local/conventions.md on init"
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
     },
     {
       "source": "ai-local/rules-library/single-source-copy-constants.md",
@@ -298,7 +378,87 @@
       "category": "ai-local",
       "disposition": "transform",
       "loadMode": "manual",
-      "reason": "Consumer-owned overlay template; seeded to .ai.local/conventions.md on init"
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/storybook-catalog-structure.md",
+      "target": "ai-local/rules-library/storybook-catalog-structure.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/storybook-cleanup-temp-screenshots.md",
+      "target": "ai-local/rules-library/storybook-cleanup-temp-screenshots.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/storybook-csf-authoring.md",
+      "target": "ai-local/rules-library/storybook-csf-authoring.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/storybook-dev-compare-figma.md",
+      "target": "ai-local/rules-library/storybook-dev-compare-figma.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/storybook-keep-tests-current.md",
+      "target": "ai-local/rules-library/storybook-keep-tests-current.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/storybook-modals.md",
+      "target": "ai-local/rules-library/storybook-modals.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/storybook-no-app-node-modules.md",
+      "target": "ai-local/rules-library/storybook-no-app-node-modules.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/storybook-ui-quality-gate.md",
+      "target": "ai-local/rules-library/storybook-ui-quality-gate.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/task-levels.md",
+      "target": "ai-local/rules-library/task-levels.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
+    },
+    {
+      "source": "ai-local/rules-library/ui-change-review-gate.md",
+      "target": "ai-local/rules-library/ui-change-review-gate.md",
+      "category": "ai-local",
+      "disposition": "transform",
+      "loadMode": "manual",
+      "reason": "Staged-inactive local overlay rule template; copied to .ai.local/rules-library/ on init (activate by moving it to .ai.local/rules/)"
     },
     {
       "source": "commands/spec-start.md",
@@ -473,6 +633,14 @@
       "reason": "Requestable Cursor rule: referenced from entry files; not claimed as MiniMax auto-load",
       "sharedCoreStem": "review/code-review-mr.md"
     },
+    {
+      "source": "rules/component-catalog-gate.mdc",
+      "target": "rules/component-catalog-gate.md",
+      "category": "rules",
+      "disposition": "transform",
+      "loadMode": "referenced",
+      "reason": "Requestable Cursor rule: referenced from entry files; not claimed as MiniMax auto-load"
+    },
     {
       "source": "rules/css-property-order-stylelint.mdc",
       "target": "rules/css-property-order-stylelint.md",
@@ -507,6 +675,14 @@
       "reason": "Requestable Cursor rule: referenced from entry files; not claimed as MiniMax auto-load",
       "sharedCoreStem": "architecture/feature-delivery-workflow.md"
     },
+    {
+      "source": "rules/forms-validation.mdc",
+      "target": "rules/forms-validation.md",
+      "category": "rules",
+      "disposition": "transform",
+      "loadMode": "referenced",
+      "reason": "Requestable Cursor rule: referenced from entry files; not claimed as MiniMax auto-load"
+    },
     {
       "source": "rules/http-client.mdc",
       "target": "rules/http-client.md",
@@ -573,6 +749,14 @@
       "loadMode": "referenced",
       "reason": "Requestable Cursor rule: referenced from entry files; not claimed as MiniMax auto-load"
     },
+    {
+      "source": "rules/next-static-export.mdc",
+      "target": "rules/next-static-export.md",
+      "category": "rules",
+      "disposition": "transform",
+      "loadMode": "referenced",
+      "reason": "Requestable Cursor rule: referenced from entry files; not claimed as MiniMax auto-load"
+    },
     {
       "source": "rules/no-props-spread.mdc",
       "target": "rules/no-props-spread.md",

package/presets/mavis/next/agents/accessibility-reviewer.md

@@ -68,8 +68,8 @@ Shipped browser split: Playwright MCP for e2e specs/selectors; Chrome DevTools M
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, implementation or UI diff scope, and prior review artifacts when present.
-- **Owned outputs:** `a11y-review.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `a11y-review`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition, implementation or UI diff scope, and prior review artifacts when present.
+- **Owned outputs:** `a11y-review.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `a11y-review`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `changes_requested`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/api-contract-reviewer.md

@@ -66,8 +66,8 @@ For feature-developer before or during implementation.
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, architecture when present, and changed types/API/mocks against the contract docs.
-- **Owned outputs:** `api-contract-review.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `api-contract-review`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition, architecture when present, and changed types/API/mocks against the contract docs.
+- **Owned outputs:** `api-contract-review.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `api-contract-review`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `changes_requested`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/build-verifier.md

@@ -33,6 +33,7 @@ Use **`package-manager.md`** for the repo package manager.
 2. **`lint:css`** — full Stylelint.
 3. **`type-check`** — when TypeScript changed.
 4. **Unit tests** — run specs for changed modules (paths from diff); if unclear, run the narrowest parent suite that covers changed mappers/services/store.
+5. **Component catalog** — when the repo ships a catalog (e.g. `storybook/`) and `app/src/ui/**` or catalog files changed, run the catalog's own test/visual-baseline suite from the catalog package and require green **without** `--update` (`component-catalog-gate`). A green app unit run does not cover catalog stories.
 
 Prefer **`lint`** (= js + css + type-check) before handoff on large changes.
 
@@ -123,7 +124,7 @@ Do not fix code — report only. Do not advance to code-reviewer until PASS.
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, implementation evidence, pipeline scope, and changed files.
-- **Owned outputs:** `validation-report.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `validation`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition, implementation evidence, pipeline scope, and changed files.
+- **Owned outputs:** `validation-report.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `validation`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `validation_failed`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/mavis/next/agents/ci-investigator.md

@@ -84,8 +84,8 @@ If a Sentry/Datadog (or similar) MCP is ready and the task is a production error
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition when present, failing check context, and prior validation/debug artifacts.
-- **Owned outputs:** `ci-report.md` plus any minimal fix paths; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `ci`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition when present, failing check context, and prior validation/debug artifacts.
+- **Owned outputs:** `ci-report.md` plus any minimal fix paths; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `ci`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/code-reviewer.md

@@ -108,7 +108,8 @@ Do not mix this output with retrospective facilitation — keep review and retro
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, implementation, validation evidence, and the scoped git diff.
-- **Owned outputs:** `review.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `review`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition, implementation, validation evidence, and the scoped git diff.
+- **Owned outputs:** `review.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `review`) and preserve all foreign items in `manifest.artifacts[]`.
+- **Commit hygiene:** never run `git commit` / `git push`. Reviewer turns end with findings only; when asked for commit guidance, propose an area-split commit plan (source / artifacts / docs) with the owning slug.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `changes_requested`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/mavis/next/agents/debugger.md

@@ -91,8 +91,8 @@ If a Sentry/Datadog (or similar) MCP is ready and the task is a production error
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition when present, failing evidence, and related prior artifacts.
-- **Owned outputs:** `debug-report.md` plus any minimal fix paths; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `debug`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition when present, failing evidence, and related prior artifacts.
+- **Owned outputs:** `debug-report.md` plus any minimal fix paths; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `debug`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/feature-developer.md

@@ -151,7 +151,8 @@ Shipped browser split: Playwright MCP for e2e specs/selectors; Chrome DevTools M
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for `brief.md`, `decomposition.md`, current scope, and applicable prior findings.
-- **Owned outputs:** `implementation.md` plus changed implementation/test paths; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `implementation`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for `brief.md`, `decomposition.md`, current scope, and applicable prior findings.
+- **Owned outputs:** `implementation.md` plus changed implementation/test paths; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `implementation`) and preserve all foreign items in `manifest.artifacts[]`.
+- **Commit hygiene:** never run `git commit` / `git push`. At the end of the turn return a `## Human commits` block: files touched + a proposed commit message, split by area (source / artifacts / docs) with the owning slug/ticket in the subject. See the consumer `commit-hygiene` local rule.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/mavis/next/agents/migration-specialist.md

@@ -72,8 +72,8 @@ Load requestable rule `mcp-usage` when verifying third-party library APIs (Conte
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition and stack/version context from the repo.
-- **Owned outputs:** `migration-plan.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `migration-plan`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition and stack/version context from the repo.
+- **Owned outputs:** `migration-plan.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `migration-plan`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/mockup-reviewer.md

@@ -88,8 +88,8 @@ Standalone FAIL must **not** set `changes_requested`. Embedded FAIL is a FAIL-on
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for routing + analysis when present (standalone may have only the prompt + URL).
-- **Owned outputs:** `mockup-review.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `mockup-review`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for routing + analysis when present (standalone may have only the prompt + URL).
+- **Owned outputs:** `mockup-review.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `mockup-review`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed`, `changes_requested`, or `blocked` per the table above. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/openspec-author.md

@@ -71,6 +71,8 @@ Hard constraints (read `config.yaml rules.proposal` first — they win):
 
 - `proposal.md` ≤ 500 words.
 - `## Non-goals` section mandatory (omit → `blocked`).
+- `## Compliance impact` block mandatory in `proposal.md` and `design.md` (None | Affected — list PD / medical / analytics / SSR-cookie / third-party surfaces); when unclear, default to `Affected` and block.
+- `## Hard rules applied` block at the top of `proposal.md` / `design.md` / `tasks.md` (applicable rules + how applied; `N/A — reason` for the rest), when the consumer repo maintains hard rules.
 - `## What Changes` lists capability deltas **only**; no implementation steps.
 - `## Capabilities` table groups deltas by capability slug; cite spec paths.
 - Spec deltas use `## MODIFIED Requirements` heading (or `## REMOVED Requirements`); Each `### Requirement:` block carries `SHALL` statements and `#### Scenario:` Given/When/Then. Mirror existing capability voice.
@@ -132,8 +134,8 @@ If `scope` carries multiple phases (e.g. `openspec:<change-id>:propose+apply`),
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition and available architecture/migration/review artifacts.
-- **Owned outputs:** `openspec/changes/<change-id>/**` (proposal.md, design.md, tasks.md, .openspec.yaml, specs/<capability>/spec.md delta) plus the team slot `openspec-change.md` in `.ai.local/team/tasks/<slug>/` when the orchestrator asks for a summary handoff. Preserve all foreign entries; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `openspec-change`).
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition and available architecture/migration/review artifacts.
+- **Owned outputs:** `openspec/changes/<change-id>/**` (proposal.md, design.md, tasks.md, .openspec.yaml, specs/<capability>/spec.md delta) plus the team slot `openspec-change.md` in `.ai.local/team/tasks/<slug>/` when the orchestrator asks for a summary handoff. Preserve all foreign items in `manifest.artifacts[]`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `openspec-change`).
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths under `openspec/changes/<change-id>/**`, attach `openspec validate <change-id> --type change --strict` exit code + deltas-only summary, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/performance-auditor.md

@@ -71,8 +71,8 @@ If Chrome DevTools MCP is ready and the app is running, use it for console/netwo
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief when present and the scoped git diff / routes under audit.
-- **Owned outputs:** `perf-report.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `perf-report`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief when present and the scoped git diff / routes under audit.
+- **Owned outputs:** `perf-report.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `perf-report`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/qa-tester.md

@@ -51,8 +51,8 @@ When the task is mostly e2e, prefer invoking the dedicated `playwright-test-plan
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, reviewer notes when present, and prior implementation/validation artifacts.
-- **Owned outputs:** changed/added test paths (and any QA notes written under the slug dir); upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `qa-tester`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition, reviewer notes when present, and prior implementation/validation artifacts.
+- **Owned outputs:** changed/added test paths (and any QA notes written under the slug dir); upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `qa-tester`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/security-reviewer.md

@@ -61,8 +61,8 @@ PASS | PASS_WITH_NOTES | FAIL
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, prior `review.md` when present, and the scoped git diff.
-- **Owned outputs:** `security-review.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `security-review`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition, prior `review.md` when present, and the scoped git diff.
+- **Owned outputs:** `security-review.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `security-review`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `changes_requested`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/solution-architect.md

@@ -71,8 +71,8 @@ Load requestable rule `mcp-usage` when verifying third-party library APIs (Conte
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition and applicable prior analysis artifacts.
-- **Owned outputs:** `architecture.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `architecture`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition and applicable prior analysis artifacts.
+- **Owned outputs:** `architecture.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `architecture`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/mavis/next/agents/task-analyst.md

@@ -60,6 +60,13 @@ Create or update files under `.ai.local/team/tasks/<slug>/`:
 ## Slug
 <slug>
 
+## Hard rules applied
+- <applicable preset/local rule> — <how applied>
+- N/A — <reason>   (list non-applicable hard rules explicitly)
+
+## Compliance impact
+None | Affected — <surfaces: PD / medical data / analytics / SSR cookies / error reporting / third-party scripts>
+
 ## Goal
 ...
 
@@ -178,6 +185,6 @@ If the prompt/brief has a tracker URL (Linear/Jira/Notion/…) and that MCP is r
 ## Artifact contract
 
 - **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume `pipeline.json`, the manifest routing entry, user-approved decisions, and any authoritative architecture/approval entries.
-- **Owned outputs:** `brief.md` and `decomposition.md` (plus `ux-design.md` when produced); upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign entries.
+- **Owned outputs:** `brief.md` and `decomposition.md` (plus `ux-design.md` when produced); upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/mavis/next/agents/task-router.md

@@ -111,6 +111,7 @@ Keep top-level `profile` and emit this top-level object in every new `pipeline.j
 - If prompt or `brief.md` contains `figma.com` on `feature` / `refactor` / `spike` / `spec-gen`, insert **mockup-reviewer** after **task-analyst** (when present) and before **solution-architect** and **feature-developer**. Set `model: "strong"` on that step. Do not add static `humanGates: ["after:mockup-reviewer"]` (FAIL-only hook exception). Never put `mockup-reviewer` in a `parallel: true` step (FAIL-only gate is serial).
 - Classify intent `mockup-review` **before** `ux-design` **before** `review-only`. A `figma.com` URL with review-not-implement language is `mockup-review` even without the word «макет», including when the user said «ревью UX». <!-- i18n-keep: E4 -->
 - If UI stack and (required-signal or advisory UI AC), instruct **task-analyst** to load skill `ux-design` (no new pipeline step; analyst default model, not `strong`). Required-signal: user asked UX, or AC require flows/states, or spec-gen page/feature.
+- If the resolved scope touches UI paths (`app/src/ui/**`, or the repo's component-catalog root) on `feature` / `refactor`, insert **mockup-reviewer** even **without** a `figma.com` URL — it reviews against the AC / `ux-design.md` instead of Figma. Pair it with a **`mockup-review.md`** terminal artifact requirement (the UI change is not complete without it) and, where the repo ships a component catalog, a catalog-test note on `build-verifier` (`component-catalog-gate`).
 - Skip **task-analyst** if AC/scope fully specified → document in `skipped`.
 - Add **solution-architect** for cross-layer / new public APIs — after analyst, before developer.
 - Add **api-contract-reviewer** for new/changed backend contracts — before developer.
@@ -190,6 +191,6 @@ Return the routing receipt to the orchestrator. The orchestration runtime/hook e
 ## Artifact contract
 
 - **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume the user request and any existing authoritative task/decision entries.
-- **Owned outputs:** `pipeline.json` and the routing manifest entry; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `routing`) and preserve all foreign entries.
+- **Owned outputs:** `pipeline.json` and the routing entry in `manifest.artifacts[]`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `routing`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.