@bonesofspring/ai-rules 0.2.30 → 0.2.32

package/presets/opencode/svelte/agents/migration-specialist.md

@@ -84,8 +84,8 @@ Load requestable rule `mcp-usage` when verifying third-party library APIs (Conte
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition and stack/version context from the repo.
-- **Owned outputs:** `migration-plan.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `migration-plan`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition and stack/version context from the repo.
+- **Owned outputs:** `migration-plan.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `migration-plan`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/mockup-reviewer.md

@@ -74,8 +74,8 @@ Standalone FAIL must **not** set `changes_requested`. Embedded FAIL is a FAIL-on
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for routing + analysis when present (standalone may have only the prompt + URL).
-- **Owned outputs:** `mockup-review.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `mockup-review`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for routing + analysis when present (standalone may have only the prompt + URL).
+- **Owned outputs:** `mockup-review.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `mockup-review`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed`, `changes_requested`, or `blocked` per the table above. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/openspec-author.md

@@ -145,8 +145,8 @@ If `scope` carries multiple phases (e.g. `openspec:<change-id>:propose+apply`),
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition and available architecture/migration/review artifacts.
-- **Owned outputs:** `openspec/changes/<change-id>/**` (proposal.md, design.md, tasks.md, .openspec.yaml, specs/<capability>/spec.md delta) plus the team slot `openspec-change.md` in `.ai.local/team/tasks/<slug>/` when the orchestrator asks for a summary handoff. Preserve all foreign entries; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `openspec-change`).
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition and available architecture/migration/review artifacts.
+- **Owned outputs:** `openspec/changes/<change-id>/**` (proposal.md, design.md, tasks.md, .openspec.yaml, specs/<capability>/spec.md delta) plus the team slot `openspec-change.md` in `.ai.local/team/tasks/<slug>/` when the orchestrator asks for a summary handoff. Preserve all foreign items in `manifest.artifacts[]`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `openspec-change`).
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths under `openspec/changes/<change-id>/**`, attach `openspec validate <change-id> --type change --strict` exit code + deltas-only summary, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/performance-auditor.md

@@ -83,8 +83,8 @@ If Chrome DevTools MCP is ready and the app is running, use it for console/netwo
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief when present and the scoped git diff / routes under audit.
-- **Owned outputs:** `perf-report.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `perf-report`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief when present and the scoped git diff / routes under audit.
+- **Owned outputs:** `perf-report.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `perf-report`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/qa-tester.md

@@ -59,8 +59,8 @@ When the task is mostly e2e, prefer invoking the dedicated `playwright-test-plan
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, reviewer notes when present, and prior implementation/validation artifacts.
-- **Owned outputs:** changed/added test paths (and any QA notes written under the slug dir); upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `qa-tester`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition, reviewer notes when present, and prior implementation/validation artifacts.
+- **Owned outputs:** changed/added test paths (and any QA notes written under the slug dir); upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `qa-tester`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/security-reviewer.md

@@ -73,8 +73,8 @@ PASS | PASS_WITH_NOTES | FAIL
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition, prior `review.md` when present, and the scoped git diff.
-- **Owned outputs:** `security-review.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `security-review`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition, prior `review.md` when present, and the scoped git diff.
+- **Owned outputs:** `security-review.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `security-review`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `changes_requested`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/solution-architect.md

@@ -83,8 +83,8 @@ Load requestable rule `mcp-usage` when verifying third-party library APIs (Conte
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition and applicable prior analysis artifacts.
-- **Owned outputs:** `architecture.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `architecture`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition and applicable prior analysis artifacts.
+- **Owned outputs:** `architecture.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `architecture`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/task-analyst.md

@@ -190,6 +190,6 @@ If the prompt/brief has a tracker URL (Linear/Jira/Notion/…) and that MCP is r
 ## Artifact contract
 
 - **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume `pipeline.json`, the manifest routing entry, user-approved decisions, and any authoritative architecture/approval entries.
-- **Owned outputs:** `brief.md` and `decomposition.md` (plus `ux-design.md` when produced); upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign entries.
+- **Owned outputs:** `brief.md` and `decomposition.md` (plus `ux-design.md` when produced); upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `analysis`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/opencode/svelte/agents/task-router.md

@@ -202,6 +202,6 @@ Return the routing receipt to the orchestrator. The orchestration runtime/hook e
 ## Artifact contract
 
 - **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume the user request and any existing authoritative task/decision entries.
-- **Owned outputs:** `pipeline.json` and the routing manifest entry; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `routing`) and preserve all foreign entries.
+- **Owned outputs:** `pipeline.json` and the routing entry in `manifest.artifacts[]`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `routing`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.

package/presets/opencode/svelte/agents/tech-writer.md

@@ -77,8 +77,8 @@ Post-delivery: when behavior or public docs changed and `docs/specs/` is in play
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition and available architecture/migration/review artifacts.
-- **Owned outputs:** `documentation.md` (and any explicitly requested docs paths); upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `documentation`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition and available architecture/migration/review artifacts.
+- **Owned outputs:** `documentation.md` (and any explicitly requested docs paths); upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `documentation`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/unit-test-generator.md

@@ -47,8 +47,8 @@ Run affected unit tests from repository root when feasible. Report files changed
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for `unit-test-plan.md`, brief/decomposition when present, and target modules.
-- **Owned outputs:** generated/updated `*.spec.ts` paths; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `unit-test-generator`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for `unit-test-plan.md`, brief/decomposition when present, and target modules.
+- **Owned outputs:** generated/updated `*.spec.ts` paths; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `unit-test-generator`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/unit-test-healer.md

@@ -48,8 +48,8 @@ Report root cause, files changed, validation result, and remaining risk.
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for failing test evidence, `unit-test-plan.md` when present, and recent diff.
-- **Owned outputs:** healed `*.spec.ts` paths (and minimal production fixes only when evidenced); upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `unit-test-healer`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for failing test evidence, `unit-test-plan.md` when present, and recent diff.
+- **Owned outputs:** healed `*.spec.ts` paths (and minimal production fixes only when evidenced); upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `unit-test-healer`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/agents/unit-test-planner.md

@@ -72,8 +72,8 @@ Test titles in the plan must follow Russian capitalization rules from `tests-uni
 
 ## Artifact contract
 
-- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the manifest entries for brief/decomposition and target modules under `**`.
-- **Owned outputs:** `unit-test-plan.md`; upsert only the manifest entry assigned by handoff (`artifactOutputId`; fallback `unit-test-planner`) and preserve all foreign entries.
+- **Authoritative inputs:** read `.ai.local/team/tasks/<slug>/artifact-manifest.json` first; consume handoff `artifactInputIds` when supplied, otherwise consume the items in `manifest.artifacts[]` for brief/decomposition and target modules under `**`.
+- **Owned outputs:** `unit-test-plan.md`; upsert only the entry in `manifest.artifacts[]` assigned by handoff (`artifactOutputId`; fallback `unit-test-planner`) and preserve all foreign items in `manifest.artifacts[]`.
 - **Terminal receipt:** cover applicable AC/task IDs, list authoritative evidence paths, and emit `completed` or `blocked`. Bind it to the supplied `attemptId` when present.
 - **Shared state:** never create or mutate `status.json` or `metrics.json`; the orchestration runtime/hook owns lifecycle, gates, retries, attempts, and timestamps.
 

package/presets/opencode/svelte/rules/agent-team-orchestrator.md

@@ -109,7 +109,7 @@ Each slug has one `artifact-manifest.json` at `.ai.local/team/tasks/<slug>/`. Th
 
 - Read the manifest before broad prior-artifact discovery. Each step receives authoritative input entry IDs, owns named output entry IDs, and finishes with one terminal receipt linked to AC/task IDs.
 - Markdown remains detailed evidence; the manifest points to authoritative paths and records producer, status, timestamps, outcome, and evidence paths.
-- Agents upsert only entries they own and preserve foreign entries. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges.
+- Agents upsert only the items they own in `manifest.artifacts[]` and preserve all foreign items in that array. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges. The top-level array key is `artifacts` — not `entries`; see `agent-artifact-contracts.md` for the schema callout.
 - The orchestration runtime/hook is the single writer for `status.json` lifecycle fields and `metrics.json`. Agents read status for eligibility but never rewrite unrelated state, gate, retry, attempt, timestamp, or metrics fields.
 - Missing/stale manifests are reported as a handoff gap; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` rather than inventing authority.
 
@@ -145,6 +145,8 @@ Each slug has one `artifact-manifest.json` at `.ai.local/team/tasks/<slug>/`. Th
 | `awaiting_approval` | Human gate; wait for `/task-continue` |
 | `changes_requested` | Reviewer blocked; re-run developer (`retryAfterFix`) |
 | `validation_failed` | build-verifier failed; re-run developer then build-verifier |
+| `blocked` | Pipeline / step cannot proceed (e.g. `pipeline_parse_error`, completion of a parallel step whose producer's receipt was missing — see `agent-artifact-contracts.md` § Completion receipts) |
+| `awaiting_artifact_receipt` | Producer stopped but the bound or assigned-output receipt was missing or stale; hook keeps the attempt active and does not advance. See `agent-artifact-contracts.md` (Schema field name + Receipt binding) for the silent-bug class that lands here. |
 
 On each `subagentStop`, the hook reconciles `status.state` from the completing producer's terminal `artifact-manifest.json` receipt (`completed` \| `changes_requested` \| `validation_failed`) when agents left lifecycle fields untouched. Parent orchestrators must wait for that handoff before invoking the next step.
 

package/presets/opencode/svelte/rules/code-review-mr.md

@@ -45,9 +45,9 @@ On-demand rule for review flows. **Procedure and output format:** skill `code-re
 
 ### Checklist references
 
-- Architecture layers: `architecture-boundaries.mdc`, `svelte-app-core.mdc`; network: `http-client.mdc`
-- Imports: `public-imports.mdc`, `layer-barrel-exports.mdc`
-- UI: `svelte-ui.mdc`
-- Security: `security-sveltekit.mdc`
-- Tests: `tests-unit.mdc`, `playwright-agents.mdc`, `tests-e2e-structure.mdc`
-- Lint gate before final report: `post-change-lint.mdc`
+- Architecture layers: `architecture-boundaries.md`, `svelte-app-core.md`; network: `http-client.md`
+- Imports: `public-imports.md`, `layer-barrel-exports.md`
+- UI: `svelte-ui.md`
+- Security: `security-sveltekit.md`
+- Tests: `tests-unit.md`, `playwright-agents.md`, `tests-e2e-structure.md`
+- Lint gate before final report: `post-change-lint.md`

package/presets/opencode/svelte/rules/feature-delivery-workflow.md

@@ -52,7 +52,7 @@ Filled in the stack adapter: concrete globs/paths and `.mdc` / topic `.md` names
 
 When the prompt or `brief.md` contains a `figma.com` URL, **mockup review** (`mockup-reviewer` / skill `mockup-review`) must complete — or the user must continue past FAIL/`BLOCKED_MCP` via `/task-continue` — **before UI implementation**. Non-UI tasks no-op this gate. When required-signal and **no** `figma.com`, **`ux-design.md`** (on the analysis manifest entry) must exist and not be `INCOMPLETE` before UI work — else **blocked**, hand back to `task-analyst`. Parallel to the mockup gate.
 
-Typical feature with backend data and shared state. Layer details — `architecture-boundaries.mdc`, `svelte-app-core.mdc`.
+Typical feature with backend data and shared state. Layer details — `architecture-boundaries.md`, `svelte-app-core.md`.
 
 Canonical paths: `src/routes/**`, `src/lib/{components,stores,api,clients,types}/**`, `tests/e2e/**`. Aliases: `$lib` preferred; `@/` if configured. State: `store-svelte` (runes primary; legacy stores secondary).
 

package/presets/opencode/svelte/rules/reference-features.md

@@ -77,6 +77,6 @@ Post-init gotchas / patterns / decisions: **`.ai.local/conventions.md`** (shared
 
 ## Related rules
 
-- `code-quality-and-refactoring.mdc` — repeat patterns; no deep-import.
-- `feature-delivery-workflow.mdc` — layer order.
+- `code-quality-and-refactoring.md` — repeat patterns; no deep-import.
+- `feature-delivery-workflow.md` — layer order.
 - skill `feature-delivery` — end-to-end scenario.

package/presets/opencode/svelte/rules/tests-e2e-structure.md

@@ -84,5 +84,5 @@ Bad (no capital after period; or wrong locale for configured ESLint):
 - `PREFIX-XXX` example: `OrderHistory` → `OH`, `BillingReport` → `BR`.
 - Russian example: `test('OH-001 Отображается список заказов', async ({ page }) => { ... })` <!-- i18n-keep: E5 --> (Order list is displayed).
 - Page object example filename: `OrderHistoryPage.ts`.
-- Cross-reference: See also **`playwright-agents.mdc`**.
+- Cross-reference: See also **`playwright-agents.md`**.
 - `## Stack notes` content is stripped by `scripts/check-shared-core-drift.sh` before byte-comparing this file against `_shared/core/testing/testing-principles.md`; keep prose above (core content) verbatim against the core file.

package/scripts/check-generated-drift.mjs

@@ -45,6 +45,42 @@ function sha256File(filePath) {
   return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
 }
 
+/**
+ * Generated rule bodies must not point at sibling rules via `.mdc` — the target
+ * trees ship `.md` only (e.g. `feature-delivery-workflow.md` referencing
+ * `store-rtk.mdc`). Embed-mode bodies preserve Cursor `## Stack notes` prose, so
+ * this is easy to regress. Only stems that exist as sibling `.md` are flagged.
+ */
+function findDanglingMdcRefs(rulesRoot) {
+  const issues = [];
+  if (!fs.existsSync(rulesRoot)) {
+    return issues;
+  }
+  const stems = new Set(
+    fs
+      .readdirSync(rulesRoot)
+      .filter((name) => name.endsWith('.md'))
+      .map((name) => name.slice(0, -'.md'.length)),
+  );
+  const refRe = /(?<![\w./-])([a-z][\w-]*)\.mdc\b/g;
+  for (const name of fs.readdirSync(rulesRoot)) {
+    if (!name.endsWith('.md')) {
+      continue;
+    }
+    // Author meta-rules describe the Cursor `.mdc` SoT; `.mdc` refs there are intentional.
+    if (name.startsWith('preset-')) {
+      continue;
+    }
+    const text = fs.readFileSync(path.join(rulesRoot, name), 'utf8');
+    for (const match of text.matchAll(refRe)) {
+      if (stems.has(match[1])) {
+        issues.push(`${name}: dangling .mdc reference to sibling rule '${match[1]}.mdc'`);
+      }
+    }
+  }
+  return issues;
+}
+
 function compareTrees(expectedRoot, actualRoot, label, drift) {
   const expected = walkRelative(expectedRoot);
   const actual = walkRelative(actualRoot);
@@ -66,8 +102,7 @@ function compareTrees(expectedRoot, actualRoot, label, drift) {
 
 const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'ai-rules-generated-drift-'));
 const drift = [];
-try {
-  fs.mkdirSync(path.join(tempRoot, 'presets'), { recursive: true });
+try {  fs.mkdirSync(path.join(tempRoot, 'presets'), { recursive: true });
   fs.cpSync(path.join(presetsRoot, 'cursor'), path.join(tempRoot, 'presets', 'cursor'), {
     recursive: true,
   });
@@ -88,6 +123,11 @@ try {
         `${platform}/${stack}`,
         drift,
       );
+      drift.push(
+        ...findDanglingMdcRefs(path.join(presetsRoot, platform, stack, 'rules')).map(
+          (issue) => `${platform}/${stack}/${issue}`,
+        ),
+      );
     }
   }
 } finally {

package/scripts/check-local-overlay.sh

@@ -235,6 +235,45 @@ if not offenders:
     print("  OK: no `team/conventions` references in any form; conventions templates present")
 print()
 
+# --- Seed glob contract (next) -------------------------------------------
+# Staged-inactive seeds under `ai-local/rules-library/` ship globs for the
+# CONSUMER layout. The next stack mandates `app/src/**`, so a bare `src/` glob
+# never activates — the rule silently no-ops. Guard the seed set.
+print("=== seed globs (next) ===")
+SEED_ROOT_PREFIXES = (
+    "app/",
+    "storybook/",
+    ".ai.local/",
+    "docs/",
+    "openspec/",
+    "packages/",
+)
+bad_seed_globs: list[str] = []
+next_seed_dir = presets / "cursor" / "next" / "ai-local" / "rules-library"
+if next_seed_dir.is_dir():
+    for path in sorted(next_seed_dir.glob("*.md")):
+        text = path.read_text(encoding="utf-8")
+        for line in text.splitlines():
+            if not re.match(r"^glob(s)?\s*:", line):
+                continue
+            value = line.split(":", 1)[1].strip()
+            if value == "always":
+                continue
+            for glob in (part.strip() for part in re.split(r",(?![^{]*\})", value)):
+                if not glob or glob.startswith("*"):
+                    continue
+                if not glob.startswith(SEED_ROOT_PREFIXES):
+                    bad_seed_globs.append(f"{path.name}: `{glob}`")
+for issue in bad_seed_globs:
+    print(
+        "FAIL: seed glob must start with app/ (or storybook/.ai.local/docs/openspec): "
+        f"{issue}"
+    )
+failed += len(bad_seed_globs)
+if not bad_seed_globs:
+    print("  OK: next seeds use consumer-layout globs")
+print()
+
 if failed:
     print(f"Result: FAIL ({failed} issue(s) across {sum(1 for v in stack_failed.values() if v > 0)} stack(s))")
     sys.exit(1)

package/scripts/fixtures/cli-golden/claude/next.json

@@ -10,7 +10,7 @@
     ".ai.local/team/fixtures/feature-full.json": "1110b152cdcb5508e8ce4179aa2e760f7f7c66569ba081d6bdf0a49a0a449470",
     ".ai.local/team/fixtures/feature-light.json": "618ac9da9527d688ec7dac849eafb869ae342ec890d0e7c73c1e57c0f8fb5a1b",
     ".ai.local/team/fixtures/feature-with-figma-url.json": "8aec2ac11ba552bc9135721678af58c73ca5a74b3038c5f4dc878b1080ade9be",
-    ".ai.local/team/fixtures/feature-with-ux-no-figma.json": "526c103a26c83afef60ebadd289735b6dfea14c8191acd9780fc72e72da2ff45",
+    ".ai.local/team/fixtures/feature-with-ux-no-figma.json": "78e0d14218a3dc0d23edd6ea6fbf96b0392ffd8b9744f8b45b6aed14b98c43d0",
     ".ai.local/team/fixtures/memlog.example.md": "53d281ddd383e0337b038a0dc6dd4e14f84743066a1a99bf45fc2e7064cce222",
     ".ai.local/team/fixtures/metrics-scenarios/tasks/human-gate/metrics.json": "6642b2ae310cdb89eb80fce7bb01d69a428c9ca8072651af7397f4f19eb0a724",
     ".ai.local/team/fixtures/metrics-scenarios/tasks/missing-ledger/status.json": "c27b87afa3c82d7d0d4b0e8385b8ebb245e17c10e3fe00f94938141f5843e9d7",
@@ -25,95 +25,98 @@
     ".claude/CLAUDE.md": "2adbeb71dbadbaefeb4f7576e6ce5db395f7bfd566b665532e156265f9457293",
     ".claude/MCP.md": "a40a7f9cd8a11a031a5fb3f2e4ccdb6cb2186461600146765d3255990e6133d0",
     ".claude/agents/README.md": "98fd8018a96eb924977217f81eb9cf966e88dee151b60af2c7c94ae2a8b32730",
-    ".claude/agents/accessibility-reviewer.md": "795072716b23b0ce3b95703bbaf4de963f24308088046c6656066e0b34c792e1",
-    ".claude/agents/api-contract-reviewer.md": "b7c974e7ff129be3f3be3af168064434255a47384d74ee4fbd464125b59e63ab",
-    ".claude/agents/build-verifier.md": "61e57cbaea65e3618afbce8026737edcf7eebd3b9adfcf50315eee43c814d6f2",
-    ".claude/agents/ci-investigator.md": "132157b20b1dc47927e40774fe89b46c3c5471ef89591269826ea478c3c3b6a9",
-    ".claude/agents/code-reviewer.md": "76f6f82cf7cdca23f2101d07983fb090c1a5d2aca54fd1ddb6997356910b9da5",
+    ".claude/agents/accessibility-reviewer.md": "0458052fb565978f1572a9cdb05ff76d76ef9a30a0695d5dcc4cbd8d0855fd50",
+    ".claude/agents/api-contract-reviewer.md": "f79ffdcb0ef82f634224e70ab625b7b6c50b7596ddd6a349b40b44d1d813e4bd",
+    ".claude/agents/build-verifier.md": "00ce6acfbebe453271e1d45d8e5403616b65a16f9dab1bff6fcdd6086ddb4360",
+    ".claude/agents/ci-investigator.md": "88c04c8e2f8f04c2d1acb9ac04e554252d7fa2db5a67423032858561bfdd6ff7",
+    ".claude/agents/code-reviewer.md": "3c7496f6ff33f1b1c99d8a4f965fbc5216c8ab205abbe6c9d8492746ee9ba617",
     ".claude/agents/codebase-analyzer.md": "73810a9283924c64d14eb2e6e9a515c8edf03fbdacb1f58cda5725b3dd17cc8b",
-    ".claude/agents/debugger.md": "f303a032f7b0731d0a1a48aeffe6dfb881f291be45ed1fe22771217aae410298",
-    ".claude/agents/feature-developer.md": "f17c17c505e15c43678079da0b6c1ec3d26b8c16c743a863cb740816f546e7ac",
-    ".claude/agents/migration-specialist.md": "7e1282e06347f226b865040cd711d4abc0a00cee36e58019a4a50237f5012d8e",
-    ".claude/agents/mockup-reviewer.md": "f38977baeb6c3e4b70c7affe46eda97c3d70a15b7d48f4f86b9856a91fac34e1",
-    ".claude/agents/openspec-author.md": "a1a50bee708bb2d9dfe724542ee44dfe824e7d6800e0d5440bb3d23b73948d49",
-    ".claude/agents/performance-auditor.md": "e5479aa5f523903064d54a275a838691a7b7c73ebf46a7163abffb70da12b306",
+    ".claude/agents/debugger.md": "201895766073b626a7d3694cbeb28cd04cb0a407baba54c96ffe9c4ed8a9b737",
+    ".claude/agents/feature-developer.md": "a9e663c0f89e4b4eceffcdd0b0b2da39c709084d3d841924ac8600e12a02590c",
+    ".claude/agents/migration-specialist.md": "8f334cf59b2e46a28e501e42aa68fb72d08702943046ecd3cfd72a1a20989676",
+    ".claude/agents/mockup-reviewer.md": "a9cf91311aa26905631af62f457ec76f329b9b239fa8d2552d22dd78cba2e3a2",
+    ".claude/agents/openspec-author.md": "2cdf40edf0860b328859067c1dda145f3c918d9d438ee0eb46a771c52256716b",
+    ".claude/agents/performance-auditor.md": "5b20c9d24dc1a69b4a9532916e488ca05d41bf3ac00fdd095aeaf68a9648da5b",
     ".claude/agents/playwright-test-generator.md": "b52015503915632f6562091c468589e8d9441b8f1f99c0a1434b2c0cb1cf0af2",
     ".claude/agents/playwright-test-healer.md": "54ff2800f93fe67fa63f32a1183d13818f69a669fe60c7f8297c1e7c6272bca4",
     ".claude/agents/playwright-test-planner.md": "23937e4eea308eea970859a40c02accdf7cb974f2b79505bd7b9408796506aab",
-    ".claude/agents/qa-tester.md": "9882cd281347a2aecb37fe4ca4213c24944eb9d2bb256722383fc6342963d4e8",
-    ".claude/agents/security-reviewer.md": "555aecb092869c7f8a142ef9b16cbd6371b1c3a05f0d1cbb463a809e341b0244",
-    ".claude/agents/solution-architect.md": "5dbfe3b8d6173afa767bbcbe73167c6c073003a503c09450966c0f5d55b3729e",
-    ".claude/agents/task-analyst.md": "83a14cadeae9875f90ecb901dc76d67e15d5e35876dcbe4c47430e3e5f2009cb",
-    ".claude/agents/task-router.md": "7c4eb96b7e3fa2824301d40d06d46bcf41f49070a02491d7ce389e46247a462e",
-    ".claude/agents/tech-writer.md": "0a983103bba3a304f2df68908bf886a2518c71047a3e134b1b25d970a57e8cb7",
-    ".claude/agents/unit-test-generator.md": "71b08fc1663f7d03b637526506b8901de2b7d86cf1bd4c6bc9fa6f2f8d5481fa",
-    ".claude/agents/unit-test-healer.md": "247bbd616ddbab7688d584f3343a3f2ccecda138e41120d91cd05b7bbada525d",
-    ".claude/agents/unit-test-planner.md": "19219de9cdd79ca9032aa939617da3272c8c08de21acb7f71a22e9b6b7c530be",
+    ".claude/agents/qa-tester.md": "1e17916566bc9666d2f0403315dcf5bafa5df316b69009385fa26f1191a1fdc8",
+    ".claude/agents/security-reviewer.md": "7ee50623115fd5ac5c0dccd6213627edf21fa30cf9842cf4bc384b1b52dc6d30",
+    ".claude/agents/solution-architect.md": "09a8a8b3aec392db1cb9295afc537b2620d97885d1d4a83ff1a1dfdfccfaa930",
+    ".claude/agents/task-analyst.md": "ea4c1ce928d32508864297cc0a86295d6eb1dfb26b2e902b920eafa5760365c2",
+    ".claude/agents/task-router.md": "480117a53d780baf3946a66c764d9a81e170d363bcc636a2fdafb28a60e3f815",
+    ".claude/agents/tech-writer.md": "13a2a12f8209209531271d38d987c26e279021fc053affb59fa6fc699d7a445e",
+    ".claude/agents/unit-test-generator.md": "dad7636b2fc46ed306c86203f5541ede6127d0afa60ec84ff2159e03c3e22b60",
+    ".claude/agents/unit-test-healer.md": "66804a932416c9f3d01b29a01700fab48e6481e5625db62d9b4df4c4ac17584a",
+    ".claude/agents/unit-test-planner.md": "9931282e10cdf374cd147a19b4929a0db80fa3f07774674cf6c1d71bbdd2b48d",
     ".claude/commands/README.md": "30574717de5deb51a4f5bbe8da7373e560403cc4710acaf0c730d27dd1cf964f",
     ".claude/commands/spec-start.md": "4c6ca849ea2d8835a9cc0902a4e39749510db1021fbc0b1a623a46c9644afbf1",
     ".claude/commands/task-continue.md": "8c2bec3c204c25910e8fc349c571778275905380e90d8bd02c0092c83ecfe6f6",
     ".claude/commands/task.md": "4db4b9245e7d5d0d56fb06d86196502aa8fa6487c747c2c103d09da27b02941e",
     ".claude/commands/technical-retro.md": "6195206cc687645fadcbe011306f6c62f1d082508c9182d880e5e4485d17214c",
     ".claude/hooks/README.md": "61a608772430bd8b1f95c0bff19fd7e1c0b554a0f0ea16b56f95a6a1b521ae60",
-    ".claude/hooks/chain-team-phases.sh": "e6790f4512bba38a17ba7f13ec9c1dc1a00db423e9ece24bf6c359107039a585",
+    ".claude/hooks/chain-team-phases.sh": "86d24436aad31e5ef1fde3eeafa399a02457cf51ed609a9d876347af93556232",
     ".claude/hooks/examples/README.md": "c5bdc1398bdaad95a15051d75c9f896f5c4991d66641982e675db648e9591813",
     ".claude/hooks/examples/format-edited.example.sh": "fd4df1d6c2a5673f963febd4f3f21ec8c42899645bdc53144d713c66b2affc76",
     ".claude/hooks/examples/secret-guard.example.sh": "51cbc95c3a1b64dfc5b19901932b4e3a047ade9332451282f254bf5f8d45a58f",
     ".claude/hooks/examples/test-on-save.example.sh": "ae185e383811e2f8f89ae5f631993705c06fc8cf7216cf8f0862a5b55c64ca2a",
     ".claude/hooks/guard-shell-command.sh": "31e1451148c17aedbcc2e9f372e50f079624f2624fb93505ba74850543749c75",
-    ".claude/rules/README.md": "fa357061cc54360b5eda263e44e59d44826b1cf743d013705f123330e473ff3b",
-    ".claude/rules/anti-hallucination/react-next-anti-hallucination.md": "021d22a4178aad43b8ba8b332cc677dbe8130a0cf673407acbb34d47c5367d32",
+    ".claude/rules/README.md": "fc53a029835b93b232b107fb9930facce73b02f85a0ed6702f85064004b471f2",
+    ".claude/rules/anti-hallucination/react-next-anti-hallucination.md": "275e6325605d39171b896e33d5d0c90bdf0e091bfa915890e904c0cde0f286e1",
     ".claude/rules/api-and-data/README.md": "1caace24921f00d60a58bea551988abd15c32f13a2711ae799ce1e689b838de2",
     ".claude/rules/api-and-data/api-services.md": "30b50d49c4281c4e0f9169d453c285f7dfc828d9991520e0c204101b5b634cb9",
     ".claude/rules/api-and-data/http-client.md": "437a97b8b533b6df8ae29d346f68a86e49fa0a66fe7ad3bec4b3874403ea6c09",
-    ".claude/rules/api-and-data/store-rtk.md": "a60d51e97639bcf4d6908bc0d8631fdceb3b343e2b79391a5446c33b3e345ed7",
+    ".claude/rules/api-and-data/store-rtk.md": "fabad917c372a20c1e54fdb155a4eca106da6af7b4e71e8c6f87e706ebe0a09b",
     ".claude/rules/architecture/README.md": "289158e67b7048545c69efdb4d5e03cc721dbf23d66e0cfe5830093d281d2326",
     ".claude/rules/architecture/architecture-boundaries-ui.md": "fefaf65f6893d087064a14602bdac7a13f8ca7dafec5af286ecc7d0ec4e332ba",
     ".claude/rules/architecture/architecture-boundaries.md": "05214891d47a286761390afb7109a6d7c10d715f84aca2d0df98960075b78b57",
-    ".claude/rules/architecture/feature-delivery-workflow.md": "d5cfdab5c192225ff0c9bea40e8a4e19296d7b852176ab52846ded74b2123aa4",
+    ".claude/rules/architecture/feature-delivery-workflow.md": "bccbe54efe6c699c8e8833fc7161e31250d30a7c8f7e011b637adb34475a3755",
     ".claude/rules/architecture/layer-barrel-exports.md": "c0339a15b5c161bde70107b9dbbd02817d603dcd00d84b43cdd72528c63b4c22",
-    ".claude/rules/architecture/product-specs-authoring.md": "2266a429713741e0653204df04516bbd5c2f95da146d7c813c7a84bb7fcd9bfe",
-    ".claude/rules/architecture/product-specs.md": "83ca98fd58c32504eef5745f986b82a6a5ddae202a3d357891e9f0f8233caab9",
+    ".claude/rules/architecture/product-specs-authoring.md": "88d4e112d158a22e4eb12fa076f4f338139643aa12c68a8e4bf4197ab99ca93e",
+    ".claude/rules/architecture/product-specs.md": "547051fa5308584a7884e03ed03c0ed0c92ebbb245cbaaa7f83c6403173a378d",
     ".claude/rules/architecture/public-imports.md": "da67712b2bb2462967d0869555fb145063fd7ecce53e4b0a08ffc7e53ffac6f3",
-    ".claude/rules/architecture/reference-features.md": "be494597fcb93e43ab91c1ec1ae7d1c0ecbb9624bd0ca0725af512dbffa0d495",
+    ".claude/rules/architecture/reference-features.md": "6e4c78725ca6c501fa5638ed5e9d787c755efc74fc552db7dba4dd4fb8ad4769",
     ".claude/rules/stack/README.md": "8dda2a6cacc3346300ea445bcb87d157c898fabdc820ca202667b915f9088de2",
     ".claude/rules/stack/arrow-functions.md": "4e382cc791c2d057431830baccff4f7043c4a39424370fe2fa0c57c62a646ea4",
     ".claude/rules/stack/navigation-router-ui.md": "8cabe15ed92ae9574c152dd1c001f4771ac1e1d287b0d2f2b12b7f84ddd5fa73",
     ".claude/rules/stack/navigation-router.md": "67e2198e7100fe96764acf47810839f8c169b118a2da71ecc172f1569a2571d6",
-    ".claude/rules/stack/next-app-core.md": "c87b3b2d73f9510d7b2c1c8892854f950c46e68a284edc492125c781000028cb",
+    ".claude/rules/stack/next-app-core.md": "d3e4e44291af48c8628b5d37864aaf3e6e3af492000f01b766a2d5cd4d359692",
     ".claude/rules/stack/next-app-router.md": "bb5b0a77fdd17f6643cdf825732e985fa41beea410fe5d6060bc259e507c4446",
+    ".claude/rules/stack/next-static-export.md": "f9dd3307229e5be58bc13072ba8ceca17aceffc5db89d8882ee2a83e03896445",
     ".claude/rules/stack/no-type-assertion.md": "6fb33fa61bceea2fad7cde3361d82c9655b6fd84d43d863033d039b78e6af210",
     ".claude/rules/stack/types-jsdoc.md": "1c9b63c5c2230ef7dc8fbb224cecb7b0a99d2235ae17f720b5a92fcd0291ffc5",
     ".claude/rules/testing/README.md": "0018e4e37f60352fafac64cad74209aedf88e9129d9bbbd3016a6cb36efe7e0a",
     ".claude/rules/testing/playwright-agents.md": "c1d5ce31222bd2dc4ccebea2be79180fe1632a69eedaca1cbf37604b7e783219",
-    ".claude/rules/testing/tests-e2e-structure.md": "bf0833d342a0c856e89f67c6a2f78e29499b56f00c4d145df53f9e9b1803e253",
-    ".claude/rules/testing/tests-unit.md": "40001c22345b6423149db0d80bd573bc7c09b120177544091f3a29808d60eac9",
+    ".claude/rules/testing/tests-e2e-structure.md": "62ad7b10aad5b0c57888f409e643b1fd34142de3101fea44cd54ac82030ced41",
+    ".claude/rules/testing/tests-unit.md": "5cb7e5069b36a19a36ace4b359fd77c55cfc4f17223ffaabe14ffdfb18bd8f08",
     ".claude/rules/tooling-and-review/README.md": "27a956fa7fa68c58cd17a9b598580b06cb2241aadef29e3b647a31ab418d99ec",
     ".claude/rules/tooling-and-review/agent-team-intake.md": "e05a5879d587a9c4774e9e36cfcadca5664eedaabe02051745fb6c87a6143e42",
-    ".claude/rules/tooling-and-review/agent-team-orchestrator.md": "810afc6e3d3a97b652af215bbc03433727b87c063d79613e3588e1d955d192d6",
-    ".claude/rules/tooling-and-review/ai-local-overlay.md": "bb96bf00cf76c58d5db4e6c12622164b0d700d8330e9805c0aa7c1542bffbde4",
+    ".claude/rules/tooling-and-review/agent-team-orchestrator.md": "04bc26f758ff5e303e49e908dba98902485afd29ee3864be5c76b51c33871f26",
+    ".claude/rules/tooling-and-review/ai-local-overlay.md": "8146c33d2c56a8029045a21f87df4f1a3ea4b3d59be2fb90dbf9323ca940485c",
     ".claude/rules/tooling-and-review/anti-sycophancy-discipline.md": "6d359631dde6dbe6588397aa1108752cfdad9764d90d6d9da31606a463b72226",
     ".claude/rules/tooling-and-review/code-quality.md": "fc764e9fbf7101475fc709a4610d09758a3a959f2fe82d3d1a487f2c8556c1b4",
-    ".claude/rules/tooling-and-review/code-review-mr.md": "57f337daf5bcd28b40a9f942be16a46d569f1b8add5b7b294c8b2632c1711c4b",
+    ".claude/rules/tooling-and-review/code-review-mr.md": "902e13e1394e4a41d5d8dd4dedc51a0c7bfcabc7a87479bb7c8432328efd2963",
     ".claude/rules/tooling-and-review/design-guidance.md": "6eb8a48f9d9f69896c047c9418577e47eda6d2ad6bf18b3dff761c6de675f7d3",
-    ".claude/rules/tooling-and-review/mcp-usage.md": "37cafc7c5271f3d846223e1f82eef5f8a85b88e6f1ff00603d39849e154033e2",
+    ".claude/rules/tooling-and-review/mcp-usage.md": "a5f17c8bc75ea34a56a0406f13081036600afb8031c03da98453febdce9afc56",
     ".claude/rules/tooling-and-review/mockup-review.md": "42e9007a00015f812a049edd2a934ed3caf7d1e0ff8500120ab761379ecd4237",
     ".claude/rules/tooling-and-review/package-manager.md": "1e80459ac986a61eee45a6d0aef67177aa449279784848397c32ac0511b0c208",
-    ".claude/rules/tooling-and-review/post-change-lint.md": "ea16a0311ef354c101efc697e738d852742f74f60f49f421b776ccf0e19ad53c",
+    ".claude/rules/tooling-and-review/post-change-lint.md": "600819e8b51430c0df46cafe80111b1a3e6f525b2ff76c643d06fc4d79f71668",
     ".claude/rules/tooling-and-review/preset-layering.md": "006b9ea97f55d039debc16847ac9b0bfae6b26b56f44e812081ddd65760289ca",
     ".claude/rules/tooling-and-review/preset-no-cross-stack-leakage.md": "01e045b7f6f5a472581804499ec97dc4296264da90e3a6e3a25807501a300dad",
     ".claude/rules/tooling-and-review/preset-pr-checklist.md": "769addcfbde87d6681291ee038ff57842e03a4634dbc90f2562fb95efd5fc625",
     ".claude/rules/tooling-and-review/preset-token-budget.md": "bc22059a066d3ba21d8813f5e50d5cc9eef3a28860372d122d31b50977438e18",
     ".claude/rules/tooling-and-review/preset-twin-sync.md": "bdd98171bc8218fdd84834aa8051e8c899f87bb1063f9a5fd539af1154cb618f",
-    ".claude/rules/tooling-and-review/security-next.md": "3e5c733925a0040928a9fbb7d841e69a471a03c5cb02d2fa986b81d29d7e31ca",
+    ".claude/rules/tooling-and-review/security-next.md": "9d51252401790c79f63623e4a37c417a15461dc68a2358decb6b29dcdd12ba53",
     ".claude/rules/tooling-and-review/technical-retro.md": "45e059219204712dbaaeda860b553eb557a539ff164e425ff4181da43c86f24a",
     ".claude/rules/tooling-and-review/ux-design.md": "df354f533cb2c3593758a68d2e276d9fa89f9ae15d408fb94b49040a3545be6c",
     ".claude/rules/ui-and-accessibility/README.md": "a3f6fed71b29b82c107014461f7546c341fea7f2c46a39e99181816b57e979d2",
+    ".claude/rules/ui-and-accessibility/component-catalog-gate.md": "ff4baa8c478423dcb07207463fde80bd957ca0b3822cb437967e57042ea256f8",
     ".claude/rules/ui-and-accessibility/css-property-order.md": "1f3ed3e5891adb0114e203e26a4ad86c12d0bfeeadb7d425104e92fd5bf20dc1",
-    ".claude/rules/ui-and-accessibility/design-tokens-binding.md": "01accdfeb8164a3dad4698f5c0d449460b98b4f77ce595eda846339fc816f60d",
+    ".claude/rules/ui-and-accessibility/design-tokens-binding.md": "e8de5136a2a530e6f1036429a8643926546507d2ac1d6d2da96673092392063f",
+    ".claude/rules/ui-and-accessibility/forms-validation.md": "6a4ab1e42f4e2799b5f7636c0a7562e4f15ba711d21c3c5e65d752e9aedf660d",
     ".claude/rules/ui-and-accessibility/no-props-spread.md": "60aa9ca9c94db981bcceb05a090734e540644febfa88f4e40089f5d16a8a5d7f",
     ".claude/rules/ui-and-accessibility/react-a11y-coding.md": "8709f43c13f7071b2cd645c29b171de218551c3895479901efa1a817585b245d",
-    ".claude/rules/ui-and-accessibility/react-ui.md": "876306fbab02452e63f21a32d982e6473bfd486243d3083b681fc82651dd04b9",
+    ".claude/rules/ui-and-accessibility/react-ui.md": "c61a53e4c8f16ca443561bb8311b61fc5fa47b79fd30397a59479262b2b37ee3",
     ".claude/settings.json": "930a46deffc5aee8161328b29ca7122d32a8434415988462f3be6578fcf5036f",
     ".claude/skills/README.md": "1aeac616a5270d0ce6be132a3dff3e0bbca1371191503f0ecf3eeeeea5b4e9f3",
     ".claude/skills/ci-investigation/SKILL.md": "b13ed9de0716671b7d192dc2ba7fec139466a933b52f25c075623dcdef38b399",
@@ -130,7 +133,7 @@
     ".claude/skills/ux-design/SKILL.md": "74b70875ba3d41ffb8401c42bc8c9e442e73b36c6a6b0d8d9d2aae0a6017479c",
     ".claude/skills/write-adr/SKILL.md": "607d70eff78d6a7b67b783237721fdc42eaa5170cb6175882e7e2a4adf132242",
     ".mcp.json": "f68a14db68a491a982975a3e6cc985057072a68eebdcedf33d8ac2a4a3b284ca",
-    "AGENTS.md": "dbfbbb0fb243c67bed8c02dd2ba45dfc92163ebed8914d7dee6e8d359638ec08",
+    "AGENTS.md": "c29c284ba6b5e847c885fd7eda026c3bf48ae3700426f5d99449bdeb1c728434",
     "docs/specs/INDEX.md": "cab59f2093e6aaa376246a56d53e4268cb59070a6b10e87a94895192c35f422d",
     "docs/specs/_templates/feature.md": "83c47b90334c555fb5144749837e2ddfe1cae5bb89031f885ba98671075d59e7",
     "docs/specs/_templates/page.md": "a668c584e28edd52afaf3f9f8f898a75e43cb82fa12822c7a016033441e12e54"