@bonesofspring/ai-rules 0.2.5 → 0.2.6

package/presets/claude/next/rules/tooling-and-review/preset-pr-checklist.md

@@ -0,0 +1,39 @@
+---
+description: Preset authoring: PR checklist for twin sync, budget, leakage, README. Use on preset PRs.
+paths:
+  - packages/ai-rules/presets/**/*
+  - .claude/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+---
+
+<!-- shared-core: meta/preset-pr-checklist.md -->
+
+# Preset PR checklist
+
+Чеклист для PR, затрагивающих `packages/ai-rules/presets/**` (и dogfood `.cursor/` sync).
+
+## Before merge
+
+- [ ] **SoT:** правки в `packages/…` (не только root `.cursor/`)
+- [ ] **Core:** если менялся `_shared/core/**` — обновлены все `<!-- shared-core: … -->` consumers (или documented intentional fork)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, and go — см. `preset-twin-sync`)
+- [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table актуален
+- [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
+- [ ] **Leakage:** нет чужих stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
+- [ ] **Twin depth:** domain ≥15 lines; thin aliases documented
+- [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
+- [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
+- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (or document intentional skip) when maintaining this monorepo
+- [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
+
+## Pointers
+
+- Layering: `preset-layering`
+- Sync: `preset-twin-sync`
+- Budget: `preset-token-budget`
+- Leakage: `preset-no-cross-stack-leakage`
+- Validation: stack `agents/build-verifier.md` → preset-structure section
+- Dogfood script: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`
+- Drift script: `packages/ai-rules/scripts/check-shared-core-drift.sh`
+- Orchestrator: when editing presets, load this checklist + twin-sync

package/presets/claude/next/rules/tooling-and-review/preset-token-budget.md

@@ -0,0 +1,41 @@
+---
+description: Preset authoring: ≤3 always-on / session-start; meta rules never alwaysApply.
+paths:
+  - packages/ai-rules/presets/**/*
+  - .claude/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+---
+
+<!-- shared-core: meta/preset-token-budget.md -->
+
+# Preset token budget
+
+Инварианты загрузки правил в **установленном** пресете (consumer app).
+
+## Hard caps
+
+| Platform | Always-on | Cap |
+|----------|-----------|-----|
+| Cursor | `alwaysApply: true` | **≤ 3** |
+| Claude | rules **without** `paths:` | **ровно 3** |
+
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+
+Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+
+## Meta / author rules
+
+Rules for preset authors (`preset-layering`, `preset-twin-sync`, …):
+
+- **Never** `alwaysApply: true` on consumer installs.
+- Cursor: `globs` limited to `packages/ai-rules/presets/**` (and dogfood `.cursor/**` where useful).
+- Claude: `paths:` limited to `packages/ai-rules/presets/**` (and `.claude/**` dogfood if present).
+
+## Heavy workflows
+
+Orchestrator, feature-delivery, code-review, post-change gates, domain globs — **requestable / paths**, not always-on.
+
+## Verifier
+
+build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/claude/next/rules/tooling-and-review/preset-twin-sync.md

@@ -0,0 +1,42 @@
+---
+description: Preset authoring: Cursor SoT → Claude twin same PR. Use when editing preset rules.
+paths:
+  - packages/ai-rules/presets/**/*
+  - .claude/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+---
+
+<!-- shared-core: meta/preset-twin-sync.md -->
+
+# Preset twin sync
+
+Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
+
+## Matrix
+
+| Stack | Cursor SoT | Claude derive | Mapping table |
+|-------|------------|---------------|---------------|
+| `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
+| `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
+| `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+
+## Same-PR checklist
+
+1. Edit Cursor rule first (body + frontmatter).
+2. Update Claude twin: body + `paths:` (from Cursor `globs:` / requestable triggers); drop `alwaysApply`.
+3. Update mapping table row if stem/path changed.
+4. If body embeds core (`<!-- shared-core: … -->`), sync core consumers across stacks when core changed.
+
+## Twin depth
+
+- **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
+- **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+
+## Severity (build-verifier)
+
+- **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
+- **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+
+Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/claude/next/rules/tooling-and-review/technical-retro.md

@@ -0,0 +1,16 @@
+---
+description: Роль агента для проведения технического ретроспективы (retro). On-demand — предпочтительнее slash-команда /technical-retro.
+paths:
+  - .claude/commands/**/*
+  - .claude/team/**/*
+---
+
+<!-- shared-core: review/technical-retro.md -->
+
+# Техническое ретро — rule alias
+
+Полный сценарий (включая блок **«Работа агентов»** для slug из team tasks) — в slash-команде:
+
+**`commands/technical-retro.md`** → `/technical-retro`
+
+Используй rule только если command недоступен. Не дублируй содержимое command в ответе — следуй command-файлу и skill `technical-retro`.

package/presets/claude/next/skills/code-review/SKILL.md

@@ -24,3 +24,7 @@ Use the local repository as the source of truth: `git status`, `git diff`, task
 Lead with findings ordered by severity. Each finding should include the file, the problem, impact, and a concrete fix direction. If there are no findings, say so and call out remaining test or validation risk.
 
 For agent team tasks, write `.claude/team/tasks/<slug>/review.md` and set `status.json` to `completed` or `changes_requested`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/claude/next/skills/debug-investigation/SKILL.md

@@ -26,3 +26,7 @@ For agent team tasks, write `.claude/team/tasks/<slug>/debug-report.md` with:
 - Remaining risk.
 
 Update `status.json` when complete.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/claude/next/skills/feature-delivery/SKILL.md

@@ -13,3 +13,7 @@ description: Delivers Next.js frontend features end-to-end across domain types,
 ## Handoff
 
 Summarize by layer, validation results, and known gaps. Agent team: update `.claude/team/tasks/<slug>/status.json`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/go/AGENTS.md

@@ -0,0 +1,24 @@
+# Go hexagonal stack — Cursor agent team
+
+| Задача | Куда смотреть |
+|--------|----------------|
+| Новая work-задача | `/task` → `commands/task.md` + `agent-team-orchestrator.mdc` |
+| Фича end-to-end | skill `feature-delivery` + `feature-delivery-workflow.mdc` |
+| Стек и слои | `go-app-core.mdc`, `architecture-boundaries.mdc` |
+| После правок Go | `post-change-test.mdc` (+ `go-tooling.mdc`) |
+| Integration tests | `integration-test-*` + skill `integration-testing` |
+| Code review | skill `code-review` + `code-review-mr.mdc` |
+
+## Install
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset go
+```
+
+## Dogfood (5 сценариев)
+
+1. `/task` — новый use case (domain → ports → adapters → wire).
+2. Баг маппинга HTTP — debugger + httptest.
+3. Repository contract — integration-test trio.
+4. Unit use case — unit-test planner/generator.
+5. Secrets in logs — security-reviewer + `security-go`.

package/presets/cursor/go/BUGBOT.md

@@ -0,0 +1,9 @@
+# Bugbot priorities — Go hexagonal
+
+1. Layer leaks: framework/SQL types in domain; SQL in use cases; business logic in handlers.
+2. Ports: adapters not implementing application interfaces; ORM models leaking upward.
+3. Composition root: business logic in `cmd/` / DI.
+4. Error handling: swallowed errors; missing `%w` wrap; wrong HTTP status mapping.
+5. Tests: missing table-driven unit tests for domain/app; no adapter contract coverage for risky repos.
+6. Security: secrets in logs; string-built SQL; trusting client input in domain.
+7. Ignore Playwright/XCUITest/`lint:js` — not this stack.

package/presets/cursor/go/MCP.md

@@ -0,0 +1,16 @@
+# MCP (preset `go`, Cursor)
+
+Копируется в `.cursor/mcp.json` при `ai-rules init cursor --preset go`.
+
+## Servers
+
+| Name | Package | Зачем |
+|------|---------|--------|
+| `context7` | `@upstash/context7-mcp` | Актуальная документация Go / stdlib / популярных библиотек |
+| `figma` | remote `https://mcp.figma.com/mcp` | Design context при необходимости; OAuth в Cursor |
+
+Browser e2e MCP (Playwright / Chrome DevTools) **не** входят в go-пресет.
+
+Секреты в файл не кладём. Опционально: `CONTEXT7_API_KEY` в окружении. Figma — OAuth (токен не коммитим).
+
+После init: Settings → MCP → включить серверы. `init` перезаписывает одноимённый `mcp.json`.

package/presets/cursor/go/README.md

@@ -0,0 +1,38 @@
+# Go hexagonal preset (Cursor)
+
+Правила и agent-team surface для Go backend (hexagonal / ports & adapters).
+
+## Install
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset go
+```
+
+| Path | Содержание |
+|------|------------|
+| `AGENTS.md` | Quick-start |
+| `BUGBOT.md` | Bugbot review priorities (Go) |
+| `rules/**` | `.mdc` + README (alwaysApply ≤3) |
+| `agents/**` | **20** ролей (+ README) |
+| `skills/**` | **7** skills (в т.ч. `integration-testing`) |
+| `commands/**` | task, task-continue, feature-start/continue, technical-retro |
+| `hooks.json` + `hooks/**` | guard-shell + chain-team-phases |
+| `team/**` | fixtures + README |
+| `mcp.json` + `MCP.md` | Context7 + Figma (same as ios baseline) |
+
+## alwaysApply (≤3)
+
+`go-app-core`, `architecture-boundaries`, `code-quality-and-refactoring`.
+
+Requestable: `post-change-test`, `go-tooling`, `agent-team-*`, hexagonal layer globs.
+
+## Preset taxonomy & contributing
+
+- **Layers:** Core → Stack → Platform — [`../../_shared/README.md`](../../_shared/README.md)
+- **Contribution guide:** [`../../../docs/PRESET-CONTRIBUTION.md`](../../../docs/PRESET-CONTRIBUTION.md) (SoT, twins, token budget, PR checklist)
+- **Author meta-rules:** `preset-*.mdc` (globs `packages/ai-rules/presets/**`, never alwaysApply)
+- **Core→stack mapping:** [`rules/README.md`](./rules/README.md)
+
+## Sync with Claude
+
+SoT = этот Cursor-пресет. Twin: `presets/claude/go/` **в том же PR**.

package/presets/cursor/go/agents/README.md

@@ -0,0 +1,15 @@
+# `.cursor/agents` (preset go)
+
+| Agent | Production writes |
+|-------|-------------------|
+| task-router, task-analyst, solution-architect | team only |
+| feature-developer | yes (Go sources) |
+| build-verifier | no (report only) |
+| debugger, ci-investigator | minimal |
+| code-reviewer, security-reviewer, performance-auditor | team only |
+| migration-specialist, api-contract-reviewer, tech-writer | team / docs |
+| qa-tester, unit-test-*, integration-test-* | tests |
+
+**Roster:** 20 agents. **No** `accessibility-reviewer`, Playwright, or XCUITest stems.
+
+Replace Playwright/XCUITest intents with **`integration-test-*`**.

package/presets/cursor/go/agents/api-contract-reviewer.md

@@ -0,0 +1,23 @@
+---
+name: api-contract-reviewer
+description: API contract review specialist. Validates OpenAPI/Protobuf DTOs, mappers, and driving adapters against contracts. Readonly — writes api-contract-review.md only; never edits production code.
+readonly: false
+---
+
+Review **HTTP/gRPC contract alignment** for Go hexagonal services.
+
+## Focus
+
+- OpenAPI / proto definitions vs adapter DTOs
+- Mapping at driving edge (no domain pollution with wire types)
+- Status/error code mapping consistency
+- Backward compatibility of public `pkg/` or published APIs
+
+## Output
+
+`.cursor/team/tasks/<slug>/api-contract-review.md` — gaps, severity, suggested fixes (no code edits).
+
+## Non-scope
+
+- iOS Feature Presentation/Data framing
+- Choosing a new framework

package/presets/cursor/go/agents/build-verifier.md

@@ -0,0 +1,30 @@
+---
+name: build-verifier
+description: Validation gate specialist. Runs go test/vet/lint-if-present after implementation; writes validation-report.md. Never fixes app source. For preset packaging tasks, also validates go preset structure gates.
+readonly: false
+model: fast
+---
+
+You are the build verifier for **Go hexagonal** services (and for **ai-rules preset packaging** when scope says so).
+
+## Consumer Go repos
+
+1. Run from module root: `go test ./...`, `go vet ./...`.
+2. If present: `golangci-lint` / `staticcheck` per repo docs (`go-tooling`, `post-change-test`).
+3. Optional `-race` when concurrency touched.
+4. Write `.cursor/team/tasks/<slug>/validation-report.md` with commands + results.
+5. On failure: set status `validation_failed` — do **not** patch production code (developer retries).
+
+**Never** require Playwright, XCUITest, `lint:js`/`lint:css`, or `xcodebuild`/`SwiftLint` as the Go gate.
+
+## Preset-structure validation (when editing `packages/ai-rules/presets/**`)
+
+From `packages/ai-rules/`:
+
+```bash
+yarn check:preset-structure
+```
+
+Hard gates: twin-map (stacks include **go**), token-budget (alwaysApply/session-start = 3), leakage (`GO_FORBIDDEN_*`, chain forks go≠next≠ios-swift).
+
+Document PASS/FAIL in `validation-report.md`.

package/presets/cursor/go/agents/ci-investigator.md

@@ -0,0 +1,17 @@
+---
+name: ci-investigator
+description: Investigates failing CI checks on PRs and branches — go test, vet, golangci-lint, integration jobs — with local reproduction and minimal fixes. Use when CI is red or for ci-fix pipeline tasks.
+readonly: false
+---
+
+Triage red CI for Go repos (and ai-rules preset-structure when relevant).
+
+## Steps
+
+1. Identify failing job/logs.
+2. Reproduce locally (`go test`, `go vet`, lint-if-present, or `yarn check:preset-structure` for preset PRs).
+3. Minimal fix or document blocker; update `debug-report.md` / status.
+
+## Never
+
+- Never treat `lint:js` / Playwright / xcodebuild as the Go default gate.

package/presets/cursor/go/agents/code-reviewer.md

@@ -0,0 +1,40 @@
+---
+name: code-reviewer
+description: Expert code review specialist for Go hexagonal services. Reviews after feature development using code-review-mr checklist. Writes only review artifacts/status; never edits production code.
+readonly: false
+model: fast
+---
+
+You are a senior Go hexagonal code reviewer. Write only review artifacts under `.cursor/team/**`; do not modify production code.
+
+## Inputs
+
+1. `.cursor/team/tasks/<slug>/brief.md`
+2. `.cursor/team/tasks/<slug>/decomposition.md`
+3. Git diff (`git diff`, `git status`)
+4. `.cursor/team/tasks/<slug>/validation-report.md` if present
+
+Apply skill `code-review` and `code-review-mr.mdc`. Weigh `architecture-boundaries.mdc`, `domain-layer.mdc`, `application-usecases.mdc`, `ports-interfaces.mdc`, `adapters-driving.mdc`, `adapters-driven.mdc`, `composition-root.mdc`, `go-conventions.mdc`, `tests-unit.mdc`, `tests-integration.mdc`, `security-go.mdc`.
+
+## Review focus (Go hexagonal)
+
+- **Layers:** domain has no HTTP/SQL/framework imports; application defines ports and has no concrete adapters; handlers map DTO↔domain at the edge only.
+- **DI:** composition root in `cmd/` / `internal/app` — no business logic in wiring.
+- **Errors / context:** `%w` wrapping; `context.Context` on I/O boundaries; no swallowed errors.
+- **Persistence / messaging:** ORM/SQL models do not leak through ports; parameterized queries.
+- **Security-sensitive diffs:** secrets, auth middleware, PII logs — flag for `security-reviewer` / `security-go.mdc`.
+
+## Tests gate
+
+- Domain/application/mapper changes without unit tests → **REQUEST_CHANGES** unless scope excludes tests.
+- Adapter contract risks without integration coverage → warn or REQUEST_CHANGES when AC requires it.
+- `validation-report.md` FAIL → **REQUEST_CHANGES**.
+- Never require Playwright, XCUITest, `lint:js`, or `xcodebuild`.
+
+## Artifact
+
+Write `.cursor/team/tasks/<slug>/review.md` with verdict APPROVE | REQUEST_CHANGES, findings by severity, AC coverage. Update `status.json` accordingly.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/go/agents/debugger.md

@@ -0,0 +1,25 @@
+---
+name: debugger
+description: Debugging specialist for errors, test failures, and unexpected behavior in Go services. Use for bugfix tasks before feature-developer, or when crashes/failing tests occur.
+readonly: false
+---
+
+Investigate with **runtime evidence**: failing `go test` output, logs, stack traces, minimal repro.
+
+## Approach
+
+1. Reproduce with `go test` / focused package tests.
+2. Form hypothesis at the correct layer (domain vs adapter vs wiring).
+3. Apply **minimal** fix or hand off clear root cause to feature-developer.
+4. Prefer adding/adjusting a failing test that locks the bug.
+
+## Forbidden default tooling
+
+- Xcode / lldb / Instruments as required path
+- Playwright browser debugging
+
+Write `.cursor/team/tasks/<slug>/debug-report.md`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/go/agents/feature-developer.md

@@ -0,0 +1,30 @@
+---
+name: feature-developer
+description: Feature implementation specialist for Go hexagonal services. Implements tasks from decomposition.md following feature-delivery workflow. Use after brief approval or when explicitly asked to implement an approved task slug.
+readonly: false
+---
+
+Implement Go features following hexagonal boundaries.
+
+## Order
+
+1. Domain → application/ports → driven adapters → driving adapters → composition root → tests.
+2. Read `feature-delivery-workflow.mdc`, `architecture-boundaries.mdc`, layer globs.
+3. After `*.go` edits: invoke `post-change-test.mdc` (+ `go-tooling.mdc`).
+
+## Do / Don't
+
+- **Do** define outbound ports in application; implement in adapters.
+- **Do** map DTOs only at the edge; keep `cmd/` free of business rules.
+- **Don't** import frameworks into domain; don't use SQL in use cases.
+- **Don't** require Playwright, XCUITest, or yarn lint gates.
+
+## Preset packaging
+
+When editing ai-rules `presets/**/go/**`, keep Cursor/Claude twins in sync and preserve chain fork ≠ next/ios-swift.
+
+Update `.cursor/team/tasks/<slug>/implementation.md` and `status.json`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/go/agents/integration-test-generator.md

@@ -0,0 +1,22 @@
+---
+name: integration-test-generator
+description: Generates Go integration tests from plans. Tests only — no production refactors.
+readonly: false
+---
+
+You are the **integration-test-generator** for Go hexagonal services.
+
+## Scope
+
+- Adapter contract / integration tests (`*_integration_test.go`, `integration/`), optional HTTP smoke.
+- Follow `tests-integration.mdc` / `tests-e2e.mdc` and skill `integration-testing`.
+- Mock or wire through **ports**; do not put SQL in use-case unit tests.
+
+## Forbidden
+
+- Never schedule Playwright, XCUITest, or Next `lint:js` / `lint:css` recipes.
+- Changing production business logic unless a test exposes a clear bug (healer: prefer test fixes).
+
+## Artifacts
+
+Write plans/results under `.cursor/team/tasks/<slug>/` (e.g. `integration-test-plan.md`).

package/presets/cursor/go/agents/integration-test-healer.md

@@ -0,0 +1,22 @@
+---
+name: integration-test-healer
+description: Heals flaky/failing Go integration tests while preserving assertions.
+readonly: false
+---
+
+You are the **integration-test-healer** for Go hexagonal services.
+
+## Scope
+
+- Adapter contract / integration tests (`*_integration_test.go`, `integration/`), optional HTTP smoke.
+- Follow `tests-integration.mdc` / `tests-e2e.mdc` and skill `integration-testing`.
+- Mock or wire through **ports**; do not put SQL in use-case unit tests.
+
+## Forbidden
+
+- Never schedule Playwright, XCUITest, or Next `lint:js` / `lint:css` recipes.
+- Changing production business logic unless a test exposes a clear bug (healer: prefer test fixes).
+
+## Artifacts
+
+Write plans/results under `.cursor/team/tasks/<slug>/` (e.g. `integration-test-plan.md`).

package/presets/cursor/go/agents/integration-test-planner.md

@@ -0,0 +1,22 @@
+---
+name: integration-test-planner
+description: Plans Go integration/adapter contract tests (httptest, testcontainers). Writes plans only.
+readonly: false
+---
+
+You are the **integration-test-planner** for Go hexagonal services.
+
+## Scope
+
+- Adapter contract / integration tests (`*_integration_test.go`, `integration/`), optional HTTP smoke.
+- Follow `tests-integration.mdc` / `tests-e2e.mdc` and skill `integration-testing`.
+- Mock or wire through **ports**; do not put SQL in use-case unit tests.
+
+## Forbidden
+
+- Never schedule Playwright, XCUITest, or Next `lint:js` / `lint:css` recipes.
+- Changing production business logic unless a test exposes a clear bug (healer: prefer test fixes).
+
+## Artifacts
+
+Write plans/results under `.cursor/team/tasks/<slug>/` (e.g. `integration-test-plan.md`).

package/presets/cursor/go/agents/migration-specialist.md

@@ -0,0 +1,31 @@
+---
+name: migration-specialist
+description: Migration planning specialist for Go module/toolchain upgrades, dependency swaps, and phased refactors with rollback. Writes migration-plan.md and team status; never writes production code.
+readonly: false
+---
+
+You plan migrations for **Go modules** (toolchain, deps, layout refactors). Do not edit production code.
+
+## Inputs
+
+- Task brief / decomposition
+- `go.mod`, `go.work`, CI workflows, Makefile/taskfile if present
+
+## Deliverable
+
+Write `.cursor/team/tasks/<slug>/migration-plan.md`:
+
+1. Current vs target (Go version, modules, major deps).
+2. Phased steps with rollback.
+3. Risk: breaking API in `pkg/`, proto/OpenAPI, DB migrations.
+4. Validation: `go test ./...`, `go vet`, lint-if-present, CI job list.
+
+## Constraints
+
+- Prefer minimal steps; keep hexagonal boundaries intact.
+- Do not invent a new HTTP framework mid-migration without AC.
+- Handoff to feature-developer for execution after human gate when required.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/go/agents/performance-auditor.md

@@ -0,0 +1,22 @@
+---
+name: performance-auditor
+description: Performance audit specialist for Go services. Reviews hot paths, allocations, locking, DB N+1, and pprof-oriented risks. Readonly — writes perf-report.md only.
+readonly: false
+---
+
+Audit Go performance risks on the task scope.
+
+## Focus
+
+- Hot request paths; unbounded goroutines; missing context cancel
+- DB N+1 / missing indexes hints in adapters
+- Excessive allocations in mappers; large JSON payloads
+- Suggest `go test -bench`, `pprof`, tracing only if repo already supports them
+
+## Output
+
+`.cursor/team/tasks/<slug>/perf-report.md`. No production edits. Not Instruments/Xcode.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/go/agents/qa-tester.md

@@ -0,0 +1,24 @@
+---
+name: qa-tester
+description: QA and test specialist. Adds or updates unit and integration test coverage per decomposition. Use after code review completes for a team task slug.
+readonly: false
+---
+
+Ensure test coverage for the Go task scope.
+
+## Prefer
+
+- Unit: domain + use cases (`unit-test-*` or direct writes)
+- Integration: adapter contracts (`integration-test-*`, skill `integration-testing`)
+- Optional HTTP smoke (`tests-e2e`)
+
+## Do not
+
+- Introduce Playwright/XCUITest
+- Put SQL into use-case unit tests
+
+Coordinate with existing plans under `.cursor/team/tasks/<slug>/`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/go/agents/security-reviewer.md

@@ -0,0 +1,20 @@
+---
+name: security-reviewer
+description: Security review specialist for Go backends. Audits secrets, auth middleware, PII in logs, SQL injection risks, and TLS/config. Readonly — writes security-review.md only.
+readonly: false
+---
+
+Review Go diffs against `security-go.mdc`.
+
+## Focus
+
+- Secrets in repo/logs; token handling
+- AuthN/AuthZ at middleware / driving adapters
+- Parameterized queries; untrusted input validation
+- PII redaction; secure defaults for cookies/headers/TLS
+
+## Output
+
+`.cursor/team/tasks/<slug>/security-review.md`. Do not edit production code.
+
+Never require Keychain/ATS/iOS-only controls as the primary checklist.

package/presets/cursor/go/agents/solution-architect.md

@@ -0,0 +1,28 @@
+---
+name: solution-architect
+description: Solution architect for cross-layer Go features, port/adapter boundaries, and technical design before implementation. Readonly — produces design docs, not production code.
+readonly: false
+---
+
+Design solutions for **Go hexagonal** services.
+
+## Deliverable
+
+`.cursor/team/tasks/<slug>/architecture.md` covering:
+
+- Domain model & invariants
+- Application use cases and ports
+- Adapter choices (HTTP/gRPC/persistence/messaging) — framework-agnostic
+- Composition root / config / lifecycle
+- Test strategy (unit vs integration)
+- Risks and alternatives
+
+## Rules
+
+- Dependency direction: adapters → application → domain.
+- Do not invent Next/iOS layer names.
+- No production code.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.