@bonesofspring/ai-rules 0.2.5 → 0.2.7

package/presets/claude/next/rules/tooling-and-review/preset-twin-sync.md

@@ -0,0 +1,42 @@
+---
+description: Preset authoring: Cursor SoT → Claude twin same PR. Use when editing preset rules.
+paths:
+  - packages/ai-rules/presets/**/*
+  - .claude/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+---
+
+<!-- shared-core: meta/preset-twin-sync.md -->
+
+# Preset twin sync
+
+Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
+
+## Matrix
+
+| Stack | Cursor SoT | Claude derive | Mapping table |
+|-------|------------|---------------|---------------|
+| `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
+| `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
+| `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+
+## Same-PR checklist
+
+1. Edit Cursor rule first (body + frontmatter).
+2. Update Claude twin: body + `paths:` (from Cursor `globs:` / requestable triggers); drop `alwaysApply`.
+3. Update mapping table row if stem/path changed.
+4. If body embeds core (`<!-- shared-core: … -->`), sync core consumers across stacks when core changed.
+
+## Twin depth
+
+- **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
+- **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+
+## Severity (build-verifier)
+
+- **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
+- **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+
+Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/claude/next/rules/tooling-and-review/security-next.md

@@ -0,0 +1,57 @@
+---
+description: Next.js frontend security — secrets, auth, XSS, Server Actions, env
+paths:
+  - "app/src/**/*.{ts,tsx}"
+  - "app/**/app/**/*.{ts,tsx}"
+  - "**/*Auth*.{ts,tsx}"
+  - "**/*Session*.{ts,tsx}"
+  - "**/.env*"
+  - .claude/commands/**/*
+  - .claude/agents/**/*
+---
+
+# Security (Next.js)
+
+Coding-time checklist. Full audit → agent `security-reviewer` + skill `code-review`.
+
+## Secrets and env
+
+- Never put service / secret keys in `NEXT_PUBLIC_*` or client bundles (`sk_`, private API keys, DB URLs).
+- Do not commit `.env*` with real secrets; use CI / secret manager patterns already in the repo.
+- Prefer server-only modules for privileged clients; do not import them into Client Components.
+
+## Auth and session
+
+- Enforce auth on the **server** (layouts, pages, Server Actions, route handlers) — not only Edge middleware.
+- Middleware may refresh sessions; do not treat middleware alone as authorization.
+- Prefer httpOnly secure cookies over `localStorage` for tokens when the repo pattern allows.
+- Never trust client-only session claims without a server verify step used by the project.
+
+## Mutations and input
+
+- Server Actions / route handlers: validate untrusted input at the edge (Zod or the repo’s schema pattern).
+- Prefer an explicit success/error response shape over throwing opaque errors to the client.
+- CSRF / origin checks — follow existing repo middleware and form patterns for state-changing requests.
+
+## XSS and output
+
+- Avoid `dangerouslySetInnerHTML` unless sanitized and unavoidable; prefer text nodes / safe components.
+- Sanitize or encode user-generated HTML/markdown before render.
+- Open redirects: validate redirect targets against an allowlist or same-origin paths.
+
+## Data exposure
+
+- Do not log tokens, passwords, or full PII in client or server logs.
+- Do not return full privileged records to the client — map to the minimum domain fields the UI needs.
+
+## Anti-hallucination
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Invented auth helpers not in `package.json` / codebase | Copy patterns from existing auth routes |
+| Putting secrets in `NEXT_PUBLIC_*` | Server-only env + server modules |
+| Auth only in middleware | Server `getUser` / session verify in layout/page/action |
+
+## Agent requirement
+
+On auth, forms, payments, or env changes — load this rule and `tooling-and-review/code-review-mr.md`. Route sensitive features through `security-reviewer`.

package/presets/claude/next/rules/tooling-and-review/technical-retro.md

@@ -0,0 +1,16 @@
+---
+description: Роль агента для проведения технического ретроспективы (retro). On-demand — предпочтительнее slash-команда /technical-retro.
+paths:
+  - .claude/commands/**/*
+  - .claude/team/**/*
+---
+
+<!-- shared-core: review/technical-retro.md -->
+
+# Техническое ретро — rule alias
+
+Полный сценарий (включая блок **«Работа агентов»** для slug из team tasks) — в slash-команде:
+
+**`commands/technical-retro.md`** → `/technical-retro`
+
+Используй rule только если command недоступен. Не дублируй содержимое command в ответе — следуй command-файлу и skill `technical-retro`.

package/presets/claude/next/rules/ui-and-accessibility/react-ui.md

@@ -2,6 +2,7 @@
 paths:
   - app/src/ui/**/*.tsx
   - app/src/ui/**/*.ts
+impact: HIGH
 ---
 
 # Общие правила компонентов
@@ -89,3 +90,23 @@ paths:
   - **Testing Library** для React, как принято в проекте;
   - проверять поведение и бизнес‑правила, а не конкретные CSS‑классы.
 - В тестах ориентироваться на текст, роли и aria‑атрибуты.
+## Incorrect
+
+```tsx
+import { mapUserDto } from '@/api/services/UsersApi/userResponseMappers'
+
+export const UserBadge = ({ dto }: { dto: unknown }) => {
+  const user = mapUserDto(dto as any) // mapping + deep import in UI
+  return <span>{user.name}</span>
+}
+```
+
+## Correct
+
+```tsx
+import type { TUserProfile } from '@/types'
+
+export const UserBadge = ({ user }: { user: TUserProfile }) => {
+  return <span>{user.name}</span>
+}
+```

package/presets/claude/next/skills/README.md

@@ -11,5 +11,7 @@
 | `unit-testing` | Planning, generating, or healing unit test coverage |
 | `playwright-e2e` | Planning, generating, or healing Playwright e2e coverage |
 | `technical-retro` | Technical retrospective for a task, sprint, incident, or agent pipeline |
+| `write-adr` | Author an Architecture Decision Record (context / decision / consequences) |
+| `react-performance` | Implementer checklist: bundle, RSC/client, memo, waterfalls, CWV (not a perf audit agent) |
 
 Папка копируется в `.claude/skills/` при `ai-rules init claude --preset next`, если существует.

package/presets/claude/next/skills/code-review/SKILL.md

@@ -17,10 +17,22 @@ Use the local repository as the source of truth: `git status`, `git diff`, task
 4. Check public imports through `@/types` and `@/api`, plus barrel updates for new public symbols.
 5. Review UI consistency, styling conventions, and prop shape.
 6. Check tests: unit for mapper/domain logic, behavior tests for HTTP client changes, e2e plan/spec updates for user flows.
-7. Report validation gaps: lint, stylelint, type-check, or relevant tests not run.
+7. **Reuse lens:** flag new helpers that duplicate existing utilities; prefer adjacent shared modules over copy-paste.
+8. **Efficiency lens:** unnecessary work, sequential ops that should be parallel, hot-path bloat, no-op store updates, overly broad reads.
+9. Report validation gaps: lint, stylelint, type-check, or relevant tests not run.
 
 ## Output
 
-Lead with findings ordered by severity. Each finding should include the file, the problem, impact, and a concrete fix direction. If there are no findings, say so and call out remaining test or validation risk.
+Lead with findings ordered by severity. Required shape (also in `code-review-mr`):
+
+- Each finding: **`path:line`** — problem — impact — concrete fix direction.
+- Severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding context.
+- End with a verdict line: **`Safe to merge | needs changes | reject`**.
+- If there are no findings, say so and call out remaining test or validation risk.
 
 For agent team tasks, write `.claude/team/tasks/<slug>/review.md` and set `status.json` to `completed` or `changes_requested`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/claude/next/skills/debug-investigation/SKILL.md

@@ -26,3 +26,7 @@ For agent team tasks, write `.claude/team/tasks/<slug>/debug-report.md` with:
 - Remaining risk.
 
 Update `status.json` when complete.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/claude/next/skills/feature-delivery/SKILL.md

@@ -10,6 +10,14 @@ description: Delivers Next.js frontend features end-to-end across domain types,
 3. Add or update focused tests for changed behavior.
 4. Validation from `app/`: **invoke** **`rules/tooling-and-review/post-change-lint.md`** after code edits (requestable, not session-start — but mandatory when code changed). Pipeline: scoped lint OK if next step is `build-verifier`.
 
+## Scope discipline
+
+Implement only the current AC / decomposition task. Clarify ambiguity before coding; do not add unrelated hardening, polish, or refactors. See `feature-developer` → **Zero improvisation**.
+
 ## Handoff
 
 Summarize by layer, validation results, and known gaps. Agent team: update `.claude/team/tasks/<slug>/status.json`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/claude/next/skills/react-performance/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: react-performance
+description: Next.js React performance checklist for implementers — bundle, RSC/client boundaries, memoization discipline, data-fetch waterfalls, Core Web Vitals. Use while coding a next feature; not a substitute for the performance-auditor agent when the user asks for an audit report.
+---
+
+# React performance (next)
+
+On-demand checklist for **implementers** shipping Next.js UI. For a formal diff audit report, use the **`performance-auditor`** agent instead — this skill does not replace it.
+
+## Bundle
+
+- Prefer route-level and component-level code splitting for heavy UI (charts, editors).
+- Avoid importing large libraries into shared layouts; keep client entry points small.
+- Check that barrel files do not re-export heavy modules into every consumer.
+
+## RSC / client boundaries
+
+- Default to Server Components; add `"use client"` only when hooks, browser APIs, or interactivity require it.
+- Keep client leaves small; pass serializable props from server parents.
+- Do not pull server-only modules (secrets, Node APIs) into client components.
+
+## Memoization discipline
+
+- Do **not** add `useMemo` / `useCallback` by default — follow the repo’s React Compiler / team guidance.
+- Memoize when profiling shows unstable props causing expensive subtree re-renders, or when an existing pattern already does.
+- Prefer fixing state placement and list keys over blanket memo wrappers.
+
+## Data-fetch waterfalls
+
+- Avoid sequential awaits that could be parallel (`Promise.all`) when independent.
+- Lift shared fetches to a layout/parent when multiple children need the same data.
+- Prefer store/thunk or server fetch patterns already used in the feature’s reference slice — do not invent a second data layer.
+
+## Core Web Vitals (quick)
+
+| Metric | Implementer checks |
+|--------|--------------------|
+| LCP | Hero/media not blocked by unnecessary client JS; sensible image sizing |
+| INP | Click handlers lean; avoid long sync work on the main thread |
+| CLS | Reserve space for images/skeleton; stable fonts |
+
+## Handoff
+
+If the user asks for a **performance audit report** of a diff/deliverable, route to **`performance-auditor`** (readonly `perf-report.md`), not this skill alone.

package/presets/claude/next/skills/technical-retro/SKILL.md

@@ -29,12 +29,26 @@ Ask for missing period, focus, task slug, participants, or format constraints. I
 
 For `/task` pipelines, include router, analyst, developer, **build-verifier**, reviewer, QA/e2e, hooks, and rules.
 
+## Wrong-turn taxonomy (optional)
+
+When artifacts or the user mention agent mistakes, tag incidents:
+
+| Kind | Signal |
+|------|--------|
+| `correction` | User pushback («no», «don't», «actually») |
+| `retry` | Same tool/approach 2+ times before success |
+| `waste` | Many searches before the right file |
+| `reversal` | Edit then revert / delete |
+| `dead-end` | Env/tool failure (missing binary, wrong path) |
+
+Severity: **high** (explicit correction / large waste) · **med** · **low**. Confidence 0–100 — be honest; low-confidence items are optional.
+
 ## Preset feedback loop
 
-If the same issue appeared in 2+ tasks, add section **Preset updates**:
+If the same issue appeared in **2+** tasks (or **3+** for packaging a new rule/skill — Rule of Three), add section **Preset updates**:
 
-- Proposed change to `.claude/rules/`, `.claude/agents/`, or `.claude/skills/`
-- One concrete diff or file path to update
-- Whether it belongs in session-start rules vs `paths:` vs skill
+- Proposed change to `.claude/rules/`, `.claude/agents/`, `.claude/skills/`, or **`.claude/team/conventions.md`** (prefer conventions for project gotchas)
+- One concrete snippet or file path
+- Whether it belongs in session-start vs `paths:` vs skill vs conventions (see `PRESET-CONTRIBUTION` → Building blocks)
 
-Do not apply preset changes without user approval.
+Do not apply preset or conventions changes without user approval.

package/presets/claude/next/skills/write-adr/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: write-adr
+description: Author an Architecture Decision Record (ADR) with Context, Decision, Consequences, and Links. Use when capturing a durable technical choice for the team.
+---
+
+# Write ADR
+
+On-demand skill for durable architecture decisions. Stack-agnostic sections — fill with project-specific paths and links.
+
+## When to use
+
+- Choosing between non-trivial alternatives (storage, layering, library, API shape).
+- Recording a decision that future agents/humans should not silently reverse.
+- User asks for an ADR, decision log, or “why did we pick X”.
+
+## Template
+
+Create (or append) a short markdown ADR in the repo’s agreed location (e.g. `docs/adr/`, `.cursor/team/`, wiki). Suggested filename: `NNNN-short-title.md`.
+
+```markdown
+# ADR NNNN: <Title>
+
+## Context
+What problem / constraint / force requires a decision?
+
+## Decision
+What we chose (one clear option). Include rejected alternatives briefly if useful.
+
+## Consequences
+Positive and negative outcomes; follow-up work; what becomes harder.
+
+## Links
+Related PRs, issues, rules, prior ADRs, diagrams.
+```
+
+## Guidelines
+
+- Prefer one decision per ADR.
+- Keep Context factual; Decision imperative and short.
+- Link living gotchas to `team/conventions.md` when the decision becomes a recurring local pattern.
+- Do not put ADR bodies only in root `AGENTS.md` (overwrite on init).

package/presets/claude/next/team/conventions.md

@@ -0,0 +1,21 @@
+# Living conventions (team)
+
+Consumer-owned store for post-init gotchas, patterns, and decisions. **Not** always-on. Fill after `ai-rules init`. Root `AGENTS.md` only points here.
+
+## Gotchas
+
+<!-- e.g. fragile flows, “never do X in this repo” -->
+
+-
+
+## Patterns
+
+<!-- local patterns beyond reference-features table -->
+
+-
+
+## Decisions
+
+<!-- short pointers to ADRs / product choices that affect code -->
+
+-

package/presets/cursor/go/AGENTS.md

@@ -0,0 +1,30 @@
+# Go hexagonal stack — Cursor agent team
+
+**Repo-root agents:** see [`AGENTS.md`](../../AGENTS.md) at the project root (cross-tool setup, commands, security, living conventions pointers).
+
+| Задача | Куда смотреть |
+|--------|----------------|
+| Новая work-задача | `/task` → `commands/task.md` + `agent-team-orchestrator.mdc` |
+| Фича end-to-end | skill `feature-delivery` + `feature-delivery-workflow.mdc` |
+| Стек и слои | `go-app-core.mdc`, `architecture-boundaries.mdc` |
+| После правок Go | `post-change-test.mdc` (+ `go-tooling.mdc`) |
+| Integration tests | `integration-test-*` + skill `integration-testing` |
+| Code review | skill `code-review` + `code-review-mr.mdc` |
+| ADR | skill `write-adr` (on-demand) |
+| Как работает X | agent `codebase-analyzer` (explain-as-is; без `/task`) |
+
+## Install
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset go
+```
+
+Копирует rules/agents/hooks/skills/team + `REPO_AGENTS.md` → корневой `AGENTS.md`.
+
+## Dogfood (5 сценариев)
+
+1. `/task` — новый use case (domain → ports → adapters → wire).
+2. Баг маппинга HTTP — debugger + httptest.
+3. Repository contract — integration-test trio.
+4. Unit use case — unit-test planner/generator.
+5. Secrets in logs — security-reviewer + `security-go`.

package/presets/cursor/go/BUGBOT.md

@@ -0,0 +1,9 @@
+# Bugbot priorities — Go hexagonal
+
+1. Layer leaks: framework/SQL types in domain; SQL in use cases; business logic in handlers.
+2. Ports: adapters not implementing application interfaces; ORM models leaking upward.
+3. Composition root: business logic in `cmd/` / DI.
+4. Error handling: swallowed errors; missing `%w` wrap; wrong HTTP status mapping.
+5. Tests: missing table-driven unit tests for domain/app; no adapter contract coverage for risky repos.
+6. Security: secrets in logs; string-built SQL; trusting client input in domain.
+7. Ignore Playwright/XCUITest/`lint:js` — not this stack.

package/presets/cursor/go/MCP.md

@@ -0,0 +1,16 @@
+# MCP (preset `go`, Cursor)
+
+Копируется в `.cursor/mcp.json` при `ai-rules init cursor --preset go`.
+
+## Servers
+
+| Name | Package | Зачем |
+|------|---------|--------|
+| `context7` | `@upstash/context7-mcp` | Актуальная документация Go / stdlib / популярных библиотек |
+| `figma` | remote `https://mcp.figma.com/mcp` | Design context при необходимости; OAuth в Cursor |
+
+Browser e2e MCP (Playwright / Chrome DevTools) **не** входят в go-пресет.
+
+Секреты в файл не кладём. Опционально: `CONTEXT7_API_KEY` в окружении. Figma — OAuth (токен не коммитим).
+
+После init: Settings → MCP → включить серверы. `init` перезаписывает одноимённый `mcp.json`.

package/presets/cursor/go/README.md

@@ -0,0 +1,39 @@
+# Go hexagonal preset (Cursor)
+
+Правила и agent-team surface для Go backend (hexagonal / ports & adapters).
+
+## Install
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset go
+```
+
+| Path | Содержание |
+|------|------------|
+| `REPO_AGENTS.md` | → repo-root `AGENTS.md` (cross-tool) |
+| `AGENTS.md` | → `.cursor/AGENTS.md` quick-start |
+| `BUGBOT.md` | Bugbot review priorities (Go) |
+| `rules/**` | `.mdc` + README (alwaysApply ≤3) |
+| `agents/**` | **21** ролей (+ README; includes on-demand `codebase-analyzer`) |
+| `skills/**` | **8** skills (incl. `integration-testing`, `write-adr`; no `react-performance`) |
+| `commands/**` | task, task-continue, feature-start/continue, technical-retro |
+| `hooks.json` + `hooks/**` | guard-shell + chain-team-phases; optional `hooks/examples/` |
+| `team/**` | fixtures + `conventions.md` + README |
+| `mcp.json` + `MCP.md` | Context7 + Figma (same as ios baseline) |
+
+## alwaysApply (≤3)
+
+`go-app-core`, `architecture-boundaries`, `code-quality-and-refactoring`.
+
+Requestable: `post-change-test`, `go-tooling`, `agent-team-*`, hexagonal layer globs.
+
+## Preset taxonomy & contributing
+
+- **Layers:** Core → Stack → Platform — [`../../_shared/README.md`](../../_shared/README.md)
+- **Contribution guide:** [`../../../docs/PRESET-CONTRIBUTION.md`](../../../docs/PRESET-CONTRIBUTION.md) (SoT, twins, token budget, PR checklist)
+- **Author meta-rules:** `preset-*.mdc` (globs `packages/ai-rules/presets/**`, never alwaysApply)
+- **Core→stack mapping:** [`rules/README.md`](./rules/README.md)
+
+## Sync with Claude
+
+SoT = этот Cursor-пресет. Twin: `presets/claude/go/` **в том же PR**.

package/presets/cursor/go/REPO_AGENTS.md

@@ -0,0 +1,48 @@
+# Go — agent instructions
+
+Cross-tool repo-root guide. Tool-specific maps stay under `.cursor/AGENTS.md` and `.claude/CLAUDE.md`.
+
+## Cross-tool setup
+
+- Treat this file as the **shared** entry for any agent (Cursor, Claude Code, or other).
+- Tool maps live in `.cursor/AGENTS.md` / `.claude/CLAUDE.md` when that tool is installed.
+- Install:
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset go
+npx @bonesofspring/ai-rules init claude --preset go
+```
+
+`init` overwrites this file from the preset (`REPO_AGENTS.md` → `AGENTS.md`). Living gotchas belong in `team/conventions.md`, not here.
+
+## Commands (test / lint / build)
+
+Prefer hexagonal / ports-and-adapters layout from stack rules (`go-app-core`, `architecture-boundaries`).
+
+| Gate | Typical command |
+|------|-----------------|
+| Test | `go test ./...` (or package-scoped) |
+| Vet | `go vet ./...` |
+| Lint | **golangci-lint** when configured |
+| Format | `gofmt` / `goimports` |
+
+After code edits: invoke **`post-change-test`** (requestable). Full gate: agent `build-verifier`.
+
+## Security basics
+
+- Do not commit secrets (tokens, `.env`, private keys).
+- Review destructive git before running; respect shell hooks.
+- Do not weaken CI or skip hooks unless the user explicitly asks.
+
+## Tool entry points
+
+| Tool | Map |
+|------|-----|
+| Cursor | `.cursor/AGENTS.md` (optional if Cursor not installed) |
+| Claude Code | `.claude/CLAUDE.md` (optional if Claude not installed) |
+
+Rules: `.cursor/rules/` or `.claude/rules/`. Skills: `.cursor/skills/` or `.claude/skills/`.
+
+## Living conventions
+
+Gotchas, local patterns, and team decisions: **`.cursor/team/conventions.md`** and/or **`.claude/team/conventions.md`** (fill after init).

package/presets/cursor/go/agents/README.md

@@ -0,0 +1,36 @@
+# `.cursor/agents` (preset go)
+
+Ролевые subagents для командного пайплайна Cursor (Go hexagonal).
+
+## Analysis (on-demand)
+
+| Agent | Файл | Production-код |
+|-------|------|----------------|
+| Codebase analyzer | `codebase-analyzer.md` | no (explain-as-is only) |
+
+## Roster (21)
+
+| Agent | Production writes |
+|-------|-------------------|
+| task-router, task-analyst, solution-architect | team only |
+| codebase-analyzer | no (explain-as-is only) |
+| feature-developer | yes (Go sources) |
+| build-verifier | no (report only) |
+| debugger, ci-investigator | minimal |
+| code-reviewer, security-reviewer, performance-auditor | team only |
+| migration-specialist, api-contract-reviewer, tech-writer | team / docs |
+| qa-tester, unit-test-*, integration-test-* | tests |
+
+**No** `accessibility-reviewer`, Playwright, or XCUITest stems. Replace those intents with **`integration-test-*`**.
+
+## Frontmatter `readonly`
+
+Все agents — **`readonly: false`** (нужна запись в `.cursor/team/**`). Ограничения production — в теле промпта.
+
+## Model matrix (frontmatter `model`)
+
+| Tier | Frontmatter | Agents |
+|------|-------------|--------|
+| **cheap** | `fast` | router, analyst, build-verifier, code-reviewer, tech-writer, codebase-analyzer |
+| **standard** | `inherit` | developer, debugger, ci-investigator, api-contract, qa, unit-*, integration-* |
+| **strong** | `claude-opus-4-8[effort=high]` | solution-architect, migration-specialist, security-reviewer, performance-auditor |

package/presets/cursor/go/agents/api-contract-reviewer.md

@@ -0,0 +1,23 @@
+---
+name: api-contract-reviewer
+description: API contract review specialist. Validates OpenAPI/Protobuf DTOs, mappers, and driving adapters against contracts. Readonly — writes api-contract-review.md only; never edits production code.
+readonly: false
+---
+
+Review **HTTP/gRPC contract alignment** for Go hexagonal services.
+
+## Focus
+
+- OpenAPI / proto definitions vs adapter DTOs
+- Mapping at driving edge (no domain pollution with wire types)
+- Status/error code mapping consistency
+- Backward compatibility of public `pkg/` or published APIs
+
+## Output
+
+`.cursor/team/tasks/<slug>/api-contract-review.md` — gaps, severity, suggested fixes (no code edits).
+
+## Non-scope
+
+- iOS Feature Presentation/Data framing
+- Choosing a new framework

package/presets/cursor/go/agents/build-verifier.md

@@ -0,0 +1,35 @@
+---
+name: build-verifier
+description: Validation gate specialist. Runs go test/vet/lint-if-present after implementation; writes validation-report.md. Never fixes app source. For preset packaging tasks, also validates go preset structure gates.
+readonly: false
+model: fast
+---
+
+You are the build verifier for **Go hexagonal** services (and for **ai-rules preset packaging** when scope says so).
+
+## Consumer Go repos
+
+1. Run from module root: `go test ./...`, `go vet ./...`.
+2. If present: `golangci-lint` / `staticcheck` per repo docs (`go-tooling`, `post-change-test`).
+3. Optional `-race` when concurrency touched.
+4. Write `.cursor/team/tasks/<slug>/validation-report.md` with commands + results.
+5. On failure: set status `validation_failed` — do **not** patch production code (developer retries).
+
+**Never** require Playwright, XCUITest, `lint:js`/`lint:css`, or `xcodebuild`/`SwiftLint` as the Go gate.
+
+## Preset-structure validation (when editing `packages/ai-rules/presets/**`)
+
+From `packages/ai-rules/`:
+
+```bash
+yarn check:preset-structure
+```
+
+Hard gates: twin-map (stacks include **go**), token-budget (alwaysApply/session-start = 3), leakage (`GO_FORBIDDEN_*`, chain forks go≠next≠ios-swift).
+
+Document PASS/FAIL in `validation-report.md`.
+
+9. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go`) must ship `REPO_AGENTS.md` when validating preset packaging → **FAIL** if missing.
+10. **Hooks cookbook:** default `hooks.json` must **not** reference `hooks/examples/` → **FAIL** if it does.
+11. **No react-performance on ios/go:** skill directory / required handoff must be absent under ios-swift and go → **FAIL** (leakage). Prefer `check:preset-leakage`.
+12. **Rule eval (WARN):** `scripts/check-rule-eval.mjs` / `yarn check:rule-eval` should exist for maintainers; smoke optional. Hard fail only when the opt-in eval job runs — not part of default `check:preset-structure`.

package/presets/cursor/go/agents/ci-investigator.md

@@ -0,0 +1,17 @@
+---
+name: ci-investigator
+description: Investigates failing CI checks on PRs and branches — go test, vet, golangci-lint, integration jobs — with local reproduction and minimal fixes. Use when CI is red or for ci-fix pipeline tasks.
+readonly: false
+---
+
+Triage red CI for Go repos (and ai-rules preset-structure when relevant).
+
+## Steps
+
+1. Identify failing job/logs.
+2. Reproduce locally (`go test`, `go vet`, lint-if-present, or `yarn check:preset-structure` for preset PRs).
+3. Minimal fix or document blocker; update `debug-report.md` / status.
+
+## Never
+
+- Never treat `lint:js` / Playwright / xcodebuild as the Go default gate.