@bonesofspring/ai-rules 0.2.6 → 0.2.8

package/presets/claude/next/rules/architecture/reference-features.md

@@ -35,6 +35,10 @@ Taxonomy / shared core: [`presets/_shared/README.md`](../../../../_shared/README
 3. Зеркаль именование, порядок файлов, паттерны импортов и тестов.
 4. Если эталона нет — выбери **самую близкую** существующую фичу того же слоя и зафиксируй выбор в handoff.
 
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.claude/team/conventions.md`** (and the twin tool path if both Cursor and Claude are installed). Consumer-owned; not always-on. See root `AGENTS.md` § Living conventions.
+
 ## Связанные правила
 
 - `tooling-and-review/code-quality.md` — повторять паттерны, не deep-import.

package/presets/claude/next/rules/stack/arrow-functions.md

@@ -1,45 +1,30 @@
 ---
 paths:
   - app/src/**/*.{ts,tsx,js,jsx}
+impact: LOW
 ---
-
 # Стрелочные функции
 
-При разработке **использовать стрелочный синтаксис** для функций, где это допустимо в TypeScript/JavaScript.
-
-## Что делать
+Предпочитать стрелочный синтаксис для нового кода в `app/src/**`, где это допустимо в TypeScript/JavaScript.
 
-- Объявлять функции как **`const имя = (...) => { ... }`** вместо **`function имя(...) { ... }`**, если не нужны особенности объявления `function`.
-- Колбэки и обработчики — стрелочные функции: `.map((x) => ...)`, `onClick={() => ...}`.
-- React-компоненты и хуки — как стрелочные функции с явной типизацией пропсов/возврата по принятому в проекте стилю.
+**Style enforcement:** детальные pref — в ESLint (`app/eslint.config.mjs`) и Stylelint; после правок — **`post-change-lint`**. Это правило — краткий intent, не дублировать линтер.
 
-## Исключения (допустимо не стрелка)
+## Исключения
 
-- **Генераторы** (`function*`) — стрелкой не выразить.
-- **Методы класса** — если в коде используются классы, допустимы обычные методы (`method() {}`).
-- Когда осознанно нужны **подъём (hoisting)** или **имя функции в стеке** только у `function` — редкие случаи.
+- Генераторы (`function*`)
+- Методы класса, где нужен `this` прототипа
+- Редкие случаи hoisting / именованного `function` в стеке
 
-## Примеры
+## Incorrect
 
-```typescript
-// ❌ Избегать для нового кода
+```ts
 function formatLabel(id: string): string {
   return id.toUpperCase()
 }
-
-// ✅ Предпочтительно
-const formatLabel = (id: string): string => {
-  return id.toUpperCase()
-}
 ```
 
-```tsx
-// ✅ Предпочтительно
-const UserCard = ({ name }: { name: string }) => {
-  return <span>{name}</span>
-}
-```
+## Correct
 
-## Требование к агенту
-
-При генерации и правке кода **по умолчанию выбирать стрелочные функции**; отступать к `function` только в случаях из раздела исключений.
+```ts
+const formatLabel = (id: string): string => id.toUpperCase()
+```

package/presets/claude/next/rules/stack/next-app-router.md

@@ -22,7 +22,7 @@ paths:
 
 ## Маршруты и UX
 
-- Для async routes использовать **`loading.tsx`**, **`error.tsx`**, **`not-found.tsx`** по образцу соседних routes.
+- Для async data routes **обязательны** sibling **`loading.tsx`** и **`error.tsx`** (и `not-found.tsx` где уместно) — по образцу соседних routes.
 - **Suspense** — для медленных client/server секций; fallback согласован с дизайн-системой.
 - Навигация — `stack/navigation-router.md` + router/link паттерны проекта.
 
@@ -31,6 +31,18 @@ paths:
 - RSC/route handlers **не импортируют UI-компоненты с client-only зависимостями** напрямую в server tree без `'use client'` границы.
 - Доменные типы — `@/types`; вызовы backend — через `@/api` / services, не raw `fetch` из page.tsx без слоя API.
 
+## Anti-hallucination (App Router)
+
+Меньше угаданного кода лучше, чем больше. Сверяй API с версией Next в `package.json` и соседними routes.
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Sync `params` / `searchParams` / `cookies()` / `headers()` when the installed Next treats them as async | `await params` / `await cookies()` / patterns from existing pages |
+| Invented `getSession()`-only server auth without project verify | Server session verify used by the repo (`tooling-and-review/security-next.md`) |
+| Auth enforcement only in Edge middleware | Layout/page/Server Action checks + middleware refresh if present |
+| New App Router APIs not in the installed Next major | Copy from a sibling route; mark `VERIFY` if unsure |
+| Client `fetch` in `page.tsx` bypassing `@/api` | Services via `@/api` / established data loaders |
+
 ## Эталон
 
 Смотри существующий route той же сложности в `app/src/app/**` и повтори структуру (`architecture/reference-features.md`).

package/presets/claude/next/rules/testing/tests-unit.md

@@ -4,6 +4,7 @@ paths:
   - app/src/**/*.spec.tsx
   - app/src/**/*.test.ts
   - app/src/**/*.test.tsx
+impact: MEDIUM
 ---
 
 # Общие правила тестирования
@@ -64,3 +65,15 @@ it('Returns empty list when user is guest', () => {})
   - для **компонентов UI** — **не создавать** поддиректорию `__tests__` внутри папки компонента; тест — соседний `*.spec.tsx`.
   - в **других модулях** (например `api/services`) допустима уже существующая схема с `__tests__` — не ломать ради единообразия с UI.
   - **новые** файлы — `*.spec.ts` / `*.spec.tsx` (см. блок «Имена файлов» выше).
+## Incorrect
+
+```ts
+it('returns empty list when guest', () => {})
+it('Возвращает пустой список. пользователь не авторизован', () => {})
+```
+
+## Correct
+
+```ts
+it('Возвращает пустой список. Пользователь не авторизован', () => {})
+```

package/presets/claude/next/rules/tooling-and-review/README.md

@@ -9,6 +9,7 @@ Lint, package manager, качество кода, agent team, code review MR.
 | `code-quality.md` | Boy scout rule, рефакторинг, ESLint | session start |
 | `agent-team-intake.md` | Когда предлагать `/task` и router pipeline | `paths:` commands/team |
 | `agent-team-orchestrator.md` | Dynamic agent team: router, pipeline, gates | `paths:` commands/team/agents |
-| `code-review-mr.md` | Чеклист ревью merge request | `paths:` review-related |
+| `code-review-mr.md` | Чеклист ревью merge request + output contract | `paths:` review-related |
+| `security-next.md` | Secrets, auth, XSS, Server Actions (coding-time) | `paths:` app/auth/env |
 
 On-demand (не rule): **`commands/technical-retro.md`** (фасилитация ретро).

package/presets/claude/next/rules/tooling-and-review/agent-team-intake.md

@@ -12,6 +12,6 @@ When the user message looks like a **work request** (implement, add, fix, refact
 
 1. Prefer **`/task <their request>`** or invoke **task-router** first.
 2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
-3. Pure questions («как работает X», «объясни») — answer normally, no `/task`.
+3. Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
 
 Exceptions: user explicitly says «без pipeline», «просто сделай», or continues an active slug.

package/presets/claude/next/rules/tooling-and-review/agent-team-orchestrator.md

@@ -146,7 +146,7 @@ If `pipeline.json` is missing (old `/feature-start` tasks), fall back to fixed p
 
 Do **not** run `/task` + router for:
 
-- Pure questions («как работает X», «объясни»).
+- Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** for deep traces; inline OK for trivial one-liners.
 - Typo / one-file fix / trivial config with no architecture risk.
 - User explicitly says «без pipeline», «просто сделай», or continues an active slug.
 - Single-line `docs-only` with no code impact.

package/presets/claude/next/rules/tooling-and-review/code-quality.md

@@ -61,10 +61,20 @@ description: Поддержка и улучшение качества кода
 - **Boy scout rule:** оставлять модуль немного лучше, чем до изменения (простые, безопасные улучшения).
 - Не жертвовать архитектурой и слоями ради краткости реализации.
 
-> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
+## Agent discipline (anti-sycophancy)
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent) and surface uncertainty; never invent signatures.
+- Before «is this correct?» — list ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose a characterization test first; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential «added for issue Y» comments.
+- Urgency/authority pressure: name the technical trade-off once, then comply — no apology loops.
+- Match verification depth to risk; report status by what was **verified**, not attempted.
 
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**; do not invent a parallel style bible in this core body.
+
+> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
 ## Stack notes
 
 - Public API: index/barrel‑файлы (`architecture/public-imports.md`, `architecture/layer-barrel-exports.md`).
 - Примеры: общий хук/утилита; `any`/`unknown`; разделение компонента; CSS‑токены.
-- Lint/stylelint — только **`tooling-and-review/post-change-lint.md`**; ESLint: `app/eslint.config.mjs`. `eslint-disable` — точечно с комментарием «зачем».
+- Lint/stylelint — только **`tooling-and-review/post-change-lint.md`**; ESLint: `app/eslint.config.mjs`. `eslint-disable` — точечно с комментарием «зачем». Style prose in domain rules stays thin — prefer ESLint/Stylelint over duplicating formatter recipes.

package/presets/claude/next/rules/tooling-and-review/code-review-mr.md

@@ -37,3 +37,25 @@ Concrete rule stems — in **Stack notes**.
 - Use local `git diff` — do not invent hosting metadata.
 - Boy scout rule: suggest fixes feasible within the MR scope.
 - No «большие рефакторинги» without an explicit request (`code-quality-and-refactoring`).
+
+## Output contract
+
+Procedure details live in skill `code-review`. Required shape:
+
+- Each finding cites **`path:line`**, the problem, impact, and a concrete fix direction.
+- Rank by severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding file context.
+- End with a verdict on its own line: **`Safe to merge | needs changes | reject`**.
+
+## Stack notes
+
+On-demand rule for review flows. **Procedure and output format:** skill `code-review`.
+
+### Checklist references
+
+- Architecture layers: `architecture/architecture-boundaries.md`, `stack/next-app-core.md`; network: `api-and-data/http-client.md`
+- Imports: `architecture/public-imports.md`, `architecture/layer-barrel-exports.md`
+- UI: `ui-and-accessibility/react-ui.md`
+- Security: `tooling-and-review/security-next.md`
+- Tests: `testing/tests-unit.md`, `testing/playwright-agents.md`, `testing/tests-e2e-structure.md`
+- Lint gate before final report: `tooling-and-review/post-change-lint.md`

package/presets/claude/next/rules/tooling-and-review/preset-layering.md

@@ -24,7 +24,7 @@ paths:
 ## Куда класть новое правило
 
 1. Общие принципы для всех стеков → **core** + адаптеры с `<!-- shared-core: … -->`.
-2. Только один из installable стеков (`next` / `ios-swift` / `go`) → **stack-specific** (не в `_shared`).
+2. Только один из installable стеков (`next` / `ios-swift` / `go` / `java`) → **stack-specific** (не в `_shared`).
 3. Только Cursor или только Claude packaging → platform artifact / frontmatter, не дублировать семантику.
 
 ## SoT

package/presets/claude/next/rules/tooling-and-review/preset-no-cross-stack-leakage.md

@@ -17,7 +17,7 @@ paths:
 
 - `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
 - `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
-- `go` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `go` / `java` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
 - Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
 
 ## Forbidden in ios-swift hooks/agents (FAIL)
@@ -35,14 +35,16 @@ Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild`
 - `xcuitest-test-` as handoff stems
 - Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
 
-## Forbidden in go hooks/agents (FAIL)
+## Forbidden in go / java hooks/agents (FAIL)
+
+Shared backend-stack bans (both `go` and `java`):
 
 - `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
 - Positive yarn recipes `lint:js` / `lint:css`
 - `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
 - Agent file `accessibility-reviewer` (no UI surface)
 
-Required instead: `integration-test-*`; build-verifier / `post-change-test` / `go-tooling` (`go test`, `go vet`).
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`) or `java-tooling` (`mvn test` / `./gradlew test`).
 
 ## Soft / document
 
@@ -51,4 +53,4 @@ Required instead: `integration-test-*`; build-verifier / `post-change-test` / `g
 
 ## Chain fork
 
-`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, and `go` (per platform).
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, `go`, and `java` (per platform).

package/presets/claude/next/rules/tooling-and-review/preset-pr-checklist.md

@@ -17,7 +17,7 @@ paths:
 
 - [ ] **SoT:** правки в `packages/…` (не только root `.cursor/`)
 - [ ] **Core:** если менялся `_shared/core/**` — обновлены все `<!-- shared-core: … -->` consumers (или documented intentional fork)
-- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, and go — см. `preset-twin-sync`)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, ios-swift, go, and java — см. `preset-twin-sync`)
 - [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table актуален
 - [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
 - [ ] **Leakage:** нет чужих stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)

package/presets/claude/next/rules/tooling-and-review/preset-twin-sync.md

@@ -20,6 +20,7 @@ Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
 | `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
 | `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
 | `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+| `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
 
 ## Same-PR checklist
 
@@ -38,5 +39,6 @@ Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
 - **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
 - **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
 - **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+- **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
 
 Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/claude/next/rules/tooling-and-review/security-next.md

@@ -0,0 +1,57 @@
+---
+description: Next.js frontend security — secrets, auth, XSS, Server Actions, env
+paths:
+  - "app/src/**/*.{ts,tsx}"
+  - "app/**/app/**/*.{ts,tsx}"
+  - "**/*Auth*.{ts,tsx}"
+  - "**/*Session*.{ts,tsx}"
+  - "**/.env*"
+  - .claude/commands/**/*
+  - .claude/agents/**/*
+---
+
+# Security (Next.js)
+
+Coding-time checklist. Full audit → agent `security-reviewer` + skill `code-review`.
+
+## Secrets and env
+
+- Never put service / secret keys in `NEXT_PUBLIC_*` or client bundles (`sk_`, private API keys, DB URLs).
+- Do not commit `.env*` with real secrets; use CI / secret manager patterns already in the repo.
+- Prefer server-only modules for privileged clients; do not import them into Client Components.
+
+## Auth and session
+
+- Enforce auth on the **server** (layouts, pages, Server Actions, route handlers) — not only Edge middleware.
+- Middleware may refresh sessions; do not treat middleware alone as authorization.
+- Prefer httpOnly secure cookies over `localStorage` for tokens when the repo pattern allows.
+- Never trust client-only session claims without a server verify step used by the project.
+
+## Mutations and input
+
+- Server Actions / route handlers: validate untrusted input at the edge (Zod or the repo’s schema pattern).
+- Prefer an explicit success/error response shape over throwing opaque errors to the client.
+- CSRF / origin checks — follow existing repo middleware and form patterns for state-changing requests.
+
+## XSS and output
+
+- Avoid `dangerouslySetInnerHTML` unless sanitized and unavoidable; prefer text nodes / safe components.
+- Sanitize or encode user-generated HTML/markdown before render.
+- Open redirects: validate redirect targets against an allowlist or same-origin paths.
+
+## Data exposure
+
+- Do not log tokens, passwords, or full PII in client or server logs.
+- Do not return full privileged records to the client — map to the minimum domain fields the UI needs.
+
+## Anti-hallucination
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Invented auth helpers not in `package.json` / codebase | Copy patterns from existing auth routes |
+| Putting secrets in `NEXT_PUBLIC_*` | Server-only env + server modules |
+| Auth only in middleware | Server `getUser` / session verify in layout/page/action |
+
+## Agent requirement
+
+On auth, forms, payments, or env changes — load this rule and `tooling-and-review/code-review-mr.md`. Route sensitive features through `security-reviewer`.

package/presets/claude/next/rules/ui-and-accessibility/react-ui.md

@@ -2,6 +2,7 @@
 paths:
   - app/src/ui/**/*.tsx
   - app/src/ui/**/*.ts
+impact: HIGH
 ---
 
 # Общие правила компонентов
@@ -89,3 +90,23 @@ paths:
   - **Testing Library** для React, как принято в проекте;
   - проверять поведение и бизнес‑правила, а не конкретные CSS‑классы.
 - В тестах ориентироваться на текст, роли и aria‑атрибуты.
+## Incorrect
+
+```tsx
+import { mapUserDto } from '@/api/services/UsersApi/userResponseMappers'
+
+export const UserBadge = ({ dto }: { dto: unknown }) => {
+  const user = mapUserDto(dto as any) // mapping + deep import in UI
+  return <span>{user.name}</span>
+}
+```
+
+## Correct
+
+```tsx
+import type { TUserProfile } from '@/types'
+
+export const UserBadge = ({ user }: { user: TUserProfile }) => {
+  return <span>{user.name}</span>
+}
+```

package/presets/claude/next/skills/README.md

@@ -11,5 +11,7 @@
 | `unit-testing` | Planning, generating, or healing unit test coverage |
 | `playwright-e2e` | Planning, generating, or healing Playwright e2e coverage |
 | `technical-retro` | Technical retrospective for a task, sprint, incident, or agent pipeline |
+| `write-adr` | Author an Architecture Decision Record (context / decision / consequences) |
+| `react-performance` | Implementer checklist: bundle, RSC/client, memo, waterfalls, CWV (not a perf audit agent) |
 
 Папка копируется в `.claude/skills/` при `ai-rules init claude --preset next`, если существует.

package/presets/claude/next/skills/code-review/SKILL.md

@@ -17,11 +17,19 @@ Use the local repository as the source of truth: `git status`, `git diff`, task
 4. Check public imports through `@/types` and `@/api`, plus barrel updates for new public symbols.
 5. Review UI consistency, styling conventions, and prop shape.
 6. Check tests: unit for mapper/domain logic, behavior tests for HTTP client changes, e2e plan/spec updates for user flows.
-7. Report validation gaps: lint, stylelint, type-check, or relevant tests not run.
+7. **Reuse lens:** flag new helpers that duplicate existing utilities; prefer adjacent shared modules over copy-paste.
+8. **Efficiency lens:** unnecessary work, sequential ops that should be parallel, hot-path bloat, no-op store updates, overly broad reads.
+9. Report validation gaps: lint, stylelint, type-check, or relevant tests not run.
 
 ## Output
 
-Lead with findings ordered by severity. Each finding should include the file, the problem, impact, and a concrete fix direction. If there are no findings, say so and call out remaining test or validation risk.
+Lead with findings ordered by severity. Required shape (also in `code-review-mr`):
+
+- Each finding: **`path:line`** — problem — impact — concrete fix direction.
+- Severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding context.
+- End with a verdict line: **`Safe to merge | needs changes | reject`**.
+- If there are no findings, say so and call out remaining test or validation risk.
 
 For agent team tasks, write `.claude/team/tasks/<slug>/review.md` and set `status.json` to `completed` or `changes_requested`.
 

package/presets/claude/next/skills/feature-delivery/SKILL.md

@@ -10,6 +10,10 @@ description: Delivers Next.js frontend features end-to-end across domain types,
 3. Add or update focused tests for changed behavior.
 4. Validation from `app/`: **invoke** **`rules/tooling-and-review/post-change-lint.md`** after code edits (requestable, not session-start — but mandatory when code changed). Pipeline: scoped lint OK if next step is `build-verifier`.
 
+## Scope discipline
+
+Implement only the current AC / decomposition task. Clarify ambiguity before coding; do not add unrelated hardening, polish, or refactors. See `feature-developer` → **Zero improvisation**.
+
 ## Handoff
 
 Summarize by layer, validation results, and known gaps. Agent team: update `.claude/team/tasks/<slug>/status.json`.

package/presets/claude/next/skills/react-performance/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: react-performance
+description: Next.js React performance checklist for implementers — bundle, RSC/client boundaries, memoization discipline, data-fetch waterfalls, Core Web Vitals. Use while coding a next feature; not a substitute for the performance-auditor agent when the user asks for an audit report.
+---
+
+# React performance (next)
+
+On-demand checklist for **implementers** shipping Next.js UI. For a formal diff audit report, use the **`performance-auditor`** agent instead — this skill does not replace it.
+
+## Bundle
+
+- Prefer route-level and component-level code splitting for heavy UI (charts, editors).
+- Avoid importing large libraries into shared layouts; keep client entry points small.
+- Check that barrel files do not re-export heavy modules into every consumer.
+
+## RSC / client boundaries
+
+- Default to Server Components; add `"use client"` only when hooks, browser APIs, or interactivity require it.
+- Keep client leaves small; pass serializable props from server parents.
+- Do not pull server-only modules (secrets, Node APIs) into client components.
+
+## Memoization discipline
+
+- Do **not** add `useMemo` / `useCallback` by default — follow the repo’s React Compiler / team guidance.
+- Memoize when profiling shows unstable props causing expensive subtree re-renders, or when an existing pattern already does.
+- Prefer fixing state placement and list keys over blanket memo wrappers.
+
+## Data-fetch waterfalls
+
+- Avoid sequential awaits that could be parallel (`Promise.all`) when independent.
+- Lift shared fetches to a layout/parent when multiple children need the same data.
+- Prefer store/thunk or server fetch patterns already used in the feature’s reference slice — do not invent a second data layer.
+
+## Core Web Vitals (quick)
+
+| Metric | Implementer checks |
+|--------|--------------------|
+| LCP | Hero/media not blocked by unnecessary client JS; sensible image sizing |
+| INP | Click handlers lean; avoid long sync work on the main thread |
+| CLS | Reserve space for images/skeleton; stable fonts |
+
+## Handoff
+
+If the user asks for a **performance audit report** of a diff/deliverable, route to **`performance-auditor`** (readonly `perf-report.md`), not this skill alone.

package/presets/claude/next/skills/technical-retro/SKILL.md

@@ -29,12 +29,26 @@ Ask for missing period, focus, task slug, participants, or format constraints. I
 
 For `/task` pipelines, include router, analyst, developer, **build-verifier**, reviewer, QA/e2e, hooks, and rules.
 
+## Wrong-turn taxonomy (optional)
+
+When artifacts or the user mention agent mistakes, tag incidents:
+
+| Kind | Signal |
+|------|--------|
+| `correction` | User pushback («no», «don't», «actually») |
+| `retry` | Same tool/approach 2+ times before success |
+| `waste` | Many searches before the right file |
+| `reversal` | Edit then revert / delete |
+| `dead-end` | Env/tool failure (missing binary, wrong path) |
+
+Severity: **high** (explicit correction / large waste) · **med** · **low**. Confidence 0–100 — be honest; low-confidence items are optional.
+
 ## Preset feedback loop
 
-If the same issue appeared in 2+ tasks, add section **Preset updates**:
+If the same issue appeared in **2+** tasks (or **3+** for packaging a new rule/skill — Rule of Three), add section **Preset updates**:
 
-- Proposed change to `.claude/rules/`, `.claude/agents/`, or `.claude/skills/`
-- One concrete diff or file path to update
-- Whether it belongs in session-start rules vs `paths:` vs skill
+- Proposed change to `.claude/rules/`, `.claude/agents/`, `.claude/skills/`, or **`.claude/team/conventions.md`** (prefer conventions for project gotchas)
+- One concrete snippet or file path
+- Whether it belongs in session-start vs `paths:` vs skill vs conventions (see `PRESET-CONTRIBUTION` → Building blocks)
 
-Do not apply preset changes without user approval.
+Do not apply preset or conventions changes without user approval.

package/presets/claude/next/skills/write-adr/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: write-adr
+description: Author an Architecture Decision Record (ADR) with Context, Decision, Consequences, and Links. Use when capturing a durable technical choice for the team.
+---
+
+# Write ADR
+
+On-demand skill for durable architecture decisions. Stack-agnostic sections — fill with project-specific paths and links.
+
+## When to use
+
+- Choosing between non-trivial alternatives (storage, layering, library, API shape).
+- Recording a decision that future agents/humans should not silently reverse.
+- User asks for an ADR, decision log, or “why did we pick X”.
+
+## Template
+
+Create (or append) a short markdown ADR in the repo’s agreed location (e.g. `docs/adr/`, `.cursor/team/`, wiki). Suggested filename: `NNNN-short-title.md`.
+
+```markdown
+# ADR NNNN: <Title>
+
+## Context
+What problem / constraint / force requires a decision?
+
+## Decision
+What we chose (one clear option). Include rejected alternatives briefly if useful.
+
+## Consequences
+Positive and negative outcomes; follow-up work; what becomes harder.
+
+## Links
+Related PRs, issues, rules, prior ADRs, diagrams.
+```
+
+## Guidelines
+
+- Prefer one decision per ADR.
+- Keep Context factual; Decision imperative and short.
+- Link living gotchas to `team/conventions.md` when the decision becomes a recurring local pattern.
+- Do not put ADR bodies only in root `AGENTS.md` (overwrite on init).

package/presets/claude/next/team/conventions.md

@@ -0,0 +1,21 @@
+# Living conventions (team)
+
+Consumer-owned store for post-init gotchas, patterns, and decisions. **Not** always-on. Fill after `ai-rules init`. Root `AGENTS.md` only points here.
+
+## Gotchas
+
+<!-- e.g. fragile flows, “never do X in this repo” -->
+
+-
+
+## Patterns
+
+<!-- local patterns beyond reference-features table -->
+
+-
+
+## Decisions
+
+<!-- short pointers to ADRs / product choices that affect code -->
+
+-

package/presets/cursor/go/AGENTS.md

@@ -1,5 +1,7 @@
 # Go hexagonal stack — Cursor agent team
 
+**Repo-root agents:** see [`AGENTS.md`](../../AGENTS.md) at the project root (cross-tool setup, commands, security, living conventions pointers).
+
 | Задача | Куда смотреть |
 |--------|----------------|
 | Новая work-задача | `/task` → `commands/task.md` + `agent-team-orchestrator.mdc` |
@@ -8,6 +10,8 @@
 | После правок Go | `post-change-test.mdc` (+ `go-tooling.mdc`) |
 | Integration tests | `integration-test-*` + skill `integration-testing` |
 | Code review | skill `code-review` + `code-review-mr.mdc` |
+| ADR | skill `write-adr` (on-demand) |
+| Как работает X | agent `codebase-analyzer` (explain-as-is; без `/task`) |
 
 ## Install
 
@@ -15,6 +19,8 @@
 npx @bonesofspring/ai-rules init cursor --preset go
 ```
 
+Копирует rules/agents/hooks/skills/team + `REPO_AGENTS.md` → корневой `AGENTS.md`.
+
 ## Dogfood (5 сценариев)
 
 1. `/task` — новый use case (domain → ports → adapters → wire).

package/presets/cursor/go/README.md

@@ -10,14 +10,15 @@ npx @bonesofspring/ai-rules init cursor --preset go
 
 | Path | Содержание |
 |------|------------|
-| `AGENTS.md` | Quick-start |
+| `REPO_AGENTS.md` | → repo-root `AGENTS.md` (cross-tool) |
+| `AGENTS.md` | → `.cursor/AGENTS.md` quick-start |
 | `BUGBOT.md` | Bugbot review priorities (Go) |
 | `rules/**` | `.mdc` + README (alwaysApply ≤3) |
-| `agents/**` | **20** ролей (+ README) |
-| `skills/**` | **7** skills (в т.ч. `integration-testing`) |
+| `agents/**` | **21** ролей (+ README; includes on-demand `codebase-analyzer`) |
+| `skills/**` | **8** skills (incl. `integration-testing`, `write-adr`; no `react-performance`) |
 | `commands/**` | task, task-continue, feature-start/continue, technical-retro |
-| `hooks.json` + `hooks/**` | guard-shell + chain-team-phases |
-| `team/**` | fixtures + README |
+| `hooks.json` + `hooks/**` | guard-shell + chain-team-phases; optional `hooks/examples/` |
+| `team/**` | fixtures + `conventions.md` + README |
 | `mcp.json` + `MCP.md` | Context7 + Figma (same as ios baseline) |
 
 ## alwaysApply (≤3)