@bonesofspring/ai-rules 0.2.6 → 0.2.8

package/presets/cursor/java/rules/preset-token-budget.mdc

@@ -0,0 +1,41 @@
+---
+description: Preset authoring meta-rule (preset-token-budget)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-token-budget.md -->
+
+# Preset token budget
+
+Инварианты загрузки правил в **установленном** пресете (consumer app).
+
+## Hard caps
+
+| Platform | Always-on | Cap |
+|----------|-----------|-----|
+| Cursor | `alwaysApply: true` | **≤ 3** |
+| Claude | rules **without** `paths:` | **ровно 3** |
+
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+
+Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+
+## Meta / author rules
+
+Rules for preset authors (`preset-layering`, `preset-twin-sync`, …):
+
+- **Never** `alwaysApply: true` on consumer installs.
+- Cursor: `globs` limited to `packages/ai-rules/presets/**` (and dogfood `.cursor/**` where useful).
+- Claude: `paths:` limited to `packages/ai-rules/presets/**` (and `.claude/**` dogfood if present).
+
+## Heavy workflows
+
+Orchestrator, feature-delivery, code-review, post-change gates, domain globs — **requestable / paths**, not always-on.
+
+## Verifier
+
+build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/cursor/java/rules/preset-twin-sync.mdc

@@ -0,0 +1,44 @@
+---
+description: Preset authoring meta-rule (preset-twin-sync)
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-twin-sync.md -->
+
+# Preset twin sync
+
+Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
+
+## Matrix
+
+| Stack | Cursor SoT | Claude derive | Mapping table |
+|-------|------------|---------------|---------------|
+| `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
+| `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
+| `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+| `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
+
+## Same-PR checklist
+
+1. Edit Cursor rule first (body + frontmatter).
+2. Update Claude twin: body + `paths:` (from Cursor `globs:` / requestable triggers); drop `alwaysApply`.
+3. Update mapping table row if stem/path changed.
+4. If body embeds core (`<!-- shared-core: … -->`), sync core consumers across stacks when core changed.
+
+## Twin depth
+
+- **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
+- **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+
+## Severity (build-verifier)
+
+- **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
+- **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+- **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
+
+Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/cursor/java/rules/reference-features.mdc

@@ -0,0 +1,36 @@
+---
+description: Reference paths for Java hexagonal layout (fill after init)
+globs:
+  - src/main/java/**/*
+  - "**/configuration/**"
+  - "**/*Application.java"
+alwaysApply: false
+---
+
+<!-- shared-core: architecture/reference-features.template.md -->
+
+# Reference features (Java)
+
+Fill concrete paths after adopting this preset in a real service repo. Defaults below match layer-first single-module; adjust for feature-first / multi-module variants.
+
+| Area | Example path | Glob hint |
+|------|--------------|-----------|
+| Domain | `src/main/java/<base>/domain/` | `**/domain/**` |
+| Application / ports | `src/main/java/<base>/application/` | `**/application/**` |
+| HTTP adapter | `src/main/java/<base>/adapters/inbound/http/` | `**/adapters/inbound/http/**`, `**/adapters/http/**` |
+| Persistence | `src/main/java/<base>/adapters/outbound/persistence/` | `**/adapters/outbound/persistence/**`, `**/adapters/persistence/**` |
+| Composition root | `…/configuration/`, `*Application.java` | `**/configuration/**`, `**/*Application.java` |
+| Unit tests | `src/test/java/**/*Test.java` | `**/*Test.java`, `**/src/test/java/**` |
+| Integration | `*IT.java` / `*IntegrationTest.java` | `**/*IT.java`, `**/integration/**` |
+
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and the twin tool path if both Cursor and Claude are installed). Consumer-owned; not always-on. See root `AGENTS.md` § Living conventions.
+
+## Dogfood scenarios
+
+1. `/task` new use case — domain → ports → adapters → wire → `post-change-test`.
+2. Bug in handler mapping — debugger + MockMvc / controller unit.
+3. Repository contract — integration-test trio + Testcontainers.
+4. OpenAPI/proto drift — api-contract-reviewer.
+5. Secrets in logs — security-reviewer + `security-java`.

package/presets/cursor/java/rules/security-java.mdc

@@ -0,0 +1,31 @@
+---
+description: Security basics for Java backends (secrets, auth, PII, TLS)
+globs:
+  - "**/security/**/*"
+  - "**/auth/**/*"
+  - "**/config/**/*"
+  - "**/configuration/**/*"
+alwaysApply: false
+---
+
+
+# Security (Java)
+
+- Secrets from env / secret manager — never commit keys, tokens, or `.env` with credentials; do not log passwords or bearer tokens.
+- Validate and canonicalize untrusted input at the driving adapter edge (Bean Validation / explicit checks).
+- Prefer prepared statements / parameterized queries / JPA bind parameters in persistence adapters.
+- TLS and secure cookie/header defaults when exposing HTTP.
+- AuthN/AuthZ in filters, Spring Security config, or driving adapters; pass identity into use cases as a domain value (user ID / claims), **not** raw headers or `SecurityContext` types.
+- Minimize PII in logs; redact where needed.
+
+## Spring Security (pointer only)
+
+- When the repo uses Spring Security: keep filter chains and `SecurityFilterChain` beans in configuration / security adapters — **not** in domain.
+- Do not invent a full security architecture in this rule; follow existing `SecurityConfig` patterns and repo docs.
+- Method security (`@PreAuthorize`) belongs at application/adapter edges already using it — do not sprinkle onto domain entities.
+
+## Config
+
+- Distinguish public vs secret config fields in types (`@ConfigurationProperties` / plain records).
+- Fail closed when auth is misconfigured in production profiles.
+- Static analysis / secret scanners: run only if the repo/CI already wires them.

package/presets/cursor/java/rules/technical-retro.mdc

@@ -0,0 +1,14 @@
+---
+description: Technical retro alias — use /technical-retro command
+alwaysApply: false
+---
+
+<!-- shared-core: review/technical-retro.md -->
+
+# Техническое ретро — rule alias
+
+Полный сценарий (включая блок **«Работа агентов»** для slug из team tasks) — в slash-команде:
+
+**`commands/technical-retro.md`** → `/technical-retro`
+
+Используй rule только если command недоступен. Не дублируй содержимое command в ответе — следуй command-файлу и skill `technical-retro`.

package/presets/cursor/java/rules/tests-e2e.mdc

@@ -0,0 +1,24 @@
+---
+description: End-to-end HTTP smoke tests for Java services (optional)
+globs:
+  - "**/e2e/**/*.java"
+  - "**/*E2ETest.java"
+  - "**/*SmokeTest.java"
+alwaysApply: false
+---
+
+
+# E2E / HTTP smoke (optional)
+
+> Prefer **`tests-integration`** + `integration-test-*` for adapter contracts. E2E smoke is optional breadth — do not build a browser suite.
+
+- Black-box against a running server (`@SpringBootTest` + Testcontainers with full composition root, or localhost in CI).
+- Cover critical paths only; prefer integration + unit for breadth.
+- REST Assured / WebTestClient are optional HTTP smoke tools when already in the repo — not a mandated framework.
+- Stable test data; avoid depending on wall-clock flakiness.
+- Do **not** use browser/Playwright/XCUITest tooling in this preset.
+
+## Placement
+
+- `e2e/` package or `*E2ETest.java` / `*SmokeTest.java` under `src/test/java` if the repo separates smoke jobs.
+- Keep Failsafe/Gradle smoke tags honest — do not mark unit tests as e2e.

package/presets/cursor/java/rules/tests-integration.mdc

@@ -0,0 +1,29 @@
+---
+description: Integration / adapter contract tests for Java hexagonal services
+globs:
+  - "**/*IT.java"
+  - "**/*IntegrationTest.java"
+  - "**/integration/**"
+  - "**/src/test/java/**/*IT.java"
+alwaysApply: false
+---
+
+
+# Integration tests
+
+- Exercise driven adapters against real infra doubles (**Testcontainers**, docker compose test DB, WireMock, etc.).
+- Or exercise HTTP adapter with `MockMvc` / WebTestClient / Spring Boot **test slices** + wired use case + fake/real ports — still no full prod cluster required.
+- Use Surefire/Failsafe (or Gradle test filters) if the repo separates CI unit vs integration jobs.
+- Keep fixtures deterministic; clean up data between tests.
+- Prefer testing through the **port implementation** (save/load roundtrip) over asserting on private JPA internals.
+
+## Scope
+
+- Contract of a port implementation (repo save/load, outbound client mapping).
+- Not a substitute for domain unit tests.
+- Full `@SpringBootTest` only when slices cannot prove the contract.
+
+## Agents
+
+- Planning/generation: `integration-test-{planner,generator,healer}` + skill `integration-testing` (Phase C surface).
+- Prefer integration-test agents over inventing browser e2e for backend contracts.

package/presets/cursor/java/rules/tests-unit.mdc

@@ -0,0 +1,35 @@
+---
+description: Unit testing conventions for Java hexagonal services
+globs:
+  - "**/*Test.java"
+  - "**/*Tests.java"
+  - "**/src/test/java/**"
+alwaysApply: false
+---
+
+
+# Unit tests
+
+- Prefer **JUnit 5**; clear arrange/act/assert (or Given/When/Then).
+- Domain and application: mock/fake **ports** only — no real DB/network.
+- Prefer fakes over heavy mocking when simple; **Mockito** is optional when the repo already uses it.
+- Prefer **AssertJ** fluent assertions when already on the classpath; otherwise JUnit assertions are fine.
+- Skip integration/e2e files matching `*IT.java`, `*IntegrationTest.java`, `*E2ETest.java`, `*SmokeTest.java`, or dirs `integration/`, `e2e/` — those use other rules.
+
+## Scope
+
+- Domain factories/invariants; application use cases with port fakes; pure mappers.
+- Adapter unit tests may use `MockMvc` + mocked use case — still no live DB.
+
+## Forbidden smells
+
+- `HttpServletRequest` / `ServerHttpRequest` / Spring MVC types in **domain** tests.
+- SQL or live HTTP in use-case unit tests.
+- Brittle tests on package-private adapter internals without need.
+- Loading a full `@SpringBootTest` for a pure domain/unit case.
+- Structural smells vocabulary (Feature Envy, Message Chains, …): see requestable `design-guidance` — do not duplicate the catalog here.
+
+## Naming
+
+- `UseCaseDoXTest` / `EntityInvariantTest` (or `*Tests` if the repo already uses that suffix).
+- Match Surefire patterns the CI already uses.

package/presets/cursor/java/skills/README.md

@@ -0,0 +1,5 @@
+# Skills (preset java)
+
+8 skills: `feature-delivery`, `unit-testing`, `integration-testing`, `ci-investigation`, `debug-investigation`, `code-review`, `technical-retro`, `write-adr`.
+
+No `playwright-e2e` / `xcuitest-e2e` / `react-performance`.

package/presets/cursor/java/skills/ci-investigation/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: ci-investigation
+description: Investigates failing CI checks on PRs and branches — mvn/gradle test, compiler, lint, integration, preset-structure — with local reproduction and minimal fixes. Use when CI is red or for ci-fix pipeline tasks.
+---
+
+# CI investigation (Java)
+
+1. Identify job + log excerpt.
+2. Reproduce locally with the same commands.
+3. Minimal fix; for ai-rules preset PRs run `yarn check:preset-structure`.
+4. Do not treat Playwright/xcodebuild/`lint:js` as default Java gates.

package/presets/cursor/java/skills/code-review/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: code-review
+description: Reviews pull requests and branch diffs for Java hexagonal services using architecture, ports/adapters, networking, and testing standards. Use when the user asks for review or when code-reviewer runs.
+---
+
+# Code review (Java)
+
+1. Diff-first; load `code-review-mr.mdc` + hexagonal rules.
+2. Check layer leaks, port ownership, composition root purity, tests, security-sensitive bits.
+3. **Reuse lens:** flag new helpers that duplicate existing packages/utilities; prefer shared adapters over copy-paste.
+4. **Efficiency lens:** unnecessary allocations, N+1 I/O, sequential work that should be concurrent, hot-path bloat, missing context cancellation.
+5. Write `review.md` using the output contract below.
+
+## Output
+
+- Each finding: **`path:line`** — problem — impact — concrete fix direction.
+- Severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- End with a verdict line: **`Safe to merge | needs changes | reject`**.
+- Map agent status: Safe to merge → `completed`; needs changes / reject → `changes_requested`.
+
+Never require iOS/Next-only gates (XCUITest, Playwright, `lint:js`).
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/java/skills/debug-investigation/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: debug-investigation
+description: Investigates bugs, failing tests, and unexpected behavior in Java services with runtime evidence before applying minimal fixes. Use for bugfix tasks, debugger agent runs, or regressions.
+---
+
+# Debug investigation (Java)
+
+1. Capture failing `mvn test` / `./gradlew test` / logs / stack traces.
+2. Hypothesize layer (domain vs adapter vs wiring).
+3. Minimal fix + regression test when appropriate.
+4. Document in `debug-report.md`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/java/skills/feature-delivery/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: feature-delivery
+description: Delivers Java hexagonal backend features end-to-end across domain, application/ports, adapters, composition root, tests, and post-change-test validation. Use when implementing or extending a feature, especially through /task or feature-developer.
+---
+
+# Feature Delivery (Java hexagonal)
+
+1. Read brief, AC, and decomposition.
+2. Follow `feature-delivery-workflow.mdc` + `reference-features.mdc`: domain → application/ports → driven adapters → driving adapters → composition root → tests.
+3. Wire DI only in `configuration/` / `*Application.java`.
+4. Add unit tests for domain/use cases; integration tests for risky adapters.
+5. After Java edits: **invoke** `post-change-test.mdc` (+ `java-tooling.mdc`).
+
+## Do / Don't
+
+- **Do** keep ports owned by application; map wire types at adapters.
+- **Don't** put SQL/business rules in HTTP handlers or frameworks in domain.
+- **Don't** use Playwright, XCUITest, or yarn lint as this stack's gate.
+
+## Scope discipline
+
+Implement only the current AC / decomposition task. Clarify ambiguity before coding; do not add unrelated hardening or drive-by refactors. See `feature-developer` → **Zero improvisation**.
+
+## Handoff
+
+Summarize by layer + validation. Update `.cursor/team/tasks/<slug>/status.json`.
+
+## Design guidance
+
+- Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.

package/presets/cursor/java/skills/integration-testing/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: integration-testing
+description: Plans, generates, and heals Java integration and adapter contract tests (MockMvc, Testcontainers). Use for integration-test-* agents or adapter/e2e coverage.
+---
+
+# Integration testing (Java)
+
+1. Read `tests-integration` / `tests-e2e` rules and task brief.
+2. Prefer testing driven adapters behind ports; HTTP adapters with `MockMvc` + fakes.
+3. Use build tags / CI job split if the repo already does.
+4. Do not introduce Playwright or XCUITest.
+
+## Agents
+
+`integration-test-planner` → `integration-test-generator` → `integration-test-healer` as needed.

package/presets/cursor/java/skills/technical-retro/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: technical-retro
+description: Facilitates technical retrospectives for tasks, sprints, incidents, releases, and agent-team pipelines. Use when the user asks for retro, postmortem, process review, or action items after delivery.
+---
+
+# Technical Retro
+
+## Inputs
+
+Ask for missing period, focus, task slug, participants, or format constraints. If a slug is provided, read `.cursor/team/tasks/<slug>/` artifacts and local git status/diff. Do not invent facts not present in artifacts or the user's message.
+
+## Facilitation Principles
+
+- Focus on process and system behavior, not blame.
+- Separate facts, interpretations, and proposed actions.
+- Balance what worked with what slowed delivery.
+- Keep action items concrete, owned, and measurable.
+
+## Default Structure
+
+1. Goal and scope.
+2. Timeline or factual observations.
+3. What worked.
+4. What hurt quality, speed, or confidence.
+5. Root causes for the top one or two issues.
+6. Experiments and action items.
+
+## Agent Team Block
+
+For `/task` pipelines, include router, analyst, developer, **build-verifier** (mvn test / ./gradlew test), reviewer, QA/integration tests, hooks, and rules.
+
+## Wrong-turn taxonomy (optional)
+
+When artifacts or the user mention agent mistakes, tag incidents:
+
+| Kind | Signal |
+|------|--------|
+| `correction` | User pushback («no», «don't», «actually») |
+| `retry` | Same tool/approach 2+ times before success |
+| `waste` | Many searches before the right file |
+| `reversal` | Edit then revert / delete |
+| `dead-end` | Env/tool failure (missing binary, wrong path) |
+
+Severity: **high** (explicit correction / large waste) · **med** · **low**. Confidence 0–100 — be honest; low-confidence items are optional.
+
+## Preset feedback loop
+
+If the same issue appeared in **2+** tasks (or **3+** for packaging a new rule/skill — Rule of Three), add section **Preset updates**:
+
+- Proposed change to `.cursor/rules/`, `.cursor/agents/`, `.cursor/skills/`, or **`.cursor/team/conventions.md`** (prefer conventions for project gotchas)
+- One concrete snippet or file path
+- Whether it belongs in always-on vs globs vs skill vs conventions (see `PRESET-CONTRIBUTION` → Building blocks)
+
+Do not apply preset or conventions changes without user approval.

package/presets/cursor/java/skills/unit-testing/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: unit-testing
+description: Plans, generates, and heals parameterized JUnit unit tests for domain, use cases, and mappers using *Test.java and tests-unit rules. Use for unit-test planning, generation, or healing.
+---
+
+# Unit testing (Java)
+
+1. Prefer JUnit 5 `@ParameterizedTest` (and AssertJ assertions) beside code under test (`*Test.java`).
+2. Fake outbound ports for use cases with Mockito; no real DB/network.
+3. Follow `tests-unit.mdc`; heal with `unit-test-healer` when red.
+
+## Agents
+
+`unit-test-planner` → `unit-test-generator` → `unit-test-healer`.

package/presets/cursor/java/skills/write-adr/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: write-adr
+description: Author an Architecture Decision Record (ADR) with Context, Decision, Consequences, and Links. Use when capturing a durable technical choice for the team.
+---
+
+# Write ADR
+
+On-demand skill for durable architecture decisions. Stack-agnostic sections — fill with project-specific paths and links.
+
+## When to use
+
+- Choosing between non-trivial alternatives (storage, layering, library, API shape).
+- Recording a decision that future agents/humans should not silently reverse.
+- User asks for an ADR, decision log, or “why did we pick X”.
+
+## Template
+
+Create (or append) a short markdown ADR in the repo’s agreed location (e.g. `docs/adr/`, `.cursor/team/`, wiki). Suggested filename: `NNNN-short-title.md`.
+
+```markdown
+# ADR NNNN: <Title>
+
+## Context
+What problem / constraint / force requires a decision?
+
+## Decision
+What we chose (one clear option). Include rejected alternatives briefly if useful.
+
+## Consequences
+Positive and negative outcomes; follow-up work; what becomes harder.
+
+## Links
+Related PRs, issues, rules, prior ADRs, diagrams.
+```
+
+## Guidelines
+
+- Prefer one decision per ADR.
+- Keep Context factual; Decision imperative and short.
+- Link living gotchas to `team/conventions.md` when the decision becomes a recurring local pattern.
+- Do not put ADR bodies only in root `AGENTS.md` (overwrite on init).

package/presets/cursor/java/team/README.md

@@ -0,0 +1,31 @@
+# Agent team artifacts (preset java)
+
+Каталог артефактов пайплайна «команда агентов» для Java backend (hexagonal / ports & adapters).
+
+## Layout
+
+```
+.cursor/team/   # Claude: .claude/team/
+  active-task.json
+  fixtures/
+  tasks/<slug>/
+    pipeline.json
+    status.json
+    brief.md
+    decomposition.md
+    …
+```
+
+## Fixtures
+
+| Fixture | Notes |
+|---------|-------|
+| `feature-full.json` | Full profile; QA scope `e2e-only` = **adapter/integration tests** (not UI e2e); Playwright/XCUITest stems in `skipped` |
+| `feature-light.json` | developer → build-verifier (`mvn test` / `./gradlew test` / configured static analysis) |
+| `bugfix-standard.json` | debugger → developer (skipIf) → verifier → reviewer |
+
+**Never** schedule Playwright/XCUITest-only steps for this preset. Use `integration-test-*` (or QA with `e2e-only` = integration) for adapter-level coverage.
+
+## Creating task dirs
+
+Bootstrap `tasks/<slug>/` by **writing** artifacts (Write tool), not Shell `mkdir`. Cursor sandbox → `Operation not permitted` otherwise (worse on Desktop/Documents).

package/presets/cursor/java/team/conventions.md

@@ -0,0 +1,21 @@
+# Living conventions (team)
+
+Consumer-owned store for post-init gotchas, patterns, and decisions. **Not** always-on. Fill after `ai-rules init`. Root `AGENTS.md` only points here.
+
+## Gotchas
+
+<!-- e.g. fragile flows, “never do X in this repo” -->
+
+-
+
+## Patterns
+
+<!-- local patterns beyond reference-features table -->
+
+-
+
+## Decisions
+
+<!-- short pointers to ADRs / product choices that affect code -->
+
+-

package/presets/cursor/java/team/fixtures/bugfix-standard.json

@@ -0,0 +1,37 @@
+{
+  "slug": "example-bugfix-standard",
+  "intent": "bugfix",
+  "profile": "standard",
+  "summary": "Regression fix with review",
+  "steps": [
+    {
+      "agent": "debugger",
+      "label": "Root cause"
+    },
+    {
+      "agent": "feature-developer",
+      "label": "Fix if needed",
+      "skipIf": "debugger.fixed"
+    },
+    {
+      "agent": "build-verifier",
+      "label": "mvn test / ./gradlew test / static analysis"
+    },
+    {
+      "agent": "code-reviewer",
+      "label": "Code review"
+    }
+  ],
+  "humanGates": [],
+  "autoChain": true,
+  "skipped": [
+    {
+      "agent": "playwright-test-planner",
+      "reason": "Java backend uses integration-test-* — not in this bugfix path"
+    },
+    {
+      "agent": "xcuitest-test-planner",
+      "reason": "Java backend uses integration-test-* — not in this bugfix path"
+    }
+  ]
+}

package/presets/cursor/java/team/fixtures/feature-full.json

@@ -0,0 +1,25 @@
+{
+  "slug": "example-feature-full",
+  "intent": "feature",
+  "profile": "full",
+  "summary": "Multi-layer Java use case with integration-test coverage",
+  "steps": [
+    { "agent": "task-analyst", "label": "Clarify and decompose" },
+    { "agent": "solution-architect", "label": "Design boundaries", "model": "strong" },
+    { "agent": "feature-developer", "label": "Implement + unit tests", "scope": "unit-in-dev" },
+    { "agent": "build-verifier", "label": "mvn test / ./gradlew test / static analysis", "model": "cheap" },
+    { "agent": "security-reviewer", "label": "Security review", "model": "strong" },
+    { "agent": "code-reviewer", "label": "Code review", "model": "cheap" },
+    { "agent": "qa-tester", "label": "Integration tests", "scope": "e2e-only" },
+    { "agent": "integration-test-planner", "label": "Plan integration coverage" },
+    { "agent": "integration-test-generator", "label": "Generate integration tests" }
+  ],
+  "humanGates": ["after:task-analyst"],
+  "autoChain": true,
+  "skipped": [
+    {
+      "agent": "accessibility-reviewer",
+      "reason": "Java backend has no UI surface"
+    }
+  ]
+}

package/presets/cursor/java/team/fixtures/feature-light.json

@@ -0,0 +1,17 @@
+{
+  "slug": "example-feature-light",
+  "intent": "feature",
+  "profile": "light",
+  "summary": "Trivial single-package change with explicit AC",
+  "steps": [
+    { "agent": "feature-developer", "label": "Implement", "model": "cheap" },
+    { "agent": "build-verifier", "label": "mvn test / ./gradlew test / static analysis", "model": "cheap" }
+  ],
+  "humanGates": [],
+  "autoChain": true,
+  "skipped": [
+    { "agent": "task-analyst", "reason": "Explicit AC and single-package scope" },
+    { "agent": "code-reviewer", "reason": "Light profile — non-trivial module/service changes should use standard" },
+    { "agent": "qa-tester", "reason": "No integration-test AC" }
+  ]
+}

package/presets/cursor/next/AGENTS.md

@@ -2,6 +2,8 @@
 
 Краткая точка входа для Cursor. Подробные правила — `.cursor/rules/*.mdc`; сценарии — `.cursor/skills/**`.
 
+**Repo-root agents:** see [`AGENTS.md`](../../AGENTS.md) at the project root (cross-tool setup, commands, security, living conventions pointers).
+
 See `.cursor/rules/README.md` for the full catalog and loading strategy.
 
 ## Quick start
@@ -14,6 +16,7 @@ See `.cursor/rules/README.md` for the full catalog and loading strategy.
 | Эталонные фичи | `reference-features.mdc` (заполнить пути в репо) |
 | После правок кода | `post-change-lint.mdc` (**requestable**, но обязателен после edits; полный gate — `build-verifier`) |
 | Code review MR | skill `code-review` + `code-review-mr.mdc` |
+| Security (auth/forms/env) | `security-next.mdc` + agent `security-reviewer` |
 | Валидация перед review | agent `build-verifier` |
 | Техническое ретро | `/technical-retro` + skill `technical-retro` |
 
@@ -21,7 +24,7 @@ See `.cursor/rules/README.md` for the full catalog and loading strategy.
 
 - Реализация, багфикс, миграция, тесты, ревью MR, CI-fix — **предпочтительно через `/task`**.
 - Простой one-liner без архитектурного риска — можно без pipeline, если пользователь явно просит.
-- Вопросы «как работает X» — ответ без `/task`.
+- Вопросы «как работает X» — agent `codebase-analyzer` (explain-as-is) или ответ без `/task`.
 
 ## Pipeline routing
 
@@ -33,4 +36,4 @@ Intent detection, profiles (`full` / `standard` / `light`), and default steps
 npx @bonesofspring/ai-rules init cursor --preset next
 ```
 
-Копирует rules, commands, agents, hooks, skills, team, `hooks.json`, `BUGBOT.md`, `AGENTS.md`, `MCP.md`, `mcp.json` → `.cursor/mcp.json`.
+Копирует rules, commands, agents, hooks, skills, team, `hooks.json`, `BUGBOT.md`, `AGENTS.md` → `.cursor/AGENTS.md`, `MCP.md`, `mcp.json` → `.cursor/mcp.json`, плюс `REPO_AGENTS.md` → корневой `AGENTS.md`. Skills: `write-adr`, `react-performance` (on-demand).