@bonesofspring/ai-rules 0.2.6 → 0.2.8

package/presets/cursor/next/README.md

@@ -12,14 +12,15 @@ npx @bonesofspring/ai-rules init cursor --preset next
 
 | Path | Содержание |
 |------|------------|
-| `AGENTS.md` | Quick-start |
+| `REPO_AGENTS.md` | → repo-root `AGENTS.md` (cross-tool) |
+| `AGENTS.md` | → `.cursor/AGENTS.md` quick-start |
 | `BUGBOT.md` | Cursor Bugbot review priorities (Next) |
-| `rules/**` | `.mdc` + README (alwaysApply ≤3) |
-| `agents/**` | **21** ролей (+ README) |
-| `skills/**` | 7 skills (в т.ч. `playwright-e2e`) |
+| `rules/**` | `.mdc` + README (alwaysApply ≤3); golden rules with Incorrect/Correct + `impact:` |
+| `agents/**` | **22** ролей (+ README; includes on-demand `codebase-analyzer`) |
+| `skills/**` | 9 skills (incl. `playwright-e2e`, `write-adr`, `react-performance`) |
 | `commands/**` | task, task-continue, feature-start/continue, technical-retro |
-| `hooks.json` + `hooks/**` | guard-shell + chain-team-phases |
-| `team/**` | fixtures + README |
+| `hooks.json` + `hooks/**` | guard-shell + chain-team-phases; optional `hooks/examples/` cookbook |
+| `team/**` | fixtures + `conventions.md` + README |
 | `mcp.json` + `MCP.md` | Context7 + Figma MCP → `.cursor/mcp.json` |
 
 ## alwaysApply (≤3)

package/presets/cursor/next/REPO_AGENTS.md

@@ -0,0 +1,48 @@
+# Next.js — agent instructions
+
+Cross-tool repo-root guide. Tool-specific maps stay under `.cursor/AGENTS.md` and `.claude/CLAUDE.md`.
+
+## Cross-tool setup
+
+- Treat this file as the **shared** entry for any agent (Cursor, Claude Code, or other).
+- Tool maps (agent-team tables, slash commands) live in `.cursor/AGENTS.md` / `.claude/CLAUDE.md` — use them when that tool is installed.
+- Install:
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset next
+npx @bonesofspring/ai-rules init claude --preset next
+```
+
+`init` overwrites this file from the preset (`REPO_AGENTS.md` → `AGENTS.md`). Living gotchas belong in `team/conventions.md`, not here.
+
+## Commands (test / lint / build)
+
+Working directory for app scripts: **`app/`**. Detect the package manager from lockfile / `packageManager` (`package-manager` rule).
+
+| Gate | Typical command |
+|------|-----------------|
+| Lint JS | `yarn lint:js` (or project equivalent) from `app/` |
+| Lint CSS | `yarn lint:css` from `app/` |
+| Unit tests | project unit script under `app/` |
+| Build | project `build` under `app/` |
+
+After code edits: invoke **`post-change-lint`** (requestable). Full gate: agent `build-verifier`.
+
+## Security basics
+
+- Do not commit secrets (`.env`, tokens, credentials).
+- Review destructive git (`reset --hard`, force-push) before running; respect shell hooks.
+- Do not weaken CI or skip hooks unless the user explicitly asks.
+
+## Tool entry points
+
+| Tool | Map |
+|------|-----|
+| Cursor | `.cursor/AGENTS.md` (optional if Cursor not installed) |
+| Claude Code | `.claude/CLAUDE.md` (optional if Claude not installed) |
+
+Rules: `.cursor/rules/` or `.claude/rules/`. Skills: `.cursor/skills/` or `.claude/skills/`.
+
+## Living conventions
+
+Gotchas, local patterns, and team decisions: **`.cursor/team/conventions.md`** and/or **`.claude/team/conventions.md`** (fill after init; not overwritten on every dogfood sync when already present).

package/presets/cursor/next/agents/README.md

@@ -12,6 +12,12 @@
 | Migration planner | `migration-specialist.md` | no |
 | API contract reviewer | `api-contract-reviewer.md` | no |
 
+## Analysis (on-demand)
+
+| Agent | Файл | Production-код |
+|-------|------|----------------|
+| Codebase analyzer | `codebase-analyzer.md` | no (explain-as-is only) |
+
 ## Implementation and CI
 
 | Agent | Файл | Production-код |
@@ -62,7 +68,7 @@ SoT по умолчанию — YAML `model` в каждом agent-файле.
 
 | Tier | Default frontmatter | Agents |
 |------|---------------------|--------|
-| **cheap** | `fast` | `task-router`, `task-analyst`, `build-verifier`, `code-reviewer`, `tech-writer` |
+| **cheap** | `fast` | `task-router`, `task-analyst`, `build-verifier`, `code-reviewer`, `tech-writer`, `codebase-analyzer` |
 | **standard** | `inherit` | `feature-developer`, `debugger`, `ci-investigator`, `api-contract-reviewer`, `accessibility-reviewer`, `qa-tester`, `unit-test-*`, `playwright-test-*` |
 | **strong** | `claude-opus-4-8[effort=high]` | `solution-architect`, `migration-specialist`, `security-reviewer`, `performance-auditor` |
 

package/presets/cursor/next/agents/build-verifier.md

@@ -36,11 +36,16 @@ When validating **preset packaging** changes (paths under `packages/ai-rules/pre
 2. **Leakage (next):** hooks/agents must not require `xcuitest-test-*` handoffs or `xcodebuild` as the default Next post-change gate. See `preset-no-cross-stack-leakage.mdc`.
 3. **Mapping / README:** `claude/next/rules/README.md` must include a Cursor→Claude mapping table; stack `rules/README.md` should document core→stack mapping when `_shared` consumers exist.
 4. **shared-core consumers:** if `_shared/core/**` changed, every file with matching `<!-- shared-core: … -->` in this PR must be updated (or intentional fork documented in validation-report).
-5. **Twin presence:** Cursor rule change without Claude twin same PR → **FAIL** (next, ios-swift, and go). Domain twin body ≥15 lines; thin aliases (`agent-team-intake`, `technical-retro`) may be shorter.
+5. **Twin presence:** Cursor rule change without Claude twin same PR → **FAIL** (next, ios-swift, go, and java). Domain twin body ≥15 lines; thin aliases (`agent-team-intake`, `technical-retro`) may be shorter.
 6. **Session-start body budget (soft→document, FAIL if grossly over):** sum body lines of the **3** intended always-on / session-start rules ≤ **120** (stretch ≤100); do **not** include `**/README.md`. Record the sum in validation-report.
-7. **Embed drift (soft by default):** run `packages/ai-rules/scripts/check-shared-core-drift.sh`. Document DRIFT; set `AI_RULES_DRIFT_FAIL=1` only when enforcing. Lineage stems are excluded from body equality.
+7. **Embed drift (hard in `check:preset-structure`):** run `packages/ai-rules/scripts/check-shared-core-drift.sh` with `AI_RULES_DRIFT_FAIL=1` (bundled by the structure orchestrator). Lineage stems are excluded from body equality.
 8. **Dogfood (monorepo soft):** if root `.cursor/` is in the PR, prefer sync via `packages/ai-rules/scripts/sync-dogfood-cursor.sh`; mass deletion of tracked dogfood without migration doc → note as risk / FAIL for maintainers.
 
+9. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go|java`) must ship `REPO_AGENTS.md` when validating preset packaging → **FAIL** if missing.
+10. **Hooks cookbook:** default `hooks.json` must **not** reference `hooks/examples/` → **FAIL** if it does.
+11. **No react-performance on ios/go/java:** skill directory / required handoff must be absent under ios-swift, go, and java → **FAIL** (leakage). Prefer `check:preset-leakage`.
+12. **Rule eval (WARN):** `scripts/check-rule-eval.mjs` / `yarn check:rule-eval` should exist for maintainers; smoke optional. Hard fail only when the opt-in eval job runs — not part of default `check:preset-structure`.
+
 ### Soft notes
 
 - Thin aliases may be &lt;15 body lines.

package/presets/cursor/next/agents/codebase-analyzer.md

@@ -0,0 +1,28 @@
+---
+name: codebase-analyzer
+description: Explains HOW existing code works as-is. Use when the user asks how something works, to trace data flow, or document architecture — without suggesting changes. Prefer over /task for pure questions.
+readonly: false
+model: fast
+---
+
+You are a specialist at understanding HOW this Next.js codebase works. Document implementation details with precise `path:line` references.
+
+## CRITICAL — explain as-is only
+
+- DO NOT suggest improvements, refactors, or "better approaches" unless the user explicitly asks.
+- DO NOT perform root-cause analysis or bug hunts unless asked.
+- DO NOT critique quality, performance, or security unless asked.
+- ONLY describe what exists, how it works, and how components interact.
+
+## Workflow
+
+1. Start from entry points the user named (routes, public barrels `@/api` / `@/types`, feature folders).
+2. Trace calls and data flow across UI → store → API → HTTP as applicable; read each file involved.
+3. Summarize: purpose, flow, contracts between modules, layer placement, conventions observed.
+4. End with open questions only if facts are missing — not with a wishlist of changes.
+
+## Will / Will not
+
+**Will:** map files, call chains, types/mappers, layer boundaries as they exist today.
+
+**Will not:** edit production code; open `/task` pipelines; propose PRs or refactors unprompted.

package/presets/cursor/next/agents/feature-developer.md

@@ -21,6 +21,19 @@ You are a senior frontend developer working in a Next.js monorepo with strict la
 - Mark completed tasks in `decomposition.md`.
 - Validation: **`post-change-lint.mdc`**. If pipeline next step is **`build-verifier`**, scoped lint/type-check on **changed files** is enough; full project lint is build-verifier's job.
 
+## Zero improvisation
+
+- Implement **only** what the brief / AC / current decomposition task require.
+- If requirements are ambiguous, conflicting, or multi-way — **ask** before coding; do not guess extras as "best practices".
+- Forbidden without explicit AC/task: unrelated security hardening, extra validation, UI polish, logging/monitoring, drive-by refactors, new config/env.
+- Boy scout / `design-guidance` improvements stay **within** touched files and must not expand task scope.
+
+## Will / Will not
+
+**Will:** follow layer order and reference features; add required unit tests; run the post-change gate; update task artifacts.
+
+**Will not:** formal code review; start blocked/dependent tasks; invent AC; auto-continue the next WP when the pipeline expects a human gate or handoff.
+
 ## On completion
 
 Update `status.json` (`currentAgent`: `feature-developer`, `state`: `completed`). Handoff: tasks done, files by layer, unit specs, validation result, gaps for build-verifier/reviewer.

package/presets/cursor/next/agents/security-reviewer.md

@@ -15,9 +15,11 @@ You are a frontend security reviewer for a Next.js TypeScript application.
 
 ## Review scope
 
-- Secrets, tokens, API keys in source or committed env files.
+Load `security-next.mdc` for coding-time invariants. Focus on:
+
+- Secrets, tokens, API keys in source or committed env files; never in `NEXT_PUBLIC_*`.
 - `dangerouslySetInnerHTML`, unsanitized HTML, URL injection.
-- Auth token storage (cookies vs localStorage), refresh flows, 401 handling.
+- Auth token storage (cookies vs localStorage), server-side session verify, refresh flows, 401 handling.
 - CSRF considerations for state-changing requests (as applicable to frontend).
 - Open redirects in navigation/router usage.
 - Sensitive data in client-side logs or error messages.

package/presets/cursor/next/commands/README.md

@@ -42,7 +42,7 @@ Slash-команды копируются в `.cursor/commands/` при `ai-rule
 
 ## Связанные файлы
 
-- Subagents: `../agents/` (**21** ролей, включая `task-router.md`)
+- Subagents: `../agents/` (**22** ролей, включая `task-router.md`, `codebase-analyzer.md`)
 - Оркестратор: `../rules/agent-team-orchestrator.mdc`
 - Skills: `../skills/` (`feature-delivery`, `code-review`, `debug-investigation`, `ci-investigation`, `unit-testing`, `playwright-e2e`, `technical-retro`)
 - Артефакты: `../team/README.md` (`pipeline.json`, `status.json`)

package/presets/cursor/next/hooks/README.md

@@ -6,3 +6,7 @@
 | `guard-shell-command.sh` | Blocks/asks on destructive git commands and package-manager mismatches (`failClosed: true`) |
 
 `hooks.json`: `loop_limit: 15` for long pipelines (build-verifier + parallel reviewers + e2e).
+
+## Optional cookbook
+
+See `hooks/examples/README.md` — secret-guard / format-edited / test-on-save. **Not** in default `hooks.json`.

package/presets/cursor/next/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **next** — recipes must stay stack-safe (no cross-stack lint/test commands).

package/presets/cursor/next/hooks/examples/format-edited.example.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Optional: format/lint edited JS/TS under app/ after save.
+# NOT in default hooks.json. Requires yarn scripts in app/.
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT/app" 2>/dev/null || cd "$ROOT"
+# Prefer project scripts; adjust names to match package.json
+if command -v yarn >/dev/null 2>&1; then
+  yarn lint:js --fix 2>/dev/null || yarn eslint --fix . 2>/dev/null || true
+fi
+exit 0

package/presets/cursor/next/hooks/examples/secret-guard.example.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Optional cookbook: block committing likely secrets in staged diffs.
+# NOT wired in default hooks.json — copy to hooks/ and register manually.
+set -euo pipefail
+PATTERN='(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----|api[_-]?key\s*[:=]\s*['\''\"][^'\''\"]{12,})'
+if git diff --cached -U0 2>/dev/null | grep -Eiq "$PATTERN"; then
+  echo "secret-guard: possible secret in staged diff — review before commit" >&2
+  exit 1
+fi
+exit 0

package/presets/cursor/next/hooks/examples/test-on-save.example.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Optional: scoped unit tests for changed files under app/src.
+# NOT in default hooks.json. No Playwright here.
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT/app" 2>/dev/null || exit 0
+yarn test --findRelatedTests --passWithNoTests 2>/dev/null || yarn test --passWithNoTests 2>/dev/null || true
+exit 0

package/presets/cursor/next/rules/README.md

@@ -21,7 +21,7 @@
 
 - **`alwaysApply: true`** (Cursor) / **без `paths:`** (Claude) — только базовые инварианты (**3**):
   - `next-app-core`, `package-manager`, `code-quality-and-refactoring`
-- **On-demand / requestable** — `post-change-lint` (**обязателен после правок кода**, не always-on), `agent-team-intake` (через orchestrator/commands), `agent-team-orchestrator`, architecture, imports, UI, tests, feature-delivery-workflow, `design-guidance`, reference-features, next-app-router, react-a11y-coding, `technical-retro`
+- **On-demand / requestable** — `post-change-lint` (**обязателен после правок кода**, не always-on), `agent-team-intake` (через orchestrator/commands), `agent-team-orchestrator`, architecture, imports, UI, tests, feature-delivery-workflow, `design-guidance`, reference-features, next-app-router, `security-next`, react-a11y-coding, `technical-retro`
 - **Preset author meta** (globs `packages/ai-rules/presets/**`, never alwaysApply): `preset-layering`, `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`
 - **Skills** — длинные процедуры (`feature-delivery`, `code-review`, …)
 
@@ -69,7 +69,8 @@ Claude twins + Cursor→Claude map: `presets/claude/next/rules/README.md`.
 | Файл | Назначение |
 |------|------------|
 | `reference-features.mdc` | Эталонные пути UI/store/API/types/tests |
-| `next-app-router.mdc` | App Router, RSC, loading/error |
+| `next-app-router.mdc` | App Router, RSC, loading/error, anti-hallucination banlist |
+| `security-next.mdc` | Secrets, auth, XSS, Server Actions (coding-time) |
 | `react-a11y-coding.mdc` | A11y при написании UI |
 | `feature-delivery-workflow.mdc` | Сквозной чеклист (on-demand, не always-on) |
 | `agent-team-intake.mdc` | Подсказка `/task` при work-запросе (on-demand, через orchestrator) |
@@ -89,7 +90,7 @@ Claude twins + Cursor→Claude map: `presets/claude/next/rules/README.md`.
 | `layer-barrel-exports.mdc` | Двухуровневые barrel для слоёв с public API (`@/api`, `@/types`, `@/core`, …) |
 | `types-jsdoc.mdc` | JSDoc для типов в `app/src/types` (русский текст, `[computed]`, без `@param`/`@returns`) |
 | `no-type-assertion-as-import-export.mdc` | Ограничение `as`, в т.ч. `instanceof` для ошибок транспорта в `catch` |
-| `code-review-mr.mdc` | Чеклист ревью MR, в т.ч. HTTP‑клиент и тесты |
+| `code-review-mr.mdc` | Чеклист ревью MR + output contract (`path:line`, severity, verdict) |
 | `tests-unit.mdc` | Unit‑тесты и behavior‑тесты HTTP‑клиента |
 | `playwright-agents.mdc`, `tests-e2e-structure.mdc` | E2E |
 | `react-ui.mdc` | React/Next UI: структура компонентов, соседние `ComponentName.data.ts` / `.utils.ts`, стили, пропсы |

package/presets/cursor/next/rules/agent-team-intake.mdc

@@ -11,6 +11,6 @@ When the user message looks like a **work request** (implement, add, fix, refact
 
 1. Prefer **`/task <their request>`** or invoke **task-router** first.
 2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
-3. Pure questions («как работает X», «объясни») — answer normally, no `/task`.
+3. Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
 
 Exceptions: user explicitly says «без pipeline», «просто сделай», or continues an active slug.

package/presets/cursor/next/rules/agent-team-orchestrator.mdc

@@ -151,7 +151,7 @@ If `pipeline.json` is missing (old `/feature-start` tasks), fall back to fixed p
 
 Do **not** run `/task` + router for:
 
-- Pure questions («как работает X», «объясни»).
+- Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** for deep traces; inline OK for trivial one-liners.
 - Typo / one-file fix / trivial config with no architecture risk.
 - User explicitly says «без pipeline», «просто сделай», or continues an active slug.
 - Single-line `docs-only` with no code impact.

package/presets/cursor/next/rules/api-services.mdc

@@ -2,6 +2,7 @@
 description: Конвенции API сервисов и мапперов
 globs: app/src/api/services/**/*.ts
 alwaysApply: false
+impact: HIGH
 ---
 
 # Роль API слоя
@@ -55,4 +56,24 @@ alwaysApply: false
   - компоненты не должны зависеть от DTO;
   - store не должен сам собирать URL/коды эндпоинтов и не обходить сервисы; **транспортный тип ответа** и **контракт ошибки** из `@/types` (как у прикладного клиента) допустимы во thunk при разборе `catch`/payload, если так выстроен сервис (см. `store-rtk.mdc`, `http-client.mdc`).
 - При использовании API‑сервисов в UI, store и утилитах **вне** `app/src/api/**` импортировать **только** из `@/api` (корневой barrel), см. **`public-imports.mdc`**; внутри слоя API — по относительным путям или `@/api/services/**` / `@/api/clients/**`, не дублируя публичный контракт мимо корневого barrel для внешних потребителей.
+## Incorrect
 
+```ts
+// Returning raw DTO to store/UI without mapping
+export const getCard = async (id: string) => {
+  const { data } = await cardsClient.get(`/cards/${id}`)
+  return data // backend DTO leaked upward
+}
+```
+
+## Correct
+
+```ts
+import type { TCard } from '@/types'
+import { mapCardResponse } from './cardResponseMappers'
+
+export const getCard = async (id: string): Promise<TCard> => {
+  const { data } = await cardsClient.get(`/cards/${id}`)
+  return mapCardResponse(data)
+}
+```

package/presets/cursor/next/rules/architecture-boundaries.mdc

@@ -2,6 +2,7 @@
 description: Архитектурные границы и правила импортов
 globs: app/src/api/**/*,app/src/store/**/*,app/src/types/**/*,app/src/lib/**/*
 alwaysApply: false
+impact: CRITICAL
 ---
 
 # Границы между слоями
@@ -63,4 +64,30 @@ alwaysApply: false
 - Разместить файлы в **соответствующих слоях**.
 - Проверить существующие фичи с аналогичной структурой и **повторить их организацию**.
 - Не "коротить" слои (например, не вызывать API прямо из компонента только ради упрощения).
+## Incorrect
 
+```ts
+// UI calling HTTP client / deep service path directly
+import { httpClient } from '@/lib/clients/HttpClient'
+import { fetchOrders } from '@/api/services/OrdersApi/orders.service'
+
+export const OrdersPage = () => {
+  // bypasses store and @/api barrel
+  void httpClient.get('/orders')
+  return null
+}
+```
+
+## Correct
+
+```ts
+import { useAppDispatch } from '@/store'
+import { loadOrders } from '@/store/slices/Orders'
+
+export const OrdersPage = () => {
+  const dispatch = useAppDispatch()
+  // UI → store → services from @/api (inside thunk)
+  void dispatch(loadOrders())
+  return null
+}
+```

package/presets/cursor/next/rules/arrow-functions.mdc

@@ -2,45 +2,30 @@
 description: Предпочитать стрелочные функции при написании кода
 globs: app/src/**/*.{ts,tsx,js,jsx}
 alwaysApply: false
+impact: LOW
 ---
-
 # Стрелочные функции
 
-При разработке **использовать стрелочный синтаксис** для функций, где это допустимо в TypeScript/JavaScript.
-
-## Что делать
+Предпочитать стрелочный синтаксис для нового кода в `app/src/**`, где это допустимо в TypeScript/JavaScript.
 
-- Объявлять функции как **`const имя = (...) => { ... }`** вместо **`function имя(...) { ... }`**, если не нужны особенности объявления `function`.
-- Колбэки и обработчики — стрелочные функции: `.map((x) => ...)`, `onClick={() => ...}`.
-- React-компоненты и хуки — как стрелочные функции с явной типизацией пропсов/возврата по принятому в проекте стилю.
+**Style enforcement:** детальные pref — в ESLint (`app/eslint.config.mjs`) и Stylelint; после правок — **`post-change-lint`**. Это правило — краткий intent, не дублировать линтер.
 
-## Исключения (допустимо не стрелка)
+## Исключения
 
-- **Генераторы** (`function*`) — стрелкой не выразить.
-- **Методы класса** — если в коде используются классы, допустимы обычные методы (`method() {}`), а не стрелки в теле класса (из‑за `this`).
-- Когда осознанно нужны **подъём (hoisting)** или **имя функции в стеке** только у `function` — редкие случаи; иначе предпочитать стрелку.
+- Генераторы (`function*`)
+- Методы класса, где нужен `this` прототипа
+- Редкие случаи hoisting / именованного `function` в стеке
 
-## Примеры
+## Incorrect
 
-```typescript
-// ❌ Избегать для нового кода
+```ts
 function formatLabel(id: string): string {
   return id.toUpperCase()
 }
-
-// ✅ Предпочтительно
-const formatLabel = (id: string): string => {
-  return id.toUpperCase()
-}
 ```
 
-```tsx
-// ✅ Предпочтительно
-const UserCard = ({ name }: { name: string }) => {
-  return <span>{name}</span>
-}
-```
+## Correct
 
-## Требование к агенту
-
-При генерации и правке кода **по умолчанию выбирать стрелочные функции**; отступать к `function` только в случаях из раздела исключений.
+```ts
+const formatLabel = (id: string): string => id.toUpperCase()
+```

package/presets/cursor/next/rules/code-quality-and-refactoring.mdc

@@ -62,11 +62,21 @@ alwaysApply: true
 - **Boy scout rule:** оставлять модуль немного лучше, чем до изменения (простые, безопасные улучшения).
 - Не жертвовать архитектурой и слоями ради краткости реализации.
 
-> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
+## Agent discipline (anti-sycophancy)
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent) and surface uncertainty; never invent signatures.
+- Before «is this correct?» — list ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose a characterization test first; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential «added for issue Y» comments.
+- Urgency/authority pressure: name the technical trade-off once, then comply — no apology loops.
+- Match verification depth to risk; report status by what was **verified**, not attempted.
 
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**; do not invent a parallel style bible in this core body.
+
+> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
 ## Stack notes
 
 - Перед новым UI‑контролом проверять существующий UI‑код и пакеты проекта.
 - Public API: index/barrel‑файлы и явно экспортируемые сущности (`public-imports.mdc`, `layer-barrel-exports.mdc`).
 - Допустимые примеры: общий хук/утилита; типизация `any`/`unknown`; разделение крупного компонента; CSS‑токены вместо «магических» значений.
-- Lint/stylelint — только **`post-change-lint.mdc`**; ESLint config: `app/eslint.config.mjs`. Отключение правила (`eslint-disable`) — только **точечно** (строка/небольшой блок) с кратким комментарием «зачем».
+- Lint/stylelint — только **`post-change-lint.mdc`**; ESLint config: `app/eslint.config.mjs`. Отключение правила (`eslint-disable`) — только **точечно** (строка/небольшой блок) с кратким комментарием «зачем». Style prose in domain rules stays thin — prefer ESLint/Stylelint over duplicating formatter recipes.

package/presets/cursor/next/rules/code-review-mr.mdc

@@ -35,26 +35,24 @@ Concrete rule stems — in **Stack notes**.
 - Boy scout rule: suggest fixes feasible within the MR scope.
 - No «большие рефакторинги» without an explicit request (`code-quality-and-refactoring`).
 
+## Output contract
+
+Procedure details live in skill `code-review`. Required shape:
+
+- Each finding cites **`path:line`**, the problem, impact, and a concrete fix direction.
+- Rank by severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding file context.
+- End with a verdict on its own line: **`Safe to merge | needs changes | reject`**.
+
 ## Stack notes
 
 On-demand rule for review flows. **Procedure and output format:** skill `code-review`.
 
-## Checklist references
+### Checklist references
 
 - Architecture layers: `architecture-boundaries.mdc`, `next-app-core.mdc`; network: `http-client.mdc`
 - Imports: `public-imports.mdc`, `layer-barrel-exports.mdc`
 - UI: `react-ui.mdc`
+- Security: `security-next.mdc`
 - Tests: `tests-unit.mdc`, `playwright-agents.mdc`, `tests-e2e-structure.mdc`
 - Lint gate before final report: `post-change-lint.mdc`
-
-## When to load
-
-- User asks for review/MR/diff
-- Pipeline step `code-reviewer`
-- BUGBOT automated review
-
-## Constraints
-
-- Focus on MR diff, not the whole repo.
-- Use local `git diff` — do not invent hosting metadata.
-- Boy scout rule: suggest fixes feasible within the MR scope.

package/presets/cursor/next/rules/http-client.mdc

@@ -4,6 +4,7 @@ globs:
   - app/src/lib/clients/HttpClient/**/*.ts
   - app/src/api/clients/**/*.ts
 alwaysApply: false
+impact: HIGH
 ---
 
 # HTTP-транспорт
@@ -40,3 +41,23 @@ alwaysApply: false
 
 - Меняя реализацию общего клиента — **обновить или добавить behavior‑тесты** рядом с модулем клиента (`tests-unit.mdc`).
 - Не вводить **второй полноценный HTTP‑стек** без явной задачи и согласования с архитектурой репозитория.
+## Incorrect
+
+```ts
+// Inside api/services — ad-hoc fetch bypasses shared client
+export const getSettings = async () => {
+  const res = await fetch('/api/settings')
+  return res.json()
+}
+```
+
+## Correct
+
+```ts
+import { appHttpClient } from '@/api/clients/appHttpClient'
+
+export const getSettings = async () => {
+  const { data } = await appHttpClient.get('/settings')
+  return mapSettingsResponse(data)
+}
+```

package/presets/cursor/next/rules/layer-barrel-exports.mdc

@@ -2,6 +2,7 @@
 description: Двухуровневые barrel-экспорты для слоёв с регламентированным public API
 globs: app/src/**/index.ts
 alwaysApply: false
+impact: MEDIUM
 ---
 
 # Barrel-экспорты слоёв с public API
@@ -57,3 +58,17 @@ alwaysApply: false
 | Core | `app/src/core/index.ts` | ESLint: `@/core/index` |
 
 Иллюстрация двух уровней (API): локальный `services/.../<Feature>/index.ts` → фасад `*ApiService.ts` → `app/src/api/index.ts`.
+## Incorrect
+
+```ts
+// app/src/api/index.ts — leaking internals
+export { mapCardResponse } from './services/CardsApi/cardResponseMappers'
+export { rawCardsClient } from './clients/rawCardsClient'
+```
+
+## Correct
+
+```ts
+// app/src/api/index.ts — public facade only
+export { cardsApi } from './services/CardsApi'
+```

package/presets/cursor/next/rules/next-app-router.mdc

@@ -22,7 +22,7 @@ alwaysApply: false
 
 ## Маршруты и UX
 
-- Для async routes использовать **`loading.tsx`**, **`error.tsx`**, **`not-found.tsx`** по образцу соседних routes.
+- Для async data routes **обязательны** sibling **`loading.tsx`** и **`error.tsx`** (и `not-found.tsx` где уместно) — по образцу соседних routes.
 - **Suspense** — для медленных client/server секций; fallback согласован с дизайн-системой.
 - Навигация — `navigation-router-stack.mdc` + router/link паттерны проекта.
 
@@ -31,6 +31,18 @@ alwaysApply: false
 - RSC/route handlers **не импортируют UI-компоненты с client-only зависимостями** напрямую в server tree без `'use client'` границы.
 - Доменные типы — `@/types`; вызовы backend — через `@/api` / services, не raw `fetch` из page.tsx без слоя API.
 
+## Anti-hallucination (App Router)
+
+Меньше угаданного кода лучше, чем больше. Сверяй API с версией Next в `package.json` и соседними routes.
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Sync `params` / `searchParams` / `cookies()` / `headers()` when the installed Next treats them as async | `await params` / `await cookies()` / patterns from existing pages |
+| Invented `getSession()`-only server auth without project verify | Server session verify used by the repo (`security-next.mdc`) |
+| Auth enforcement only in Edge middleware | Layout/page/Server Action checks + middleware refresh if present |
+| New App Router APIs not in the installed Next major | Copy from a sibling route; mark `VERIFY` if unsure |
+| Client `fetch` in `page.tsx` bypassing `@/api` | Services via `@/api` / established data loaders |
+
 ## Эталон
 
 Смотри существующий route той же сложности в `app/src/app/**` и повтори структуру (`reference-features.mdc`).

package/presets/cursor/next/rules/preset-layering.mdc

@@ -24,7 +24,7 @@ alwaysApply: false
 ## Куда класть новое правило
 
 1. Общие принципы для всех стеков → **core** + адаптеры с `<!-- shared-core: … -->`.
-2. Только один из installable стеков (`next` / `ios-swift` / `go`) → **stack-specific** (не в `_shared`).
+2. Только один из installable стеков (`next` / `ios-swift` / `go` / `java`) → **stack-specific** (не в `_shared`).
 3. Только Cursor или только Claude packaging → platform artifact / frontmatter, не дублировать семантику.
 
 ## SoT

package/presets/cursor/next/rules/preset-no-cross-stack-leakage.mdc

@@ -17,7 +17,7 @@ alwaysApply: false
 
 - `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
 - `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
-- `go` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `go` / `java` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
 - Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
 
 ## Forbidden in ios-swift hooks/agents (FAIL)
@@ -35,14 +35,16 @@ Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild`
 - `xcuitest-test-` as handoff stems
 - Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
 
-## Forbidden in go hooks/agents (FAIL)
+## Forbidden in go / java hooks/agents (FAIL)
+
+Shared backend-stack bans (both `go` and `java`):
 
 - `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
 - Positive yarn recipes `lint:js` / `lint:css`
 - `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
 - Agent file `accessibility-reviewer` (no UI surface)
 
-Required instead: `integration-test-*`; build-verifier / `post-change-test` / `go-tooling` (`go test`, `go vet`).
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`) or `java-tooling` (`mvn test` / `./gradlew test`).
 
 ## Soft / document
 
@@ -51,4 +53,4 @@ Required instead: `integration-test-*`; build-verifier / `post-change-test` / `g
 
 ## Chain fork
 
-`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, and `go` (per platform).
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `ios-swift`, `go`, and `java` (per platform).