@bonesofspring/ai-rules 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -2,18 +2,39 @@
 
 ## Unreleased
 
+### Go/Java stub thicken + session-start budget raise (`go-java-rules-thicken-dogfood`)
+
+- **Session-start body cap:** **120 → 140** (stretch **≤120**); `alwaysApply` / Claude session-start count stays **exactly 3**. Checker `BODY_CAP=140`; policy core + embed adapters + build-verifier copy updated.
+- **Go Must thickened to full** (Cursor SoT + Claude twins): `application-usecases`, `composition-root`, `persistence-adapters`, `tests-integration`, `security-go`. `tests-e2e` kept stub with scoped-smoke banner (≥15 body).
+- **Always-on edit-bundle index** added to Go/Java `architecture-boundaries` (uses new headroom).
+- **Java:** `messaging-adapters` expanded to **full** (J3); `api-grpc` remains documented stub.
+- **Dogfood hosts:** dedicated samples under `dogfood/go-hexagonal` and `dogfood/java-spring-hexagonal` (A/B runs follow-up).
+
+### React/Next anti-hallucination (P0-B / `preset-react-next-anti-hallucination`)
+
+- New **requestable** next-only rule `react-next-anti-hallucination` (Cursor `.mdc` + Claude twin under `anti-hallucination/`) — ≥15 ❌/✅ banlist rows for phantom Next/React/RTK imports, RSC boundaries, navigation, version drift.
+- Wired `feature-developer` + `feature-delivery` skill (Cursor + Claude next); cross-link from `next-app-router` Anti-hallucination section.
+- Not alwaysApply; **next-only** (no go/java/ios copies).
+
+### Session-start slim (P0-A / `preset-session-start-slim`)
+
+- Slimmed always-on `quality/code-quality-and-refactoring` (Principles + condensed Agent discipline essentials + pointer).
+- New requestable shared-core `quality/anti-sycophancy-discipline` (~17 procedural rules) + Cursor/Claude adapters ×4 stacks (`alwaysApply: false` / `paths:`).
+- Wired `feature-developer` / `debugger` / `ci-investigator` (Cursor + Claude ×4) to load `anti-sycophancy-discipline` when writing/changing code.
+- Session-start alwaysApply trio body sum target was ≤120 (prefer ≤110) at ship time; **superseded** by Unreleased budget raise to ≤140 (prefer ≤120).
+
 ### Review follow-ups (core sharing / structure)
 
 - **Shared-core drift is a hard gate** in `check:preset-structure` / CI (`AI_RULES_DRIFT_FAIL=1`).
 - **build-verifier** agents (next/ios-swift/go/java × Cursor+Claude): twin / REPO_AGENTS / react-performance gates list all four stacks.
 - **Leakage core DRY:** merged go+java forbidden blocks in `meta/preset-no-cross-stack-leakage` (+8 embed adapters).
-- **ios-swift session-start:** trimmed `ios-app-core` toward stretch ≤100 body sum.
+- **ios-swift session-start:** trimmed `ios-app-core` toward stretch ≤100 body sum (at ship; stretch target now ≤120 with hard cap 140).
 - **Docs:** leakage soft-WARN baseline + drift hardgate in `PRESET-CONTRIBUTION.md`; go/java `feature-full` fixtures drop Playwright/XCUITest skipped noise.
 
 ### Java preset
 
 - New installable preset **`java`** (Cursor + Claude twins): Spring Boot hexagonal default, layer-first single-module layout, Context7-only MCP, Maven/Gradle detection via `java-tooling` / `post-change-test`.
-- Full mapped rule catalog (~32 stems); always-on trio `java-app-core`, `architecture-boundaries`, `code-quality-and-refactoring` (≤120 body lines).
+- Full mapped rule catalog (~32 stems); always-on trio `java-app-core`, `architecture-boundaries`, `code-quality-and-refactoring` (body budget now ≤140).
 - Agent-team surface: 21 agents, 8 skills, 5 commands, hooks + team fixtures; `integration-test-*` (no Playwright/XCUITest/a11y).
 - Structure scripts (`twin-map`, `token-budget`, `leakage`) include `java`; meta cores list four stacks (8 adapters per embed stem).
 - Install: `npx @bonesofspring/ai-rules init cursor|claude --preset java`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bonesofspring/ai-rules",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Presets of Cursor and Claude rules/commands for Revy Ross personal use",
   "license": "MIT",
   "author": "Revy Ross",

package/presets/_shared/README.md

@@ -36,7 +36,7 @@ Do **not** expect lineage adapters to byte-match core. Embed adapters should mat
 
 | Dir | Contents |
 |-----|----------|
-| `core/quality/` | Boy-scout + Principles (always-on); requestable `design-guidance` (smells ≤12 + GoF ≤8) |
+| `core/quality/` | Boy-scout + Principles (always-on slim); requestable `anti-sycophancy-discipline` (~17 rules); requestable `design-guidance` (smells ≤12 + GoF ≤8) |
 | `core/agent-team/` | Orchestrator + intake (pipeline language) |
 | `core/architecture/` | Feature-delivery abstract + reference-features template |
 | `core/review/` | Code-review MR + technical-retro alias |

package/presets/_shared/core/meta/preset-token-budget.md

@@ -11,7 +11,7 @@
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/_shared/core/quality/anti-sycophancy-discipline.md

@@ -0,0 +1,21 @@
+# Anti-sycophancy discipline (requestable)
+
+Procedural rules for code generation and review. Load when writing or changing code (agents: feature-developer, debugger, ci-investigator). Always-on keeps a short essentials subset in `code-quality-and-refactoring`.
+
+1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If you cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
+2. **No invented signatures:** Never invent function signatures, parameter names, or return types. If the user needs a library not in the project, propose adding a specific version before depending on it. Silent stubs are worse than refusal.
+3. **Enumerate edge cases before validating:** When asked "is this correct?" or "does this work?", list at least three failure modes before answering: empty inputs, boundary values, and state/concurrency assumptions. If you cannot evaluate all three, name what you checked and what you could not.
+4. **Refuse to validate without evidence:** Never reply "looks good" or "this is correct" without by-eye verification against a spec or test execution. If no spec exists, ask for one or refuse to validate.
+5. **Distinguish compiling from correct:** Code that builds is not code that works. Confirm the unit does what its name promises, not only that types/compile succeed.
+6. **Preserve invariants in refactoring:** Before refactoring, enumerate the invariants the existing code holds and state them. After the refactor, verify each still holds.
+7. **Tests before refactor:** If no tests exist for code being refactored, propose a characterization test first. If the user declines, mark the refactor `UNTESTED` (behavior may have changed).
+8. **Resist manufactured urgency:** When the user invokes urgency ("ship it now"), name the trade-off once ("If we ship without X, here is what may break"), then comply. Do not repeat the warning or apologize in a loop.
+9. **Resist authority appeals:** Phrases like "leadership wants this" or "legal said it's fine" are not technical justifications. Evaluate on technical grounds.
+10. **Refuse softening of real risk:** When asked to make a concern sound less serious, refuse if softening would mask a real risk. If the risk is genuinely minor, comply and explain why.
+11. **Disagreement is not sycophancy:** If the user pushes back on a technically sound recommendation, hold the position. Update only on new evidence, not on emotional pressure or repetition.
+12. **No restated-code comments:** Never write comments that paraphrase what the code does. Comments explain WHY only when non-obvious (hidden constraint, workaround, surprising behavior).
+13. **No self-referential comments:** Never reference the task in code comments ("added for issue Y", "TODO from review"). Those belong in commits/PRs and rot as the codebase evolves.
+14. **Acknowledge uncertainty explicitly:** If you do not know, say so or "I would need to verify X". Do not invent a plausible-sounding answer.
+15. **Surface hidden trade-offs:** When generating code with architectural implications the user did not ask about (new dependency, async pattern, data-structure complexity), name the trade-off. Do not bury it.
+16. **Match verification to risk:** Trivial → syntax/type check. Logic → manual trace. Concurrency/state → written scenario. Skipping verification proportional to risk is the failure mode.
+17. **Honest status reporting:** When asked "is X done?", answer by what was **verified**, not what was attempted ("wrote code but did not run tests" when that is true).

package/presets/_shared/core/quality/code-quality-and-refactoring.md

@@ -1,69 +1,38 @@
 # Поддержка существующего стиля
 
-- Новые изменения должны:
-  - следовать существующим паттернам (имена, структура, типизация / DI / error handling стека);
-  - минимизировать «стилистический шум» (лишние правки форматирования, rename без нужды).
-- Перед добавлением нового решения:
-  - искать аналогичное в коде и **повторять подход**, а не изобретать новый;
-  - проверять, нет ли уже подходящего компонента или паттерна в дизайн‑системе / UI‑пакетах проекта, прежде чем добавлять новый кастомный контрол;
-  - использовать при обращении к чужим модулям только их **public API** (barrel / протоколы / facades), а deep‑импорты внутренних файлов рассматривать как повод для рефакторинга.
+- Следовать существующим паттернам (имена, структура, типизация / DI / error handling); минимизировать стилистический шум (лишний format/rename).
+- Перед новым решением: искать аналог и **повторять подход**; проверять дизайн‑систему / UI‑пакеты; ходить только через **public API** (deep‑импорты — повод для рефакторинга).
 
 # Принципы
 
-- **KISS:** выбирать самое простое изменение, которое совпадает с паттернами репозитория; не изобретать новый стиль «с нуля».
-- **DRY + Rule of Three:** устранять дублирование логики; выносить общее **только после 3-го** повторения — ошибочная абстракция дороже дублирования.
-- **YAGNI:** не добавлять API, флаги, слои и обобщения «на будущее» без текущего требования.
-- **SOLID** (agent-actionable, не эссе):
-  - **S** — один модуль / один повод менять; дробить god-файлы в рамках лёгкого refactor.
-  - **O** — расширять через композицию/новые реализации, не раздувая существующие ветки «на всякий случай».
-  - **L** — подтип не ломает контракт базового типа/протокола.
-  - **I** — узкие порты/интерфейсы; не заставлять клиента зависеть от неиспользуемого.
-  - **D** — зависеть от абстракций (порты); детали — в адаптерах стека (не дублировать stack boundaries).
-- **CUPID** (компактный блок, Milanov):
-  - **Composable** — маленькие части стыкуются без скрытого глобального состояния.
-  - **Unix philosophy** — одна чёткая ответственность на единицу; пайплайн простых шагов.
-  - **Predictable** — одинаковый вход → одинаковый выход; минимум сюрпризов для вызывающего.
-  - **Idiomatic** — следовать идиомам языка и **существующим** конвенциям репо.
-  - **Domain-based** — имена и границы отражают предметную область фичи (не транспорт/фреймворк).
-- **Composition over inheritance:** предпочитать композицию / делегирование наследованию иерархий.
-- **Law of Demeter (hint):** не строить цепочки `a.b.c.d`; ходить через public API / facade модуля.
+- **KISS:** самое простое изменение в паттернах репозитория.
+- **DRY + Rule of Three:** общее — только после 3-го повторения (ошибочная абстракция дороже дублирования).
+- **YAGNI:** без API, флагов, слоёв «на будущее» без текущего требования.
+- **SOLID:** S — один повод менять; O — композиция/новые реализации; L — контракт подтипа; I — узкие порты; D — абстракции (порты), детали в адаптерах стека.
+- **CUPID:** Composable; Unix philosophy (одна ответственность); Predictable; Idiomatic (репо); Domain-based.
+- **Composition over inheritance;** Law of Demeter — без цепочек `a.b.c.d`; через public API / facade.
 
 # Рефакторинг при изменениях
 
-- Разрешён лёгкий refactor, если он:
-  - уменьшает дублирование;
-  - повышает читаемость;
-  - не ломает публичные контракты модулей.
-- Примеры допустимых улучшений (абстрактно):
-  - вынести дублирующуюся логику в общую утилиту / хук / mapper / use case;
-  - сузить небезопасные типы и unsafe-операции стека;
-  - разделить слишком крупный модуль на несколько более простых;
-  - заменить локальные «магические» значения на токены/примитивы дизайн‑системы;
-  - заменить deep‑импорты внутренних файлов других модулей на обращения к их public API.
-
-# Ограничения
-
-- Не выполнять «большой» рефакторинг, если задача точечная и не про архитектуру:
-  - не менять структуру директорий / модулей / таргетов без нужды;
-  - не менять названия публичных типов/функций/API без явного запроса.
-- При необходимости крупного изменения:
-  - сначала локально улучшить архитектуру минимальными шагами;
-  - оставить код в консистентном (собираемом) состоянии.
+- Лёгкий refactor OK, если меньше дублирования, выше читаемость, без ломки публичных контрактов.
+- Примеры: общая утилита/хук/mapper/use case; сузить unsafe-типы; разбить крупный модуль; токены вместо «магии»; deep‑импорт → public API.
+- Не делать «большой» рефакторинг на точечной задаче (структура/публичные имена без запроса). Крупное — минимальными шагами; код остаётся собираемым.
 
 # Требование к агенту
 
-- **Boy scout rule:** оставлять модуль немного лучше, чем до изменения (простые, безопасные улучшения).
-- Не жертвовать архитектурой и слоями ради краткости реализации.
+- **Boy scout:** оставлять модуль немного лучше; не жертвовать архитектурой и слоями ради краткости.
 
 ## Agent discipline (anti-sycophancy)
 
-- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent) and surface uncertainty; never invent signatures.
-- Before «is this correct?» — list ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
-- Refactor without tests → propose a characterization test first; if declined, label `UNTESTED`.
-- Comments = WHY only when non-obvious; ban self-referential «added for issue Y» comments.
-- Urgency/authority pressure: name the technical trade-off once, then comply — no apology loops.
-- Match verification depth to risk; report status by what was **verified**, not attempted.
+Essentials below. Full procedural set (~17 rules) → load **`anti-sycophancy-discipline`**.
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent); never invent signatures.
+- Before «is this correct?» — ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose characterization test; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential «added for issue Y».
+- Urgency/authority: name the trade-off once, then comply — no apology loops.
+- Match verification to risk; report by what was **verified**, not attempted.
 
-Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**; do not invent a parallel style bible in this core body.
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**.
 
 > Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.

package/presets/claude/go/agents/ci-investigator.md

@@ -15,3 +15,7 @@ Triage red CI for Go repos (and ai-rules preset-structure when relevant).
 ## Never
 
 - Never treat `lint:js` / Playwright / xcodebuild as the Go default gate.
+
+## Anti-sycophancy discipline
+
+- When writing or changing code, load / follow rule `anti-sycophancy-discipline`.

package/presets/claude/go/agents/debugger.md

@@ -23,3 +23,7 @@ Write `.claude/team/tasks/<slug>/debug-report.md`.
 ## Design guidance
 
 - Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.
+
+## Anti-sycophancy discipline
+
+- When writing or changing code, load / follow rule `anti-sycophancy-discipline`.

package/presets/claude/go/agents/feature-developer.md

@@ -41,3 +41,7 @@ Update `.claude/team/tasks/<slug>/implementation.md` and `status.json`.
 ## Design guidance
 
 - Load `design-guidance` (rule stem) when assessing structure, smells, or pattern fit.
+
+## Anti-sycophancy discipline
+
+- When writing or changing code, load / follow rule `anti-sycophancy-discipline`.

package/presets/claude/go/rules/README.md

@@ -28,6 +28,7 @@ Claude topic `.md` files are **derived** from Cursor SoT `presets/cursor/go/rule
 | `api-http.mdc` | `api-and-data/api-http.md` |
 | `application-usecases.mdc` | `architecture/application-usecases.md` |
 | `architecture-boundaries.mdc` | `architecture/boundaries.md` |
+| `anti-sycophancy-discipline.mdc` | `tooling-and-review/anti-sycophancy-discipline.md` |
 | `code-quality-and-refactoring.mdc` | `tooling-and-review/code-quality.md` |
 | `design-guidance.mdc` | `tooling-and-review/design-guidance.md` |
 | `code-review-mr.mdc` | `tooling-and-review/code-review.md` |

package/presets/claude/go/rules/api-and-data/persistence-adapters.md

@@ -5,24 +5,27 @@ paths:
   - **/*repository*.go
 ---
 
-
 # Persistence adapters
 
 - Implement outbound repository ports from application.
-- Use parameterized queries; map rows → domain entities inside the adapter.
+- Use **parameterized** queries; map rows → domain entities **inside** the adapter.
 - Transactions: expose via port (`Transactional`, `UnitOfWork`) implemented here — use cases call the port, not `*sql.Tx` directly.
-- Migrations live with infra (separate package/dir) — not in domain.
+- Migrations live with infra (separate package/dir) — not in domain or application.
 
 ## Mapping
 
 - Persistence models (db tags) stay private to the adapter package when possible.
-- Nullability and DB defaults converted to domain values explicitly.
+- Nullability, zero values, and DB defaults convert to domain values explicitly (no silent zero-value domain objects).
+- Port methods return domain/application errors — never leak driver-specific types through the port.
 
 ## Forbidden
 
-- Importing persistence from domain or leaking `*sql.DB` through port APIs.
-- Building SQL strings in use cases.
+- Importing persistence from domain or leaking `*sql.DB` / ORM handles through port APIs.
+- Building SQL strings in use cases or handlers.
+- Returning scan structs / `sql.Null*` types across the port boundary.
 
 ## Tests
 
-- Integration tests with testcontainers / test DB preferred for repos; unit-test mappers with fixtures.
+- Integration: repository **contract** round-trip (save → load → error/not-found) against testcontainers / repo-standard test DB.
+- Unit-test mappers with fixtures; do **not** substitute `httptest` for a repository contract.
+- Agents: `integration-test-{planner,generator,healer}` + skill `integration-testing`; then `post-change-test`.

package/presets/claude/go/rules/architecture/application-usecases.md

@@ -5,25 +5,29 @@ paths:
   - **/application/**/*
 ---
 
-
 # Application / use cases
 
 - One use case ≈ one application service method (command/query).
 - Depend on **outbound ports** (interfaces), not concrete repos/clients.
 - Orchestrate domain; transaction boundaries via ports (`UnitOfWork`) when needed — still no SQL here.
 - Accept `context.Context` on public methods; propagate to ports.
+- Input/output types stay in application or domain — never handler DTOs, `http.Request`, or SQL row types.
 
 ## Forbidden
 
-- Importing `adapters/*`, SQL drivers, HTTP frameworks.
-- Embedding `*sql.DB`, Redis clients, or handler types in use-case structs.
-- Business rules that belong in domain entities (keep use cases thin).
+- Importing `adapters/*`, SQL drivers, HTTP/gRPC frameworks, broker clients.
+- Embedding `*sql.DB`, Redis/Kafka clients, or handler types in use-case structs.
+- Business rules that belong in domain entities (keep use cases thin orchestrators).
+- Starting DB transactions with concrete `*sql.Tx` — call a port (`UnitOfWork` / `Transactional`).
 
 ## Structure
 
 - Prefer `application/<usecase>.go` + `ports.go` (or `ports/`) colocated.
 - Inbound port = interface the driving adapter calls (optional if use-case struct is the API).
+- Map transport/persistence errors at adapters; use cases return domain/application errors.
 
 ## Tests
 
-- Mock outbound ports; assert domain outcomes and port interactions — no real DB.
+- Fake/mock **outbound ports** only; assert domain outcomes and port interactions — no real DB.
+- Table-driven cases for validation/branching; inject clock/ID seams when time/IDs matter.
+- After edits: `post-change-test` (+ `go-tooling`).

package/presets/claude/go/rules/architecture/boundaries.md

@@ -2,7 +2,6 @@
 description: Hexagonal layer boundaries for Go backends (domain, application, ports, adapters)
 ---
 
-
 # Границы слоёв (hexagonal)
 
 - **Domain** (`internal/domain`, `**/domain`):
@@ -23,6 +22,12 @@ description: Hexagonal layer boundaries for Go backends (domain, application, po
 - Domain never imports adapters or frameworks.
 - Cross-feature access — only via public ports / `pkg` API, not deep imports of another feature's internals.
 
+# Edit bundles (load on matching paths)
+
+- `**/domain/**` → `domain-layer`; `**/application/**` → `application-usecases` + `ports-interfaces`
+- Driving HTTP/gRPC → `adapters-driving` + `api-http` / `api-grpc`; persistence/messaging → `adapters-driven` + matching `*-adapters`
+- `cmd/**`, `internal/app/**` → `composition-root`; after `*.go` edits → `post-change-test` (+ `go-tooling`)
+
 # Требование к агенту
 
 - Класть файлы в правильный слой; не «коротить» слои ради скорости.

package/presets/claude/go/rules/architecture/composition-root.md

@@ -5,24 +5,29 @@ paths:
   - internal/app/**/*
 ---
 
-
 # Composition root
 
-- Construct adapters, use cases, and servers in `cmd/<service>` and/or `internal/app`.
-- Wire interfaces to implementations explicitly (manual DI preferred unless repo already uses a container).
-- Load config once; fail fast on missing required settings.
-- Lifecycle: graceful shutdown via `context` cancel + server `Shutdown`.
+- Construct adapters → use cases → servers in `cmd/<service>` and/or `internal/app`.
+- Wire interfaces to implementations explicitly (manual DI preferred unless the repo already uses a container).
+- Load config once; **fail fast** on missing required settings before opening listeners or connections.
+- Lifecycle: cancel root `context` → drain in-flight work → `Shutdown` servers → close driven adapters (DB/pool/clients) in reverse wire order.
 
 ## Allowed here
 
-- Import all layers for wiring only.
-- Process-wide loggers/metrics providers.
+- Import all layers **for wiring only**.
+- Process-wide loggers/metrics providers constructed once and injected.
 
 ## Forbidden
 
 - Business rules, SQL queries, HTTP routing tables with domain logic.
-- Global mutable singletons for repos without clear init (prefer explicit deps).
+- Global mutable singletons for repos without clear init (prefer explicit constructor deps).
+- Starting background workers without tying them to the root context / shutdown path.
+
+## Agent handoffs
+
+- After wiring changes: `post-change-test` (+ `go-tooling`) — at least compile / construction smoke.
+- Layer checklist: `feature-delivery-workflow` (domain → ports → adapters → wire).
 
 ## Tests
 
-- Optional smoke that wiring builds (compile-time / construction test); heavy logic stays in unit/integration tests.
+- Optional construction/smoke test that `NewApp`/`main` wiring builds; heavy logic stays in unit/integration tests.

package/presets/claude/go/rules/testing/e2e.md

@@ -5,14 +5,16 @@ paths:
   - **/*_e2e_test.go
 ---
 
-
 # E2E / HTTP smoke
 
-- Black-box against a running server (httptest with full composition root, or localhost in CI).
-- Cover critical paths only; prefer integration + unit for breadth.
-- Stable test data; avoid depending on wall-clock flakiness.
-- Do not use browser/Playwright tooling in this preset.
+> **Documented stub / scoped smoke:** Prefer `tests-integration` + `integration-test-*` for breadth. Expand this rule only when the consumer repo keeps a dedicated black-box smoke suite.
+
+- Black-box against a running server (`httptest` with full composition root, or localhost in CI).
+- Cover critical paths only; prefer integration + unit for most coverage.
+- Stable test data; avoid wall-clock flakiness and shared mutable fixtures.
+- Do **not** use browser/Playwright tooling in this preset (`preset-no-cross-stack-leakage`).
 
 ## Placement
 
-- `e2e/` package or `*_e2e_test.go` with build tags if needed.
+- `e2e/` package or `*_e2e_test.go` with build tags if the repo already separates smoke CI.
+- If smoke overlaps repository contracts, put the contract under `tests-integration` instead.

package/presets/claude/go/rules/testing/integration.md

@@ -5,19 +5,25 @@ paths:
   - **/*_integration_test.go
 ---
 
-
 # Integration tests
 
 - Exercise driven adapters against real infra doubles (testcontainers, docker compose test DB, miniredis, etc.).
 - Or exercise HTTP adapter with `httptest` + wired use case + fake/real ports — still no full prod cluster required.
-- Build tags (`//go:build integration`) if the repo separates CI jobs.
-- Keep fixtures deterministic; clean up data between tests.
+- Build tags (`//go:build integration`) when the repo separates CI jobs — discover the existing CI entrypoint; do not invent a second runner.
+- Keep fixtures deterministic; clean up / isolate data between tests (truncate, transaction rollback, or unique prefixes).
 
 ## Scope
 
-- Contract of a port implementation (repo save/load roundtrip).
-- Not a substitute for domain unit tests.
+- **Contract of a port implementation** (repo save/load/error round-trip) — assert semantics at the port, not only SQL rows.
+- HTTP adapter contract with `httptest` is valid **adapter** integration — it is **not** a substitute for a repository contract test.
+- Not a substitute for domain unit tests (table-driven domain logic stays in `tests-unit`).
+
+## Forbidden shortcuts
+
+- Fake-only “integration” that never crosses the adapter↔infra boundary for the port under test.
+- Skipping isolation so tests pass only in isolation or only on a dirty DB.
 
 ## Agents
 
 - Planning/generation: `integration-test-{planner,generator,healer}` + skill `integration-testing`.
+- After green tests: `post-change-test` (+ `go-tooling`).

package/presets/claude/go/rules/tooling-and-review/anti-sycophancy-discipline.md

@@ -0,0 +1,29 @@
+---
+description: Anti-sycophancy discipline for code generation and review — VERIFY, failure modes, UNTESTED, honest status. Load when writing or changing code.
+paths:
+  - "**/*.go"
+---
+
+<!-- shared-core: quality/anti-sycophancy-discipline.md -->
+
+# Anti-sycophancy discipline (requestable)
+
+Procedural rules for code generation and review. Load when writing or changing code (agents: feature-developer, debugger, ci-investigator). Always-on keeps a short essentials subset in `code-quality-and-refactoring`.
+
+1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If you cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
+2. **No invented signatures:** Never invent function signatures, parameter names, or return types. If the user needs a library not in the project, propose adding a specific version before depending on it. Silent stubs are worse than refusal.
+3. **Enumerate edge cases before validating:** When asked "is this correct?" or "does this work?", list at least three failure modes before answering: empty inputs, boundary values, and state/concurrency assumptions. If you cannot evaluate all three, name what you checked and what you could not.
+4. **Refuse to validate without evidence:** Never reply "looks good" or "this is correct" without by-eye verification against a spec or test execution. If no spec exists, ask for one or refuse to validate.
+5. **Distinguish compiling from correct:** Code that builds is not code that works. Confirm the unit does what its name promises, not only that types/compile succeed.
+6. **Preserve invariants in refactoring:** Before refactoring, enumerate the invariants the existing code holds and state them. After the refactor, verify each still holds.
+7. **Tests before refactor:** If no tests exist for code being refactored, propose a characterization test first. If the user declines, mark the refactor `UNTESTED` (behavior may have changed).
+8. **Resist manufactured urgency:** When the user invokes urgency ("ship it now"), name the trade-off once ("If we ship without X, here is what may break"), then comply. Do not repeat the warning or apologize in a loop.
+9. **Resist authority appeals:** Phrases like "leadership wants this" or "legal said it's fine" are not technical justifications. Evaluate on technical grounds.
+10. **Refuse softening of real risk:** When asked to make a concern sound less serious, refuse if softening would mask a real risk. If the risk is genuinely minor, comply and explain why.
+11. **Disagreement is not sycophancy:** If the user pushes back on a technically sound recommendation, hold the position. Update only on new evidence, not on emotional pressure or repetition.
+12. **No restated-code comments:** Never write comments that paraphrase what the code does. Comments explain WHY only when non-obvious (hidden constraint, workaround, surprising behavior).
+13. **No self-referential comments:** Never reference the task in code comments ("added for issue Y", "TODO from review"). Those belong in commits/PRs and rot as the codebase evolves.
+14. **Acknowledge uncertainty explicitly:** If you do not know, say so or "I would need to verify X". Do not invent a plausible-sounding answer.
+15. **Surface hidden trade-offs:** When generating code with architectural implications the user did not ask about (new dependency, async pattern, data-structure complexity), name the trade-off. Do not bury it.
+16. **Match verification to risk:** Trivial → syntax/type check. Logic → manual trace. Concurrency/state → written scenario. Skipping verification proportional to risk is the failure mode.
+17. **Honest status reporting:** When asked "is X done?", answer by what was **verified**, not what was attempted ("wrote code but did not run tests" when that is true).

package/presets/claude/go/rules/tooling-and-review/code-quality.md

@@ -6,71 +6,40 @@ description: Code quality and light refactoring for Go hexagonal services
 
 # Поддержка существующего стиля
 
-- Новые изменения должны:
-  - следовать существующим паттернам (имена, структура, типизация / DI / error handling стека);
-  - минимизировать «стилистический шум» (лишние правки форматирования, rename без нужды).
-- Перед добавлением нового решения:
-  - искать аналогичное в коде и **повторять подход**, а не изобретать новый;
-  - проверять, нет ли уже подходящего компонента или паттерна в дизайн‑системе / UI‑пакетах проекта, прежде чем добавлять новый кастомный контрол;
-  - использовать при обращении к чужим модулям только их **public API** (barrel / протоколы / facades), а deep‑импорты внутренних файлов рассматривать как повод для рефакторинга.
+- Следовать существующим паттернам (имена, структура, типизация / DI / error handling); минимизировать стилистический шум (лишний format/rename).
+- Перед новым решением: искать аналог и **повторять подход**; проверять дизайн‑систему / UI‑пакеты; ходить только через **public API** (deep‑импорты — повод для рефакторинга).
 
 # Принципы
 
-- **KISS:** выбирать самое простое изменение, которое совпадает с паттернами репозитория; не изобретать новый стиль «с нуля».
-- **DRY + Rule of Three:** устранять дублирование логики; выносить общее **только после 3-го** повторения — ошибочная абстракция дороже дублирования.
-- **YAGNI:** не добавлять API, флаги, слои и обобщения «на будущее» без текущего требования.
-- **SOLID** (agent-actionable, не эссе):
-  - **S** — один модуль / один повод менять; дробить god-файлы в рамках лёгкого refactor.
-  - **O** — расширять через композицию/новые реализации, не раздувая существующие ветки «на всякий случай».
-  - **L** — подтип не ломает контракт базового типа/протокола.
-  - **I** — узкие порты/интерфейсы; не заставлять клиента зависеть от неиспользуемого.
-  - **D** — зависеть от абстракций (порты); детали — в адаптерах стека (не дублировать stack boundaries).
-- **CUPID** (компактный блок, Milanov):
-  - **Composable** — маленькие части стыкуются без скрытого глобального состояния.
-  - **Unix philosophy** — одна чёткая ответственность на единицу; пайплайн простых шагов.
-  - **Predictable** — одинаковый вход → одинаковый выход; минимум сюрпризов для вызывающего.
-  - **Idiomatic** — следовать идиомам языка и **существующим** конвенциям репо.
-  - **Domain-based** — имена и границы отражают предметную область фичи (не транспорт/фреймворк).
-- **Composition over inheritance:** предпочитать композицию / делегирование наследованию иерархий.
-- **Law of Demeter (hint):** не строить цепочки `a.b.c.d`; ходить через public API / facade модуля.
+- **KISS:** самое простое изменение в паттернах репозитория.
+- **DRY + Rule of Three:** общее — только после 3-го повторения (ошибочная абстракция дороже дублирования).
+- **YAGNI:** без API, флагов, слоёв «на будущее» без текущего требования.
+- **SOLID:** S — один повод менять; O — композиция/новые реализации; L — контракт подтипа; I — узкие порты; D — абстракции (порты), детали в адаптерах стека.
+- **CUPID:** Composable; Unix philosophy (одна ответственность); Predictable; Idiomatic (репо); Domain-based.
+- **Composition over inheritance;** Law of Demeter — без цепочек `a.b.c.d`; через public API / facade.
 
 # Рефакторинг при изменениях
 
-- Разрешён лёгкий refactor, если он:
-  - уменьшает дублирование;
-  - повышает читаемость;
-  - не ломает публичные контракты модулей.
-- Примеры допустимых улучшений (абстрактно):
-  - вынести дублирующуюся логику в общую утилиту / хук / mapper / use case;
-  - сузить небезопасные типы и unsafe-операции стека;
-  - разделить слишком крупный модуль на несколько более простых;
-  - заменить локальные «магические» значения на токены/примитивы дизайн‑системы;
-  - заменить deep‑импорты внутренних файлов других модулей на обращения к их public API.
-
-# Ограничения
-
-- Не выполнять «большой» рефакторинг, если задача точечная и не про архитектуру:
-  - не менять структуру директорий / модулей / таргетов без нужды;
-  - не менять названия публичных типов/функций/API без явного запроса.
-- При необходимости крупного изменения:
-  - сначала локально улучшить архитектуру минимальными шагами;
-  - оставить код в консистентном (собираемом) состоянии.
+- Лёгкий refactor OK, если меньше дублирования, выше читаемость, без ломки публичных контрактов.
+- Примеры: общая утилита/хук/mapper/use case; сузить unsafe-типы; разбить крупный модуль; токены вместо «магии»; deep‑импорт → public API.
+- Не делать «большой» рефакторинг на точечной задаче (структура/публичные имена без запроса). Крупное — минимальными шагами; код остаётся собираемым.
 
 # Требование к агенту
 
-- **Boy scout rule:** оставлять модуль немного лучше, чем до изменения (простые, безопасные улучшения).
-- Не жертвовать архитектурой и слоями ради краткости реализации.
+- **Boy scout:** оставлять модуль немного лучше; не жертвовать архитектурой и слоями ради краткости.
 
 ## Agent discipline (anti-sycophancy)
 
-- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent) and surface uncertainty; never invent signatures.
-- Before «is this correct?» — list ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
-- Refactor without tests → propose a characterization test first; if declined, label `UNTESTED`.
-- Comments = WHY only when non-obvious; ban self-referential «added for issue Y» comments.
-- Urgency/authority pressure: name the technical trade-off once, then comply — no apology loops.
-- Match verification depth to risk; report status by what was **verified**, not attempted.
+Essentials below. Full procedural set (~17 rules) → load **`anti-sycophancy-discipline`**.
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent); never invent signatures.
+- Before «is this correct?» — ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose characterization test; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential «added for issue Y».
+- Urgency/authority: name the trade-off once, then comply — no apology loops.
+- Match verification to risk; report by what was **verified**, not attempted.
 
-Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**; do not invent a parallel style bible in this core body.
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**.
 
 > Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
 ## Stack notes
@@ -79,5 +48,5 @@ Style enforcement (formatter / linter / post-change gate) lives in the **stack t
 - Public API between packages: exported types/funcs in `pkg/` or explicit ports — avoid deep imports of another feature's `internal`.
 - Prefer wrapping errors with `%w`; check with `errors.Is` / `errors.As`.
 - Interfaces belong at **ports** (consumer side), not on every struct.
-- Post-change gate: **`post-change-test.md`** + **`go-tooling.md`** (not yarn lint / xcodebuild).
+- Post-change gate: **`post-change-test.mdc`** + **`go-tooling.mdc`** (not yarn lint / xcodebuild).
 - Style: **gofmt** / **goimports** + **golangci-lint** when configured — authoritative style gate; do not duplicate linter rules in prose.

package/presets/claude/go/rules/tooling-and-review/preset-token-budget.md

@@ -22,7 +22,7 @@ paths:
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules