@bonesofspring/ai-rules 0.2.9 → 0.2.10

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+### Go/Java stub thicken + session-start budget raise (`go-java-rules-thicken-dogfood`)
+
+- **Session-start body cap:** **120 → 140** (stretch **≤120**); `alwaysApply` / Claude session-start count stays **exactly 3**. Checker `BODY_CAP=140`; policy core + embed adapters + build-verifier copy updated.
+- **Go Must thickened to full** (Cursor SoT + Claude twins): `application-usecases`, `composition-root`, `persistence-adapters`, `tests-integration`, `security-go`. `tests-e2e` kept stub with scoped-smoke banner (≥15 body).
+- **Always-on edit-bundle index** added to Go/Java `architecture-boundaries` (uses new headroom).
+- **Java:** `messaging-adapters` expanded to **full** (J3); `api-grpc` remains documented stub.
+- **Dogfood hosts:** dedicated samples under `dogfood/go-hexagonal` and `dogfood/java-spring-hexagonal` (A/B runs follow-up).
+
 ### React/Next anti-hallucination (P0-B / `preset-react-next-anti-hallucination`)
 
 - New **requestable** next-only rule `react-next-anti-hallucination` (Cursor `.mdc` + Claude twin under `anti-hallucination/`) — ≥15 ❌/✅ banlist rows for phantom Next/React/RTK imports, RSC boundaries, navigation, version drift.
@@ -13,20 +21,20 @@
 - Slimmed always-on `quality/code-quality-and-refactoring` (Principles + condensed Agent discipline essentials + pointer).
 - New requestable shared-core `quality/anti-sycophancy-discipline` (~17 procedural rules) + Cursor/Claude adapters ×4 stacks (`alwaysApply: false` / `paths:`).
 - Wired `feature-developer` / `debugger` / `ci-investigator` (Cursor + Claude ×4) to load `anti-sycophancy-discipline` when writing/changing code.
-- Session-start alwaysApply trio body sum target ≤120 (prefer ≤110); still exactly 3 always-on per stack.
+- Session-start alwaysApply trio body sum target was ≤120 (prefer ≤110) at ship time; **superseded** by Unreleased budget raise to ≤140 (prefer ≤120).
 
 ### Review follow-ups (core sharing / structure)
 
 - **Shared-core drift is a hard gate** in `check:preset-structure` / CI (`AI_RULES_DRIFT_FAIL=1`).
 - **build-verifier** agents (next/ios-swift/go/java × Cursor+Claude): twin / REPO_AGENTS / react-performance gates list all four stacks.
 - **Leakage core DRY:** merged go+java forbidden blocks in `meta/preset-no-cross-stack-leakage` (+8 embed adapters).
-- **ios-swift session-start:** trimmed `ios-app-core` toward stretch ≤100 body sum.
+- **ios-swift session-start:** trimmed `ios-app-core` toward stretch ≤100 body sum (at ship; stretch target now ≤120 with hard cap 140).
 - **Docs:** leakage soft-WARN baseline + drift hardgate in `PRESET-CONTRIBUTION.md`; go/java `feature-full` fixtures drop Playwright/XCUITest skipped noise.
 
 ### Java preset
 
 - New installable preset **`java`** (Cursor + Claude twins): Spring Boot hexagonal default, layer-first single-module layout, Context7-only MCP, Maven/Gradle detection via `java-tooling` / `post-change-test`.
-- Full mapped rule catalog (~32 stems); always-on trio `java-app-core`, `architecture-boundaries`, `code-quality-and-refactoring` (≤120 body lines).
+- Full mapped rule catalog (~32 stems); always-on trio `java-app-core`, `architecture-boundaries`, `code-quality-and-refactoring` (body budget now ≤140).
 - Agent-team surface: 21 agents, 8 skills, 5 commands, hooks + team fixtures; `integration-test-*` (no Playwright/XCUITest/a11y).
 - Structure scripts (`twin-map`, `token-budget`, `leakage`) include `java`; meta cores list four stacks (8 adapters per embed stem).
 - Install: `npx @bonesofspring/ai-rules init cursor|claude --preset java`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bonesofspring/ai-rules",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Presets of Cursor and Claude rules/commands for Revy Ross personal use",
   "license": "MIT",
   "author": "Revy Ross",

package/presets/_shared/core/meta/preset-token-budget.md

@@ -11,7 +11,7 @@
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/claude/go/rules/api-and-data/persistence-adapters.md

@@ -5,24 +5,27 @@ paths:
   - **/*repository*.go
 ---
 
-
 # Persistence adapters
 
 - Implement outbound repository ports from application.
-- Use parameterized queries; map rows → domain entities inside the adapter.
+- Use **parameterized** queries; map rows → domain entities **inside** the adapter.
 - Transactions: expose via port (`Transactional`, `UnitOfWork`) implemented here — use cases call the port, not `*sql.Tx` directly.
-- Migrations live with infra (separate package/dir) — not in domain.
+- Migrations live with infra (separate package/dir) — not in domain or application.
 
 ## Mapping
 
 - Persistence models (db tags) stay private to the adapter package when possible.
-- Nullability and DB defaults converted to domain values explicitly.
+- Nullability, zero values, and DB defaults convert to domain values explicitly (no silent zero-value domain objects).
+- Port methods return domain/application errors — never leak driver-specific types through the port.
 
 ## Forbidden
 
-- Importing persistence from domain or leaking `*sql.DB` through port APIs.
-- Building SQL strings in use cases.
+- Importing persistence from domain or leaking `*sql.DB` / ORM handles through port APIs.
+- Building SQL strings in use cases or handlers.
+- Returning scan structs / `sql.Null*` types across the port boundary.
 
 ## Tests
 
-- Integration tests with testcontainers / test DB preferred for repos; unit-test mappers with fixtures.
+- Integration: repository **contract** round-trip (save → load → error/not-found) against testcontainers / repo-standard test DB.
+- Unit-test mappers with fixtures; do **not** substitute `httptest` for a repository contract.
+- Agents: `integration-test-{planner,generator,healer}` + skill `integration-testing`; then `post-change-test`.

package/presets/claude/go/rules/architecture/application-usecases.md

@@ -5,25 +5,29 @@ paths:
   - **/application/**/*
 ---
 
-
 # Application / use cases
 
 - One use case ≈ one application service method (command/query).
 - Depend on **outbound ports** (interfaces), not concrete repos/clients.
 - Orchestrate domain; transaction boundaries via ports (`UnitOfWork`) when needed — still no SQL here.
 - Accept `context.Context` on public methods; propagate to ports.
+- Input/output types stay in application or domain — never handler DTOs, `http.Request`, or SQL row types.
 
 ## Forbidden
 
-- Importing `adapters/*`, SQL drivers, HTTP frameworks.
-- Embedding `*sql.DB`, Redis clients, or handler types in use-case structs.
-- Business rules that belong in domain entities (keep use cases thin).
+- Importing `adapters/*`, SQL drivers, HTTP/gRPC frameworks, broker clients.
+- Embedding `*sql.DB`, Redis/Kafka clients, or handler types in use-case structs.
+- Business rules that belong in domain entities (keep use cases thin orchestrators).
+- Starting DB transactions with concrete `*sql.Tx` — call a port (`UnitOfWork` / `Transactional`).
 
 ## Structure
 
 - Prefer `application/<usecase>.go` + `ports.go` (or `ports/`) colocated.
 - Inbound port = interface the driving adapter calls (optional if use-case struct is the API).
+- Map transport/persistence errors at adapters; use cases return domain/application errors.
 
 ## Tests
 
-- Mock outbound ports; assert domain outcomes and port interactions — no real DB.
+- Fake/mock **outbound ports** only; assert domain outcomes and port interactions — no real DB.
+- Table-driven cases for validation/branching; inject clock/ID seams when time/IDs matter.
+- After edits: `post-change-test` (+ `go-tooling`).

package/presets/claude/go/rules/architecture/boundaries.md

@@ -2,7 +2,6 @@
 description: Hexagonal layer boundaries for Go backends (domain, application, ports, adapters)
 ---
 
-
 # Границы слоёв (hexagonal)
 
 - **Domain** (`internal/domain`, `**/domain`):
@@ -23,6 +22,12 @@ description: Hexagonal layer boundaries for Go backends (domain, application, po
 - Domain never imports adapters or frameworks.
 - Cross-feature access — only via public ports / `pkg` API, not deep imports of another feature's internals.
 
+# Edit bundles (load on matching paths)
+
+- `**/domain/**` → `domain-layer`; `**/application/**` → `application-usecases` + `ports-interfaces`
+- Driving HTTP/gRPC → `adapters-driving` + `api-http` / `api-grpc`; persistence/messaging → `adapters-driven` + matching `*-adapters`
+- `cmd/**`, `internal/app/**` → `composition-root`; after `*.go` edits → `post-change-test` (+ `go-tooling`)
+
 # Требование к агенту
 
 - Класть файлы в правильный слой; не «коротить» слои ради скорости.

package/presets/claude/go/rules/architecture/composition-root.md

@@ -5,24 +5,29 @@ paths:
   - internal/app/**/*
 ---
 
-
 # Composition root
 
-- Construct adapters, use cases, and servers in `cmd/<service>` and/or `internal/app`.
-- Wire interfaces to implementations explicitly (manual DI preferred unless repo already uses a container).
-- Load config once; fail fast on missing required settings.
-- Lifecycle: graceful shutdown via `context` cancel + server `Shutdown`.
+- Construct adapters → use cases → servers in `cmd/<service>` and/or `internal/app`.
+- Wire interfaces to implementations explicitly (manual DI preferred unless the repo already uses a container).
+- Load config once; **fail fast** on missing required settings before opening listeners or connections.
+- Lifecycle: cancel root `context` → drain in-flight work → `Shutdown` servers → close driven adapters (DB/pool/clients) in reverse wire order.
 
 ## Allowed here
 
-- Import all layers for wiring only.
-- Process-wide loggers/metrics providers.
+- Import all layers **for wiring only**.
+- Process-wide loggers/metrics providers constructed once and injected.
 
 ## Forbidden
 
 - Business rules, SQL queries, HTTP routing tables with domain logic.
-- Global mutable singletons for repos without clear init (prefer explicit deps).
+- Global mutable singletons for repos without clear init (prefer explicit constructor deps).
+- Starting background workers without tying them to the root context / shutdown path.
+
+## Agent handoffs
+
+- After wiring changes: `post-change-test` (+ `go-tooling`) — at least compile / construction smoke.
+- Layer checklist: `feature-delivery-workflow` (domain → ports → adapters → wire).
 
 ## Tests
 
-- Optional smoke that wiring builds (compile-time / construction test); heavy logic stays in unit/integration tests.
+- Optional construction/smoke test that `NewApp`/`main` wiring builds; heavy logic stays in unit/integration tests.

package/presets/claude/go/rules/testing/e2e.md

@@ -5,14 +5,16 @@ paths:
   - **/*_e2e_test.go
 ---
 
-
 # E2E / HTTP smoke
 
-- Black-box against a running server (httptest with full composition root, or localhost in CI).
-- Cover critical paths only; prefer integration + unit for breadth.
-- Stable test data; avoid depending on wall-clock flakiness.
-- Do not use browser/Playwright tooling in this preset.
+> **Documented stub / scoped smoke:** Prefer `tests-integration` + `integration-test-*` for breadth. Expand this rule only when the consumer repo keeps a dedicated black-box smoke suite.
+
+- Black-box against a running server (`httptest` with full composition root, or localhost in CI).
+- Cover critical paths only; prefer integration + unit for most coverage.
+- Stable test data; avoid wall-clock flakiness and shared mutable fixtures.
+- Do **not** use browser/Playwright tooling in this preset (`preset-no-cross-stack-leakage`).
 
 ## Placement
 
-- `e2e/` package or `*_e2e_test.go` with build tags if needed.
+- `e2e/` package or `*_e2e_test.go` with build tags if the repo already separates smoke CI.
+- If smoke overlaps repository contracts, put the contract under `tests-integration` instead.

package/presets/claude/go/rules/testing/integration.md

@@ -5,19 +5,25 @@ paths:
   - **/*_integration_test.go
 ---
 
-
 # Integration tests
 
 - Exercise driven adapters against real infra doubles (testcontainers, docker compose test DB, miniredis, etc.).
 - Or exercise HTTP adapter with `httptest` + wired use case + fake/real ports — still no full prod cluster required.
-- Build tags (`//go:build integration`) if the repo separates CI jobs.
-- Keep fixtures deterministic; clean up data between tests.
+- Build tags (`//go:build integration`) when the repo separates CI jobs — discover the existing CI entrypoint; do not invent a second runner.
+- Keep fixtures deterministic; clean up / isolate data between tests (truncate, transaction rollback, or unique prefixes).
 
 ## Scope
 
-- Contract of a port implementation (repo save/load roundtrip).
-- Not a substitute for domain unit tests.
+- **Contract of a port implementation** (repo save/load/error round-trip) — assert semantics at the port, not only SQL rows.
+- HTTP adapter contract with `httptest` is valid **adapter** integration — it is **not** a substitute for a repository contract test.
+- Not a substitute for domain unit tests (table-driven domain logic stays in `tests-unit`).
+
+## Forbidden shortcuts
+
+- Fake-only “integration” that never crosses the adapter↔infra boundary for the port under test.
+- Skipping isolation so tests pass only in isolation or only on a dirty DB.
 
 ## Agents
 
 - Planning/generation: `integration-test-{planner,generator,healer}` + skill `integration-testing`.
+- After green tests: `post-change-test` (+ `go-tooling`).

package/presets/claude/go/rules/tooling-and-review/preset-token-budget.md

@@ -22,7 +22,7 @@ paths:
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/claude/go/rules/tooling-and-review/security-go.md

@@ -6,17 +6,29 @@ paths:
   - **/config/**/*
 ---
 
-
 # Security (Go)
 
-- Secrets from env/secret manager — never commit keys; do not log tokens/passwords.
+- Secrets from env/secret manager — never commit keys; **never log** tokens, passwords, raw `Authorization` headers, or cookie values.
 - Validate and canonicalize untrusted input at the driving adapter edge.
 - Prefer prepared statements / parameterized queries in persistence adapters.
 - TLS and secure cookie/header defaults when exposing HTTP.
 - AuthN/AuthZ in middleware or driving adapters; pass identity into use cases as domain value (user ID / claims), not raw headers.
-- Minimize PII in logs; redact where needed.
+- Minimize PII in structured logs; redact known sensitive fields by default.
 
 ## Config
 
-- Distinguish public vs secret config fields in types.
-- Fail closed when auth is misconfigured in production builds.
+- Distinguish public vs secret config fields in types (separate structs or tagged fields).
+- **Fail closed** when auth is misconfigured in production builds (missing issuer/JWKS/secret → refuse to start or reject requests).
+- Sample configs and README snippets must use placeholders — never real-looking secrets.
+
+## Forbidden
+
+- Hardcoded API keys/tokens in source or committed `.env` examples with live values.
+- Logging request/response bodies that may contain credentials without an explicit redact step.
+- Fail-open auth middleware when required validators are nil/empty in prod.
+
+## Tests
+
+- Negative assertions: logs/metrics fixtures must not contain bearer tokens or secret config values.
+- Missing/invalid auth config fails closed in a construction or middleware test.
+- Agents: `security-reviewer` on auth/config/logging changes; then `post-change-test`.

package/presets/claude/ios-swift/README.md

@@ -29,7 +29,7 @@ npx @bonesofspring/ai-rules init claude --preset ios-swift
 
 ## Session-start (= Cursor alwaysApply)
 
-Ровно **3** файла без `paths:`: `stack/ios-app-core.md`, `architecture/boundaries.md`, `tooling-and-review/code-quality.md`. Бюджет тела ≤120 строк суммарно.
+Ровно **3** файла без `paths:`: `stack/ios-app-core.md`, `architecture/boundaries.md`, `tooling-and-review/code-quality.md`. Бюджет тела ≤140 строк суммарно.
 
 ## Parity with Cursor
 

package/presets/claude/ios-swift/agents/build-verifier.md

@@ -38,7 +38,7 @@ When validating **ios-swift preset** changes (or `scope: preset-structure-valida
 6. **Twin presence (hard):** Cursor rule change → Claude twin same PR — **FAIL** if missing (next, ios-swift, go, and java).
 7. **Mapping / README:** Cursor→Claude mapping table present; core→stack mapping when `_shared` consumers exist.
 8. **shared-core consumers:** if `_shared/core/**` changed, update all `<!-- shared-core: … -->` consumers (or document intentional fork).
-9. **Session-start body budget:** sum of the **3** intended session-start rule bodies ≤ **120** lines (stretch ≤100); do **not** include `**/README.md` — record in report.
+9. **Session-start body budget:** sum of the **3** intended session-start rule bodies ≤ **140** lines (stretch ≤120); do **not** include `**/README.md` — record in report.
 10. **Embed drift (hard in `check:preset-structure`):** `packages/ai-rules/scripts/check-shared-core-drift.sh` with `AI_RULES_DRIFT_FAIL=1`.
 11. **Dogfood (monorepo soft):** `packages/ai-rules/scripts/sync-dogfood-cursor.sh`; mass deletion without migration doc → risk / FAIL for maintainers.
 

package/presets/claude/ios-swift/rules/README.md

@@ -13,7 +13,7 @@
 
 ## Loading budget
 
-- **Session-start (no `paths:`):** ровно **3** — `ios-app-core`, `boundaries`, `code-quality` (≤120 body lines total)
+- **Session-start (no `paths:`):** ровно **3** — `ios-app-core`, `boundaries`, `code-quality` (≤140 body lines total)
 - **Все остальные** — с `paths:` (commands/team/agents и/или Feature/Swift globs)
 - **Soft twin depth:** domain rules ≥15 body lines; thin aliases (`agent-team-intake`, `technical-retro`) могут быть короче (как next)
 

package/presets/claude/ios-swift/rules/tooling-and-review/preset-token-budget.md

@@ -22,7 +22,7 @@ paths:
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/claude/java/agents/build-verifier.md

@@ -30,7 +30,7 @@ Hard gates for the **java** stack:
 | Gate | FAIL when |
 |------|-----------|
 | **twin-map** | `java` missing from `STACKS`, or Cursor↔Claude orphan/missing twins |
-| **token-budget** | Cursor `alwaysApply` ≠ 3 or Claude session-start (excl. README) ≠ 3, or trio body sum > 120 |
+| **token-budget** | Cursor `alwaysApply` ≠ 3 or Claude session-start (excl. README) ≠ 3, or trio body sum > 140 |
 | **leakage** | `JAVA_FORBIDDEN_*` hits (Playwright/XCUITest/`lint:js`/`accessibility-reviewer` as required handoffs) |
 | **chain fork** | `hooks/chain-team-phases.sh` byte-identical to **next**, **ios-swift**, or **go** (same platform) |
 

package/presets/claude/java/rules/README.md

@@ -14,7 +14,7 @@ Claude topic `.md` files are **derived** from Cursor SoT `presets/cursor/java/ru
 
 - **Session-start (no `paths:`):** exactly **3** — `java-app-core`, `boundaries`, `code-quality`
 - All others — with `paths:`
-- **Twin depth:** domain rules target ≥15 body lines; thin aliases: `agent-team-intake`, `technical-retro`; **documented stubs** (v1): `api-grpc`, `messaging-adapters` — see Cursor `presets/cursor/java/rules/README.md` Catalog (Depth column)
+- **Twin depth:** domain rules target ≥15 body lines; thin aliases: `agent-team-intake`, `technical-retro`; **documented stub** (v1): `api-grpc`; `messaging-adapters` is **full** — see Cursor `presets/cursor/java/rules/README.md` Catalog (Depth column)
 
 ## Cursor → Claude mapping
 

package/presets/claude/java/rules/api-and-data/messaging-adapters.md

@@ -6,19 +6,26 @@ paths:
   - "**/adapters/messaging/**/*"
 ---
 
-# Messaging adapters (documented stub)
+# Messaging adapters
 
-> **Stub (v1):** Light guidance only — not a full Kafka/Rabbit/JMS cookbook. **When to use:** editing `adapters/**/messaging/**` or adding broker publishers/consumers. Prefer expanding this rule when the consumer repo standardizes on a broker.
-
-- **Publisher** (driven): implements outbound port; serializes domain events / integration events.
-- **Consumer** (driving): deserializes → calls use case / inbound port; ack/nack policy here.
-- Idempotency keys and retry/DLQ are adapter concerns; document at-least-once assumptions.
-- Do not put broker client types (`KafkaTemplate`, JMS sessions, etc.) in domain or application signatures.
+- **Publisher** (driven): implements an outbound port; serializes application/domain events to wire format inside the adapter.
+- **Consumer** (driving): deserializes → maps to application/domain types → calls inbound port / use case; **ack/nack** (and commit) stays in the adapter.
+- Idempotency keys, retry, and DLQ/parking-lot policy are adapter (or infra) concerns — document at-least-once vs exactly-once assumptions at the port.
+- Use the broker client already present in the repo (`KafkaTemplate`, JMS, Spring Cloud Stream, etc.) — do not invent a second stack.
 
 ## Event shapes
 
-- Prefer explicit event types in application or a small `events` package used by ports — map to wire format in the adapter.
+- Prefer explicit event types in application or a small `events` package used by ports.
+- Map wire DTOs ↔ application events **only** in the adapter; never pass `ConsumerRecord` / broker payloads into domain.
+
+## Forbidden
+
+- Broker client types (`KafkaTemplate`, JMS sessions, `MessageListener`) in domain or application signatures.
+- Business rules inside listeners beyond mapping + calling one use case.
+- Silent catch-and-ack that drops poison messages without DLQ/metrics policy.
 
 ## Tests
 
-- Unit-test mapping with fakes; integration against embedded/broker Testcontainers when the repo has them.
+- Unit-test mapping and idempotency branches with fakes.
+- Integration against embedded broker / Testcontainers **when the repo already has that setup**.
+- After edits: `post-change-test` (+ `java-tooling`); agents `integration-test-*` when adding consumer contracts.

package/presets/claude/java/rules/architecture/boundaries.md

@@ -2,7 +2,6 @@
 description: Hexagonal layer boundaries for Java backends (domain, application, ports, adapters)
 ---
 
-
 # Границы слоёв (hexagonal)
 
 - **Domain** (`**/domain`):
@@ -23,6 +22,12 @@ description: Hexagonal layer boundaries for Java backends (domain, application,
 - Domain never imports adapters or frameworks.
 - Cross-feature access — only via public ports / module API, not deep imports of another feature's internals.
 
+# Edit bundles (load on matching paths)
+
+- `**/domain/**` → `domain-layer`; `**/application/**` → `application-usecases` + `ports-interfaces`
+- Inbound HTTP/gRPC → `adapters-driving` + `api-http` / `api-grpc`; outbound persistence/messaging → `adapters-driven` + matching `*-adapters`
+- `**/configuration/**`, `*Application.java` → `composition-root`; after `*.java` edits → `post-change-test` (+ `java-tooling`)
+
 # Требование к агенту
 
 - Класть файлы в правильный слой; не «коротить» слои ради скорости.

package/presets/claude/java/rules/tooling-and-review/preset-token-budget.md

@@ -22,7 +22,7 @@ paths:
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/claude/next/agents/build-verifier.md

@@ -36,7 +36,7 @@ When validating **preset packaging** changes (paths under `packages/ai-rules/pre
 3. **Mapping / README:** `rules/README.md` must include a Cursor→Claude mapping table; document core→stack mapping when `_shared` consumers exist.
 4. **shared-core consumers:** if `_shared/core/**` changed, every file with matching `<!-- shared-core: … -->` in this PR must be updated (or intentional fork documented).
 5. **Twin presence:** Cursor rule change without Claude twin same PR → **FAIL** (next, ios-swift, go, and java). Domain twin body ≥15 lines; thin aliases may be shorter.
-6. **Session-start body budget:** sum body lines of the **3** intended session-start rules ≤ **120** (stretch ≤100); do **not** include `**/README.md` — record in validation-report; FAIL if grossly over.
+6. **Session-start body budget:** sum body lines of the **3** intended session-start rules ≤ **140** (stretch ≤120); do **not** include `**/README.md` — record in validation-report; FAIL if grossly over.
 7. **Embed drift (hard in `check:preset-structure`):** run `packages/ai-rules/scripts/check-shared-core-drift.sh` with `AI_RULES_DRIFT_FAIL=1` (bundled by the structure orchestrator). Lineage stems excluded from body equality.
 8. **Dogfood (monorepo soft):** prefer `packages/ai-rules/scripts/sync-dogfood-cursor.sh`; mass dogfood deletion without migration doc → risk / FAIL for maintainers.
 

package/presets/claude/next/rules/tooling-and-review/preset-token-budget.md

@@ -22,7 +22,7 @@ paths:
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/cursor/go/rules/README.md

@@ -8,13 +8,13 @@
 | `architecture-boundaries` | Hexagonal invariants |
 | `code-quality-and-refactoring` | Shared quality + Go notes |
 
-**Session-start body budget:** sum of the 3 always-on bodies ≤ **120** lines (stretch ≤100).
+**Session-start body budget:** sum of the 3 always-on bodies ≤ **140** lines (stretch ≤120).
 
 ## Twin depth (Cursor↔Claude)
 
 - **Domain** rules: target ≥15 non-empty body lines (FAIL soft when undocumented stubs).
 - **Thin aliases** (may be shorter): `agent-team-intake`, `technical-retro`.
-- **Documented stubs** (checklist-style, expand in consumer Stack notes / target repo): see Catalog **Depth** column (`stub`). High-traffic stems (`domain-layer`, `ports-interfaces`, `adapters-*`, `post-change-test`, `go-tooling`) are expanded to **full** depth.
+- **Documented stubs** (checklist-style, expand in consumer Stack notes / target repo): see Catalog **Depth** column (`stub`). High-traffic stems (`domain-layer`, `ports-interfaces`, `adapters-*`, `application-usecases`, `composition-root`, `persistence-adapters`, `tests-integration`, `security-go`, `post-change-test`, `go-tooling`) are expanded to **full** depth.
 
 ## Loading strategy
 
@@ -71,21 +71,21 @@ Claude twins + Cursor→Claude map: `presets/claude/go/rules/README.md`. Cross-s
 | `technical-retro` | thin-alias | |
 | `api-grpc` | stub | optional transport; expand when repo uses gRPC |
 | `domain-layer` | full | high-traffic hexagonal |
-| `application-usecases` | stub | |
+| `application-usecases` | full | use-case ports, Forbidden, unit via fakes |
 | `ports-interfaces` | full | high-traffic hexagonal |
 | `adapters-driven` | full | high-traffic hexagonal |
 | `adapters-driving` | full | high-traffic hexagonal |
-| `composition-root` | stub | |
+| `composition-root` | full | wire order, shutdown, construction smoke |
 | `api-http` | full | thin handlers, resilience, idempotency/bulkhead |
-| `persistence-adapters` | stub | |
+| `persistence-adapters` | full | port contract, no `*sql.DB` leak |
 | `messaging-adapters` | stub | |
 | `module-public-api` | stub | |
 | `go-conventions` | full | errors, interfaces at call site, anti-hallucination |
 | `go-tooling` | full | requestable toolchain |
 | `post-change-test` | full | requestable gate |
-| `security-go` | stub | |
+| `security-go` | full | redact, fail-closed auth, secret tests |
 | `tests-unit` | stub | |
-| `tests-integration` | stub | |
-| `tests-e2e` | stub | optional smoke; prefer integration-test-* |
+| `tests-integration` | full | repo contract vs httptest; isolation |
+| `tests-e2e` | stub | scoped smoke banner; prefer integration-test-* |
 
 **Всего topic `.mdc`:** 27 domain + 5 preset-meta (без README) = 32.

package/presets/cursor/go/rules/application-usecases.mdc

@@ -6,25 +6,29 @@ globs:
 alwaysApply: false
 ---
 
-
 # Application / use cases
 
 - One use case ≈ one application service method (command/query).
 - Depend on **outbound ports** (interfaces), not concrete repos/clients.
 - Orchestrate domain; transaction boundaries via ports (`UnitOfWork`) when needed — still no SQL here.
 - Accept `context.Context` on public methods; propagate to ports.
+- Input/output types stay in application or domain — never handler DTOs, `http.Request`, or SQL row types.
 
 ## Forbidden
 
-- Importing `adapters/*`, SQL drivers, HTTP frameworks.
-- Embedding `*sql.DB`, Redis clients, or handler types in use-case structs.
-- Business rules that belong in domain entities (keep use cases thin).
+- Importing `adapters/*`, SQL drivers, HTTP/gRPC frameworks, broker clients.
+- Embedding `*sql.DB`, Redis/Kafka clients, or handler types in use-case structs.
+- Business rules that belong in domain entities (keep use cases thin orchestrators).
+- Starting DB transactions with concrete `*sql.Tx` — call a port (`UnitOfWork` / `Transactional`).
 
 ## Structure
 
 - Prefer `application/<usecase>.go` + `ports.go` (or `ports/`) colocated.
 - Inbound port = interface the driving adapter calls (optional if use-case struct is the API).
+- Map transport/persistence errors at adapters; use cases return domain/application errors.
 
 ## Tests
 
-- Mock outbound ports; assert domain outcomes and port interactions — no real DB.
+- Fake/mock **outbound ports** only; assert domain outcomes and port interactions — no real DB.
+- Table-driven cases for validation/branching; inject clock/ID seams when time/IDs matter.
+- After edits: `post-change-test` (+ `go-tooling`).

package/presets/cursor/go/rules/architecture-boundaries.mdc

@@ -24,6 +24,12 @@ alwaysApply: true
 - Domain never imports adapters or frameworks.
 - Cross-feature access — only via public ports / `pkg` API, not deep imports of another feature's internals.
 
+# Edit bundles (load on matching paths)
+
+- `**/domain/**` → `domain-layer`; `**/application/**` → `application-usecases` + `ports-interfaces`
+- Driving HTTP/gRPC → `adapters-driving` + `api-http` / `api-grpc`; persistence/messaging → `adapters-driven` + matching `*-adapters`
+- `cmd/**`, `internal/app/**` → `composition-root`; after `*.go` edits → `post-change-test` (+ `go-tooling`)
+
 # Требование к агенту
 
 - Класть файлы в правильный слой; не «коротить» слои ради скорости.

package/presets/cursor/go/rules/composition-root.mdc

@@ -6,24 +6,29 @@ globs:
 alwaysApply: false
 ---
 
-
 # Composition root
 
-- Construct adapters, use cases, and servers in `cmd/<service>` and/or `internal/app`.
-- Wire interfaces to implementations explicitly (manual DI preferred unless repo already uses a container).
-- Load config once; fail fast on missing required settings.
-- Lifecycle: graceful shutdown via `context` cancel + server `Shutdown`.
+- Construct adapters → use cases → servers in `cmd/<service>` and/or `internal/app`.
+- Wire interfaces to implementations explicitly (manual DI preferred unless the repo already uses a container).
+- Load config once; **fail fast** on missing required settings before opening listeners or connections.
+- Lifecycle: cancel root `context` → drain in-flight work → `Shutdown` servers → close driven adapters (DB/pool/clients) in reverse wire order.
 
 ## Allowed here
 
-- Import all layers for wiring only.
-- Process-wide loggers/metrics providers.
+- Import all layers **for wiring only**.
+- Process-wide loggers/metrics providers constructed once and injected.
 
 ## Forbidden
 
 - Business rules, SQL queries, HTTP routing tables with domain logic.
-- Global mutable singletons for repos without clear init (prefer explicit deps).
+- Global mutable singletons for repos without clear init (prefer explicit constructor deps).
+- Starting background workers without tying them to the root context / shutdown path.
+
+## Agent handoffs
+
+- After wiring changes: `post-change-test` (+ `go-tooling`) — at least compile / construction smoke.
+- Layer checklist: `feature-delivery-workflow` (domain → ports → adapters → wire).
 
 ## Tests
 
-- Optional smoke that wiring builds (compile-time / construction test); heavy logic stays in unit/integration tests.
+- Optional construction/smoke test that `NewApp`/`main` wiring builds; heavy logic stays in unit/integration tests.

package/presets/cursor/go/rules/persistence-adapters.mdc

@@ -6,24 +6,27 @@ globs:
 alwaysApply: false
 ---
 
-
 # Persistence adapters
 
 - Implement outbound repository ports from application.
-- Use parameterized queries; map rows → domain entities inside the adapter.
+- Use **parameterized** queries; map rows → domain entities **inside** the adapter.
 - Transactions: expose via port (`Transactional`, `UnitOfWork`) implemented here — use cases call the port, not `*sql.Tx` directly.
-- Migrations live with infra (separate package/dir) — not in domain.
+- Migrations live with infra (separate package/dir) — not in domain or application.
 
 ## Mapping
 
 - Persistence models (db tags) stay private to the adapter package when possible.
-- Nullability and DB defaults converted to domain values explicitly.
+- Nullability, zero values, and DB defaults convert to domain values explicitly (no silent zero-value domain objects).
+- Port methods return domain/application errors — never leak driver-specific types through the port.
 
 ## Forbidden
 
-- Importing persistence from domain or leaking `*sql.DB` through port APIs.
-- Building SQL strings in use cases.
+- Importing persistence from domain or leaking `*sql.DB` / ORM handles through port APIs.
+- Building SQL strings in use cases or handlers.
+- Returning scan structs / `sql.Null*` types across the port boundary.
 
 ## Tests
 
-- Integration tests with testcontainers / test DB preferred for repos; unit-test mappers with fixtures.
+- Integration: repository **contract** round-trip (save → load → error/not-found) against testcontainers / repo-standard test DB.
+- Unit-test mappers with fixtures; do **not** substitute `httptest` for a repository contract.
+- Agents: `integration-test-{planner,generator,healer}` + skill `integration-testing`; then `post-change-test`.

package/presets/cursor/go/rules/preset-token-budget.mdc

@@ -22,7 +22,7 @@ alwaysApply: false
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/cursor/go/rules/security-go.mdc

@@ -7,17 +7,29 @@ globs:
 alwaysApply: false
 ---
 
-
 # Security (Go)
 
-- Secrets from env/secret manager — never commit keys; do not log tokens/passwords.
+- Secrets from env/secret manager — never commit keys; **never log** tokens, passwords, raw `Authorization` headers, or cookie values.
 - Validate and canonicalize untrusted input at the driving adapter edge.
 - Prefer prepared statements / parameterized queries in persistence adapters.
 - TLS and secure cookie/header defaults when exposing HTTP.
 - AuthN/AuthZ in middleware or driving adapters; pass identity into use cases as domain value (user ID / claims), not raw headers.
-- Minimize PII in logs; redact where needed.
+- Minimize PII in structured logs; redact known sensitive fields by default.
 
 ## Config
 
-- Distinguish public vs secret config fields in types.
-- Fail closed when auth is misconfigured in production builds.
+- Distinguish public vs secret config fields in types (separate structs or tagged fields).
+- **Fail closed** when auth is misconfigured in production builds (missing issuer/JWKS/secret → refuse to start or reject requests).
+- Sample configs and README snippets must use placeholders — never real-looking secrets.
+
+## Forbidden
+
+- Hardcoded API keys/tokens in source or committed `.env` examples with live values.
+- Logging request/response bodies that may contain credentials without an explicit redact step.
+- Fail-open auth middleware when required validators are nil/empty in prod.
+
+## Tests
+
+- Negative assertions: logs/metrics fixtures must not contain bearer tokens or secret config values.
+- Missing/invalid auth config fails closed in a construction or middleware test.
+- Agents: `security-reviewer` on auth/config/logging changes; then `post-change-test`.

package/presets/cursor/go/rules/tests-e2e.mdc

@@ -6,14 +6,16 @@ globs:
 alwaysApply: false
 ---
 
-
 # E2E / HTTP smoke
 
-- Black-box against a running server (httptest with full composition root, or localhost in CI).
-- Cover critical paths only; prefer integration + unit for breadth.
-- Stable test data; avoid depending on wall-clock flakiness.
-- Do not use browser/Playwright tooling in this preset.
+> **Documented stub / scoped smoke:** Prefer `tests-integration` + `integration-test-*` for breadth. Expand this rule only when the consumer repo keeps a dedicated black-box smoke suite.
+
+- Black-box against a running server (`httptest` with full composition root, or localhost in CI).
+- Cover critical paths only; prefer integration + unit for most coverage.
+- Stable test data; avoid wall-clock flakiness and shared mutable fixtures.
+- Do **not** use browser/Playwright tooling in this preset (`preset-no-cross-stack-leakage`).
 
 ## Placement
 
-- `e2e/` package or `*_e2e_test.go` with build tags if needed.
+- `e2e/` package or `*_e2e_test.go` with build tags if the repo already separates smoke CI.
+- If smoke overlaps repository contracts, put the contract under `tests-integration` instead.

package/presets/cursor/go/rules/tests-integration.mdc

@@ -6,19 +6,25 @@ globs:
 alwaysApply: false
 ---
 
-
 # Integration tests
 
 - Exercise driven adapters against real infra doubles (testcontainers, docker compose test DB, miniredis, etc.).
 - Or exercise HTTP adapter with `httptest` + wired use case + fake/real ports — still no full prod cluster required.
-- Build tags (`//go:build integration`) if the repo separates CI jobs.
-- Keep fixtures deterministic; clean up data between tests.
+- Build tags (`//go:build integration`) when the repo separates CI jobs — discover the existing CI entrypoint; do not invent a second runner.
+- Keep fixtures deterministic; clean up / isolate data between tests (truncate, transaction rollback, or unique prefixes).
 
 ## Scope
 
-- Contract of a port implementation (repo save/load roundtrip).
-- Not a substitute for domain unit tests.
+- **Contract of a port implementation** (repo save/load/error round-trip) — assert semantics at the port, not only SQL rows.
+- HTTP adapter contract with `httptest` is valid **adapter** integration — it is **not** a substitute for a repository contract test.
+- Not a substitute for domain unit tests (table-driven domain logic stays in `tests-unit`).
+
+## Forbidden shortcuts
+
+- Fake-only “integration” that never crosses the adapter↔infra boundary for the port under test.
+- Skipping isolation so tests pass only in isolation or only on a dirty DB.
 
 ## Agents
 
 - Planning/generation: `integration-test-{planner,generator,healer}` + skill `integration-testing`.
+- After green tests: `post-change-test` (+ `go-tooling`).

package/presets/cursor/ios-swift/agents/build-verifier.md

@@ -38,7 +38,7 @@ When validating **ios-swift preset** changes (or `scope: preset-structure-valida
 6. **Twin presence (hard):** Cursor rule change → Claude twin present **same PR** — **FAIL** if missing (next, ios-swift, go, and java).
 7. **Mapping / README:** `claude/ios-swift/rules/README.md` mapping table present; core→stack mapping documented when `_shared` consumers exist.
 8. **shared-core consumers:** if `_shared/core/**` changed, every matching `<!-- shared-core: … -->` consumer in this PR must be updated (or intentional fork documented).
-9. **Session-start body budget:** sum of the **3** intended always-on / session-start rule bodies ≤ **120** lines (stretch ≤100); do **not** include `**/README.md` — record in report.
+9. **Session-start body budget:** sum of the **3** intended always-on / session-start rule bodies ≤ **140** lines (stretch ≤120); do **not** include `**/README.md` — record in report.
 10. **Embed drift (hard in `check:preset-structure`):** `packages/ai-rules/scripts/check-shared-core-drift.sh` with `AI_RULES_DRIFT_FAIL=1`.
 11. **Dogfood (monorepo soft):** `packages/ai-rules/scripts/sync-dogfood-cursor.sh`; mass deletion without migration doc → risk / FAIL for maintainers.
 

package/presets/cursor/ios-swift/rules/README.md

@@ -13,7 +13,7 @@
 
 ### Пресет ios-swift — карта правил
 
-**alwaysApply budget:** **≤3** always-on правила и **≤120** строк тела (после YAML) суммарно (stretch ≤100). Новые alwaysApply только вместе с сокращением существующего бюджета.
+**alwaysApply budget:** **≤3** always-on правила и **≤140** строк тела (после YAML) суммарно (stretch ≤120). Новые alwaysApply только вместе с сокращением существующего бюджета.
 
 | Файл | Скоуп | Тема |
 |------|--------|------|

package/presets/cursor/ios-swift/rules/preset-token-budget.mdc

@@ -22,7 +22,7 @@ alwaysApply: false
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/cursor/java/README.md

@@ -10,7 +10,7 @@ npx @bonesofspring/ai-rules init cursor --preset java
 
 | Path | Role |
 |------|------|
-| `rules/*.mdc` | Cursor SoT (~32 stems); always-on trio ≤120 lines |
+| `rules/*.mdc` | Cursor SoT (~32 stems); always-on trio ≤140 lines |
 | `agents/` | 21 agents + README (no a11y / Playwright / XCUITest) |
 | `skills/` | 8 skills + README |
 | `commands/` | 5 slash commands |

package/presets/cursor/java/agents/build-verifier.md

@@ -30,7 +30,7 @@ Hard gates for the **java** stack:
 | Gate | FAIL when |
 |------|-----------|
 | **twin-map** | `java` missing from `STACKS`, or Cursor↔Claude orphan/missing twins |
-| **token-budget** | Cursor `alwaysApply` ≠ 3 or Claude session-start (excl. README) ≠ 3, or trio body sum > 120 |
+| **token-budget** | Cursor `alwaysApply` ≠ 3 or Claude session-start (excl. README) ≠ 3, or trio body sum > 140 |
 | **leakage** | `JAVA_FORBIDDEN_*` hits (Playwright/XCUITest/`lint:js`/`accessibility-reviewer` as required handoffs) |
 | **chain fork** | `hooks/chain-team-phases.sh` byte-identical to **next**, **ios-swift**, or **go** (same platform) |
 

package/presets/cursor/java/rules/README.md

@@ -8,13 +8,13 @@
 | `architecture-boundaries` | Hexagonal invariants |
 | `code-quality-and-refactoring` | Shared quality + Java notes |
 
-**Session-start body budget:** sum of the 3 always-on bodies ≤ **120** lines (stretch ≤100).
+**Session-start body budget:** sum of the 3 always-on bodies ≤ **140** lines (stretch ≤120).
 
 ## Twin depth (Cursor↔Claude)
 
 - **Domain** rules: target ≥15 non-empty body lines (FAIL soft when undocumented stubs).
 - **Thin aliases** (may be shorter): `agent-team-intake`, `technical-retro`.
-- **Documented stubs** (v1): `api-grpc`, `messaging-adapters` — catalog Depth=`stub`; bodies carry an in-file stub banner + when-to-use.
+- **Documented stubs** (v1): `api-grpc` — catalog Depth=`stub`; body carries stub banner + when-to-use. `messaging-adapters` expanded to **full** for dogfood J3.
 
 ## Loading strategy
 
@@ -78,7 +78,7 @@ Claude twins + Cursor→Claude map: `presets/claude/java/rules/README.md`. Cross
 | `composition-root` | full | Spring `@Configuration` + plain Java bootstrap |
 | `api-http` | full | Spring MVC/Jakarta; DTO validation/mapping |
 | `persistence-adapters` | full | JPA/JDBC; entities do not leak upward |
-| `messaging-adapters` | stub | optional; stub banner + when-to-use |
+| `messaging-adapters` | full | publisher/consumer, idempotency, ack/DLQ |
 | `module-public-api` | full | package/module boundaries |
 | `java-conventions` | full | records, exceptions, naming, no invented APIs |
 | `java-tooling` | full | requestable Maven/Gradle detect |
@@ -94,6 +94,6 @@ Claude twins + Cursor→Claude map: `presets/claude/java/rules/README.md`. Cross
 
 - Spring Boot hexagonal = public default; plain Java / Quarkus / Micronaut / Jakarta = documented variants
 - Layer-first single-module = default; multi-module = documented variant
-- gRPC/messaging = documented stubs in v1
+- gRPC = documented stub in v1; messaging adapters = full (broker-agnostic)
 - MCP = Context7 only
 - Static analysis = discover from repo/CI (no mandated Checkstyle/SpotBugs/Error Prone)

package/presets/cursor/java/rules/architecture-boundaries.mdc

@@ -24,6 +24,12 @@ alwaysApply: true
 - Domain never imports adapters or frameworks.
 - Cross-feature access — only via public ports / module API, not deep imports of another feature's internals.
 
+# Edit bundles (load on matching paths)
+
+- `**/domain/**` → `domain-layer`; `**/application/**` → `application-usecases` + `ports-interfaces`
+- Inbound HTTP/gRPC → `adapters-driving` + `api-http` / `api-grpc`; outbound persistence/messaging → `adapters-driven` + matching `*-adapters`
+- `**/configuration/**`, `*Application.java` → `composition-root`; after `*.java` edits → `post-change-test` (+ `java-tooling`)
+
 # Требование к агенту
 
 - Класть файлы в правильный слой; не «коротить» слои ради скорости.

package/presets/cursor/java/rules/messaging-adapters.mdc

@@ -1,5 +1,5 @@
 ---
-description: Messaging driven/driving adapters for Java hexagonal services (stub)
+description: Messaging driven/driving adapters for Java hexagonal services
 globs:
   - "**/adapters/outbound/messaging/**/*"
   - "**/adapters/inbound/messaging/**/*"
@@ -7,20 +7,26 @@ globs:
 alwaysApply: false
 ---
 
+# Messaging adapters
 
-# Messaging adapters (documented stub)
+- **Publisher** (driven): implements an outbound port; serializes application/domain events to wire format inside the adapter.
+- **Consumer** (driving): deserializes → maps to application/domain types → calls inbound port / use case; **ack/nack** (and commit) stays in the adapter.
+- Idempotency keys, retry, and DLQ/parking-lot policy are adapter (or infra) concerns — document at-least-once vs exactly-once assumptions at the port.
+- Use the broker client already present in the repo (`KafkaTemplate`, JMS, Spring Cloud Stream, etc.) — do not invent a second stack.
 
-> **Stub (v1):** Light guidance only — not a full Kafka/Rabbit/JMS cookbook. **When to use:** editing `adapters/**/messaging/**` or adding broker publishers/consumers. Prefer expanding this rule when the consumer repo standardizes on a broker.
+## Event shapes
 
-- **Publisher** (driven): implements outbound port; serializes domain events / integration events.
-- **Consumer** (driving): deserializes → calls use case / inbound port; ack/nack policy here.
-- Idempotency keys and retry/DLQ are adapter concerns; document at-least-once assumptions.
-- Do not put broker client types (`KafkaTemplate`, JMS sessions, etc.) in domain or application signatures.
+- Prefer explicit event types in application or a small `events` package used by ports.
+- Map wire DTOs ↔ application events **only** in the adapter; never pass `ConsumerRecord` / broker payloads into domain.
 
-## Event shapes
+## Forbidden
 
-- Prefer explicit event types in application or a small `events` package used by ports — map to wire format in the adapter.
+- Broker client types (`KafkaTemplate`, JMS sessions, `MessageListener`) in domain or application signatures.
+- Business rules inside listeners beyond mapping + calling one use case.
+- Silent catch-and-ack that drops poison messages without DLQ/metrics policy.
 
 ## Tests
 
-- Unit-test mapping with fakes; integration against embedded/broker Testcontainers when the repo has them.
+- Unit-test mapping and idempotency branches with fakes.
+- Integration against embedded broker / Testcontainers **when the repo already has that setup**.
+- After edits: `post-change-test` (+ `java-tooling`); agents `integration-test-*` when adding consumer contracts.

package/presets/cursor/java/rules/preset-token-budget.mdc

@@ -22,7 +22,7 @@ alwaysApply: false
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules
 

package/presets/cursor/next/agents/build-verifier.md

@@ -37,7 +37,7 @@ When validating **preset packaging** changes (paths under `packages/ai-rules/pre
 3. **Mapping / README:** `claude/next/rules/README.md` must include a Cursor→Claude mapping table; stack `rules/README.md` should document core→stack mapping when `_shared` consumers exist.
 4. **shared-core consumers:** if `_shared/core/**` changed, every file with matching `<!-- shared-core: … -->` in this PR must be updated (or intentional fork documented in validation-report).
 5. **Twin presence:** Cursor rule change without Claude twin same PR → **FAIL** (next, ios-swift, go, and java). Domain twin body ≥15 lines; thin aliases (`agent-team-intake`, `technical-retro`) may be shorter.
-6. **Session-start body budget (soft→document, FAIL if grossly over):** sum body lines of the **3** intended always-on / session-start rules ≤ **120** (stretch ≤100); do **not** include `**/README.md`. Record the sum in validation-report.
+6. **Session-start body budget (soft→document, FAIL if grossly over):** sum body lines of the **3** intended always-on / session-start rules ≤ **140** (stretch ≤120); do **not** include `**/README.md`. Record the sum in validation-report.
 7. **Embed drift (hard in `check:preset-structure`):** run `packages/ai-rules/scripts/check-shared-core-drift.sh` with `AI_RULES_DRIFT_FAIL=1` (bundled by the structure orchestrator). Lineage stems are excluded from body equality.
 8. **Dogfood (monorepo soft):** if root `.cursor/` is in the PR, prefer sync via `packages/ai-rules/scripts/sync-dogfood-cursor.sh`; mass deletion of tracked dogfood without migration doc → note as risk / FAIL for maintainers.
 

package/presets/cursor/next/rules/preset-token-budget.mdc

@@ -22,7 +22,7 @@ alwaysApply: false
 
 **Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
 
-Session-start body budget (где задокументировано): ≤120 строк суммарно (stretch ≤100).
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
 
 ## Meta / author rules