@next-friday/create-app 2.1.9 → 4.0.0

package/templates/nodejs/.github/workflows/ci.yml

@@ -164,6 +164,50 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
+  triage:
+    name: Triage failed build
+    needs:
+      - checks
+      - image
+    if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read # Needed to read the logs of the failed jobs.
+      id-token: write # Needed to authenticate to Anthropic with the workflow's OIDC token.
+      pull-requests: write # Needed to post the summary on the pull request.
+    steps:
+      - name: Collect the build log
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          mkdir -p out
+          for job in $(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/jobs" --paginate --jq '.jobs[] | select(.conclusion == "failure") | .id'); do
+            gh api "repos/$REPOSITORY/actions/jobs/$job/logs" >> out/build.log
+          done
+      - name: Triage failed build
+        id: triage
+        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
+        with:
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          prompt: >
+            Read the build log at out/build.log. Identify the most
+            likely cause, say whether the failure looks flaky or real, and write a
+            three-line summary for the PR thread.
+          claude_args: >-
+            --allowedTools "Read"
+            --json-schema '{"type":"object","properties":{"summary":{"type":"string"}},"required":["summary"]}'
+      - name: Post the summary
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+          SUMMARY: ${{ fromJSON(steps.triage.outputs.structured_output).summary }}
+        run: gh pr comment "$PR_NUMBER" --repo "$REPOSITORY" --body "$SUMMARY"
+
   ci:
     name: All Checks
     if: always()

package/templates/nodejs/AGENTS.md

@@ -13,18 +13,31 @@ TypeScript HTTP service on `node:http`, without a framework, on pnpm and Node.js
 | Every check                 | `pnpm verify`                                       |
 | Render rules after a change | `pnpm rules:sync`                                   |
 
-## How it fits together
+## Verifying your work
+
+- Build: `pnpm build` (prints nothing after `$ tsc -p tsconfig.build.json`)
+- Test: `pnpm test:coverage` (all green, then the coverage summary; never skip or delete a failing test)
+- Lint: `pnpm verify:static` (ESLint allows zero warnings; prints `✔ no dependency violations found`)
+
+Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
+If a test fails, fix the code, not the test.
+
+## Architecture
 
 - `src/main.ts` starts `createAppServer()` from `src/server.ts` on `parsePort(process.env.PORT)`, and on `SIGTERM` or `SIGINT` stops accepting connections and closes any left after 10 seconds.
 - `src/server.ts` answers `GET` and `HEAD` `/health` and returns 404 for every other request. Routes go there.
 
-## Mandatory rules
+## Conventions
 
-1. **Follow `.agents/rules/`.** `.agents/rules.json` gives each rule's scope; Claude Code and Cursor load them. After changing either, run `pnpm rules:sync`; `pnpm check` fails on stale copies.
+1. **Follow `.agents/rules/`.** `.agents/rules.json` gives each rule's scope; Claude Code and Cursor load them. After changing either, or a skill or subagent in `.agents/skills/` or `.agents/agents/`, run `pnpm rules:sync`; `pnpm check` fails on stale copies.
 2. **Put tests next to the code as `src/**/*.test.ts`.** Vitest collects only that pattern.
 3. **Read configuration from environment variables and fail when one is missing**, as `parsePort` does. Document each variable in `.env.example`; `pnpm start` and `pnpm start:dev` load `.env`.
+4. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
+5. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
+
+## Things Claude gets wrong
 
-## Known pitfalls
+When Claude makes a mistake twice, add the correction here.
 
 - **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 

package/templates/nodejs/README.md

@@ -14,22 +14,7 @@ The server listens on the port set by `PORT` in `.env`, which the CLI created fr
 
 ## After creating a project from this template
 
-1. Install gitleaks and jq (see [CONTRIBUTING.md](CONTRIBUTING.md)). Make the first commit on `main` and push it. The Git hooks allow only this first commit and push on `main`; work on branches after that.
-
-   ```sh
-   git add --all
-   git commit -m "chore(repo): start from template"
-   git push --set-upstream origin main
-   ```
-
-2. Add your team as the owner of every file in `.github/CODEOWNERS`, and replace the owner placeholder in `.github/zizmor.yml`.
-3. Replace the template's description and owner: `package.json#description`, `repository.url`, and `author`. Change `license` from `UNLICENSED` if the project is open source.
-4. In the repository settings:
-   - **Actions → General → Workflow permissions:** select **Read repository contents and packages permissions**. Every workflow requests the extra permissions it needs.
-   - **Advanced Security:** enable private vulnerability reporting, Dependabot alerts, Dependabot security updates, secret scanning, and push protection. `SECURITY.md` sends reporters to private vulnerability reporting.
-   - **Cursor Bugbot:** enable the repository at [Bugbot](https://cursor.com/automations/from-cursor/bugbot). Bugbot reviews pull requests against the rules linked from `.cursor/BUGBOT.md`.
-   - **Rules → Rulesets:** protect `main` with squash merges only, a linear history, no force pushes or deletion, and the required checks `All Checks` and `Validate pull request title`. Rulesets in a private repository need GitHub Pro, Team, or Enterprise; on GitHub Free, make the repository public or upgrade.
-   - Create the `needs triage` label, which the issue forms apply: `gh label create "needs triage"`.
+Follow [SETUP.md](SETUP.md) in order. It sets up the repository, the reviews, and the AI-native SDLC.
 
 ## Scripts
 

package/templates/payload/.agents/agents/verifier.md

@@ -0,0 +1 @@
+Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/payload/.agents/mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": ["@playwright/mcp@0.0.83"]
+    }
+  }
+}

package/templates/payload/.agents/rules.json

@@ -12,7 +12,25 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "globs": [
+      ".agents/rules/**",
+      ".agents/rules.json",
+      ".agents/hooks/**",
+      ".claude/settings.json",
+      ".claude/rules/**",
+      ".cursor/rules/**",
+      ".cursor/hooks/**",
+      ".cursor/hooks.json",
+      "scripts/sync-agent-rules.ts",
+      "scripts/check-agent-gates.ts",
+      ".husky/**",
+      ".commitlintrc.json",
+      ".prettierrc.json",
+      "eslint.config.ts",
+      ".lintstagedrc.json",
+      ".gitleaks.toml"
+    ]
   },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
@@ -32,28 +50,24 @@
     "globs": ["**/*.test.ts", "**/*.test.tsx"]
   },
   "diagnostics-and-error-handling": {
-    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "evidence-before-claims": {
     "description": "Evidence: verify and cite a claim before stating or writing it"
   },
-  "git-workflow": {
-    "description": "Git workflow: trunk-based branches, commits, and pull requests"
-  },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
   "platform-and-library-first": {
     "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
   },
-  "script-driven-changes": {
-    "description": "Scripts: apply a repeated edit across many files with a script"
-  },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
   "structured-logging": {
-    "description": "Logging: log through a logging library in structured, durable records"
+    "description": "Logging: log through a logging library in structured, durable records",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",

package/templates/payload/.claude/agents/verifier.md

@@ -0,0 +1,7 @@
+---
+name: verifier
+description: Runs the app and checks the change works before the session reports done
+tools: Bash, Read
+---
+
+Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/payload/.claude/rules/constitution-changes.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - ".agents/rules/**"
+  - ".agents/rules.json"
+  - ".agents/hooks/**"
+  - ".claude/settings.json"
+  - ".claude/rules/**"
+  - ".cursor/rules/**"
+  - ".cursor/hooks/**"
+  - ".cursor/hooks.json"
+  - "scripts/sync-agent-rules.ts"
+  - "scripts/check-agent-gates.ts"
+  - ".husky/**"
+  - ".commitlintrc.json"
+  - ".prettierrc.json"
+  - "eslint.config.ts"
+  - ".lintstagedrc.json"
+  - ".gitleaks.toml"
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/payload/.claude/rules/diagnostics-and-error-handling.md

@@ -0,0 +1,15 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/payload/.claude/rules/structured-logging.md

@@ -0,0 +1,11 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/payload/.cursor/agents/verifier.md

@@ -0,0 +1,7 @@
+---
+name: verifier
+description: Runs the app and checks the change works before the session reports done
+readonly: true
+---
+
+Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/payload/.cursor/mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": ["@playwright/mcp@0.0.83"]
+    }
+  }
+}

package/templates/payload/.cursor/rules/constitution-changes.mdc

@@ -0,0 +1,11 @@
+---
+description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
+alwaysApply: false
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/payload/.cursor/rules/diagnostics-and-error-handling.mdc

@@ -0,0 +1,13 @@
+---
+description: "Diagnostics: fix runtime failures at the source and keep the root cause"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/payload/.cursor/rules/structured-logging.mdc

@@ -0,0 +1,9 @@
+---
+description: "Logging: log through a logging library in structured, durable records"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/payload/.github/workflows/ci.yml

@@ -189,6 +189,50 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
+  triage:
+    name: Triage failed build
+    needs:
+      - checks
+      - image
+    if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read # Needed to read the logs of the failed jobs.
+      id-token: write # Needed to authenticate to Anthropic with the workflow's OIDC token.
+      pull-requests: write # Needed to post the summary on the pull request.
+    steps:
+      - name: Collect the build log
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          mkdir -p out
+          for job in $(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/jobs" --paginate --jq '.jobs[] | select(.conclusion == "failure") | .id'); do
+            gh api "repos/$REPOSITORY/actions/jobs/$job/logs" >> out/build.log
+          done
+      - name: Triage failed build
+        id: triage
+        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
+        with:
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          prompt: >
+            Read the build log at out/build.log. Identify the most
+            likely cause, say whether the failure looks flaky or real, and write a
+            three-line summary for the PR thread.
+          claude_args: >-
+            --allowedTools "Read"
+            --json-schema '{"type":"object","properties":{"summary":{"type":"string"}},"required":["summary"]}'
+      - name: Post the summary
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+          SUMMARY: ${{ fromJSON(steps.triage.outputs.structured_output).summary }}
+        run: gh pr comment "$PR_NUMBER" --repo "$REPOSITORY" --body "$SUMMARY"
+
   ci:
     name: All Checks
     if: always()

package/templates/payload/.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": ["@playwright/mcp@0.0.83"]
+    }
+  }
+}

package/templates/payload/AGENTS.md

@@ -16,20 +16,33 @@ Payload CMS on Next.js App Router and PostgreSQL, in TypeScript on pnpm and Node
 | Every check                   | `pnpm verify`                                              |
 | Render rules after a change   | `pnpm rules:sync`                                          |
 
-## How it fits together
+## Verifying your work
+
+- Build: `pnpm build` (prints the `Route (app)` table)
+- Test: `pnpm test:coverage` (all green, then the coverage summary; never skip or delete a failing test)
+- Lint: `pnpm verify:static` (ESLint allows zero warnings; prints `✔ no dependency violations found`)
+
+Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
+If a test fails, fix the code, not the test.
+
+## Architecture
 
 - `src/payload.config.ts` wires the collections in `src/collections/` to PostgreSQL. The site lives in `src/app/(frontend)/`, and `src/app/health/route.ts` serves `/health`.
 - In development, Payload applies collection changes to the database directly. In production, the server applies the migrations in `src/migrations/` when it starts.
 
-## Mandatory rules
+## Conventions
 
-1. **Follow `.agents/rules/`.** `.agents/rules.json` gives each rule's scope; Claude Code and Cursor load them. After changing either, run `pnpm rules:sync`; `pnpm check` fails on stale copies.
+1. **Follow `.agents/rules/`.** `.agents/rules.json` gives each rule's scope; Claude Code and Cursor load them. After changing either, or a skill or subagent in `.agents/skills/` or `.agents/agents/`, run `pnpm rules:sync`; `pnpm check` fails on stale copies.
 2. **Change the schema only through collections, then regenerate and commit.** Payload generates `src/app/(payload)/`, `src/payload-types.ts`, and `src/migrations/`; run `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>`. Do not edit those files by hand.
 3. **Put unit tests next to the code as `src/**/*.test.{ts,tsx}` and Playwright end-to-end tests in `test/` as `*.e2e.test.ts`.** Vitest collects only the first pattern.
 4. **Ask the user before adding component tests.** They need a DOM test environment, and Vitest runs in Node.js.
 5. **Read configuration through `requireEnvironment` in `src/environment.ts`.** Document each variable in `.env.example`.
+6. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
+7. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
+
+## Things Claude gets wrong
 
-## Known pitfalls
+When Claude makes a mistake twice, add the correction here.
 
 - **Database for `pnpm dev` and end-to-end tests**: both need a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`; the README lists every variable. Run `pnpm exec playwright install chromium` once before the first `pnpm test:e2e`.
 - **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.

package/templates/payload/README.md

@@ -24,22 +24,7 @@ In development, Payload applies collection changes to the database directly. In
 
 ## After creating a project from this template
 
-1. Install gitleaks and jq (see [CONTRIBUTING.md](CONTRIBUTING.md)). Make the first commit on `main` and push it. The Git hooks allow only this first commit and push on `main`; work on branches after that.
-
-   ```sh
-   git add --all
-   git commit -m "chore(repo): start from template"
-   git push --set-upstream origin main
-   ```
-
-2. Add your team as the owner of every file in `.github/CODEOWNERS`, and replace the owner placeholder in `.github/zizmor.yml`.
-3. Replace the template's description and owner: `package.json#description`, `repository.url`, and `author`, and the `Next Friday Payload template` text in `src/app/(frontend)/layout.tsx`, `src/app/(frontend)/page.tsx`, and their tests. Change `license` from `UNLICENSED` if the project is open source.
-4. In the repository settings:
-   - **Actions → General → Workflow permissions:** select **Read repository contents and packages permissions**. Every workflow requests the extra permissions it needs.
-   - **Advanced Security:** enable private vulnerability reporting, Dependabot alerts, Dependabot security updates, secret scanning, and push protection. `SECURITY.md` sends reporters to private vulnerability reporting.
-   - **Cursor Bugbot:** enable the repository at [Bugbot](https://cursor.com/automations/from-cursor/bugbot). Bugbot reviews pull requests against the rules linked from `.cursor/BUGBOT.md`.
-   - **Rules → Rulesets:** protect `main` with squash merges only, a linear history, no force pushes or deletion, and the required checks `All Checks` and `Validate pull request title`. Rulesets in a private repository need GitHub Pro, Team, or Enterprise; on GitHub Free, make the repository public or upgrade.
-   - Create the `needs triage` label, which the issue forms apply: `gh label create "needs triage"`.
+Follow [SETUP.md](SETUP.md) in order. It sets up the repository, the reviews, and the AI-native SDLC. In step 1, also replace the `Next Friday Payload template` text in `src/app/(frontend)/layout.tsx`, `src/app/(frontend)/page.tsx`, and their tests.
 
 ## Scripts
 

package/templates/turborepo/.agents/agents/verifier.md

@@ -0,0 +1 @@
+Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.agents/mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": ["@playwright/mcp@0.0.83"]
+    }
+  }
+}

package/templates/turborepo/.agents/rules.json

@@ -12,7 +12,25 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "globs": [
+      ".agents/rules/**",
+      ".agents/rules.json",
+      ".agents/hooks/**",
+      ".claude/settings.json",
+      ".claude/rules/**",
+      ".cursor/rules/**",
+      ".cursor/hooks/**",
+      ".cursor/hooks.json",
+      "scripts/sync-agent-rules.ts",
+      "scripts/check-agent-gates.ts",
+      ".husky/**",
+      ".commitlintrc.json",
+      "prettier.config.ts",
+      "eslint.config.ts",
+      ".lintstagedrc.json",
+      ".gitleaks.toml"
+    ]
   },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
@@ -32,28 +50,24 @@
     "globs": ["**/*.test.ts", "**/*.test.tsx"]
   },
   "diagnostics-and-error-handling": {
-    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "evidence-before-claims": {
     "description": "Evidence: verify and cite a claim before stating or writing it"
   },
-  "git-workflow": {
-    "description": "Git workflow: trunk-based branches, commits, and pull requests"
-  },
   "no-suppression": {
     "description": "Findings: fix scanner and linter reports without inline suppressions"
   },
   "platform-and-library-first": {
     "description": "Platform and library first: use built-in features, then maintained libraries, then custom code"
   },
-  "script-driven-changes": {
-    "description": "Scripts: apply a repeated edit across many files with a script"
-  },
   "single-author-style": {
     "description": "Sibling style: match layout, naming, and composition in the same project"
   },
   "structured-logging": {
-    "description": "Logging: log through a logging library in structured, durable records"
+    "description": "Logging: log through a logging library in structured, durable records",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
   },
   "typescript-first": {
     "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",

package/templates/turborepo/.claude/agents/verifier.md

@@ -0,0 +1,7 @@
+---
+name: verifier
+description: Runs the app and checks the change works before the session reports done
+tools: Bash, Read
+---
+
+Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.claude/rules/constitution-changes.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - ".agents/rules/**"
+  - ".agents/rules.json"
+  - ".agents/hooks/**"
+  - ".claude/settings.json"
+  - ".claude/rules/**"
+  - ".cursor/rules/**"
+  - ".cursor/hooks/**"
+  - ".cursor/hooks.json"
+  - "scripts/sync-agent-rules.ts"
+  - "scripts/check-agent-gates.ts"
+  - ".husky/**"
+  - ".commitlintrc.json"
+  - "prettier.config.ts"
+  - "eslint.config.ts"
+  - ".lintstagedrc.json"
+  - ".gitleaks.toml"
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/turborepo/.claude/rules/diagnostics-and-error-handling.md

@@ -0,0 +1,15 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/turborepo/.claude/rules/structured-logging.md

@@ -0,0 +1,11 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.

package/templates/turborepo/.cursor/agents/verifier.md

@@ -0,0 +1,7 @@
+---
+name: verifier
+description: Runs the app and checks the change works before the session reports done
+readonly: true
+---
+
+Start the app with `pnpm dev`. Exercise the changed behavior and the two nearest neighboring flows. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/turborepo/.cursor/mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": ["@playwright/mcp@0.0.83"]
+    }
+  }
+}

package/templates/turborepo/.cursor/rules/constitution-changes.mdc

@@ -0,0 +1,11 @@
+---
+description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,prettier.config.ts,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
+alwaysApply: false
+---
+
+# Constitution Changes
+
+The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
+
+A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.

package/templates/turborepo/.cursor/rules/diagnostics-and-error-handling.mdc

@@ -0,0 +1,13 @@
+---
+description: "Diagnostics: fix runtime failures at the source and keep the root cause"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Diagnostics
+
+Resolve runtime failures at the source with the language's standard narrowing, validation, and error types. For missing third-party types, take upstream definitions or a narrow adapter in the established location.
+
+Surface errors at the caller or process boundary with diagnostic context. Handle an error to add context, recover, or translate it at an application boundary. Retain the root cause through the language's exception mechanism.
+
+Report unresolved type, declaration, or rule conflicts to the user. Findings follow `no-suppression.md`.

package/templates/turborepo/.cursor/rules/structured-logging.mdc

@@ -0,0 +1,9 @@
+---
+description: "Logging: log through a logging library in structured, durable records"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# Logging
+
+Application code logs through the stack's logging library or the framework's logger, never `console.*`. Write structured records, and send them to a store that keeps them longer than the host does.