@polymorphism-tech/morph-spec 8.46.0 → 9.0.0

package/framework/hooks/shared/state-reader.js

@@ -227,25 +227,18 @@ export function getFeature(featureName, projectPath) {
  * Derive phase from filesystem (phase deleted from state).
  *
  * Walks the phase map in descending order and returns the first phase whose
- * CANONICAL ARTIFACT exists. An empty folder is not enough — this avoids the
- * chicken-and-egg problem where `mkdir 2-plan/` (or any pre-created sibling)
- * advances the phase before plan content is written, then
- * `enforce-phase-writes` blocks writes back to `0-proposal/`.
+ * CANONICAL ARTIFACT exists. An empty folder is not enough — a pre-created
+ * sibling folder never advances the phase before its content is written.
  *
  * Canonical artifacts (one per phase) match MORPH.md §3:
- *   - 4-review  → review-report.md
- *   - 3-implement → recap.md
- *   - 2-plan    → spec.md  (the first plan-phase output produced)
- *   - 1-design  → design-system.md
- *   - 0-proposal → proposal.md
+ *   - 4-review    → verifier.md
+ *   - 3-implement → any slice report (`reports/*.md`)
+ *   - 1-design   → design-system.md
+ *   - 2-plan      → plan.md
  *
- * If no canonical file is found, returns `'proposal'` (the starting phase).
- *
- * @param {string} featureName
- * @param {string} [projectPath]
- * @returns {string} Phase name
+ * If no canonical file is found, returns `'plan'` (the starting phase).
  */
-export const PHASE_INDEX = { proposal: 0, uiux: 1, plan: 2, implement: 3, review: 4 };
+export const PHASE_INDEX = { plan: 0, uiux: 1, implement: 2, review: 3 };
 
 /**
  * The canonical artifact of each phase, descending. Exported so a caller that
@@ -253,32 +246,61 @@ export const PHASE_INDEX = { proposal: 0, uiux: 1, plan: 2, implement: 3, review
  * tree, say) can answer the same question without re-encoding the map.
  */
 export const PHASE_ARTIFACTS = [
-  ['4-review',    'review',    'review-report.md'],
-  ['3-implement', 'implement', 'recap.md'],
-  ['2-plan',      'plan',      'spec.md'],
+  ['4-review',    'review',    'verifier.md'],
+  ['3-implement', 'implement', 'reports/'],
   ['1-design',    'uiux',      'design-system.md'],
-  ['0-proposal',  'proposal',  'proposal.md'],
+  ['2-plan',      'plan',      'plan.md'],
 ];
 
+const DESIGN_DIR = '1-design';
+
 const gatesOf = (feature) => feature?.approvals || feature?.approvalGates;
 
 /**
  * Gate-implied phase from an ALREADY-LOADED feature object — no disk access.
- *
- * Split out of `gateImpliedPhase` so callers holding a feature.json that did
- * not come from the working tree (e.g. `git show morph/{f}:…`) can reuse the
- * rule instead of copying it. The path-based wrapper below is unchanged.
+ * An approved gate authorizes the NEXT phase:
+ *   review approved → review (terminal)
+ *   plan approved   → implement, or uiux while the design branch was taken
+ *                     (`1-design/` exists) and its gate is still open
+ *   otherwise       → plan
  *
  * @param {Object|null} feature
+ * @param {boolean} [designStarted] - whether `1-design/` exists for the feature
  * @returns {string} phase name
  */
-export function gateImpliedPhaseFrom(feature) {
+export function gateImpliedPhaseFrom(feature, designStarted = false) {
   const gates = gatesOf(feature);
   const ok = (g) => gates?.[g]?.approved === true;
   if (ok('review')) return 'review';
-  if (ok('plan')) return 'implement';
-  if (ok('uiux')) return 'plan';
-  return 'proposal';
+  if (ok('plan')) return designStarted && !ok('uiux') ? 'uiux' : 'implement';
+  return 'plan';
+}
+
+/**
+ * Artifact predicate over a feature dir on disk. A path ending in `/` asks for
+ * any `.md` file directly under it: an empty folder is not an artifact.
+ */
+export function diskArtifactProbe(featureDir) {
+  return (rel) => {
+    const abs = join(featureDir, ...rel.split('/').filter(Boolean));
+    if (!rel.endsWith('/')) return existsSync(abs);
+    try {
+      return readdirSync(abs, { withFileTypes: true }).some((e) => e.isFile() && e.name.endsWith('.md'));
+    } catch {
+      return false;
+    }
+  };
+}
+
+/** The same predicate over a set of feature-relative POSIX paths (a git tree). */
+export function fileSetArtifactProbe(files) {
+  return (rel) => {
+    if (!rel.endsWith('/')) return files.has(rel);
+    for (const f of files) {
+      if (f.startsWith(rel) && f.endsWith('.md') && !f.slice(rel.length).includes('/')) return true;
+    }
+    return false;
+  };
 }
 
 /**
@@ -286,44 +308,33 @@ export function gateImpliedPhaseFrom(feature) {
  * access of its own, so the artifact universe can be a git tree.
  *
  * @param {Object|null} feature
- * @param {(relPath: string) => boolean} hasArtifact - receives POSIX-style
- *   paths relative to the feature dir, e.g. `2-plan/spec.md`
+ * @param {(relPath: string) => boolean} hasArtifact - {@link diskArtifactProbe}
+ *   or {@link fileSetArtifactProbe}: POSIX paths relative to the feature dir
  * @returns {string} phase name
  */
 export function derivePhaseFrom(feature, hasArtifact) {
-  let artifactPhase = 'proposal';
+  let artifactPhase = 'plan';
   for (const [folder, phase, canonical] of PHASE_ARTIFACTS) {
     if (hasArtifact(`${folder}/${canonical}`)) { artifactPhase = phase; break; }
   }
 
   // Gate-aware: an approved gate advances the phase even before the next
-  // phase's first canonical artifact exists. This breaks the chicken-and-egg
-  // where that first artifact could never be written because the phase never
-  // advanced to permit it. Take whichever of (artifact, gate-implied) is later.
-  const implied = gateImpliedPhaseFrom(feature);
+  // phase's first canonical artifact exists, or that artifact could never be
+  // written. Take whichever of (artifact, gate-implied) is later.
+  const designStarted = hasArtifact(DESIGN_DIR) || hasArtifact(`${DESIGN_DIR}/design-system.md`);
+  const implied = gateImpliedPhaseFrom(feature, designStarted);
   return PHASE_INDEX[implied] > PHASE_INDEX[artifactPhase] ? implied : artifactPhase;
 }
 
-/**
- * The phase implied purely by approved gates, independent of which artifacts
- * exist on disk. An approved gate authorizes the NEXT phase, so:
- *   review approved  → review   (terminal)
- *   plan approved    → implement
- *   uiux approved    → plan
- *   otherwise        → proposal  (proposal-approval's fork between uiux/plan is
- *                                 resolved by enforce-phase-writes, not here)
- * @returns {string} phase name
- */
+/** The phase implied purely by approved gates — see {@link gateImpliedPhaseFrom}. */
 export function gateImpliedPhase(featureName, projectPath) {
-  return gateImpliedPhaseFrom(getFeature(featureName, projectPath));
+  const designDir = join(projectPath || process.cwd(), '.morph/features', featureName, DESIGN_DIR);
+  return gateImpliedPhaseFrom(getFeature(featureName, projectPath), existsSync(designDir));
 }
 
 export function derivePhaseForFeature(featureName, projectPath) {
   const basePath = join(projectPath || process.cwd(), '.morph/features', featureName);
-  return derivePhaseFrom(
-    getFeature(featureName, projectPath),
-    (rel) => existsSync(join(basePath, rel)),
-  );
+  return derivePhaseFrom(getFeature(featureName, projectPath), diskArtifactProbe(basePath));
 }
 
 /**
@@ -342,7 +353,7 @@ export function getFeaturePhase(featureName, projectPath) {
 /**
  * Get approval status for a gate.
  * @param {string} featureName
- * @param {string} gate - 'proposal'|'uiux'|'plan'|'review'
+ * @param {string} gate - 'plan'|'uiux'|'review'
  * @param {string} [projectPath]
  * @returns {boolean}
  */
@@ -384,43 +395,6 @@ export function getOutputs(featureName, projectPath) {
   return feature?.outputs || null;
 }
 
-/**
- * Get uncompleted required outputs for current phase.
- * @param {string} featureName
- * @param {string} [projectPath]
- * @returns {Array<{type: string, path: string}>}
- */
-/**
- * Get task statistics directly from taskList (preferred over feature.tasks counters).
- * Excludes expanded tasks from counts, matching calculateProgress() behavior.
- *
- * @param {Object} feature - Feature state object
- * @returns {{ total: number, completed: number, inProgress: number, pending: number }}
- */
-export function getTaskStats(feature) {
-  const list = feature?.taskList || [];
-  if (list.length > 0) {
-    const active = list.filter(t => t.status !== 'expanded');
-    return {
-      total: active.length,
-      completed: active.filter(t => t.status === 'completed').length,
-      inProgress: active.filter(t => t.status === 'in_progress').length,
-      pending: active.filter(t => t.status === 'pending').length,
-    };
-  }
-  // Fallback: read from legacy counter object
-  const tasks = feature?.tasks;
-  if (tasks && typeof tasks === 'object' && !Array.isArray(tasks)) {
-    return {
-      total: tasks.total || 0,
-      completed: tasks.completed || 0,
-      inProgress: tasks.inProgress || 0,
-      pending: tasks.pending || 0,
-    };
-  }
-  return { total: 0, completed: 0, inProgress: 0, pending: 0 };
-}
-
 export function getMissingOutputs(featureName, projectPath) {
   const feature = getFeature(featureName, projectPath);
   if (!feature?.outputs) return [];

package/framework/hooks/shared/state-writer.js

@@ -101,7 +101,7 @@ export function persistFeature(featureName, feature, projectPath) {
  * canonical shape — onto the feature and persists it. Returns true on success.
  *
  * @param {string} featureName
- * @param {string} gate - 'proposal'|'uiux'|'plan'|'review'
+ * @param {string} gate - 'plan'|'uiux'|'review'
  * @param {{ approvedBy?: string, timestamp?: string }} [meta]
  * @param {string} [projectPath]
  */
@@ -114,6 +114,7 @@ export function setGateApproved(featureName, gate, meta = {}, projectPath) {
       approved: true,
       timestamp: meta.timestamp || now,
       approvedBy: meta.approvedBy || 'manual',
+      ...(meta.selfAssessed ? { selfAssessed: true } : {}),
     };
     feature.updatedAt = now;
     return persistFeature(featureName, feature, projectPath);
@@ -141,9 +142,8 @@ export function createDefaultFeature(featureName) {
     createdAt: now,
     updatedAt: now,
     approvalGates: {
-      proposal: { approved: false, timestamp: null, approvedBy: null },
-      uiux: { approved: false, timestamp: null, approvedBy: null },
       plan: { approved: false, timestamp: null, approvedBy: null },
+      uiux: { approved: false, timestamp: null, approvedBy: null },
       review: { approved: false, timestamp: null, approvedBy: null },
     },
     outputs: {},

package/framework/mcp/registry.json

@@ -3,7 +3,7 @@
   "description": "Centralized MCP registry with phase relevance and install configuration for morph-spec workflows",
   "mcps": {
     "context7": {
-      "phases": ["proposal", "plan", "implement"],
+      "phases": ["plan", "implement"],
       "tools": ["resolve-library-id", "query-docs"],
       "serverNames": ["context7", "plugin_context7_context7"],
       "detection": "enabledPlugins includes context7 or mcpServers includes context7",
@@ -216,7 +216,7 @@
       }
     },
     "graphify": {
-      "phases": ["proposal", "plan", "implement", "review"],
+      "phases": ["plan", "implement", "review"],
       "tools": ["query_graph", "get_node", "get_neighbors", "get_community", "god_nodes", "graph_stats", "shortest_path", "list_prs", "get_pr_impact", "triage_prs"],
       "detection": "graphify-out/graph.json exists in the project root (written by morph-spec graph build, or by the graphify post-commit hook)",
       "fallback": "Comportamento atual: Grep/Glob/Read. O grafo é um subconjunto estrito do grep — no eval não encontrou um único arquivo que o grep perderia — então cair para grep não perde recall, só devolve mais ruído",
@@ -281,9 +281,8 @@
   },
   "_phaseMatrixNote": "Keys must be the v5 phases from framework/phases.json. The v4 keys 'design' and 'tasks' both collapsed into 'plan'; 'review' was absent entirely, so a project in review resolved to undefined. Stack-scoped MCPs (asaas, neon) stay out of this matrix on purpose — only universal ones are listed.",
   "phaseMatrix": {
-    "proposal": ["context7", "graphify"],
-    "uiux": ["playwright", "context7", "stitch", "morph-assets"],
     "plan": ["context7", "graphify"],
+    "uiux": ["playwright", "context7", "stitch", "morph-assets"],
     "implement": ["context7", "playwright", "vercel", "morph-assets", "graphify"],
     "review": ["playwright", "context7", "graphify"]
   }

package/framework/phases.json

@@ -1,22 +1,22 @@
 {
   "version": "5.0.0",
   "phases": {
-    "proposal": {
-      "id": "proposal",
+    "plan": {
+      "id": "plan",
       "index": 0,
-      "folder": "0-proposal",
-      "displayName": "Proposal",
+      "folder": "2-plan",
+      "displayName": "Plan",
       "goals": [
-        "Understand the business problem and user flows",
-        "Detect existing stack (brownfield) or assume default stack (greenfield)",
-        "Produce proposal.md and reach Gate 1"
+        "Understand the business problem and scan the stack (brownfield) or assume the default (greenfield)",
+        "Write plan.md — scenarios with proof, decisions, reuse and slices",
+        "Run plan-check to produce checks.json and reach the plan gate"
       ],
-      "requiredOutputs": ["proposal"],
-      "optionalOutputs": ["stackScan"],
+      "requiredOutputs": ["plan", "checks"],
+      "optionalOutputs": [],
       "pausePoints": [
-        { "id": "proposal", "label": "Gate 1 — Approve proposal" }
+        { "id": "plan", "label": "Gate do plano — Approve plan.md + checks.json" }
       ],
-      "skill": "morph-brainstorming"
+      "skill": "morph-plan"
     },
     "uiux": {
       "id": "uiux",
@@ -35,50 +35,34 @@
       ],
       "skill": "morph-uiux"
     },
-    "plan": {
-      "id": "plan",
-      "index": 2,
-      "folder": "2-plan",
-      "displayName": "Plan",
-      "goals": [
-        "Write spec.md (technical spec)",
-        "Write tasks.json (ordered task breakdown)"
-      ],
-      "requiredOutputs": ["spec", "tasks"],
-      "optionalOutputs": ["decisions"],
-      "pausePoints": [
-        { "id": "plan", "label": "Gate 2 — Approve spec + tasks" }
-      ],
-      "skill": "morph-plan"
-    },
     "implement": {
       "id": "implement",
-      "index": 3,
+      "index": 2,
       "folder": "3-implement",
       "displayName": "Implementation",
       "goals": [
-        "Execute tasks in order with auto-advance between tasks",
-        "Advance a task only on verify green and its doneCriteria met",
-        "Maintain recap.md and execution trace"
+        "Execute the slices of plan.md, in parallel waves when plan-check allows",
+        "Close a slice only on verify green and its scenarios proven",
+        "One report per slice (3-implement/reports/F{n}.md, with **Arquivos:** and **Standards:**) — the implementation record"
       ],
-      "requiredOutputs": ["recap"],
+      "requiredOutputs": [],
       "optionalOutputs": ["evidencias"],
       "pausePoints": [],
-      "skill": "morph-implement"
+      "skill": "morph-apply"
     },
     "review": {
       "id": "review",
-      "index": 4,
+      "index": 3,
       "folder": "4-review",
       "displayName": "Review",
       "goals": [
-        "Independent evaluator verdict (SHIP/FIX) with evidence-typed blockers",
-        "Produce review-report.md and present Gate 3"
+        "Verifier proves every scenario; reviewer (and security, when required) judge the diff at a fixed SHA",
+        "verifier.md + reviewer.md (+ security.md) with SHIP/FIX and evidence-typed blockers, then Gate 3"
       ],
-      "requiredOutputs": ["reviewReport"],
-      "optionalOutputs": [],
+      "requiredOutputs": ["verifierReport", "reviewerReport"],
+      "optionalOutputs": ["securityReport"],
       "pausePoints": [
-        { "id": "review", "label": "Gate 3 — Approve review-report" }
+        { "id": "review", "label": "Gate 3 — Approve the review reports" }
       ],
       "skill": "morph-review"
     }

package/framework/rules/ai-agents-standards.md

@@ -9,26 +9,28 @@ stacks:
 
 # Microsoft Agent Framework Standards
 
-> **Layer 0/1 — auto-carregados.** São os standards core: aplicam-se a praticamente todo
-> agente MAF. Carregue-os sempre que tocar código de agentes.
+> **Layer 0/1 — resumo injetado pela rule.** São os standards core: aplicam-se a praticamente todo
+> agente MAF. O resumo de cada um entra no contexto quando você toca código de agentes.
 
-@.morph/framework/standards/ai-agents/setup.md
-@.morph/framework/standards/ai-agents/sweet-spot.md
-@.morph/framework/standards/ai-agents/providers/model-registry.md
-@.morph/framework/standards/ai-agents/structured-output.md
-@.morph/framework/standards/ai-agents/multi-agent-patterns.md
-@.morph/framework/standards/ai-agents/prompt-sources.md
-@.morph/framework/standards/ai-agents/rag-custom-pgvector.md
-@.morph/framework/standards/ai-agents/middleware-patterns.md
-@.morph/framework/standards/ai-agents/observability-patterns.md
-@.morph/framework/standards/ai-agents/workflows.md
-@.morph/framework/standards/ai-agents/production.md
+- **ai-agents-setup** (`ai-agents/setup.md`) — Versões exatas: Microsoft.Agents.AI 1.20.0, Microsoft.Extensions.AI 10.9.0, OpenAI 2.13.0. OpenAI pelo Responses API (`GetResponsesClient().AsAIAgent(...)`); Chat Completions só com `"api": "chat"`; `store: false`. PROIBIDO: orquestração Semantic Kernel, `AgentOpenTelemetryConsts` (não existe).
+- **ai-agents-sweet-spot** (`ai-agents/sweet-spot.md`) — Chat + Structured Output + Tools + RAG custom cobre 95%. Single-agent é o padrão; multi-agent/workflow só com fan-in/out ou handoff real. Teto prático de ~12 tools por agente (podar, depois allow-list por fase, depois agent-as-tool). Leia no plan, antes de decidir a arquitetura.
+- **ai-agents-providers-model-registry** (`ai-agents/providers/model-registry.md`) — `model-registry.json` v2 mapeia alias → { provider, model, api, options, constraints }; agente usa alias, nunca string de modelo. Todo alias declara `api` (`responses` padrão, `chat` opt-in). `temperature` e `reasoningEffort` são mutuamente exclusivos por alias. Sem range flutuante em PackageReference.
+- **ai-agents-structured-output** (`ai-agents/structured-output.md`) — Saída que alimenta outro sistema é record tipado (`RunAsync<T>` ou `ChatResponseFormat.ForJsonSchema<T>()`): `sealed record` com `[Description]` e `[JsonPropertyName]`. Raiz nunca primitivo/array (use wrapper); em streaming, `ToAgentResponseAsync()` antes de desserializar. Regra de negócio se valida depois da chamada.
+- **ai-agents-multi-agent-patterns** (`ai-agents/multi-agent-patterns.md`) — Do mais barato: agent-as-tool (`AsAIFunction()`, aninhamento ≤ 2) → sequencial → workflow; handoff vem depois de agent-as-tool, com Id estável e `WithAutonomousMode(turnLimit:)`; group chat ≤ 3 agentes. PROIBIDO: agente auxiliar DENTRO de uma tool (dois loops de function calling no mesmo turno).
+- **ai-agents-prompt-sources** (`ai-agents/prompt-sources.md`) — Prompt fixo: tabela versionada `agent_prompts` (INSERT + flip de `is_active` numa transação, nunca UPDATE; id `Guid.CreateVersion7()`). Prompt por tenant: YAML no repo → compositor determinístico → spec renderizada em jsonb. O registro de execução grava a versão EFETIVA (e o hash do blob no caminho composto).
+- **ai-agents-rag-custom-pgvector** (`ai-agents/rag-custom-pgvector.md`) — RAG em pgvector via EF Core: `IEmbeddingGenerator` injetado direto (sem EmbeddingService), alias `embeddings` do registry, `CosineDistance` LINQ, HNSW `vector_cosine_ops`, `tenant_id` filtrado em toda query e nunca exposto ao LLM. Ingestão delta por lookup-key: Unchanged nunca re-embeda, Removed só depois das escritas.
+- **ai-agents-middleware-patterns** (`ai-agents/middleware-patterns.md`) — Registro sempre `.AsBuilder().Use(...).Build()`; o PRIMEIRO registrado é o mais externo. Ordem medida: timeout → usage-cost → FunctionInvokingChatClient → chat telemetry → provider. Só o delegate não-streaming rebaixa streaming em silêncio: use `Use(sharedFunc)`.
+- **ai-agents-observability-patterns** (`ai-agents/observability-patterns.md`) — Registre os DOIS ActivitySources (`Experimental.Microsoft.Agents.AI` e `Experimental.Microsoft.Extensions.AI`); a API é `builder.UseOpenTelemetry(...)` (`agent.WithOpenTelemetry()` não existe). Instrumentar os dois níveis é normal; o mesmo nível duas vezes duplica. Prompt cru só em dev com opt-in, hash em produção; turno cancelado não grava nada.
+- **ai-agents-workflows** (`ai-agents/workflows.md`) — Raro: só para fan-in/out real ou HITL longo; `foreach` + LINQ costuma bastar. `AgentWorkflowBuilder`/`WorkflowBuilder`/`InProcessExecution` vivem no pacote SEPARADO `Microsoft.Agents.AI.Workflows` 1.20.0. Agente declarativo (`Microsoft.Agents.AI.Declarative`) ainda pede `--prerelease`.
+- **ai-agents-production** (`ai-agents/production.md`) — A2A (`Microsoft.Agents.AI.A2A`) é PRERELEASE. Isolamento multi-tenant (`AgentIsolationKeyProvider`, `UseClaimsBasedAgentIsolation`) com a chave vinda da credencial, nunca do payload. `AllowConcurrentInvocation` é opt-in e inseguro com DbContext scoped. Cache: Redis semântico + HybridCache.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.
 
 ---
 
-> **Layer 2 — sob demanda (NÃO auto-carregados).** São standards de modalidade, otimização e
-> MCP: relevantes apenas quando a feature usa especificamente esse recurso. Carregue via
-> `morph-standards` quando uma keyword corresponder — manter fora do auto-load preserva o
+> **Layer 2 — sob demanda (sem resumo aqui).** São standards de modalidade, otimização e
+> MCP: relevantes apenas quando a feature usa especificamente esse recurso. Busque via
+> `morph-spec standards --find` (skill `morph-standards`) quando uma keyword corresponder — manter fora do resumo preserva o
 > context window para o trabalho que importa.
 
 | Standard | Carregue quando a feature envolve |

package/framework/rules/asaas-standards.md

@@ -10,4 +10,6 @@ stacks:
 
 # Asaas Payment Integration Standards
 
-@.morph/framework/standards/backend/integrations/asaas/asaas-api.md
+- **backend-integrations-asaas-asaas-api** (`backend/integrations/asaas/asaas-api.md`) — Só o backend .NET chama o Asaas (o Next passa pelo proxy): `AsaasClient` HttpClient tipado, base URL com barra final e paths relativos, headers `access_token` + `User-Agent`; respostas viram `Result`. Sem cobrança duplicada: `externalReference` + GET antes de criar, nunca retry automático em cartão. Webhook: `asaas-access-token` comparado com `FixedTimeEquals`, id de evento deduplicado. Nunca guarde dado de cartão.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/csharp-standards.md

@@ -8,11 +8,13 @@ stacks:
 
 # C# and .NET VSA Standards
 
-@.morph/framework/standards/architecture/vertical-slice/vertical-slice.md
-@.morph/framework/standards/backend/dotnet/vsa-handler-patterns.md
-@.morph/framework/standards/backend/dotnet/result-pattern.md
-@.morph/framework/standards/backend/dotnet/fluent-validation-vsa.md
-@.morph/framework/standards/backend/dotnet/scrutor.md
-@.morph/framework/standards/backend/dotnet/scalar-ui.md
-@.morph/framework/standards/backend/api/validation.md
-@.morph/framework/standards/architecture/code-comments.md
+- **architecture-vertical-slice-vertical-slice** (`architecture/vertical-slice/vertical-slice.md`) — Uma slice por operação em `Features/{Entity}Feature/{Verb}{Entity}/`: Request/Response `sealed record`, Handler, Validator e Endpoint `IApiEndpoint` `internal sealed`. Decorators Scrutor: Logging → Validation → Handler. PROIBIDO: MediatR/`IRequest`, AggregateRoot, DomainEvent, CQRS formal, camada Application Service, DTO compartilhado entre features, `IRepository<T>`/`IUnitOfWork`.
+- **backend-dotnet-vsa-handler-patterns** (`backend/dotnet/vsa-handler-patterns.md`) — Handler `sealed class` com primary constructor implementando `IHandler<TRequest, TResponse>` (não MediatR): injeta `ApplicationDbContext` direto, usa `Guid.CreateVersion7()` (nunca `Guid.NewGuid()`), passa `CancellationToken` em tudo e devolve `Result<T>`. Erros em `{Feature}Errors.cs`. SQL cru ou store dedicado só com justificativa em `decisions.md`.
+- **backend-dotnet-result-pattern** (`backend/dotnet/result-pattern.md`) — Falha esperada é `Result`/`Result<T>`, nunca exceção. Endpoint: `result.Match(value => Results.Ok(value), error => error.ToHttpResult())`; nunca leia `.Value` fora do `Match`. Status pelo `ErrorType` (Validation 400, NotFound 404, Conflict 409, Unauthorized 401, Forbidden 403, Unexpected 500), nunca BadRequest para tudo. PROIBIDO: try/catch no handler, retornar null, erro string sem código.
+- **backend-dotnet-fluent-validation-vsa** (`backend/dotnet/fluent-validation-vsa.md`) — Um `sealed AbstractValidator<TRequest>` (FluentValidation 12) por request, na pasta da slice; o `ValidationDecorator` roda antes do handler e devolve `Result.Failure(ValidationError)`. `AddValidatorsFromAssembly()` ANTES de `AddHandlersFromAssembly()`. Sempre `.WithMessage()`; tempo via `TimeProvider` lido DENTRO da regra. Nunca lance `ValidationException`.
+- **backend-dotnet-scrutor** (`backend/dotnet/scrutor.md`) — `AddHandlersFromAssembly` registra cada `IHandler<,>` como Scoped (filtro `!t.ContainsGenericParameters`) e depois `Decorate` Validation e então Logging (o último registrado é o mais externo). Endpoints `IApiEndpoint` via `TryAddEnumerable` Transient + `MapApiEndpoints`. Nunca registre handler um a um.
+- **backend-dotnet-scalar-ui** (`backend/dotnet/scalar-ui.md`) — Scalar no lugar do Swagger: `Microsoft.AspNetCore.OpenApi` 10.0.0 + `Scalar.AspNetCore` 2.12.40, nunca Swashbuckle. `MapOpenApi()` só em `IsDevelopment()` e antes de `MapScalarApiReference`. Todo endpoint com `.WithTags(ApiTags.X)` (constantes), `.Produces<T>` e `.ProducesProblem(status)` por falha possível.
+- **backend-api-validation** (`backend/api/validation.md`) — O validator checa só FORMA (sem DbContext); existência, unicidade e estado ficam no handler com `{Entity}Errors` tipados. Checagem de estado valida o INVÁLIDO (enum ordenado, estados de erro em 100+). PROIBIDO: lançar exceção, validar na lambda do endpoint, misturar DataAnnotations, `if (status != Expected)`, switch exaustivo sobre estados válidos.
+- **architecture-code-comments** (`architecture/code-comments.md`) — Padrão é nenhum comentário: renomeie, extraia, tipe ou teste antes. Só o porquê que o código não mostra (invariante, ordem, quirk externo com link), até ~3 linhas. PROIBIDO: história de processo (task, UC, ADR, Gate), repetir o código, XML doc/JSDoc que repete a assinatura, banner, `#region`, código comentado, TODO solto. O hook `comment-guard` bloqueia.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/data-standards.md

@@ -2,7 +2,6 @@
 paths:
   - "**/*Cache*.cs"
   - "**/*Redis*.cs"
-  - "**/*Cosmos*.cs"
   - "**/*Vector*.cs"
   - "**/*Embedding*.cs"
   - "**/*Rag*.cs"
@@ -12,7 +11,8 @@ stacks:
 
 # Data & Cache Standards
 
-@.morph/framework/standards/data/nosql/cache/redis.md
-@.morph/framework/standards/data/nosql/cosmos-db.md
-@.morph/framework/standards/data/vector-search/rag-chunking.md
-@.morph/framework/standards/backend/database/vector-search-rag.md
+- **data-nosql-cache-redis** (`data/nosql/cache/redis.md`) — Cache distribuído, nunca store primário. `Microsoft.Extensions.Caching.StackExchangeRedis` 10.0.12; `IConnectionMultiplexer` singleton LAZY (nunca conectar no registro). Cache-aside no handler com `IDistributedCache` (sem wrapper); invalide a chave exata depois do `SaveChangesAsync`. PROIBIDO: cachear segredo/PII sem criptografia, omitir TTL, engolir `RedisConnectionException`.
+- **data-vector-search-rag-chunking** (`data/vector-search/rag-chunking.md`) — Prosa: sentence-aware, 256 tokens; doc técnico: semântico por headers; Q&A inteiro; código: a função inteira. Overlap 10–20%, mínimo 50 e máximo ~512 tokens. Sempre grave metadados do chunk (DocumentId, ChunkIndex, Section, SourceUrl) e reindexe quando o hash do conteúdo mudar.
+- **backend-database-vector-search-rag** (`backend/database/vector-search-rag.md`) — Slices VSA sobre EF Core 10 + pgvector: o handler injeta `ApplicationDbContext` e `IEmbeddingGenerator` direto (sem EmbeddingService/SearchService). Busca por `d.Embedding!.CosineDistance(query)` com a distância em ordem ASC. Sem documento relevante, `NotFound` antes de chamar o LLM. Indexação em lote: um `GenerateAsync` e um `SaveChanges`.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/dotnet-templates.md

@@ -30,7 +30,7 @@ morph-spec scaffold dotnet book get-all-books
 
 Generates 7 files: endpoint, handler, request, response, validator + entity, errors (shared at feature level). Entity/errors auto-skipped if they already exist.
 
-**Only use `template render` for individual files when adding to an existing slice.**
+**Adding a single file to an existing slice:** read its `.hbs` template (table below) and write the file following it — `scaffold` generates whole slices only, and there is no single-file render command.
 
 ## VSA Feature Templates (Vertical Slice Architecture)
 

package/framework/rules/frontend-standards.md

@@ -9,5 +9,7 @@ stacks:
 
 # Frontend Standards
 
-@.morph/framework/standards/frontend/design-system/naming.md
-@.morph/framework/standards/frontend/design-system/animations.md
+- **frontend-design-system-naming** (`frontend/design-system/naming.md`) — BEM para componente reutilizável (`.card`, `.card__header`, `.card--featured`); prefixo de página para elemento específico (`.home-hero`). Custom properties em `:root` com namespace `--app-`. Estado por sufixo fixo: `--active`, `--disabled`, `--loading`, `--error`.
+- **frontend-design-system-animations** (`frontend/design-system/animations.md`) — Classes `.animate-*`, `.duration-fast/normal/slow`, `.stagger-1..10`. Lista escalonada exige `animation-delay` E `animation-fill-mode: backwards`. Sempre o bloco `prefers-reduced-motion: reduce`. Além do CSS: Motion (`motion/react`) para enter/exit/layout; GSAP só para ScrollTrigger, SVG morph e timelines.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/gsap-standards.md

@@ -1,13 +1,18 @@
 ---
 paths:
-  - "**/*.tsx"
-  - "**/*.ts"
+  - "**/animations/**"
+  - "**/*gsap*"
+  - "**/*Gsap*"
+  - "**/*scroll-trigger*"
+  - "**/*ScrollTrigger*"
 stacks:
   - nextjs
 ---
 
 # GSAP Animation Standards
 
-@.morph/framework/standards/frontend/gsap/gsap-core.md
-@.morph/framework/standards/frontend/gsap/gsap-scrolltrigger.md
-@.morph/framework/standards/frontend/gsap/gsap-plugins.md
+- **frontend-gsap-core** (`frontend/gsap/gsap-core.md`) — GSAP 3.13 + `@gsap/react` só para ScrollTrigger, SVG morph/draw, timelines complexas e SplitText; o resto é Motion, e NUNCA os dois no mesmo elemento. Código em `'use client'` dentro de `useGSAP()` com `{ scope: containerRef }` (nunca `useEffect`). Só transform/opacity; `prefers-reduced-motion` via `gsap.matchMedia()` é obrigatório; durations/easings vêm de `@/lib/design-tokens`.
+- **frontend-gsap-scrolltrigger** (`frontend/gsap/gsap-scrolltrigger.md`) — `gsap.registerPlugin(ScrollTrigger)` uma vez no init, nunca em `useEffect`/loop, e nunca `ScrollTrigger.create()` no escopo do módulo. Scrub com ease `'none'` (0.3–1 em produção). `pin: true` + `anticipatePin: 1`; nunca pin aninhado. `ScrollTrigger.batch` em grids de 20+. `ScrollTrigger.refresh()` após conteúdo dinâmico, troca de rota e `onLoad` de imagem.
+- **frontend-gsap-plugins** (`frontend/gsap/gsap-plugins.md`) — Todo plugin é gratuito no pacote público `gsap` (`npm install gsap @gsap/react`); o registry privado `@gsap/shockingly` é obsoleto. Flip: `getState()` → muda o DOM → `Flip.from(...)`. SplitText com `autoSplit: true`, animando em `onSplit`. MorphSVG exige `<path>`; DrawSVG exige stroke visível; Draggable com inércia exige InertiaPlugin.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/hangfire-standards.md

@@ -10,4 +10,6 @@ stacks:
 
 # Hangfire Background Jobs Standards
 
-@.morph/framework/standards/backend/integrations/hangfire/hangfire-jobs.md
+- **backend-integrations-hangfire-hangfire-jobs** (`backend/integrations/hangfire/hangfire-jobs.md`) — Hangfire 1.8.25 só com razão real em `decisions.md`; o que cabe no request fica no handler. Storage `Hangfire.PostgreSql` 1.21.1 com `UseNpgsqlConnection` no endpoint DIRETO do Neon; referencie `Newtonsoft.Json` 13.0.4. Job é classe fina e idempotente que chama o handler; `[AutomaticRetry]`, sem try/catch nem retry manual. Dashboard exige Admin autenticado.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/infrastructure-standards.md

@@ -10,8 +10,10 @@ stacks:
 
 # Infrastructure Standards
 
-@.morph/framework/standards/infrastructure/docker/coolify-deploy.md
-@.morph/framework/standards/infrastructure/docker/local-compose-isolation.md
+- **infrastructure-docker-coolify-deploy** (`infrastructure/docker/coolify-deploy.md`) — Acesso só por SSH na VPS, API do Coolify em `localhost:8000/api/v1` com token server-side (nunca impresso). Env vars no Coolify, nunca no Dockerfile. Endpoint `/health`. Redeploy por `POST /api/v1/deploy?uuid=` (GET não deploya); sem `deployment_uuid` na resposta, nada foi deployado.
+- **infrastructure-docker-local-compose-isolation** (`infrastructure/docker/local-compose-isolation.md`) — Cada worktree roda o próprio stack compose; portas do bloco da worktree (`PORT`, `API_PORT`, `POSTGRES_PORT`, `REDIS_PORT`) publicadas como `${VAR:-default}:container`. PROIBIDO: porta fixa no host, `container_name`. Healthcheck em todo serviço. Compose que lê a porta por outro nome: declare em `e2e.portEnvNames`.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.
 
 ## Infrastructure Templates
 

package/framework/rules/neon-auth-standards.md

@@ -10,4 +10,6 @@ stacks:
 
 # Neon Auth Standards
 
-@.morph/framework/standards/backend/integrations/neon-auth/neon-auth.md
+- **backend-integrations-neon-auth-neon-auth** (`backend/integrations/neon-auth/neon-auth.md`) — SDK `@neondatabase/auth`: `createNeonAuth()` no server, `createAuthClient()` no client, `auth.middleware()` com `runtime='nodejs'`. Duas constantes de prefixo (`BACKEND_API_PREFIX`/`PROXY_API_PREFIX`), nunca uma só. O front não consulta o Neon para dado de negócio. .NET: token EdDSA/Ed25519, verificado pelo JWKS com BouncyCastle + `SignatureValidator` devolvendo `JsonWebToken`.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.

package/framework/rules/neon-standards.md

@@ -10,10 +10,12 @@ stacks:
 
 # Neon PostgreSQL Standards
 
-@.morph/framework/standards/infrastructure/neon/neon-setup.md
-@.morph/framework/standards/infrastructure/neon/neon-pgvector.md
-@.morph/framework/standards/infrastructure/neon/neon-pgrag.md
-@.morph/framework/standards/backend/integrations/neon-auth/neon-auth.md
+- **infrastructure-neon-setup** (`infrastructure/neon/neon-setup.md`) — Duas connection strings: `DefaultConnection` (pooled `-pooler`) para a app e `MigrationConnection` (direta) para migrations e advisory locks; nunca commitadas (user-secrets / env do Coolify). Formato keyword (`Host=...;SSL Mode=Require`), não URI. `EnableRetryOnFailure(5, 10s)` por causa do scale-to-zero. Branch sempre com `--expires-at`.
+- **infrastructure-neon-pgvector** (`infrastructure/neon/neon-pgvector.md`) — `Npgsql.EntityFrameworkCore.PostgreSQL` 10.0.3 + `Pgvector.EntityFrameworkCore` 0.3.0; coluna `Vector` (`vector(1536)`) e `UseVector()` no `UseNpgsql`. SEMPRE índice HNSW com operator class casando a função LINQ (senão seq scan); distância em ordem ASC. PROIBIDO: DocumentRepository, SQL cru do C# sem `decisions.md`, default `gen_random_uuid()`.
+- **infrastructure-neon-pgrag** (`infrastructure/neon/neon-pgrag.md`) — A extensão `rag` é EXPERIMENTAL: protótipo e RAG só-SQL, não produção sem teste. Nunca misture modelos de embedding numa coluna (bge-small 384 × text-embedding-3-small 1536). Índice HNSW depois da carga inicial. Produção .NET com lógica própria: tool MAF tipada sobre pgvector.
+- **backend-integrations-neon-auth-neon-auth** (`backend/integrations/neon-auth/neon-auth.md`) — SDK `@neondatabase/auth`: `createNeonAuth()` no server, `createAuthClient()` no client, `auth.middleware()` com `runtime='nodejs'`. Duas constantes de prefixo (`BACKEND_API_PREFIX`/`PROXY_API_PREFIX`), nunca uma só. O front não consulta o Neon para dado de negócio. .NET: token EdDSA/Ed25519, verificado pelo JWKS com BouncyCastle + `SignatureValidator` devolvendo `JsonWebToken`.
+
+> Resumo injetado quando você lê ou edita um arquivo casado por `paths:`. Texto completo: `morph-spec standards --find "<id>"` e leia só a seção necessária de `.morph/framework/standards/<path>`.
 
 ## SQL Templates