@polymorphism-tech/morph-spec 9.8.0 → 10.1.1

package/src/dashboard/scanner/features-scanner.js

@@ -7,7 +7,7 @@ import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
 import { join, basename, isAbsolute } from 'path';
 import { derivePhaseFrom, diskArtifactProbe, PHASE_ARTIFACTS } from '../../../framework/hooks/shared/state-reader.js';
 import { GATE_PREREQ } from '../../core/state/gate-order.js';
-import { sliceProgress, checksPath } from '../../../framework/hooks/shared/slice-progress.js';
+import { implementProgress, checksPath } from '../../../framework/hooks/shared/report-progress.js';
 import {
   reviewReportsFromDir, requiredReviewRoles, combinedVerdict, allBlockers, checksCoverage, reviewFileName, REVIEW_ROLES,
 } from '../../lib/review-reports.js';
@@ -110,26 +110,16 @@ function resolveLocation(projectDir, name, loc, resolveTree) {
   };
 }
 
-export function readSlices(dir) {
-  const progress = sliceProgress(dir);
+export function readProgress(dir) {
+  const progress = implementProgress(dir);
   if (!progress) return null;
-  const extracted = new Map((readJson(checksPath(dir))?.slices || []).filter((x) => x && x.id).map((x) => [x.id, x]));
-  const list = progress.slices.map((sl) => {
-    const x = extracted.get(sl.id) || {};
-    return {
-      ...sl,
-      persona: x.persona ?? null,
-      files: Array.isArray(x.files) ? x.files : [],
-      covers: Array.isArray(x.covers) ? x.covers : [],
-    };
-  });
   return {
-    counts: { total: progress.total, done: progress.done, partial: progress.partial, blocked: progress.blocked, pending: progress.pending },
-    list,
+    counts: { total: progress.total, done: progress.done, blocked: progress.blocked, pending: progress.pending },
+    byId: new Map(progress.checks.map((c) => [c.id, c])),
   };
 }
 
-const NO_SLICES = { total: 0, done: 0, partial: 0, blocked: 0, pending: 0 };
+const NO_SCENARIOS = { total: 0, done: 0, blocked: 0, pending: 0 };
 
 function gatesOf(feature) {
   const skipped = new Set(feature.skippedPhases || []);
@@ -142,9 +132,11 @@ function gatesOf(feature) {
       approved,
       approvedBy: g.approvedBy ?? (g.auto ? 'auto' : null),
       at: g.approvedAt || g.timestamp || null,
-      paused: !approved && decision?.pause === true,
+      // `paused` is "waiting for the human"; a session-owned pause is work in progress.
+      paused: !approved && decision?.pause === true && decision.resolver !== 'session',
       skipped: skipped.has(gate),
       reason: decision?.reason ?? null,
+      since: decision?.decidedAt ?? null,
     };
   });
 }
@@ -174,8 +166,39 @@ export function reviewRows(reports, workType) {
     });
 }
 
+// The contract opens the evidence with "Cn:"; a later mention is context, not the target.
+const LEADING_CHECKS_RE = /^\s*(C\d+(?:\s*(?:,|e|\/)\s*C\d+)*)\s*:/;
+function citedChecks(b) {
+  const lead = String(b.evidence).match(LEADING_CHECKS_RE)?.[1];
+  return [...new Set((lead ?? `${b.where} ${b.evidence}`).match(/\bC\d+\b/g) ?? [])];
+}
+
+// A role re-run fewer times keeps its last round; verifier rows accumulate across rounds.
+export function scoreboard(reports) {
+  const roles = Object.keys(REVIEW_ROLES).filter((role) => reports[role].status !== 'missing' && reports[role].rounds?.length);
+  const total = Math.max(0, ...roles.map((role) => reports[role].rounds.length));
+  const rows = new Map();
+  return Array.from({ length: total }, (_, i) => {
+    const byRole = {};
+    for (const role of roles) {
+      const all = reports[role].rounds;
+      const r = all[Math.min(i, all.length - 1)];
+      byRole[role] = {
+        verdict: r.verdict,
+        reviewedSha: r.reviewedSha,
+        carried: i >= all.length,
+        blockers: r.blockers.map((b) => ({ ...b, checks: citedChecks(b) })),
+      };
+      if (role === 'verifier' && i < all.length) {
+        for (const c of r.checks ?? []) rows.set(c.id, { ...c, round: i });
+      }
+    }
+    return { roles: byRole, checks: [...rows.values()] };
+  });
+}
+
 /** `coverage` is `null` until a verifier report exists; only PROVADO covers. */
-export function readChecks(dir, verifier) {
+export function readChecks(dir, verifier, progress = readProgress(dir)) {
   const checks = readJson(checksPath(dir))?.checks;
   if (!Array.isArray(checks)) return null;
   const list = checks.filter((c) => c && c.id);
@@ -192,6 +215,7 @@ export function readChecks(dir, verifier) {
       proof: c.proof ?? null,
       status: byId.get(c.id)?.status ?? null,
       evidence: byId.get(c.id)?.evidence ?? null,
+      implement: progress?.byId.get(c.id)?.status ?? 'pendente',
     })),
   };
 }
@@ -201,7 +225,7 @@ function summarize(name, resolved) {
   const feature = normalizeFeature(resolved.feature);
   const gates = gatesOf(feature);
   const reviewApproved = gates.find((g) => g.gate === 'review')?.approved === true;
-  const slices = readSlices(dir);
+  const progress = readProgress(dir);
   const verdict = reviewVerdict(dir, feature.workType);
   const status = feature.status || (location === 'archive' ? 'completed' : 'draft');
   const finished = isFinished({ status, location });
@@ -218,9 +242,7 @@ function summarize(name, resolved) {
     inEvaluation: verdict !== null && !reviewApproved,
     gates,
     awaiting: !finished && gates.some((g) => g.paused),
-    slices: slices?.counts ?? NO_SLICES,
-    // Finished features leave slice titles out: archived plans would bloat every list reply.
-    sliceIndex: finished || !slices ? [] : slices.list.map((sl) => ({ id: sl.id, title: sl.title, status: sl.status })),
+    scenarios: progress?.counts ?? NO_SCENARIOS,
     verification: feature.verification
       ? { status: feature.verification.status ?? null, ts: feature.verification.ts ?? null }
       : null,
@@ -304,16 +326,15 @@ export function readFeatureDetail(projectDir, name, { resolveTree = resolveFeatu
   if (!resolved) return null;
   const summary = summarize(name, resolved);
   const feature = normalizeFeature(resolved.feature);
-  const slices = readSlices(resolved.dir);
   const reports = reviewReportsFromDir(resolved.dir);
   const verdict = reviewVerdict(resolved.dir, feature.workType, reports);
   const checks = readChecks(resolved.dir, reports.verifier);
   return {
     ...summary,
-    slicesList: slices?.list ?? [],
     checksList: checks?.list ?? [],
     checksCoverage: checks?.coverage ?? null,
     reviews: reviewRows(reports, feature.workType),
+    rounds: scoreboard(reports),
     gateDecisions: feature.gateDecisions || {},
     verificationNodes: feature.verification?.nodes || null,
     featureVerification: feature.verifications?.feature || null,

package/src/dashboard/scanner/project-api.js

@@ -6,10 +6,11 @@
 import { join } from 'path';
 import { existsSync, readdirSync } from 'fs';
 import { scanFeatures, readFeatureDetail, readFeatureFile } from './features-scanner.js';
-import { createEventStore, buildFeed, lastActivityByFeature, ALL_KINDS, DEFAULT_KINDS } from './activity-scanner.js';
+import { createEventStore, buildFeed, lastActivityByFeature, sessionMap, ALL_KINDS, DEFAULT_KINDS } from './activity-scanner.js';
 import { containerDirs } from '../../../framework/hooks/shared/worktree-root.js';
 import { isFinished } from './feature-status.js';
 import { resolveFeatureTree } from '../../lib/worktree/feature-truth.js';
+import { computeMetrics } from '../../lib/telemetry/metrics.js';
 
 const TREE_TTL_MS = 60_000;
 
@@ -76,6 +77,7 @@ export function createProjectApi(projectDir, deps = {}) {
 
   const features = () => (cache.features ||= scan(projectDir, { resolveTree: rememberedTree }));
   const events = () => store.events();
+  let gatesCache = { from: null, length: -1, gates: null };
   const known = (name) => features().features?.find((f) => f.name === name) || undefined;
 
   /** Any `event` but 'change' may move a feature to another tree. */
@@ -111,7 +113,14 @@ export function createProjectApi(projectDir, deps = {}) {
         const limit = Math.min(Number(u.searchParams.get('limit')) || 100, 500);
         const all = events();
         const feed = buildFeed(all, { feature, kinds, before: u.searchParams.get('before') || undefined, limit });
-        return json(200, { ...feed, kinds, cost: feature ? store.cost(feature) : null });
+        return json(200, { ...feed, kinds, cost: feature ? store.cost(feature) : null, session: feature ? sessionMap(all, feature) : null });
+      }
+      if (parts[0] === 'gates' && parts.length === 1) {
+        const all = events();
+        if (gatesCache.from !== all || gatesCache.length !== all.length) {
+          gatesCache = { from: all, length: all.length, gates: computeMetrics(all.filter((e) => e?.event === 'Gate')).gates };
+        }
+        return json(200, { gates: gatesCache.gates });
       }
       return json(404, { error: 'rota desconhecida' });
     } catch (err) {

package/src/dashboard/scanner/skills-scanner.js

@@ -85,10 +85,20 @@ export function scanSkills(frameworkDir, phases = []) {
         stacks: typeof fm.stacks === 'string' ? fm.stacks.replace(/[[\]]/g, '').split(',').map((s) => s.trim()).filter(Boolean) : [],
         allowedTools: typeof fm['allowed-tools'] === 'string' ? fm['allowed-tools'].split(',').map((t) => t.trim()) : [],
         phase: phaseOf.get(skillDir.name) || null,
-        dispatches: extractDispatchPrompts(content),
+        dispatches: skillDispatches(join(levelPath, skillDir.name), content),
         content,
       });
     }
   }
   return skills.sort((a, b) => a.id.localeCompare(b.id));
 }
+
+function skillDispatches(skillDir, content) {
+  const refsDir = join(skillDir, 'references');
+  const refs = existsSync(refsDir)
+    ? readdirSync(refsDir).filter((f) => f.endsWith('.md')).sort().map((f) => readFileSync(join(refsDir, f), 'utf8'))
+    : [];
+  return [content, ...refs]
+    .flatMap((text) => extractDispatchPrompts(text))
+    .map((d, index) => ({ ...d, index }));
+}

package/src/lib/detectors/index.js

@@ -54,7 +54,7 @@ export function detectProject(targetPath, opts = {}) {
       if (depNames.includes('@neondatabase/serverless') || depNames.includes('postgres') || depNames.includes('pg')) {
         structure.integrations.push('neon');
       }
-      if (depNames.includes('@neondatabase/auth')) {
+      if (depNames.includes('@neon/auth') || depNames.includes('@neondatabase/auth')) {
         structure.integrations.push('neon-auth');
       }
       if (depNames.includes('stripe')) {

package/src/lib/e2e/applicability.js

@@ -9,6 +9,8 @@ export const E2E_NOT_APPLICABLE = 'not applicable: no `prova: e2e` scenario and
 const UI_FILE = /\.(tsx|jsx|vue|svelte|astro|css|scss|sass|less|html)$/i;
 const RUNTIME_FILE = /(^|\/)(dockerfile[^/]*|\.dockerignore|(docker-)?compose[^/]*\.ya?ml|playwright\.config\.[cm]?[jt]s)$/i;
 const E2E_DIR = /(^|\/)e2e\//i;
+// The harness writes here itself (verify syncs .claude/rules/), so these never mean the app changed.
+const HARNESS_DIR = /^\.(morph|claude)\//;
 const KNOWN_PACKAGE_DIRS = E2E_SPEC_LOCATIONS.filter((dir) => dir !== '.');
 
 function packageDirsOf(config) {
@@ -28,7 +30,7 @@ export function e2eApplicability(projectPath, featureName, config) {
   const { checks } = readPlanChecks(projectPath, featureName);
   if (checks?.checks?.some((c) => c.proof === 'e2e')) return { applicable: true, reason: 'prova: e2e' };
   const base = detectDefaultBranch(projectPath);
-  const changed = base ? changedPathsAgainst(base, projectPath).filter((f) => !f.startsWith('.morph/')) : [];
+  const changed = base ? changedPathsAgainst(base, projectPath).filter((f) => !HARNESS_DIR.test(f)) : [];
   if (changed.length === 0) return { applicable: true, reason: 'diff unknown' };
   const composeFile = resolveComposeFile(projectPath, config);
   const packageDirs = packageDirsOf(config);

package/src/lib/git/tree-state.js

@@ -4,7 +4,6 @@ import { OUTSIDE_MORPH, treeFingerprint, git as gitBuffer } from './tree-fingerp
 import { detectDefaultBranch } from './default-branch.js';
 import { resolveBaseRef } from './branch-classifier.js';
 
-export const MUTATION_MARKER = 'MUTACAO';
 const MAX_LISTED = 50;
 const MAX_COMMITS = 10;
 
@@ -51,7 +50,7 @@ export function snapshotTree(cwd) {
 }
 
 /**
- * Compares content, not status: a mutation committed since shows up, and a file
+ * Compares content, not status: an edit committed since shows up, and a file
  * committed unchanged does not.
  * @returns {{ at: string, headChanged: boolean, changed: string[], changedCount: number }}
  */
@@ -104,19 +103,6 @@ function commitsOnTop(cwd) {
     .split('\n').filter(Boolean);
 }
 
-function markers(cwd) {
-  try {
-    const out = git(cwd, ['grep', '-n', '-I', '--untracked', '-F', '-e', MUTATION_MARKER, ...OUTSIDE_MORPH]);
-    return out.split('\n').filter(Boolean).slice(0, MAX_LISTED).map((line) => {
-      const [file, lineNo] = line.split(':');
-      return { file, line: Number(lineNo) };
-    });
-  } catch (err) {
-    if (err.status === 1) return [];
-    throw err;
-  }
-}
-
 /** @returns {object|null} null when git cannot answer: unknown, never a clean tree. */
 export function treeState(cwd, { snapshot = null } = {}) {
   try {
@@ -131,7 +117,6 @@ export function treeState(cwd, { snapshot = null } = {}) {
       dirtyCount: dirty.length,
       diffstat: head ? diffstat(cwd) : null,
       commits: head ? commitsOnTop(cwd) : null,
-      markers: markers(cwd),
       sinceBeforeEval: snapshot ? compareToSnapshot(cwd, snapshot) : null,
     };
   } catch {

package/src/lib/graph/diff-tree.js

@@ -0,0 +1,127 @@
+import { buildIndex, linksOf, resolveEdgeTarget, isTestPath } from './sanitize.js';
+
+const CALL_RELATIONS = new Set(['calls', 'indirect_call', 'dispatches_to']);
+const HUNK_RE = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/;
+
+/** `git diff -U0` → per file: whether it is new, and the new-side line ranges the diff touched. */
+export function parseDiff(text) {
+  const files = new Map();
+  let current = null;
+  let fromNull = false;
+  for (const line of String(text || '').split('\n')) {
+    if (line.startsWith('--- ')) { fromNull = line === '--- /dev/null'; continue; }
+    if (line.startsWith('+++ ')) {
+      const path = line.slice(4).replace(/^b\//, '').trim();
+      current = path === '/dev/null' ? null : { added: fromNull, ranges: [] };
+      if (current) files.set(path, current);
+      continue;
+    }
+    const hunk = current && HUNK_RE.exec(line);
+    if (!hunk) continue;
+    const start = Number(hunk[1]);
+    const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
+    // A pure deletion has no new-side line: it touches the line it left behind.
+    current.ranges.push(count === 0 ? [Math.max(1, start), Math.max(1, start)] : [start, start + count - 1]);
+  }
+  return files;
+}
+
+const lineOf = (node) => Number(/^L(\d+)/.exec(node.source_location || '')?.[1]) || null;
+
+/**
+ * The call tree of what changed: every graph symbol whose lines the diff touched, `+` when its file is
+ * new and `~` otherwise, linked by the calls between them, entry points (no changed caller) first.
+ */
+export function buildDiffTree(graph, changes) {
+  const index = buildIndex(graph);
+  const perFile = new Map();
+  for (const node of graph.nodes ?? []) {
+    if (!node._callable || !changes.has(node.source_file) || lineOf(node) === null) continue;
+    if (!perFile.has(node.source_file)) perFile.set(node.source_file, []);
+    perFile.get(node.source_file).push(node);
+  }
+
+  const changed = new Map();
+  for (const [file, nodes] of perFile) {
+    const change = changes.get(file);
+    nodes.sort((a, b) => lineOf(a) - lineOf(b));
+    nodes.forEach((node, i) => {
+      const start = lineOf(node);
+      const end = i + 1 < nodes.length ? lineOf(nodes[i + 1]) - 1 : Infinity;
+      const touched = change.added || change.ranges.some(([a, b]) => a <= end && b >= start);
+      if (touched) {
+        changed.set(node.id, { id: node.id, label: node.label, file, line: start, mark: change.added ? '+' : '~', test: isTestPath(file) });
+      }
+    });
+  }
+
+  const callees = new Map([...changed.keys()].map((id) => [id, new Set()]));
+  const hasCaller = new Set();
+  for (const link of linksOf(index, graph)) {
+    if (!CALL_RELATIONS.has(link.relation) || !changed.has(link.source)) continue;
+    const target = resolveEdgeTarget(index, link).id;
+    if (!target || target === link.source || !changed.has(target)) continue;
+    callees.get(link.source).add(target);
+    hasCaller.add(target);
+  }
+
+  const byPlace = (a, b) => a.file.localeCompare(b.file) || a.line - b.line;
+  const shown = new Set();
+  const grow = (id, path) => {
+    const node = changed.get(id);
+    if (path.has(id)) return { ...node, cycle: true, children: [] };
+    if (shown.has(id)) return { ...node, repeat: true, children: [] };
+    shown.add(id);
+    const next = new Set(path).add(id);
+    const children = [...callees.get(id)].map((c) => changed.get(c)).sort(byPlace).map((c) => grow(c.id, next));
+    return { ...node, children };
+  };
+  const entries = [...changed.values()].filter((n) => !hasCaller.has(n.id)).sort(byPlace);
+  const roots = entries.map((n) => grow(n.id, new Set()));
+  // Only cycles left: every node has a changed caller, so start from what was not reached.
+  for (const n of [...changed.values()].sort(byPlace)) if (!shown.has(n.id)) roots.push(grow(n.id, new Set()));
+
+  const mapped = new Set([...changed.values()].map((n) => n.file));
+  const values = [...changed.values()];
+  return {
+    roots,
+    counts: {
+      added: values.filter((n) => n.mark === '+').length,
+      modified: values.filter((n) => n.mark === '~').length,
+      entries: entries.length,
+      files: changes.size,
+    },
+    unmapped: [...changes.keys()].filter((f) => !mapped.has(f)).sort(),
+  };
+}
+
+/**
+ * Symbols whose graph line does not declare them in the committed file: the commit stamp can match HEAD
+ * while the extraction read a dirty tree, and then every line in the tree is off.
+ */
+export function declarationDrift(tree, readLines) {
+  const drift = [];
+  const files = new Map();
+  const walk = (node) => {
+    if (!node.repeat && !node.cycle) {
+      if (!files.has(node.file)) files.set(node.file, readLines(node.file));
+      const name = String(node.label).replace(/^\./, '').split('(')[0].trim();
+      if (!(files.get(node.file)?.[node.line - 1] ?? '').includes(name)) drift.push({ file: node.file, line: node.line, label: node.label });
+    }
+    node.children.forEach(walk);
+  };
+  tree.roots.forEach(walk);
+  return drift;
+}
+
+export function renderDiffTree(tree) {
+  const lines = [];
+  const walk = (node, depth) => {
+    const tag = node.cycle ? '  ↺ ciclo' : node.repeat ? '  ↑ já mostrado' : '';
+    const test = node.test ? '  [teste]' : '';
+    lines.push(`${'  '.repeat(depth)}${node.mark} ${node.label}  ${node.file}:${node.line}${test}${tag}`);
+    for (const c of node.children) walk(c, depth + 1);
+  };
+  for (const r of tree.roots) walk(r, 0);
+  return lines;
+}

package/src/lib/graph/graphify-runtime.js

@@ -1,11 +1,13 @@
 // O binário é `graphify` (e `graphify-mcp`). NUNCA `python -m graphify.serve`, como manda o README oficial:
 // com `uv tool install` o pacote vive num venv isolado que o Python do sistema não enxerga.
 import { execFileSync } from 'node:child_process';
+import { GRAPHIFY_PACKAGE, resolveGraphify } from '../../../framework/hooks/shared/graph-refresh.js';
+
+export { GRAPHIFY_PACKAGE };
 
 // Pin exato: o graphify é pré-1.0 com release quase diária e semver não garante nada; subir é decisão
 // consciente, com o fixture de regressão regerado.
 export const GRAPHIFY_VERSION = '0.9.50';
-export const GRAPHIFY_PACKAGE = 'graphifyy';
 export const GRAPHIFY_BIN = 'graphify';
 
 const PREFERENCE = ['uv', 'pipx', 'python3', 'python'];
@@ -56,10 +58,15 @@ export function installArgs(kind, { withSql }) {
 
 /** Versão instalada, ou null se o binário não responde. */
 export function detectGraphifyVersion(deps = {}) {
-  const run = deps._run ?? (() => execFileSync(GRAPHIFY_BIN, ['--version'], {
-    encoding: 'utf-8',
-    stdio: ['ignore', 'pipe', 'ignore'],
-  }));
+  const run = deps._run ?? (() => {
+    const bin = resolveGraphify();
+    if (!bin) return '';
+    return execFileSync(bin.file, ['--version'], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      shell: bin.shell,
+    });
+  });
   try {
     const m = /(\d+\.\d+\.\d+)/.exec(run());
     return m ? m[1] : null;

package/src/lib/installers/memory-installer.js

@@ -29,7 +29,7 @@ metadata:
 ## Key paths
 
 - \`.morph/framework/MORPH.md\` — NLH charter (read once per session)
-- \`.morph/framework/agents.json\` — 8 agents: 7 domain personas + 1 stage persona (\`scout\`, read-only)
+- \`.morph/framework/agents.json\` — the 3 read-only Gate 3 agents (\`verifier\`, \`reviewer\`, \`security\`)
 - \`.morph/framework/standards/STANDARDS.json\` — standards index (load on demand)
 - \`.morph/features/{feature}/\` — feature artifacts: 2-plan / 1-design / 3-implement / 4-review
 - \`.morph/context/\` — long-lived architectural context (design-system, decisions)
@@ -39,7 +39,7 @@ metadata:
 
 | Command | Skill invoked |
 |---------|---------------|
-| \`/morph-plan {feature}\` | \`Skill(morph-plan)\` — entrevista → plan.md → plan-check → gate do plano |
+| \`/morph-plan {feature}\` | \`Skill(morph-plan)\` — tese → plan.md → plan-check → gate do plano |
 | \`/morph-apply {feature}\` | \`Skill(morph-apply)\` — fatias do plano → verify → review → Gate 3 |
 | \`/morph-status [feature]\` | inspect state.json |
 | \`/morph-archive {feature}\` | move completed feature to .morph/archive/ |
@@ -72,7 +72,7 @@ metadata:
 - \`.morph/framework/MORPH.md\` — NLH charter, Trust Mode rules, gates, skills table
 - \`.morph/framework/standards/STANDARDS.json\` — index; load specific standard via \`path\` field
 - \`.morph/framework/phases.json\` — phase folder mapping and skill associations
-- \`.morph/framework/agents.json\` — domain persona definitions (dotnet-senior, ef-modeler, etc.)
+- \`.morph/framework/agents.json\` — Gate 3 agent definitions (verifier, reviewer, security)
 - \`.morph/framework/evals/review-checklist.md\` — what the Gate 3 verifier, reviewer and security check (verdict SHIP/FIX + evidence-typed blockers)
 `;
 

package/src/lib/installers/rules-installer.js

@@ -0,0 +1,57 @@
+import { readFileSync, readdirSync } from 'fs';
+import { join } from 'path';
+import { parseStacks, shouldInstall } from '../stack-filter.js';
+import { realEffects } from './effects.js';
+
+export const MAF_TAG = 'maf';
+export const MAF_RULE = 'ai-agents-standards.md';
+const MAF_PATHS = ['**/*.cs'];
+
+/** The text a rule is installed with: in a MAF project the agents rule covers every `.cs`, not only `Agents/` folders. */
+export function ruleContentFor(file, content, projectTags) {
+  if (file !== MAF_RULE || !projectTags.includes(MAF_TAG)) return content;
+  const fm = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!fm) return content;
+  const eol = content.includes('\r\n') ? '\r\n' : '\n';
+  const list = MAF_PATHS.map((p) => `  - "${p}"`).join(eol);
+  const rewritten = fm[1].replace(
+    /^paths:[ \t]*(?:\r?\n[ \t]+-[^\r\n]*)*(\r?\n)?/m,
+    (_, tail) => `paths:${eol}${list}${tail ? eol : ''}`,
+  );
+  const start = fm[0].indexOf(fm[1]);
+  return content.slice(0, start) + rewritten + content.slice(start + fm[1].length);
+}
+
+export function installRuleFile(rulesSrc, rulesDest, file, projectTags, fx = realEffects()) {
+  const from = join(rulesSrc, file);
+  const to = join(rulesDest, file);
+  const content = readFileSync(from, 'utf-8');
+  const desired = ruleContentFor(file, content, projectTags);
+  if (desired === content) fx.copyFile(from, to);
+  else fx.writeFile(to, desired);
+}
+
+/** Also removes orphan rules in rulesDest that are no longer in the install set. */
+export function installRulesForStack(rulesSrc, rulesDest, projectTags, fx = realEffects()) {
+  const sourceFiles = readdirSync(rulesSrc).filter(f => f.endsWith('.md'));
+  const installed = new Set();
+
+  for (const file of sourceFiles) {
+    const content = readFileSync(join(rulesSrc, file), 'utf-8');
+    if (shouldInstall(parseStacks(content), projectTags)) {
+      installRuleFile(rulesSrc, rulesDest, file, projectTags, fx);
+      installed.add(file);
+    }
+  }
+
+  // Calado em `dryRun`: `cleanFrameworkDirs()` já apagou `.claude/rules/` inteiro antes da execução real.
+  if (!fx.dryRun) {
+    for (const file of readdirSync(rulesDest).filter(f => f.endsWith('.md'))) {
+      if (!installed.has(file)) {
+        fx.remove(join(rulesDest, file));
+      }
+    }
+  }
+
+  return { installed: installed.size };
+}

package/src/lib/installers/stack-assets.js

@@ -0,0 +1,17 @@
+import { join } from 'path';
+import { installRulesForStack } from './rules-installer.js';
+import { installCommandsForStack } from '../../scripts/setup-infra.js';
+import { installSkills } from '../../utils/skills-installer.js';
+import { installAgents } from '../../utils/agents-installer.js';
+
+const FRAMEWORK_SRC = join(import.meta.dirname, '..', '..', '..', 'framework');
+
+/** Everything filtered by `stacks:` — rules, commands, skills, agents — for the project's tags. The one path init and stack-set share. */
+export async function installStackAssets(targetPath, stackTags, { frameworkSrc = FRAMEWORK_SRC } = {}) {
+  if (stackTags.length === 0) return false;
+  installRulesForStack(join(frameworkSrc, 'rules'), join(targetPath, '.claude', 'rules'), stackTags);
+  installCommandsForStack(join(frameworkSrc, 'commands'), join(targetPath, '.claude', 'commands'), stackTags);
+  await installSkills(targetPath, { projectTags: stackTags });
+  await installAgents(targetPath, frameworkSrc, { projectTags: stackTags });
+  return true;
+}