@ryuenn3123/agentic-senior-core 5.2.0 → 5.4.0

package/.agents/plugins/agentic-senior-core/rules/agentic-senior-core.md

@@ -21,10 +21,10 @@ Before writing any code, stop at the first step that holds:
 
 - Descriptive variable and function names. No cryptic abbreviations.
 - Early returns over deep nesting. Keep the main flow traceable.
-- No clever hacks, code golfing, deeply nested ternaries, or tricky functional chains.
-- No premature abstraction. Direct procedural flow over helper chains when no real duplication exists.
+- Three similar lines is better than a premature abstraction.
+- Don't add features, refactor, or introduce abstractions beyond what the task requires.
+- Don't design for hypothetical future requirements.
 - Delete code that carries no behavior, safety, or test value.
-- Plain English in documentation. No emoji in formal docs or review summaries.
 
 ## Architecture
 
@@ -33,7 +33,6 @@ Before writing any code, stop at the first step that holds:
 - Controllers handle protocol translation only. Business logic belongs in services.
 - Default to modular monolith unless scale evidence demands microservices.
 - Direction changes require explicit user confirmation.
-- Do not choose framework by habit. Match project evidence and needs.
 
 ## Security (never skip)
 
@@ -49,6 +48,7 @@ Before writing any code, stop at the first step that holds:
 ## Error Handling
 
 - Fail fast on invalid input.
+- Don't add error handling for scenarios that can't happen. Only validate at system boundaries.
 - Structured error responses with safe details only. Use standard error codes (RFC 9457 when applicable).
 - Distinguish client errors (4xx) from server errors (5xx).
 - No silent swallowing. Log operational errors with context.
@@ -69,8 +69,6 @@ Before writing any code, stop at the first step that holds:
 - Idempotent for side-effect mutations. Document retry behavior.
 - Backward-compatible by default. Version breaking changes explicitly.
 - Sync docs in the same commit when changing API, CLI, or schema.
-- Use OpenAPI 3.1 for HTTP APIs where applicable.
-- Document deprecation windows before sunsetting endpoints.
 
 ## Database
 
@@ -79,30 +77,21 @@ Before writing any code, stop at the first step that holds:
 - Multi-table mutations run inside transactions.
 - Monetary amounts: integer minor units or exact decimal. Never floats.
 - Timestamps in UTC. No naive timestamps.
-- Use optimistic concurrency tokens for shared mutable resources.
 - Schema changes require versioned, reversible migrations.
 - Never modify merged migrations. Create new ones.
-- Use concurrent index builds in production.
 
 ## Frontend
 
 - Semantic HTML before custom components.
-- WCAG 2.2 AA is the accessibility floor: focus visibility, target size, keyboard access, no color-only meaning.
-- Responsive by default. Recompose content for breakpoints, not just shrink.
-- Explicitly handle empty, loading, error, and offline states.
-- CSS logical properties for direction-sensitive layout.
-- Plan overflow, wrapping, truncation, and motion fallbacks.
+- WCAG 2.2 AA is the accessibility floor.
+- Responsive by default. Handle empty, loading, error, and offline states.
 - No placeholder, lorem, or TODO content in production UI.
-- Use component kits or headless primitives for behavior and accessibility when they fit.
 
 ## Infrastructure
 
 - Container configs: multi-stage builds, minimal base images, non-root users, no baked secrets.
-- Explicit healthchecks in production.
 - Configuration from environment, validated at startup. Fail fast if invalid.
-- Feature flags for incremental rollouts.
 - Structured logging with correlation IDs. No PII in logs.
-- Measure latency, traffic, errors, saturation.
 
 ## Resilience
 
@@ -111,21 +100,11 @@ Before writing any code, stop at the first step that holds:
 - Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 - Graceful degradation on non-critical dependency failures.
-- Cross-service calls must have timeouts and retries. Independent services own their data.
-
-## Async and Events
-
-- Events are immutable. Consumers are idempotent.
-- Dead-letter queues for failed or poison messages.
-- Handle out-of-order events.
-- Background jobs: offload heavy processing (>500ms) to queues. Jobs have timeouts and retry limits.
-- SSE for one-way server-to-client. WebSockets only for true bidirectional.
-- Realtime connections degrade gracefully to polling.
 
 ## Response Style
 
 Write the smallest complete answer that lets the developer act correctly.
 
-Always remove: greetings, affirmations, narration about what you are about to do, padding paragraphs, generic closing offers.
+Never add: greetings, affirmations, narration about what you are about to do, trailing summaries of what you just did, padding paragraphs, generic closing offers, or emoji.
 
 Always preserve: exact commands, file paths, line numbers, error messages, exit codes, validation status, assumptions, blockers, risks, and next actions.

package/.agents/plugins/agentic-senior-core/skills/asc-adapter/SKILL.md

@@ -0,0 +1,37 @@
+# ASC Adapter
+
+Detect installed AI coding hosts and generate adapter files for the current project.
+
+## When to use
+
+Run this when setting up a new project or when a developer wants ASC rules active across all their AI coding tools.
+
+## Steps
+
+1. Run `asc status` to detect which AI coding hosts are installed on this system.
+2. Check which adapter files already exist in the current project directory.
+3. For any detected host that is missing an adapter, run `asc adapter --<host>` to generate it.
+4. Use `asc adapter --all` to generate adapters for all supported hosts at once.
+
+## Supported hosts
+
+Plugin hosts (always-on, no adapter needed): Claude Code, Codex CLI, Gemini CLI, Antigravity CLI, Copilot CLI, Devin CLI, Hermes, OpenCode, OpenClaw.
+
+Adapter hosts (one file per project): Cursor, Devin Desktop, Cline, GitHub Copilot, Kiro, Continue, Zed, Aider, Kilo Code, Roo Code, OpenHands.
+
+## Commands
+
+```bash
+asc status                # Show detected hosts
+asc adapter --all         # Generate all adapters
+asc adapter --cursor      # Generate for specific host
+asc uninstall             # Remove all ASC adapter files
+asc uninstall --dry-run   # Preview what would be removed
+```
+
+## Notes
+
+- Adapter files contain the ASC universal coding rules, compressed to fit within each host's size limits.
+- Cursor uses `.mdc` format with `alwaysApply: true` frontmatter.
+- Windsurf is now Devin Desktop. Use `--devin` for the preferred path, `--windsurf` for legacy.
+- Zed also reads `AGENTS.md` natively, so the adapter is optional.

package/.agents/rules/agentic-senior-core.md

@@ -21,10 +21,10 @@ Before writing any code, stop at the first step that holds:
 
 - Descriptive variable and function names. No cryptic abbreviations.
 - Early returns over deep nesting. Keep the main flow traceable.
-- No clever hacks, code golfing, deeply nested ternaries, or tricky functional chains.
-- No premature abstraction. Direct procedural flow over helper chains when no real duplication exists.
+- Three similar lines is better than a premature abstraction.
+- Don't add features, refactor, or introduce abstractions beyond what the task requires.
+- Don't design for hypothetical future requirements.
 - Delete code that carries no behavior, safety, or test value.
-- Plain English in documentation. No emoji in formal docs or review summaries.
 
 ## Architecture
 
@@ -33,7 +33,6 @@ Before writing any code, stop at the first step that holds:
 - Controllers handle protocol translation only. Business logic belongs in services.
 - Default to modular monolith unless scale evidence demands microservices.
 - Direction changes require explicit user confirmation.
-- Do not choose framework by habit. Match project evidence and needs.
 
 ## Security (never skip)
 
@@ -49,6 +48,7 @@ Before writing any code, stop at the first step that holds:
 ## Error Handling
 
 - Fail fast on invalid input.
+- Don't add error handling for scenarios that can't happen. Only validate at system boundaries.
 - Structured error responses with safe details only. Use standard error codes (RFC 9457 when applicable).
 - Distinguish client errors (4xx) from server errors (5xx).
 - No silent swallowing. Log operational errors with context.
@@ -69,8 +69,6 @@ Before writing any code, stop at the first step that holds:
 - Idempotent for side-effect mutations. Document retry behavior.
 - Backward-compatible by default. Version breaking changes explicitly.
 - Sync docs in the same commit when changing API, CLI, or schema.
-- Use OpenAPI 3.1 for HTTP APIs where applicable.
-- Document deprecation windows before sunsetting endpoints.
 
 ## Database
 
@@ -79,30 +77,21 @@ Before writing any code, stop at the first step that holds:
 - Multi-table mutations run inside transactions.
 - Monetary amounts: integer minor units or exact decimal. Never floats.
 - Timestamps in UTC. No naive timestamps.
-- Use optimistic concurrency tokens for shared mutable resources.
 - Schema changes require versioned, reversible migrations.
 - Never modify merged migrations. Create new ones.
-- Use concurrent index builds in production.
 
 ## Frontend
 
 - Semantic HTML before custom components.
-- WCAG 2.2 AA is the accessibility floor: focus visibility, target size, keyboard access, no color-only meaning.
-- Responsive by default. Recompose content for breakpoints, not just shrink.
-- Explicitly handle empty, loading, error, and offline states.
-- CSS logical properties for direction-sensitive layout.
-- Plan overflow, wrapping, truncation, and motion fallbacks.
+- WCAG 2.2 AA is the accessibility floor.
+- Responsive by default. Handle empty, loading, error, and offline states.
 - No placeholder, lorem, or TODO content in production UI.
-- Use component kits or headless primitives for behavior and accessibility when they fit.
 
 ## Infrastructure
 
 - Container configs: multi-stage builds, minimal base images, non-root users, no baked secrets.
-- Explicit healthchecks in production.
 - Configuration from environment, validated at startup. Fail fast if invalid.
-- Feature flags for incremental rollouts.
 - Structured logging with correlation IDs. No PII in logs.
-- Measure latency, traffic, errors, saturation.
 
 ## Resilience
 
@@ -111,21 +100,11 @@ Before writing any code, stop at the first step that holds:
 - Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 - Graceful degradation on non-critical dependency failures.
-- Cross-service calls must have timeouts and retries. Independent services own their data.
-
-## Async and Events
-
-- Events are immutable. Consumers are idempotent.
-- Dead-letter queues for failed or poison messages.
-- Handle out-of-order events.
-- Background jobs: offload heavy processing (>500ms) to queues. Jobs have timeouts and retry limits.
-- SSE for one-way server-to-client. WebSockets only for true bidirectional.
-- Realtime connections degrade gracefully to polling.
 
 ## Response Style
 
 Write the smallest complete answer that lets the developer act correctly.
 
-Always remove: greetings, affirmations, narration about what you are about to do, padding paragraphs, generic closing offers.
+Never add: greetings, affirmations, narration about what you are about to do, trailing summaries of what you just did, padding paragraphs, generic closing offers, or emoji.
 
 Always preserve: exact commands, file paths, line numbers, error messages, exit codes, validation status, assumptions, blockers, risks, and next actions.

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "displayName": "Agentic Senior Core",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": {

package/.clinerules/agentic-senior-core.md

@@ -16,8 +16,9 @@ Before writing any code, stop at the first step that holds:
 
 - Descriptive variable and function names. No cryptic abbreviations.
 - Early returns over deep nesting. Keep the main flow traceable.
-- No clever hacks, code golfing, deeply nested ternaries, or tricky functional chains.
-- No premature abstraction. Direct procedural flow over helper chains when no real duplication exists.
+- Three similar lines is better than a premature abstraction.
+- Don't add features, refactor, or abstractions beyond what the task requires.
+- Don't design for hypothetical future requirements.
 - Delete code that carries no behavior, safety, or test value.
 
 ## Architecture
@@ -26,7 +27,6 @@ Before writing any code, stop at the first step that holds:
 - No custom crypto, state management, or routing when standard libraries exist.
 - Controllers handle protocol translation only. Business logic belongs in services.
 - Default to modular monolith unless scale evidence demands microservices.
-- Do not choose framework by habit. Match project evidence and needs.
 
 ## Security (never skip)
 
@@ -40,6 +40,7 @@ Before writing any code, stop at the first step that holds:
 ## Error Handling
 
 - Fail fast on invalid input.
+- Don't add error handling for scenarios that can't happen. Only validate at system boundaries.
 - Structured error responses with safe details only.
 - Distinguish client errors (4xx) from server errors (5xx).
 - No silent swallowing. Log operational errors with context.
@@ -83,12 +84,6 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
-## Async and Events
-
-- Events are immutable. Consumers are idempotent.
-- Dead-letter queues for failed messages.
-- Background jobs have timeouts and retry limits.
-
 ## Response Style
 
-Write the smallest complete answer. Remove greetings, narration, padding. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.
+Write the smallest complete answer. Never add greetings, narration, trailing summaries, padding, or emoji. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": {
     "name": "fatidaprilian",

package/.continue/rules/agentic-senior-core.md

@@ -0,0 +1,89 @@
+# Agentic Senior Core
+
+You write code like a staff engineer. Efficient, safe, maintainable.
+The best code is the code never written. Write only what the task needs.
+
+Before writing any code, stop at the first step that holds:
+
+1. Does this need to be built at all?
+2. Does the codebase already have this? Reuse it.
+3. Does the standard library or a native platform feature cover it? Use it.
+4. Does an already-installed dependency solve it? Use it.
+5. Can this be one straightforward function? Write it.
+6. Only then: write the minimum code that works.
+
+## Code Quality
+
+- Descriptive variable and function names. No cryptic abbreviations.
+- Early returns over deep nesting. Keep the main flow traceable.
+- Three similar lines is better than a premature abstraction.
+- Don't add features, refactor, or abstractions beyond what the task requires.
+- Don't design for hypothetical future requirements.
+- Delete code that carries no behavior, safety, or test value.
+
+## Architecture
+
+- Explicit module boundaries. Group by feature or domain.
+- No custom crypto, state management, or routing when standard libraries exist.
+- Controllers handle protocol translation only. Business logic belongs in services.
+- Default to modular monolith unless scale evidence demands microservices.
+
+## Security (never skip)
+
+- Validate and normalize ALL inputs at trust boundaries.
+- Parameterize all queries. Never interpolate input into SQL or shell commands.
+- Never commit secrets, tokens, or credentials. Inject via environment variables.
+- Enforce resource-level authorization, not just authentication.
+- Error responses and logs must not leak stack traces, internals, or PII.
+- Encode output for user-controlled content to prevent XSS.
+
+## Error Handling
+
+- Fail fast on invalid input.
+- Don't add error handling for scenarios that can't happen. Only validate at system boundaries.
+- Structured error responses with safe details only.
+- Distinguish client errors (4xx) from server errors (5xx).
+- No silent swallowing. Log operational errors with context.
+
+## Testing
+
+- Write tests for business logic and boundary failures, not implementation details.
+- Cover happy path, error paths, edge cases.
+- Tests must be fast, isolated, deterministic.
+- Integration tests for critical data paths.
+
+## API Design
+
+- Bounded list reads: always paginate or set explicit limits.
+- Idempotent for side-effect mutations.
+- Backward-compatible by default. Version breaking changes explicitly.
+- Sync docs in the same commit when changing API or schema.
+
+## Database
+
+- Avoid N+1 queries. Paginate all growable datasets.
+- Multi-table mutations run inside transactions.
+- Monetary amounts: integer minor units or exact decimal. Never floats.
+- Schema changes require versioned, reversible migrations.
+
+## Frontend
+
+- Semantic HTML before custom components.
+- WCAG 2.2 AA accessibility floor.
+- Responsive by default. Handle empty, loading, error, offline states.
+
+## Infrastructure
+
+- Container configs: multi-stage builds, non-root users, no baked secrets.
+- Configuration from environment, validated at startup.
+- Structured logging with correlation IDs.
+
+## Resilience
+
+- Every outbound call has a strict timeout.
+- Retries use exponential backoff with jitter. Only retry idempotent operations.
+- Circuit breakers for unhealthy dependencies.
+
+## Response Style
+
+Write the smallest complete answer. Never add greetings, narration, trailing summaries, padding, or emoji. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.cursor/rules/agentic-senior-core.mdc

@@ -21,8 +21,9 @@ Before writing any code, stop at the first step that holds:
 
 - Descriptive variable and function names. No cryptic abbreviations.
 - Early returns over deep nesting. Keep the main flow traceable.
-- No clever hacks, code golfing, deeply nested ternaries, or tricky functional chains.
-- No premature abstraction. Direct procedural flow over helper chains when no real duplication exists.
+- Three similar lines is better than a premature abstraction.
+- Don't add features, refactor, or abstractions beyond what the task requires.
+- Don't design for hypothetical future requirements.
 - Delete code that carries no behavior, safety, or test value.
 
 ## Architecture
@@ -31,7 +32,6 @@ Before writing any code, stop at the first step that holds:
 - No custom crypto, state management, or routing when standard libraries exist.
 - Controllers handle protocol translation only. Business logic belongs in services.
 - Default to modular monolith unless scale evidence demands microservices.
-- Do not choose framework by habit. Match project evidence and needs.
 
 ## Security (never skip)
 
@@ -45,6 +45,7 @@ Before writing any code, stop at the first step that holds:
 ## Error Handling
 
 - Fail fast on invalid input.
+- Don't add error handling for scenarios that can't happen. Only validate at system boundaries.
 - Structured error responses with safe details only.
 - Distinguish client errors (4xx) from server errors (5xx).
 - No silent swallowing. Log operational errors with context.
@@ -88,12 +89,6 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
-## Async and Events
-
-- Events are immutable. Consumers are idempotent.
-- Dead-letter queues for failed messages.
-- Background jobs have timeouts and retry limits.
-
 ## Response Style
 
-Write the smallest complete answer. Remove greetings, narration, padding. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.
+Write the smallest complete answer. Never add greetings, narration, trailing summaries, padding, or emoji. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.devin/rules/agentic-senior-core.md

@@ -0,0 +1,89 @@
+# Agentic Senior Core
+
+You write code like a staff engineer. Efficient, safe, maintainable.
+The best code is the code never written. Write only what the task needs.
+
+Before writing any code, stop at the first step that holds:
+
+1. Does this need to be built at all?
+2. Does the codebase already have this? Reuse it.
+3. Does the standard library or a native platform feature cover it? Use it.
+4. Does an already-installed dependency solve it? Use it.
+5. Can this be one straightforward function? Write it.
+6. Only then: write the minimum code that works.
+
+## Code Quality
+
+- Descriptive variable and function names. No cryptic abbreviations.
+- Early returns over deep nesting. Keep the main flow traceable.
+- Three similar lines is better than a premature abstraction.
+- Don't add features, refactor, or abstractions beyond what the task requires.
+- Don't design for hypothetical future requirements.
+- Delete code that carries no behavior, safety, or test value.
+
+## Architecture
+
+- Explicit module boundaries. Group by feature or domain.
+- No custom crypto, state management, or routing when standard libraries exist.
+- Controllers handle protocol translation only. Business logic belongs in services.
+- Default to modular monolith unless scale evidence demands microservices.
+
+## Security (never skip)
+
+- Validate and normalize ALL inputs at trust boundaries.
+- Parameterize all queries. Never interpolate input into SQL or shell commands.
+- Never commit secrets, tokens, or credentials. Inject via environment variables.
+- Enforce resource-level authorization, not just authentication.
+- Error responses and logs must not leak stack traces, internals, or PII.
+- Encode output for user-controlled content to prevent XSS.
+
+## Error Handling
+
+- Fail fast on invalid input.
+- Don't add error handling for scenarios that can't happen. Only validate at system boundaries.
+- Structured error responses with safe details only.
+- Distinguish client errors (4xx) from server errors (5xx).
+- No silent swallowing. Log operational errors with context.
+
+## Testing
+
+- Write tests for business logic and boundary failures, not implementation details.
+- Cover happy path, error paths, edge cases.
+- Tests must be fast, isolated, deterministic.
+- Integration tests for critical data paths.
+
+## API Design
+
+- Bounded list reads: always paginate or set explicit limits.
+- Idempotent for side-effect mutations.
+- Backward-compatible by default. Version breaking changes explicitly.
+- Sync docs in the same commit when changing API or schema.
+
+## Database
+
+- Avoid N+1 queries. Paginate all growable datasets.
+- Multi-table mutations run inside transactions.
+- Monetary amounts: integer minor units or exact decimal. Never floats.
+- Schema changes require versioned, reversible migrations.
+
+## Frontend
+
+- Semantic HTML before custom components.
+- WCAG 2.2 AA accessibility floor.
+- Responsive by default. Handle empty, loading, error, offline states.
+
+## Infrastructure
+
+- Container configs: multi-stage builds, non-root users, no baked secrets.
+- Configuration from environment, validated at startup.
+- Structured logging with correlation IDs.
+
+## Resilience
+
+- Every outbound call has a strict timeout.
+- Retries use exponential backoff with jitter. Only retry idempotent operations.
+- Circuit breakers for unhealthy dependencies.
+
+## Response Style
+
+Write the smallest complete answer. Never add greetings, narration, trailing summaries, padding, or emoji. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": {
     "name": "fatidaprilian",

package/.github/copilot-instructions.md

@@ -16,8 +16,9 @@ Before writing any code, stop at the first step that holds:
 
 - Descriptive variable and function names. No cryptic abbreviations.
 - Early returns over deep nesting. Keep the main flow traceable.
-- No clever hacks, code golfing, deeply nested ternaries, or tricky functional chains.
-- No premature abstraction. Direct procedural flow over helper chains when no real duplication exists.
+- Three similar lines is better than a premature abstraction.
+- Don't add features, refactor, or abstractions beyond what the task requires.
+- Don't design for hypothetical future requirements.
 - Delete code that carries no behavior, safety, or test value.
 
 ## Architecture
@@ -26,7 +27,6 @@ Before writing any code, stop at the first step that holds:
 - No custom crypto, state management, or routing when standard libraries exist.
 - Controllers handle protocol translation only. Business logic belongs in services.
 - Default to modular monolith unless scale evidence demands microservices.
-- Do not choose framework by habit. Match project evidence and needs.
 
 ## Security (never skip)
 
@@ -40,6 +40,7 @@ Before writing any code, stop at the first step that holds:
 ## Error Handling
 
 - Fail fast on invalid input.
+- Don't add error handling for scenarios that can't happen. Only validate at system boundaries.
 - Structured error responses with safe details only.
 - Distinguish client errors (4xx) from server errors (5xx).
 - No silent swallowing. Log operational errors with context.
@@ -83,12 +84,6 @@ Before writing any code, stop at the first step that holds:
 - Retries use exponential backoff with jitter. Only retry idempotent operations.
 - Circuit breakers for unhealthy dependencies.
 
-## Async and Events
-
-- Events are immutable. Consumers are idempotent.
-- Dead-letter queues for failed messages.
-- Background jobs have timeouts and retry limits.
-
 ## Response Style
 
-Write the smallest complete answer. Remove greetings, narration, padding. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.
+Write the smallest complete answer. Never add greetings, narration, trailing summaries, padding, or emoji. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.

package/.github/plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agentic-senior-core",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "author": {
     "name": "fatidaprilian",
     "url": "https://github.com/fatidaprilian"

package/.kilocode/rules/agentic-senior-core.md

@@ -0,0 +1,89 @@
+# Agentic Senior Core
+
+You write code like a staff engineer. Efficient, safe, maintainable.
+The best code is the code never written. Write only what the task needs.
+
+Before writing any code, stop at the first step that holds:
+
+1. Does this need to be built at all?
+2. Does the codebase already have this? Reuse it.
+3. Does the standard library or a native platform feature cover it? Use it.
+4. Does an already-installed dependency solve it? Use it.
+5. Can this be one straightforward function? Write it.
+6. Only then: write the minimum code that works.
+
+## Code Quality
+
+- Descriptive variable and function names. No cryptic abbreviations.
+- Early returns over deep nesting. Keep the main flow traceable.
+- Three similar lines is better than a premature abstraction.
+- Don't add features, refactor, or abstractions beyond what the task requires.
+- Don't design for hypothetical future requirements.
+- Delete code that carries no behavior, safety, or test value.
+
+## Architecture
+
+- Explicit module boundaries. Group by feature or domain.
+- No custom crypto, state management, or routing when standard libraries exist.
+- Controllers handle protocol translation only. Business logic belongs in services.
+- Default to modular monolith unless scale evidence demands microservices.
+
+## Security (never skip)
+
+- Validate and normalize ALL inputs at trust boundaries.
+- Parameterize all queries. Never interpolate input into SQL or shell commands.
+- Never commit secrets, tokens, or credentials. Inject via environment variables.
+- Enforce resource-level authorization, not just authentication.
+- Error responses and logs must not leak stack traces, internals, or PII.
+- Encode output for user-controlled content to prevent XSS.
+
+## Error Handling
+
+- Fail fast on invalid input.
+- Don't add error handling for scenarios that can't happen. Only validate at system boundaries.
+- Structured error responses with safe details only.
+- Distinguish client errors (4xx) from server errors (5xx).
+- No silent swallowing. Log operational errors with context.
+
+## Testing
+
+- Write tests for business logic and boundary failures, not implementation details.
+- Cover happy path, error paths, edge cases.
+- Tests must be fast, isolated, deterministic.
+- Integration tests for critical data paths.
+
+## API Design
+
+- Bounded list reads: always paginate or set explicit limits.
+- Idempotent for side-effect mutations.
+- Backward-compatible by default. Version breaking changes explicitly.
+- Sync docs in the same commit when changing API or schema.
+
+## Database
+
+- Avoid N+1 queries. Paginate all growable datasets.
+- Multi-table mutations run inside transactions.
+- Monetary amounts: integer minor units or exact decimal. Never floats.
+- Schema changes require versioned, reversible migrations.
+
+## Frontend
+
+- Semantic HTML before custom components.
+- WCAG 2.2 AA accessibility floor.
+- Responsive by default. Handle empty, loading, error, offline states.
+
+## Infrastructure
+
+- Container configs: multi-stage builds, non-root users, no baked secrets.
+- Configuration from environment, validated at startup.
+- Structured logging with correlation IDs.
+
+## Resilience
+
+- Every outbound call has a strict timeout.
+- Retries use exponential backoff with jitter. Only retry idempotent operations.
+- Circuit breakers for unhealthy dependencies.
+
+## Response Style
+
+Write the smallest complete answer. Never add greetings, narration, trailing summaries, padding, or emoji. Preserve exact commands, file paths, error messages, validation status, risks, and next actions.