exonous 0.0.0-stage → 2.10.4

package/assets/techne/rules/angular/security.md

@@ -0,0 +1,26 @@
+---
+paths:
+  - "**/*.component.ts"
+  - "**/*.component.html"
+  - "**/*.service.ts"
+  - "**/*.interceptor.ts"
+---
+> Builds on the shared rules in `../common/security.md`.
+
+# Angular security
+
+Angular sanitizes bound values by default — do not call `bypassSecurityTrust*` on user-controlled strings without review.
+
+Prefer `innerText` or sanitizing pipes over `[innerHTML]` for untrusted content.
+
+Use `HttpClient` so auth/error interceptors always run — avoid ad hoc `fetch`.
+
+Environment files describe shape; inject real secrets via CI/CD env or secret manager — not committed literals.
+
+Protect admin routes with functional guards (`canMatch` prevents lazy chunk download). UI hiding is not authorization.
+
+SSR: never transfer private config through `TransferState`; gate DOM APIs with `isPlatformBrowser`.
+
+Configure CSP without `unsafe-eval`; use nonces for unavoidable inline scripts during SSR.
+
+**exo-security** / `security-review` before merging auth or PII features.

package/assets/techne/rules/angular/testing.md

@@ -0,0 +1,46 @@
+---
+paths:
+  - "**/*.spec.ts"
+  - "**/*.test.ts"
+---
+> Builds on the shared rules in `../common/testing.md`.
+
+# Angular testing
+
+Detect runner from `angular.json` / `package.json` (Vitest, Jest, or Karma/Jasmine).
+
+## TestBed
+
+Import standalone components directly; `compileComponents()` when using external templates.
+
+Signal inputs: `fixture.componentRef.setInput('name', value)` then `detectChanges()`.
+
+## UI interaction
+
+Prefer CDK component harnesses over `nativeElement.querySelector` — survives template refactors.
+
+## Router
+
+`RouterTestingHarness.create()` + `navigateByUrl` for components coupled to routes.
+
+## Async
+
+`fakeAsync` + `tick` for deterministic timers; `waitForAsync` + `fixture.whenStable()` for real async.
+
+## HTTP
+
+Provide `provideHttpClientTesting()`; inject `HttpTestingController`; `afterEach(() => httpMock.verify())`.
+
+## Services
+
+Configure TestBed providers only; inject service without component fixture for pure logic.
+
+## E2E
+
+Use project standard (Cypress/Playwright). Stable `data-cy` attributes — not CSS classes copied from design tokens.
+
+## Coverage
+
+≥80% on services/pipes; components assert behavior via harnesses, not private fields.
+
+**techne:angular** skill for signal/form harness recipes.

package/assets/techne/rules/arkts/coding-style.md

@@ -0,0 +1,63 @@
+---
+paths:
+  - "**/*.ets"
+  - "**/*.ts"
+  - "**/module.json5"
+  - "**/oh-package.json5"
+  - "**/build-profile.json5"
+---
+# HarmonyOS / ArkTS Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+ArkTS is a strict TypeScript subset — violations fail compile.
+
+## Type system (hard limits)
+
+Explicit types only — no `any`/`unknown`; no indexed access types, conditional types, mapped types, `infer`, intersections, structural typing, `typeof` types, or `as const`. Utility types limited to `Partial`, `Required`, `Readonly`, `Record` (`Record` indexes may be `undefined`). No type annotations in `catch`.
+
+## Functions / classes
+
+Arrow functions only (no function expressions/generators); no `apply`/`call`/`bind`; fields declared in class body; `this` restricted to instance methods; no `new.target`; definite-assignment assertions are banned; one static block; classes are types — do not treat as runtime values.
+
+## Objects
+
+Static property access (`obj.field`); no dynamic keys/`delete`; no `in` — use `instanceof`; no reassigning methods; no `globalThis`; spread only for arrays/rest.
+
+## Modules
+
+ESM `import`/`export` only — no `require`, `export =`, import assertions, wildcards; imports before other statements; TS must not import ArkTS (reverse allowed).
+
+## Other
+
+`let`/`const` only; no `for...in`, `with`, JSX, `#` privates; no declaration merging; explicit return types when inference crosses omitted returns.
+
+## Naming
+
+camelCase functions/vars; PascalCase types; `UPPER_SNAKE` constants; PascalCase component files, camelCase utilities.
+
+## Format
+
+Double-quoted strings; semicolons; full type annotations on public APIs.
+
+## Files
+
+One `@ComponentV2` per component file; one ViewModel per file; ~400 lines target (~800 max before split).
+
+## Errors
+
+```typescript
+try {
+  const value = await riskyCall()
+  return value
+} catch (error) {
+  hilog.error(0x0000, 'Module', 'failed: %{public}s', error)
+  throw new Error('Safe user message')
+}
+```
+
+## Immutability
+
+Return new model instances — do not mutate shared `@ObservedV2` fields in place when updating UI state.
+
+Depth: HarmonyOS references in project docs; mobile UX audits via `ui-design` skill when applicable.

package/assets/techne/rules/arkts/hooks.md

@@ -0,0 +1,38 @@
+---
+paths:
+  - "**/*.ets"
+  - "**/*.ts"
+  - "**/module.json5"
+  - "**/oh-package.json5"
+---
+# HarmonyOS / ArkTS Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` / `EXONOUS_DISABLED_HOOKS` — async hvigor/ohpm steps usually `standard` or `strict` only.
+
+## Build
+
+```bash
+hvigorw assembleHap -p product=default
+hvigorw clean
+ohpm install
+```
+
+## PostToolUse (standard/strict)
+
+After `.ets`/`.ts` edits: `hvigorw assembleHap -p product=default` (surface last errors).
+
+After `module.json5`: verify permissions/abilities.
+
+After `oh-package.json5`: `ohpm install`.
+
+## Guard
+
+Warn on V1 state decorators (`@State`, `@Prop`, `@Link`, …) — use **V2** (`@ComponentV2`, `@Local`, `@Param`, …).
+
+## Checklist
+
+- HAP builds clean
+- No `@ohos.router` in new code — use `Navigation` + `NavPathStack`
+- Permissions declared; deps in oh-package; i18n strings + dark theme colors for new resources

package/assets/techne/rules/arkts/patterns.md

@@ -0,0 +1,42 @@
+---
+paths:
+  - "**/*.ets"
+  - "**/*.ts"
+---
+# HarmonyOS / ArkTS Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## State V2 only
+
+Use `@ComponentV2`, `@Local`, `@Param`, `@Event`, `@Provider`/`@Consumer`, `@Monitor`, `@Computed`, `@ObservedV2`, `@Trace`. Do **not** use V1 `@State`/`@Prop`/`@Link`/`@Component`.
+
+## Routing
+
+`Navigation` + `NavPathStack` — `pushPath`, `replacePath`, `pop`, `clear`; subpages in `NavDestination`. No legacy router module.
+
+## MVVM layout
+
+```
+feature/
+  model/       @ObservedV2 data
+  viewmodel/   logic
+  view/        @ComponentV2 UI
+  service/     network/storage
+```
+
+`build()` renders only; business rules in ViewModels.
+
+## Lists
+
+`LazyForEach` + stable keys for large lists.
+
+## Animation
+
+State-driven; prefer `transform`/`opacity`; avoid animating layout (`width`/`height`/`padding`/`margin`); `renderGroup(true)` for heavy subtrees.
+
+## Resources
+
+UI strings/colors/sizes via `$r('app.*')` — no magic literals in widgets.
+
+Depth: consult platform docs via `biblos` MCP for API drift.

package/assets/techne/rules/arkts/security.md

@@ -0,0 +1,35 @@
+---
+paths:
+  - "**/*.ets"
+  - "**/*.ts"
+  - "**/module.json5"
+---
+# HarmonyOS / ArkTS Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Permissions
+
+Declare in `module.json5` with user-visible `reason` strings; request runtime grants for sensitive APIs; check before call with graceful denial handling.
+
+## Secrets
+
+No keys in source; non-sensitive endpoints via build profiles; sensitive material via HUKS/Keystore patterns — not Preferences.
+
+## Input
+
+Validate before navigation (allowlisted deep-link paths); sanitize before display.
+
+## Network
+
+HTTPS; cert validation; timeouts/retries; never log tokens or credentials.
+
+## Storage
+
+Encrypt sensitive local data; clear on logout; classify data before choosing storage API.
+
+## Dependencies
+
+Official ohpm registry; pin versions; review third-party updates.
+
+Review: `security-review` skill / `exo-security` agent.

package/assets/techne/rules/arkts/testing.md

@@ -0,0 +1,39 @@
+---
+paths:
+  - "**/*.ets"
+  - "**/*.ts"
+  - "**/ohosTest/**"
+---
+# HarmonyOS / ArkTS Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Layout
+
+Production under `src/main/ets/`; tests under `src/ohosTest/ets/test/` with `TestRunner` entry.
+
+## Run
+
+```bash
+hvigorw testHap -p product=default
+```
+
+Device UI tests via `@ohos.UiTest` + Hypium on hardware/emulator when required.
+
+## Unit style
+
+Hypium `describe`/`it`/`expect` on ViewModels and services — assert initial state, mutations, empty/error inputs.
+
+## TDD loop
+
+Red test in ohosTest → minimal main code → refactor → `hvigorw assembleHap` → device/emulator verify.
+
+## Coverage targets
+
+~80% on ViewModels, services, utilities; integration for API/DB; UI tests for login/navigation/submit flows; include permission denial and empty/network failure cases.
+
+## Practice
+
+Independent tests; mock network/system APIs in unit layer; name `should_<behavior>_when_<condition>`; assert `@Trace` updates and `NavPathStack` flows without testing framework internals.
+
+Workflow: `techne:quality` skill.

package/assets/techne/rules/common/agents.md

@@ -0,0 +1,6 @@
+# Agent orchestration
+
+Roster, tiers and report contract: `~/.claude/rules/nomos.md` § Agents. Multi-step delivery: `/deliver`.
+
+- Complex feature → exo-pm / exo-cto · after code changes → exo-qa or `code-review` · sensitive surface → exo-security or `security-review`.
+- Never finish while subagents still run — collect and merge first.

package/assets/techne/rules/common/code-review.md

@@ -0,0 +1,15 @@
+# Code review
+
+Review after substantive edits and before merge on shared branches, auth/data changes, or API shifts.
+
+Pre-review: CI green, conflicts resolved, up to date with target.
+
+Checklist: readable code; functions ~<50 lines; files ~<800 lines; nesting ≤4; explicit errors; no secrets/debug logs; tests for new behavior (often ≥80% coverage).
+
+Escalate to **exo-security** / `security-review` for auth, input, SQL, FS, external HTTP, crypto, payments.
+
+Severity: CRITICAL blocks; HIGH should fix; MEDIUM/LOW as time allows.
+
+Flow: diff → security → quality → tests → **exo-qa** / `code-review` skill.
+
+See [testing.md](./testing.md), [security.md](./security.md).

package/assets/techne/rules/common/coding-style.md

@@ -0,0 +1,13 @@
+# Coding style
+
+Prefer immutable updates for shared state. KISS, DRY (real duplication only), YAGNI.
+
+Organize by feature; ~200–400 lines typical, ~800 soft max for hand-written sources.
+
+Validate at boundaries; schema tools when available; safe user messages, detailed server logs.
+
+Naming: descriptive; booleans as predicates. Language folders override casing.
+
+Avoid deep nesting, magic numbers, and oversized functions.
+
+Done: small units, handled errors, no hardcoded secrets.

package/assets/techne/rules/common/development-workflow.md

@@ -0,0 +1,5 @@
+# Development workflow
+
+Before git: reuse (**atlas**, **biblos**, registries) → plan (**exo-pm**/**exo-cto**, economical models) → TDD → review (**exo-qa**) → commit per [git-workflow.md](./git-workflow.md) → `/session-handoff`.
+
+Use robust models only for implementation coding.

package/assets/techne/rules/common/git-workflow.md

@@ -0,0 +1,30 @@
+# Git workflow
+
+## Commits
+
+```text
+<type>: <description>
+
+<optional body>
+```
+
+Types: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf`, `ci`.
+
+**Never** add `Co-Authored-By`, Cursor/AI attribution lines, or similar trailers.
+
+**Never** bypass hooks (`--no-verify`, `--no-gpg-sign`, etc.) unless the user explicitly requests it in the current instruction.
+
+**Never** force-push shared branches. **Never** auto-merge dependency bumps without human review.
+
+Only commit when the user asks (or project harness authorizes via its commit skill/token).
+
+## Pull requests
+
+1. Inspect all commits since branching — not only HEAD.
+2. `git diff <base>...HEAD` for the full change set.
+3. Body: summary bullets + test plan checklist.
+4. First push: `git push -u origin <branch>`.
+
+Cross-session progress: `/session-handoff`.
+
+Implementation order before git: [development-workflow.md](./development-workflow.md).

package/assets/techne/rules/common/hooks.md

@@ -0,0 +1,7 @@
+# Harness hooks
+
+Phases: PreToolUse (validate), PostToolUse (format/lint/typecheck), Stop (build/audit).
+
+Controls: `EXONOUS_HOOK_PROFILE` (`minimal`|`standard`|`strict`); `EXONOUS_DISABLED_HOOKS` (comma-separated ids).
+
+No blanket permission bypass. Use scoped allowed-tools when automating.

package/assets/techne/rules/common/patterns.md

@@ -0,0 +1,3 @@
+# Shared patterns
+
+Start from vetted skeletons when possible. Repository interface for data access. API responses: success flag, data, error, optional pagination meta.

package/assets/techne/rules/common/performance.md

@@ -0,0 +1,3 @@
+# Performance and context
+
+Follow model tiers in [agents.md](./agents.md). Keep context headroom for multi-file work. Fix build failures incrementally with the smallest verifying command after each change.

package/assets/techne/rules/common/security.md

@@ -0,0 +1,5 @@
+# Security baseline
+
+No secrets in repo; validate input; parameterized SQL; XSS/CSRF controls; server-side authz; rate limits; safe errors.
+
+Secrets via env/secret manager. On finding: stop, **exo-security** / `security-review`, fix CRITICAL, rotate credentials, sweep similar code.

package/assets/techne/rules/common/testing.md

@@ -0,0 +1,3 @@
+# Testing baseline
+
+Often ≥80% unit+integration; E2E on critical paths. Red-green-refactor. AAA structure; behavior-named tests. **exo-qa** for strategy; stack rules for runners.

package/assets/techne/rules/cpp/coding-style.md

@@ -0,0 +1,31 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.hpp"
+  - "**/*.cc"
+  - "**/*.hh"
+  - "**/*.cxx"
+  - "**/*.h"
+  - "**/CMakeLists.txt"
+---
+# C++ Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Modern C++
+
+Prefer C++17/20/23 over C idioms: `auto` when obvious, `constexpr`, structured bindings.
+
+## RAII
+
+No manual `new`/`delete`; `unique_ptr` default ownership; `shared_ptr` only when sharing is real; `make_unique` / `make_shared`.
+
+## Naming
+
+PascalCase types; snake_case or camelCase functions (match project); `kConstant` or `UPPER_SNAKE`; lowercase namespaces; trailing `_` or `m_` for members per repo rule.
+
+## Format
+
+**clang-format** before commit.
+
+Depth: `techne:cpp` skill.

package/assets/techne/rules/cpp/hooks.md

@@ -0,0 +1,26 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.hpp"
+  - "**/*.cc"
+  - "**/*.hh"
+  - "**/*.cxx"
+  - "**/*.h"
+  - "**/CMakeLists.txt"
+---
+# C++ Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` / `EXONOUS_DISABLED_HOOKS` select pre-commit automation.
+
+## Local gate (standard/strict)
+
+```bash
+clang-format --dry-run --Werror src/*.cpp src/*.hpp
+clang-tidy src/*.cpp -- -std=c++17
+cmake --build build
+ctest --test-dir build --output-on-failure
+```
+
+CI order: format → tidy → cppcheck → build → ctest (sanitizers on strict).

package/assets/techne/rules/cpp/patterns.md

@@ -0,0 +1,31 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.hpp"
+  - "**/*.cc"
+  - "**/*.hh"
+  - "**/*.cxx"
+  - "**/*.h"
+  - "**/CMakeLists.txt"
+---
+# C++ Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## RAII handles
+
+Acquire in ctor, release in dtor; deleted copy/move when ownership is unique.
+
+## Rule of Zero / Five
+
+Prefer zero special members; if you customize one, define all five.
+
+## Values
+
+Small types by value; large by `const&`; return by value (RVO); move sinks.
+
+## Errors
+
+Exceptions for exceptional paths; `optional` for absence; `expected` (C++23) or result types for expected failures.
+
+Depth: `techne:cpp` skill.

package/assets/techne/rules/cpp/security.md

@@ -0,0 +1,37 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.hpp"
+  - "**/*.cc"
+  - "**/*.hh"
+  - "**/*.cxx"
+  - "**/*.h"
+  - "**/CMakeLists.txt"
+---
+# C++ Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Memory
+
+Smart pointers; `std::vector` / `std::array` not C arrays; no `malloc`/`free` in app code; avoid `reinterpret_cast`.
+
+## Strings
+
+`std::string`, `.at()` when bounds matter; ban `strcpy`/`sprintf` — use safe formatters.
+
+## UB hygiene
+
+Initialize variables; no signed overflow; no dangling/null deref.
+
+## CI sanitizers
+
+```bash
+cmake -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined" ..
+```
+
+## Static analysis
+
+clang-tidy and cppcheck on touched translation units.
+
+Depth: `techne:cpp` skill.

package/assets/techne/rules/cpp/testing.md

@@ -0,0 +1,31 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.hpp"
+  - "**/*.cc"
+  - "**/*.hh"
+  - "**/*.cxx"
+  - "**/*.h"
+  - "**/CMakeLists.txt"
+---
+# C++ Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Stack
+
+GoogleTest + GoogleMock via CMake/CTest.
+
+```bash
+cmake --build build && ctest --test-dir build --output-on-failure
+```
+
+## Coverage
+
+Build with `--coverage`, run ctest, capture with lcov.
+
+## Sanitizers
+
+Address + UB sanitizers in CI test jobs.
+
+Depth: `techne:quality` skill for TDD loop; `techne:cpp` for patterns.

package/assets/techne/rules/csharp/coding-style.md

@@ -0,0 +1,30 @@
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+---
+# C# Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Baseline
+
+Current .NET conventions; nullable reference types on; explicit modifiers on public/internal API; one primary type per file.
+
+## Models
+
+`record` / `record struct` for immutable DTOs; `class` for entities; interfaces at boundaries; no `dynamic` in app code.
+
+## Immutability
+
+`init` accessors, constructor-only mutation, immutable collections for shared state; `with` for updates.
+
+## Async
+
+`async`/`await` only — no `.Result`/`.Wait()`; thread `CancellationToken` through public async methods; log with structured properties; throw specific exceptions.
+
+## Format
+
+`dotnet format`; tidy usings; expression bodies when still readable.
+
+Depth: `techne:dotnet` skill.

package/assets/techne/rules/csharp/hooks.md

@@ -0,0 +1,24 @@
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+  - "**/*.csproj"
+  - "**/*.sln"
+  - "**/Directory.Build.props"
+  - "**/Directory.Build.targets"
+---
+# C# Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` / `EXONOUS_DISABLED_HOOKS`.
+
+## PostToolUse
+
+- **dotnet format** on edited C#
+- **dotnet build**
+- **dotnet test --no-build** when behavior changed (standard/strict)
+
+## Stop
+
+Strict profile: final **dotnet build** after wide edits; warn on touched `appsettings*.json` (secrets).

package/assets/techne/rules/csharp/patterns.md

@@ -0,0 +1,28 @@
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+---
+# C# Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## API wrapper
+
+```csharp
+public sealed record ApiResult<T>(bool Ok, T? Payload = default, string? Error = null);
+```
+
+## Repository
+
+Async CRUD interface with `CancellationToken` on each method.
+
+## Options
+
+Strongly typed `IOptions<T>` sections — no magic string keys scattered in code.
+
+## DI lifetimes
+
+Singleton for stateless/shared infra; scoped per request; transient for cheap workers; split god-services instead of huge constructors.
+
+Depth: `techne:dotnet` skill.