exonous 0.0.0-stage → 2.10.4

package/assets/techne/rules/csharp/security.md

@@ -0,0 +1,32 @@
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+  - "**/*.csproj"
+  - "**/appsettings*.json"
+---
+# C# Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Secrets
+
+Configuration, user secrets locally, vault in prod — no literals; real credentials never in committed appsettings.
+
+## SQL
+
+Parameterized ADO/Dapper/EF only; whitelist dynamic sort/filter fields.
+
+## Validation
+
+Validate DTOs at the edge (annotations, FluentValidation, guards).
+
+## Auth
+
+Framework handlers and policies; never log tokens/passwords.
+
+## Errors
+
+Safe outward messages; structured server logs without stack/SQL/path leakage.
+
+Review: `security-review` skill / `exo-security` agent.

package/assets/techne/rules/csharp/testing.md

@@ -0,0 +1,27 @@
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+  - "**/*.csproj"
+---
+# C# Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Stack
+
+xUnit, FluentAssertions, Moq/NSubstitute, Testcontainers when needed.
+
+## Layout
+
+Mirror `src/` under `tests/`; behavior-named tests.
+
+## Web
+
+`WebApplicationFactory` integration tests through HTTP middleware — do not bypass auth/pipeline.
+
+## Coverage
+
+~80% on domain, validation, auth, failure paths; CI `dotnet test` with coverage when enabled.
+
+Depth: `techne:quality` skill; `techne:dotnet` for stack patterns.

package/assets/techne/rules/dart/coding-style.md

@@ -0,0 +1,47 @@
+---
+paths:
+  - "**/*.dart"
+  - "**/pubspec.yaml"
+  - "**/analysis_options.yaml"
+---
+# Dart/Flutter Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Format
+
+`dart format` in CI (`--set-exit-if-changed`); 80 columns; trailing commas on multiline lists.
+
+## Immutability
+
+`final` locals; `const` when compile-time; unmodifiable collections from public APIs; `copyWith` on state classes.
+
+## Naming
+
+Dart style: camelCase members, PascalCase types, snake_case files, `_` private, descriptive extension names.
+
+## Null safety
+
+Avoid `!` and careless `late`; use `?.`, `??`, guards, or Dart 3 patterns; `required` ctor params.
+
+## Sealed state (Dart 3+)
+
+Closed hierarchies with exhaustive `switch` — no default branch on sealed roots.
+
+## Errors
+
+Typed `on` clauses; never catch bare `Error`; sealed/`Result` for recoverable failures.
+
+## Async
+
+Await or `unawaited()`; no fake `async`; `context.mounted` after awaits in widgets.
+
+## Imports
+
+`package:` imports across layers; order dart → external → own package.
+
+## Codegen
+
+Commit or ignore `.g.dart`/`.freezed.dart` consistently; never hand-edit generated files.
+
+Depth: `techne:flutter` skill.

package/assets/techne/rules/dart/hooks.md

@@ -0,0 +1,26 @@
+---
+paths:
+  - "**/*.dart"
+  - "**/pubspec.yaml"
+  - "**/analysis_options.yaml"
+---
+# Dart/Flutter Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` / `EXONOUS_DISABLED_HOOKS`.
+
+## PostToolUse
+
+- **dart format** on edited `.dart`
+- **dart analyze** (fatal infos when strict)
+- **flutter test** for risky UI/state edits (strict)
+
+## Pre-commit (standard/strict)
+
+```bash
+dart format --set-exit-if-changed .
+dart analyze --fatal-infos
+flutter test
+dart run build_runner build --delete-conflicting-outputs  # when generators touched
+```

package/assets/techne/rules/dart/patterns.md

@@ -0,0 +1,38 @@
+---
+paths:
+  - "**/*.dart"
+  - "**/pubspec.yaml"
+---
+# Dart/Flutter Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## Repository
+
+Abstract interface + impl coordinating remote/local sources; `Future` for fetches, `Stream` for watch APIs.
+
+## State
+
+Pick one primary approach per feature: **Cubit/BLoC** (events → emit), **Riverpod** (`@riverpod`, notifiers, `ConsumerWidget`), or **ChangeNotifier** view models with sealed/async state.
+
+## DI
+
+Constructor injection; register at composition root (`get_it` or Riverpod providers).
+
+## Use cases
+
+Single-purpose classes with `call()` forwarding to repositories.
+
+## Layers
+
+`domain/` (pure Dart) → `data/` (DTOs, sources) → `presentation/` (widgets + state). Presentation calls use cases, not stores directly.
+
+## Navigation
+
+GoRouter with validated params; auth redirects via `refreshListenable` + redirect callback.
+
+## Immutability
+
+`freezed` or manual immutable state classes for complex UI state.
+
+Depth: `techne:flutter` skill; shared mobile patterns also in `techne:kotlin` for KMP overlap.

package/assets/techne/rules/dart/security.md

@@ -0,0 +1,44 @@
+---
+paths:
+  - "**/*.dart"
+  - "**/pubspec.yaml"
+  - "**/AndroidManifest.xml"
+  - "**/Info.plist"
+---
+# Dart/Flutter Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Secrets
+
+No literals; `--dart-define` for non-secret config; runtime secrets in **flutter_secure_storage**; server holds true secrets.
+
+## Network
+
+HTTPS only; platform cleartext blocked; client timeouts; optional pinning for sensitive APIs.
+
+## Input
+
+Parameterized SQL (sqflite/drift); validate deep links (`Uri.tryParse`, allowlisted hosts/paths) before `go`.
+
+## Storage
+
+No tokens in SharedPreferences plaintext; wipe auth on logout; `local_auth` for sensitive actions; never log secrets.
+
+## Android
+
+Minimal permissions; `exported=false` where possible; `FLAG_SECURE` on sensitive screens.
+
+## iOS
+
+Usage strings only for used capabilities; Keychain via secure storage; ATS enforced.
+
+## WebView
+
+Prefer current `webview_flutter` controller API; disable JS unless required; intercept navigation.
+
+## Release
+
+`flutter build --obfuscate --split-debug-info=...`; analyze clean before ship.
+
+Review: `security-review` skill / `exo-security` agent.

package/assets/techne/rules/dart/testing.md

@@ -0,0 +1,39 @@
+---
+paths:
+  - "**/*.dart"
+  - "**/pubspec.yaml"
+  - "**/analysis_options.yaml"
+---
+# Dart/Flutter Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Stack
+
+`flutter_test` / `test`; **mocktail** or mockito; **bloc_test**; **fake_async**; **integration_test** for device flows.
+
+## Layout
+
+`test/unit`, `test/widget`, `test/golden`, `integration_test/flows`.
+
+## State tests
+
+`blocTest` for BLoC; `ProviderContainer` + overrides for Riverpod.
+
+## Widget tests
+
+Pump with scoped providers; assert semantics and key widgets.
+
+## Fakes
+
+Hand-written repository fakes over deep mocks.
+
+## Goldens
+
+`matchesGoldenFile`; update with `flutter test --update-goldens` intentionally.
+
+## Coverage
+
+~80% on domain + state machines; every loading/success/error path; CI threshold on `lcov.info`.
+
+Depth: `techne:flutter` skill; workflow: `techne:quality` skill.

package/assets/techne/rules/fsharp/coding-style.md

@@ -0,0 +1,34 @@
+---
+paths:
+  - "**/*.fs"
+  - "**/*.fsx"
+---
+# F# Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Baseline
+
+Idiomatic F#; immutability default; small focused modules.
+
+## Domain types
+
+Discriminated unions over deep class trees; records for labeled data; single-case unions for validated primitives.
+
+## Updates
+
+`with` expressions; persistent `list`/`map`/`set`; no mutable domain fields.
+
+## Functions
+
+Small composable functions; pipe `|>` for pipelines; pattern match over nested if/else; `Option` not null; `Result` for expected failures.
+
+## Async
+
+`task { }` for .NET interop; `async { }` for F# workflows; pass `CancellationToken` on public async APIs.
+
+## Format
+
+**fantomas**; trim unused `open`; group opens: System → Microsoft → third-party → project (blank line between groups, sorted within).
+
+Depth: `techne:dotnet` skill.

package/assets/techne/rules/fsharp/hooks.md

@@ -0,0 +1,25 @@
+---
+paths:
+  - "**/*.fs"
+  - "**/*.fsx"
+  - "**/*.fsproj"
+  - "**/*.sln"
+  - "**/*.slnx"
+  - "**/Directory.Build.props"
+  - "**/Directory.Build.targets"
+---
+# F# Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` / `EXONOUS_DISABLED_HOOKS`.
+
+## PostToolUse
+
+- **fantomas**
+- **dotnet build**
+- **dotnet test --no-build** on behavior edits (standard/strict)
+
+## Stop
+
+Strict: final build; warn on `appsettings*.json` changes.

package/assets/techne/rules/fsharp/patterns.md

@@ -0,0 +1,43 @@
+---
+paths:
+  - "**/*.fs"
+  - "**/*.fsx"
+---
+# F# Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## Result railway
+
+```fsharp
+type OrderProblem =
+    | BadCustomer of string
+    | NoLines
+
+let validateDraft (req: DraftOrder) : Result<ValidOrder, OrderProblem> =
+    if String.IsNullOrWhiteSpace req.CustomerId then Error(BadCustomer "CustomerId required")
+    elif List.isEmpty req.Lines then Error NoLines
+    else Ok { CustomerId = req.CustomerId; Lines = req.Lines }
+```
+
+## Option
+
+`Option.map` / `bind` / `defaultValue` instead of null checks.
+
+## Unions
+
+Exhaustive `match` on business states (payment, fulfillment, etc.).
+
+## Computation expressions
+
+`result { }` / custom CEs for sequential validation.
+
+## Modules
+
+`[<RequireQualifiedAccess>]` on domain modules; functions over classes.
+
+## DI
+
+Record-of-functions or explicit parameters; partial application for pipelines.
+
+Depth: `techne:dotnet` skill.

package/assets/techne/rules/fsharp/security.md

@@ -0,0 +1,32 @@
+---
+paths:
+  - "**/*.fs"
+  - "**/*.fsx"
+  - "**/*.fsproj"
+  - "**/appsettings*.json"
+---
+# F# Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Secrets
+
+Configuration keys or env — fail if missing; no committed credentials.
+
+## SQL
+
+Parameterized queries only (ADO/Dapper/EF).
+
+## Validation
+
+Single-case DU wrappers (`ValidatedEmail`) created at boundaries.
+
+## Auth
+
+Use ASP.NET auth middleware/policies; no token logging.
+
+## Errors
+
+Generic client messages; detailed structured logs server-side.
+
+Review: `security-review` skill / `exo-security` agent.

package/assets/techne/rules/fsharp/testing.md

@@ -0,0 +1,27 @@
+---
+paths:
+  - "**/*.fs"
+  - "**/*.fsx"
+  - "**/*.fsproj"
+---
+# F# Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Stack
+
+xUnit + FsUnit; **Unquote** for expressive asserts; **FsCheck** for properties; NSubstitute or function stubs; Testcontainers when needed.
+
+## Names
+
+Backtick behavior descriptions; mirror `src/` under `tests/`.
+
+## Web
+
+`WebApplicationFactory` through full HTTP pipeline.
+
+## Coverage
+
+~80% on domain/validation/auth failures; CI `dotnet test` with coverage when enabled.
+
+Depth: `techne:quality` skill.

package/assets/techne/rules/golang/coding-style.md

@@ -0,0 +1,30 @@
+---
+paths:
+  - "**/*.go"
+  - "**/go.mod"
+  - "**/go.sum"
+---
+# Go Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Format
+
+**gofmt** and **goimports** — non-negotiable.
+
+## APIs
+
+- Parameters: interfaces; returns: concrete structs.
+- Keep interfaces tiny (often 1–3 methods).
+
+## Errors
+
+Wrap with context:
+
+```go
+if err != nil {
+    return fmt.Errorf("persist profile: %w", err)
+}
+```
+
+Depth: `techne:go` skill.

package/assets/techne/rules/golang/hooks.md

@@ -0,0 +1,17 @@
+---
+paths:
+  - "**/*.go"
+  - "**/go.mod"
+  - "**/go.sum"
+---
+# Go Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` (`minimal` | `standard` | `strict`); disable ids with `EXONOUS_DISABLED_HOOKS`.
+
+## PostToolUse
+
+- **gofmt** / **goimports** on touched `.go`
+- **go vet** after edits
+- **staticcheck** on changed packages when profile is `standard` or `strict`

package/assets/techne/rules/golang/patterns.md

@@ -0,0 +1,43 @@
+---
+paths:
+  - "**/*.go"
+  - "**/go.mod"
+  - "**/go.sum"
+---
+# Go Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## Functional options
+
+```go
+type Tune func(*Server)
+
+func WithListenPort(p int) Tune {
+    return func(s *Server) { s.port = p }
+}
+
+func NewServer(tunes ...Tune) *Server {
+    s := &Server{port: 8080}
+    for _, t := range tunes {
+        t(s)
+    }
+    return s
+}
+```
+
+## Interfaces
+
+Declare small interfaces at the call site, not on the implementer.
+
+## Wiring
+
+Constructor injection:
+
+```go
+func NewBillingSvc(store LedgerStore, log Logger) *BillingSvc {
+    return &BillingSvc{store: store, log: log}
+}
+```
+
+Depth: `techne:go` skill.

package/assets/techne/rules/golang/security.md

@@ -0,0 +1,33 @@
+---
+paths:
+  - "**/*.go"
+  - "**/go.mod"
+  - "**/go.sum"
+---
+# Go Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Secrets
+
+```go
+key := os.Getenv("BILLING_KEY")
+if key == "" {
+    log.Fatal("BILLING_KEY not configured")
+}
+```
+
+## Scan
+
+```bash
+gosec ./...
+```
+
+## Timeouts
+
+Always bound I/O with context:
+
+```go
+ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+defer cancel()
+```

package/assets/techne/rules/golang/testing.md

@@ -0,0 +1,20 @@
+---
+paths:
+  - "**/*.go"
+  - "**/go.mod"
+  - "**/go.sum"
+---
+# Go Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Style
+
+Table-driven tests with `go test`.
+
+```bash
+go test -race ./...
+go test -cover ./...
+```
+
+Depth: `techne:go` skill (testing reference).

package/assets/techne/rules/java/coding-style.md

@@ -0,0 +1,51 @@
+---
+paths:
+  - "**/*.java"
+---
+# Java Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Format
+
+- **google-java-format** or **Checkstyle** (Google/Sun) — match the repo.
+- One public top-level type per file; stable member order (constants → fields → ctors → public → protected → private).
+
+## Immutability
+
+- `record` for values (16+); `final` fields by default.
+- Expose copies: `List.copyOf`, `Map.copyOf`, `Set.copyOf`.
+- Prefer new instances over in-place mutation.
+
+```java
+public record InvoiceLine(long sku, BigDecimal qty) {}
+
+public class Cart {
+    private final long id;
+    private final List<InvoiceLine> lines;
+    public List<InvoiceLine> lines() { return List.copyOf(lines); }
+}
+```
+
+## Naming
+
+PascalCase types; camelCase members; `SCREAMING_SNAKE_CASE` constants; lowercase reverse-DNS packages.
+
+## Modern syntax
+
+Records, sealed hierarchies, pattern `instanceof`, text blocks, switch expressions, switch patterns (21+) where they clarify intent.
+
+## Optional
+
+- Return `Optional` from finders; chain `map` / `flatMap` / `orElseThrow`.
+- Never `Optional` fields or parameters.
+
+## Errors
+
+Domain unchecked exceptions; narrow catches; messages include ids/context.
+
+## Streams
+
+Short pipelines (≤4 ops); method refs when clear; prefer loops for gnarly logic.
+
+Depth: `techne:java` skill.

package/assets/techne/rules/java/hooks.md

@@ -0,0 +1,18 @@
+---
+paths:
+  - "**/*.java"
+  - "**/pom.xml"
+  - "**/build.gradle"
+  - "**/build.gradle.kts"
+---
+# Java Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` (`minimal` | `standard` | `strict`); `EXONOUS_DISABLED_HOOKS` for opt-out ids.
+
+## PostToolUse
+
+- **google-java-format** on edited `.java`
+- **checkstyle** when the project enables it
+- **`./mvnw compile`** or **`./gradlew compileJava`** after structural edits (strict profile)