exonous 0.0.0-stage → 2.10.4

package/assets/techne/rules/php/patterns.md

@@ -0,0 +1,26 @@
+---
+paths:
+  - "**/*.php"
+  - "**/composer.json"
+---
+# PHP Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## Controllers
+
+HTTP concerns only — auth, validation, status, serialization.
+
+## Services
+
+Business rules in injectable services testable without bootstrapping the full framework.
+
+## DTOs / values
+
+Typed request/response objects; value objects for money, ids, ranges.
+
+## Boundaries
+
+Thin ORM models; adapter wrappers around third-party SDKs.
+
+API shape: `techne:services` skill; Laravel architecture: `techne:php` skill.

package/assets/techne/rules/php/security.md

@@ -0,0 +1,27 @@
+---
+paths:
+  - "**/*.php"
+  - "**/composer.lock"
+  - "**/composer.json"
+---
+# PHP Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## I/O
+
+Validate at framework boundary; escape template output by default; treat headers/cookies/uploads as untrusted.
+
+## Database
+
+Prepared statements / query builder; careful mass-assignment allow lists.
+
+## Secrets
+
+Env or secret manager; `composer audit` in CI; deliberate version pins.
+
+## Sessions
+
+`password_hash` / `password_verify`; regenerate session id on login/privilege change; CSRF on state-changing web forms.
+
+Framework hardening: `techne:php` skill.

package/assets/techne/rules/php/testing.md

@@ -0,0 +1,28 @@
+---
+paths:
+  - "**/*.php"
+  - "**/phpunit.xml"
+  - "**/phpunit.xml.dist"
+  - "**/composer.json"
+---
+# PHP Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Runner
+
+PHPUnit default; Pest only when the repo already standardizes on Pest — do not mix casually.
+
+```bash
+vendor/bin/phpunit --coverage-text
+```
+
+## Organization
+
+Fast unit vs integration suites; factories/builders over huge arrays; service tests for rules, controller tests for transport.
+
+## Inertia
+
+When used, assert Inertia component/props via framework helpers — not raw JSON alone.
+
+Loop: `techne:quality` skill; Laravel testing: `techne:php` skill.

package/assets/techne/rules/python/coding-style.md

@@ -0,0 +1,38 @@
+---
+paths:
+  - "**/*.py"
+  - "**/*.pyi"
+---
+# Python Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Standards
+
+- PEP 8 layout and naming; annotate every public function signature.
+
+## Immutability
+
+Favor frozen or value-style data for shared state:
+
+```python
+from dataclasses import dataclass
+from typing import NamedTuple
+
+@dataclass(frozen=True)
+class Account:
+    handle: str
+    mailbox: str
+
+class Coord(NamedTuple):
+    x: float
+    y: float
+```
+
+## Tooling
+
+- **black** — format
+- **isort** — import order
+- **ruff** — lint
+
+Depth: `techne:python` skill.

package/assets/techne/rules/python/fastapi.md

@@ -0,0 +1,57 @@
+---
+paths:
+  - "**/app/**/*.py"
+  - "**/fastapi/**/*.py"
+  - "**/*_api.py"
+---
+# FastAPI Rules
+
+Apply with general Python rules on FastAPI codebases.
+
+## Layout
+
+- Factory: `create_app()` owns wiring.
+- Routers: HTTP only; persistence and rules live in services/CRUD helpers.
+- Split create / update / response schemas.
+- DB sessions and auth via `Depends`.
+
+## Async boundaries
+
+- `async def` routes when work is I/O-bound.
+- Async DB/HTTP clients from async handlers.
+- No blocking `requests`, sync SQLAlchemy sessions, or sync disk/network in async routes.
+
+## Injection
+
+```python
+@router.get("/accounts/{account_id}")
+async def fetch_account(
+    account_id: str,
+    session: AsyncSession = Depends(get_session),
+    principal: User = Depends(current_user),
+):
+    ...
+```
+
+Never open `SessionLocal()` or long-lived clients inside handlers.
+
+## Schemas
+
+- Omit secrets, hashes, tokens, and internal auth fields from response models.
+- Set `response_model` on data endpoints.
+- Prefer Pydantic constraints over hand-rolled validation.
+
+## Security
+
+- CORS origins per environment; no wildcard + credentials.
+- Validate JWT exp, iss, aud, alg.
+- Rate-limit auth and heavy writes.
+- Redact credentials and auth headers in logs.
+
+## Tests
+
+- Override the same callable `Depends` references.
+- Clear `app.dependency_overrides` after each test.
+- Async clients for async apps.
+
+Depth: `techne:python` skill (FastAPI reference).

package/assets/techne/rules/python/hooks.md

@@ -0,0 +1,19 @@
+---
+paths:
+  - "**/*.py"
+  - "**/*.pyi"
+---
+# Python Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+Hook intensity: `EXONOUS_HOOK_PROFILE` (`minimal` | `standard` | `strict`). Skip ids via `EXONOUS_DISABLED_HOOKS` (comma-separated).
+
+## PostToolUse (when profile allows)
+
+- **black** / **ruff** on edited `.py`
+- **mypy** / **pyright** after type-sensitive edits
+
+## Warnings
+
+- Flag new `print()` in application code — use `logging`.

package/assets/techne/rules/python/patterns.md

@@ -0,0 +1,37 @@
+---
+paths:
+  - "**/*.py"
+  - "**/*.pyi"
+---
+# Python Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## Structural typing
+
+```python
+from typing import Protocol
+
+class ItemStore(Protocol):
+    def load(self, key: str) -> dict | None: ...
+    def persist(self, row: dict) -> dict: ...
+```
+
+## Request DTOs
+
+```python
+from dataclasses import dataclass
+
+@dataclass
+class RegisterPayload:
+    display_name: str
+    mailbox: str
+    years: int | None = None
+```
+
+## Resources
+
+- `with` for acquire/release
+- Generators for lazy, memory-bounded iteration
+
+Depth: `techne:python` skill.

package/assets/techne/rules/python/security.md

@@ -0,0 +1,26 @@
+---
+paths:
+  - "**/*.py"
+  - "**/*.pyi"
+---
+# Python Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Secrets
+
+```python
+import os
+from dotenv import load_dotenv
+
+load_dotenv()
+token = os.environ["SERVICE_TOKEN"]  # KeyError if unset
+```
+
+## Static scan
+
+```bash
+bandit -r src/
+```
+
+Framework-specific hardening: `techne:python` skill. Broad review: `security-review` skill / `exo-security` agent.

package/assets/techne/rules/python/testing.md

@@ -0,0 +1,32 @@
+---
+paths:
+  - "**/*.py"
+  - "**/*.pyi"
+---
+# Python Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Runner
+
+**pytest** default.
+
+```bash
+pytest --cov=src --cov-report=term-missing
+```
+
+## Marks
+
+```python
+import pytest
+
+@pytest.mark.unit
+def test_subtotal():
+    ...
+
+@pytest.mark.integration
+def test_pool_connect():
+    ...
+```
+
+Depth: `techne:python` skill (testing reference).

package/assets/techne/rules/react/coding-style.md

@@ -0,0 +1,24 @@
+---
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/components/**/*.ts"
+  - "**/components/**/*.js"
+  - "**/hooks/**/*.ts"
+  - "**/hooks/**/*.js"
+---
+> Extends [typescript/coding-style.md](../typescript/coding-style.md).
+
+# React coding style
+
+`.tsx` for JSX; `.ts` for logic/hooks/types. PascalCase components/files; `use*` hooks; `handle*` handlers vs `on*` props; boolean props prefixed (`isLoading`).
+
+Destructure props in signature. Minimal JSX logic — precompute above `return`. Fragments over wrapper divs.
+
+Next App Router: Server Components default; `"use client"` only when needed on line 1; never pull server-only modules into client graphs.
+
+Imports: React → vendors → aliases → relatives; `import type` when split.
+
+State: local first; context for low-churn globals; external store for high-frequency shared state; derive don't duplicate.
+
+No new class components. Colocate tests; **techne:react** for depth.

package/assets/techne/rules/react/hooks.md

@@ -0,0 +1,62 @@
+---
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/hooks/**/*.ts"
+  - "**/hooks/**/*.js"
+  - "**/use-*.ts"
+  - "**/use-*.tsx"
+---
+> React hook APIs (not harness hooks). Extends [typescript/patterns.md](../typescript/patterns.md).
+
+# React hooks rules
+
+Enable `eslint-plugin-react-hooks` (`rules-of-hooks`: error).
+
+## Placement
+
+Hooks only at component/hook top level — never inside conditions, loops, nested functions, or after early returns.
+
+## Effects
+
+Use `useEffect` to sync with externals (subscriptions, DOM APIs, non-React libraries). Do **not** use effects to:
+
+- mirror props/state into other state (derive in render)
+- run transformations already needed for render
+- reset child state when props change (use `key` on child)
+- fire parent notifications (call in the event handler)
+
+Every effect that registers listeners, intervals, or fetches must return cleanup (abort controllers, `clearInterval`, unsubscribe).
+
+## Dependencies
+
+List every reactive value read inside the effect/callback. Do not blanket-disable `exhaustive-deps`; comment rare exceptions. Split oversized effects.
+
+## Memoization
+
+Default: no `useMemo`/`useCallback`. Add when profiling shows cost, when passing to `memo` children, or when stable identity is a hook dependency.
+
+## Custom hooks
+
+Extract when the same state+effect bundle appears in 2+ components with a nameable purpose (`useDebouncedValue`, `useMediaQuery`). Skip wrappers that only rename `useState`.
+
+## State primitives
+
+- Expensive initial state: `useState(() => compute())`
+- Updates from prior state in async/batched code: functional updater `set(n => n + 1)`
+- Related fields that always change together: single object state; otherwise split
+- Many conditional transitions: `useReducer`
+
+## Refs
+
+DOM/imperative only; mutate `.current` in effects/handlers, not during render. `useImperativeHandle` sparingly.
+
+## External stores
+
+Subscribe with `useSyncExternalStore` for browser APIs or non-React stores under concurrent rendering.
+
+## React 19+
+
+Prefer built-ins over custom: `use()` for promises/context, `useActionState`/`useFormStatus`, `useOptimistic`, `useTransition`.
+
+CI: treat `exhaustive-deps` warnings as errors on new code.

package/assets/techne/rules/react/patterns.md

@@ -0,0 +1,48 @@
+---
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/components/**/*.ts"
+  - "**/components/**/*.js"
+  - "**/app/**/*.tsx"
+  - "**/pages/**/*.tsx"
+---
+> Extends [typescript/patterns.md](../typescript/patterns.md).
+
+# React patterns
+
+## Smart vs presentational
+
+Containers fetch and orchestrate; leaf components render from props without service calls.
+
+## Where state lives
+
+1. Single component → local `useState`
+2. Parent + nearby children → lift + props
+3. Rare, low-churn cross-tree reads → Context (theme, locale)
+4. Frequent shared updates → Zustand/Jotai/RTK
+5. Remote data → TanStack Query/SWR/RSC fetch — avoid naked `fetch` in `useEffect`
+
+## RSC (App Router)
+
+Server Components default; add `"use client"` only for state/effects/events/browser APIs. Pass serializable props down; slot Server output through `children`. Mark secret modules with `server-only`.
+
+Pair `<Suspense fallback=…>` with an Error Boundary near the async subtree — not only at the route root.
+
+## Forms
+
+Submit-driven flows: uncontrolled fields + server action reading `FormData`. Live validation or cross-field rules: controlled fields or React Hook Form / TanStack Form.
+
+## Lists
+
+Stable `key` from entity id — not array index when rows reorder. Composition: `children`, render props, compound components with shared context (tabs/menus).
+
+## Portals
+
+Modals/toasts via portal to escape overflow/z-index traps.
+
+## Refs
+
+React 19: `ref` prop on function components; React 18: `forwardRef`.
+
+Load **techne:react** for Next.js/Turbopack specifics.

package/assets/techne/rules/react/security.md

@@ -0,0 +1,45 @@
+---
+paths:
+  - "**/*.tsx"
+  - "**/*.jsx"
+  - "**/components/**/*.ts"
+  - "**/app/**/*.ts"
+  - "**/pages/**/*.ts"
+---
+> Extends [typescript/security.md](../typescript/security.md).
+
+# React security
+
+## HTML injection
+
+Audit every `dangerouslySetInnerHTML` — prefer text nodes or sanitizing markdown renderers. If HTML is required, sanitize at the call site (allowlist tags).
+
+## URLs
+
+Block `javascript:` and suspicious `data:` in dynamic `href`/`src`. Add `rel="noopener noreferrer"` with `target="_blank"`.
+
+## Server actions & APIs
+
+Treat `"use server"` handlers like public endpoints: schema-validate input, authenticate, authorize per record, rate-limit destructive work.
+
+## Client bundle exposure
+
+Framework public env prefixes ship to browsers (`NEXT_PUBLIC_*`, `VITE_*`, etc.). Never place signing secrets there.
+
+## Session storage
+
+Prefer httpOnly secure cookies over `localStorage` session tokens (XSS exfiltration risk).
+
+## CSP & SSR
+
+Set CSP at the edge; use per-request nonces for inline scripts in SSR frameworks. Do not concatenate user input into HTML shells outside JSX.
+
+## State merge attacks
+
+Do not spread unvalidated JSON into React state — validate with Zod first.
+
+## Maps in production
+
+Do not publish full source maps to CDN; upload to error tracker if needed.
+
+Escalate to **exo-security** / `security-review` before merge on auth/payment changes.

package/assets/techne/rules/react/testing.md

@@ -0,0 +1,42 @@
+---
+paths:
+  - "**/*.test.tsx"
+  - "**/*.test.jsx"
+  - "**/*.spec.tsx"
+  - "**/*.spec.jsx"
+  - "**/__tests__/**/*.ts"
+  - "**/__tests__/**/*.tsx"
+---
+> Extends [typescript/testing.md](../typescript/testing.md).
+
+# React testing
+
+## Stack
+
+React Testing Library + Vitest (Vite) or Jest (Next legacy). One component runner per repo.
+
+## Queries
+
+Prefer `getByRole` with accessible name, then label, placeholder, text. `getByTestId` last.resort. Use `findBy*` / `waitFor` for async — never fixed `setTimeout`.
+
+## Interactions
+
+`@testing-library/user-event` with `await`; setup once per test.
+
+## Network
+
+MSW at the fetch boundary; override handlers per test for error paths.
+
+## Hooks
+
+`renderHook` + `act` for custom hooks; test public API only.
+
+## Anti-patterns
+
+No snapshotting large trees; no asserting render counts; do not mock React itself.
+
+## Coverage (typical)
+
+Utilities ≥90%; hooks ≥85%; presentational components ≥80% behavior; containers cover happy + error paths.
+
+See **techne:react** and **techne:quality** for E2E and a11y automation (`ui-design` audit for manual a11y pass).

package/assets/techne/rules/react-native/accessibility.md

@@ -0,0 +1,14 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+# React Native accessibility
+
+Label interactive controls (`accessibilityRole`, `accessibilityLabel`); icon-only buttons need labels. Use `accessibilityState` for disabled/selected/expanded.
+
+Announce async errors/toasts; don't rely on color alone; WCAG AA contrast both themes.
+
+Touch targets ~44pt iOS / 48dp Android; support dynamic type; respect reduced motion.
+
+Test VoiceOver and TalkBack on devices; align tests with role/label queries.

package/assets/techne/rules/react-native/coding-style.md

@@ -0,0 +1,16 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+> Builds on the shared rules in `../common/coding-style.md`.
+
+# React Native style
+
+Function components; typed props; thin screens composing hooks + presentational pieces.
+
+One styling approach per app (`StyleSheet.create` at module scope or utility classes — no inline style objects on hot paths). Centralize tokens.
+
+Platform files (`.ios.tsx`/`.android.tsx`) for large diffs; `Platform.select` for tiny tweaks. Safe areas via `react-native-safe-area-context`.
+
+Path aliases; feature folders; no `console.log` in release. TypeScript rules from [typescript/](../typescript/).

package/assets/techne/rules/react-native/hooks.md

@@ -0,0 +1,16 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+> Builds on the shared rules in `../common/hooks.md`.
+
+# React Native harness hooks
+
+PostToolUse on TS/TSX: `tsc --noEmit`, `expo lint`, Prettier on touched files.
+
+Periodic: `expo-doctor`, `expo install --check`, dependency audit.
+
+No full native builds per edit — reserve EAS/E2E for CI/commands.
+
+`EXONOUS_HOOK_PROFILE`, `EXONOUS_DISABLED_HOOKS`.

package/assets/techne/rules/react-native/patterns.md

@@ -0,0 +1,18 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+> Builds on the shared rules in `../common/patterns.md`.
+
+# React Native patterns
+
+Do not install web DOM rules in RN projects.
+
+Expo Router: thin route files; Zod-validate deep link params with `safeParse` + redirect.
+
+Separate server cache, UI state, route params, forms; secure tokens in `expo-secure-store`.
+
+Lists: `FlatList`/`FlashList` — not huge `.map` in `ScrollView`. Custom hooks for device APIs.
+
+Cleanup effects; ignore stale async on unmount. **techne:react-native** skill.

package/assets/techne/rules/react-native/performance.md

@@ -0,0 +1,14 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+> Builds on the shared rules in `../common/performance.md`.
+
+# React Native performance
+
+Memoize where it stops real re-renders; narrow state. Virtualized lists with stable `keyExtractor` and memoized `renderItem`.
+
+`expo-image` with sized assets. Prefer Reanimated over JS-driven `Animated`.
+
+Target New Architecture + Hermes; defer heavy work (`InteractionManager`). Profile with RN/React profilers — avoid deprecated debug tooling on New Arch.

package/assets/techne/rules/react-native/production-readiness.md

@@ -0,0 +1,16 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+# React Native production readiness
+
+Pin Expo SDK; EAS Build/Submit; separate profiles; credentials in EAS — not repo.
+
+OTA via `expo-updates` for JS-only; native changes need store builds.
+
+Crash reporting (e.g. Sentry) in release; structured logging; surface network failures.
+
+Bump version/build numbers; `EXPO_PUBLIC_*` only for public config.
+
+Pre-release: typecheck, lint, tests (≥80%), expo-doctor, E2E on real builds, secrets scan, physical device smoke.

package/assets/techne/rules/react-native/security.md

@@ -0,0 +1,16 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+> Builds on the shared rules in `../common/security.md`.
+
+# React Native security
+
+Assume JS bundle is public — no privileged keys in app binary. Anon keys OK only with server-enforced rules.
+
+Tokens in Secure Store; not AsyncStorage/MMKV for secrets. HTTPS; validate API + deep link + push payloads with Zod.
+
+Minimal permissions with rationale; accurate store privacy labels.
+
+**exo-security** for review — not third-party agent-config scanners.

package/assets/techne/rules/react-native/testing.md

@@ -0,0 +1,14 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+> Builds on the shared rules in `../common/testing.md`.
+
+# React Native testing
+
+Jest + `@testing-library/react-native` (`jest-expo`); Maestro or Detox for E2E on CI builds.
+
+Query by role/label; mock Expo modules and router; fresh QueryClient per test.
+
+Cover auth/navigation/core flows before release. TDD via **exo-qa** guidance.