exonous 0.0.0-stage → 2.10.4

package/assets/techne/rules/ruby/coding-style.md

@@ -0,0 +1,40 @@
+---
+paths:
+  - "**/*.rb"
+  - "**/*.rake"
+  - "**/Gemfile"
+  - "**/*.gemspec"
+  - "**/config.ru"
+---
+# Ruby Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Runtime
+
+Target Ruby 3.3+ on new Rails apps; respect an existing pin to an older supported release. Enable YJIT in production only after measuring memory and throughput.
+
+## Files
+
+`# frozen_string_literal: true` when the repo uses it; keep metaprogramming behind small, tested APIs.
+
+## Lint
+
+Project RuboCop config (Rails 8+ often starts from omakase); run via binstub:
+
+```bash
+bundle exec rubocop
+bundle exec rubocop -A
+```
+
+Narrow inline disables only with justification.
+
+## Rails
+
+MVC conventions first; thin controllers; domain in models/services/query/form objects as complexity demands; prefer `bin/rails` / binstubs.
+
+## Errors
+
+Rescue specific exceptions; log operations — no committed `puts`/`debugger`.
+
+Layering: `techne:services` skill.

package/assets/techne/rules/ruby/hooks.md

@@ -0,0 +1,33 @@
+---
+paths:
+  - "**/*.rb"
+  - "**/*.rake"
+  - "**/Gemfile"
+  - "**/Gemfile.lock"
+  - "**/config/routes.rb"
+---
+# Ruby Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` / `EXONOUS_DISABLED_HOOKS`.
+
+## PostToolUse
+
+- **RuboCop** (`bundle exec rubocop -A` or project script)
+- **Brakeman** after security-sensitive Rails edits
+- Narrowest **bin/rails test** / **rspec** for touched paths
+- **bundle-audit** when Gemfile/lock changes (if installed)
+
+## Warnings
+
+Debug helpers (`binding.pry`, `debugger`, `puts`) in app code; CSRF off; unsafe mass assignment; raw SQL.
+
+## CI (use what exists)
+
+```bash
+bundle exec rubocop
+bundle exec brakeman --no-progress
+bin/rails test
+bundle exec rspec
+```

package/assets/techne/rules/ruby/patterns.md

@@ -0,0 +1,33 @@
+---
+paths:
+  - "**/*.rb"
+  - "**/*.rake"
+  - "**/Gemfile"
+  - "**/app/**/*.erb"
+  - "**/config/routes.rb"
+---
+# Ruby Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## Rails first
+
+MVC until boundaries blur — then extract named service/query/form objects (verb names, not `Manager`).
+
+## Data store
+
+PostgreSQL for typical multi-host production; SQLite defaults suit single-host — match platform reality. Parameterize all dynamic SQL.
+
+## Jobs
+
+Solid Queue for simple Rails 8 deployments; Sidekiq when Redis ops, throughput, or mature tooling already exist. Solid Cache/Cable vs Redis — match deployment needs.
+
+## UI
+
+Hotwire (Turbo/Stimulus/importmap) for server-rendered apps; SPA/Inertia when complexity or team ownership requires it. No persistence/auth in templates.
+
+## Auth
+
+Rails 8 generator for basic session auth; Devise (or similar) for OAuth/MFA/legacy Devise apps.
+
+Boundaries: `techne:services` skill.

package/assets/techne/rules/ruby/security.md

@@ -0,0 +1,39 @@
+---
+paths:
+  - "**/*.rb"
+  - "**/*.rake"
+  - "**/Gemfile"
+  - "**/Gemfile.lock"
+  - "**/config/routes.rb"
+  - "**/config/credentials*.yml.enc"
+---
+# Ruby Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Rails defaults
+
+CSRF on; strong parameters or typed params; secrets in credentials/env/vault — never plaintext in git.
+
+## SQL
+
+ActiveRecord/query APIs or bound SQL — never interpolate request/job/webhook data into strings.
+
+## Sessions
+
+Rotate on login/elevation; rate-limit and audit recovery flows.
+
+## Dependencies
+
+```bash
+bundle exec bundle-audit check --update
+bundle exec brakeman --no-progress
+```
+
+Review new gems for maintenance and native extension risk.
+
+## Web
+
+Default HTML escaping; treat `html_safe`/`raw` as security code; validate uploads; treat jobs/cable/turbo streams as untrusted input.
+
+Review: `security-review` skill / `exo-security` agent.

package/assets/techne/rules/ruby/testing.md

@@ -0,0 +1,35 @@
+---
+paths:
+  - "**/*.rb"
+  - "**/*.rake"
+  - "**/Gemfile"
+  - "**/test/**/*.rb"
+  - "**/spec/**/*.rb"
+  - "**/config/routes.rb"
+---
+# Ruby Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Framework
+
+Minitest when that is the app default; RSpec when established — do not mix in one feature without a migration plan.
+
+## Pyramid
+
+Model/service/job/policy unit tests; request specs for HTTP/auth/status; system tests only for critical browser flows; job unit + enqueue integration.
+
+## Data
+
+Fixtures for small graphs; factory_bot when traits/composition matter.
+
+```bash
+bin/rails test
+bundle exec rspec
+```
+
+## Coverage
+
+SimpleCov thresholds in CI; regression test before fixing production bugs.
+
+Loop: `techne:quality` skill.

package/assets/techne/rules/rust/coding-style.md

@@ -0,0 +1,41 @@
+---
+paths:
+  - "**/*.rs"
+---
+# Rust Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Format
+
+`cargo fmt`; `cargo clippy -- -D warnings`; 100-col lines (rustfmt default).
+
+## Immutability
+
+Default `let`; `let mut` only when needed; return new values; `Cow` when borrow vs allocate is conditional.
+
+## Naming
+
+`snake_case` values/modules; `PascalCase` types; `SCREAMING_SNAKE_CASE` consts.
+
+## Borrowing
+
+Prefer `&str`, `&[T]` parameters; `impl Into<String>` when storing owned strings; avoid clone-to-placate the checker without understanding why.
+
+## Errors
+
+`Result` + `?`; libraries: `thiserror`; binaries: `anyhow` + `.context(...)`. No `unwrap` in production paths.
+
+## Iterators vs loops
+
+Chains for transforms; loops when control flow is irregular.
+
+## Modules
+
+Group by domain (`auth/`, `billing/`), not by layer file type.
+
+## Visibility
+
+Private by default; `pub(crate)` for internal API; re-export public surface from `lib.rs`.
+
+Depth: `techne:rust` skill.

package/assets/techne/rules/rust/hooks.md

@@ -0,0 +1,16 @@
+---
+paths:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+---
+# Rust Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` / `EXONOUS_DISABLED_HOOKS` gate automation.
+
+## PostToolUse
+
+- **cargo fmt**
+- **cargo clippy**
+- **cargo check** (strict: after non-trivial edits)

package/assets/techne/rules/rust/patterns.md

@@ -0,0 +1,42 @@
+---
+paths:
+  - "**/*.rs"
+---
+# Rust Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## Repository trait
+
+```rust
+pub trait Ledger: Send + Sync {
+    fn by_id(&self, id: u64) -> Result<Option<Entry>, StoreErr>;
+    fn save(&self, row: &Entry) -> Result<Entry, StoreErr>;
+}
+```
+
+## Services
+
+Struct + constructor injecting `Box<dyn Ledger>` (or generics); business methods call traits, not concrete DB types.
+
+## Newtypes
+
+Wrap ids (`struct AccountId(u64)`) to prevent argument swaps.
+
+## State enums
+
+Model connection lifecycle as enum; match exhaustively — no catch-all on critical variants.
+
+## Builders
+
+Fluent builder for configs with many optional fields.
+
+## Sealed traits
+
+Private `Sealed` supertrait to block external impls when extension must stay internal.
+
+## JSON envelope
+
+Tagged enum with `serde` for `{ "status": "ok" | "error" }` responses.
+
+Depth: `techne:rust` skill.

package/assets/techne/rules/rust/security.md

@@ -0,0 +1,33 @@
+---
+paths:
+  - "**/*.rs"
+---
+# Rust Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Secrets
+
+`std::env::var` at startup; `.gitignore` for local env files; no const secrets.
+
+## SQL
+
+Bound parameters via sqlx/diesel/sea-orm — never format user input into SQL strings.
+
+## Validation
+
+Newtypes + parse-at-boundary; reject early with typed errors.
+
+## Unsafe
+
+Minimal blocks; mandatory `// SAFETY:` listing invariants; review every `unsafe`.
+
+## Dependencies
+
+`cargo audit`, `cargo deny check`, `cargo tree`; keep deps lean and updated.
+
+## Responses
+
+Generic client errors; `tracing` for server detail.
+
+Review: `security-review` skill / `exo-security` agent. Idioms: `techne:rust` skill.

package/assets/techne/rules/rust/testing.md

@@ -0,0 +1,30 @@
+---
+paths:
+  - "**/*.rs"
+---
+# Rust Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Tools
+
+`#[test]` modules; **rstest** for cases; **proptest** for properties; **mockall** for trait mocks; **`#[tokio::test]`** for async.
+
+## Layout
+
+Unit tests in `#[cfg(test)]` beside code; integration tests under `tests/`; shared helpers in `tests/common/`.
+
+## Mocks
+
+Define traits in production; `mockall::mock!` in test modules with expectations.
+
+## Coverage
+
+~80% with **cargo-llvm-cov**; exclude generated/FFI glue.
+
+```bash
+cargo test
+cargo llvm-cov --fail-under-lines 80
+```
+
+Depth: `techne:rust` skill (testing reference).

package/assets/techne/rules/swift/coding-style.md

@@ -0,0 +1,30 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Coding Style
+
+> Builds on the shared rules in `../common/coding-style.md`.
+
+## Format
+
+SwiftFormat + SwiftLint (or Xcode 16+ `swift-format` if that is the repo standard).
+
+## Values
+
+Prefer `let`; structs by default; classes only for identity/reference semantics.
+
+## Naming
+
+Apple API Design Guidelines — clarity at call site; omit redundant type words; `static let` for constants.
+
+## Errors
+
+Typed throws (Swift 6+) where applicable; structured `LoadError`-style enums.
+
+## Concurrency
+
+Strict concurrency checking; `Sendable` values across actors; actors for shared mutation; structured concurrency over detached tasks.
+
+Depth: `techne:swift` skill.

package/assets/techne/rules/swift/hooks.md

@@ -0,0 +1,20 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Hooks
+
+> Builds on the shared rules in `../common/hooks.md`.
+
+`EXONOUS_HOOK_PROFILE` / `EXONOUS_DISABLED_HOOKS`.
+
+## PostToolUse
+
+- **SwiftFormat**
+- **SwiftLint**
+- **swift build** on package edits (standard/strict)
+
+## Warnings
+
+Flag `print()` — prefer `os.Logger` or structured logging.

package/assets/techne/rules/swift/patterns.md

@@ -0,0 +1,30 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Patterns
+
+> Builds on the shared rules in `../common/patterns.md`.
+
+## Protocols
+
+Small `Sendable` protocols; default implementations in extensions.
+
+## State enums
+
+```swift
+enum FetchPhase<T: Sendable>: Sendable {
+    case idle, working, done(T), broken(Error)
+}
+```
+
+## Actors
+
+Shared caches/registries as actors instead of manual locks.
+
+## DI
+
+Protocol parameters with production defaults; inject test doubles in tests.
+
+Depth: `techne:swift` skill (concurrency, SwiftUI, testing).

package/assets/techne/rules/swift/security.md

@@ -0,0 +1,22 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Security
+
+> Builds on the shared rules in `../common/security.md`.
+
+## Secrets
+
+Keychain for tokens/passwords — not UserDefaults; build-time via `.xcconfig`/env; no literals in repo.
+
+## Transport
+
+Keep ATS enabled; pin certs for high-value endpoints; validate server trust.
+
+## Input
+
+Sanitize before render; validate `URL` and deep links; treat API/pasteboard data as untrusted until validated.
+
+Review: `security-review` skill / `exo-security` agent.

package/assets/techne/rules/swift/testing.md

@@ -0,0 +1,28 @@
+---
+paths:
+  - "**/*.swift"
+  - "**/Package.swift"
+---
+# Swift Testing
+
+> Builds on the shared rules in `../common/testing.md`.
+
+## Framework
+
+Swift Testing (`import Testing`) — `@Test`, `#expect`, `#require`.
+
+## Isolation
+
+Per-test setup in `init`/`deinit`; no shared mutable globals.
+
+## Parameterized
+
+`@Test(arguments: [...])` for matrix cases.
+
+## Coverage
+
+```bash
+swift test --enable-code-coverage
+```
+
+Depth: `techne:swift` skill (DI and mocks with Swift Testing).

package/assets/techne/rules/typescript/coding-style.md

@@ -0,0 +1,38 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+> Builds on the shared rules in `../common/coding-style.md`.
+
+# TypeScript / JavaScript style
+
+## Typing policy
+
+- Exported functions, public class methods, and shared DTOs: explicit parameter + return types
+- Locals: infer when obvious
+- Repeated inline object shapes → named `type`/`interface`
+
+`interface` for extend/implement shapes; `type` for unions, tuples, mapped types. Prefer string union literals over `enum` unless generating API contracts that require enums.
+
+## Safety
+
+Ban `any` in application code. External payloads: `unknown` + narrowing (`instanceof`, type guards, schema parse).
+
+React props: dedicated `Props` type; skip `React.FC` unless children typing demands it.
+
+## Data handling
+
+Updates clone via spread/`Readonly` rather than mutating arguments.
+
+`async`/`await` with `catch (err: unknown)` funneled through a small `getErrorMessage` helper.
+
+## Validation
+
+Zod (or equivalent) at IO edges; export inferred types via `z.infer`.
+
+## Logging
+
+No stray `console.log` in committed code — use the project logger; hooks may warn on debug prints in edited files.

package/assets/techne/rules/typescript/hooks.md

@@ -0,0 +1,14 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+> Builds on the shared rules in `../common/hooks.md`.
+
+# TypeScript hooks
+
+PostToolUse: Prettier, `tsc`, warn on `console.log` in touched files. Stop: scan session edits for debug logs.
+
+Profile: `EXONOUS_HOOK_PROFILE`, `EXONOUS_DISABLED_HOOKS`.

package/assets/techne/rules/typescript/patterns.md

@@ -0,0 +1,12 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+> Builds on the shared rules in `../common/patterns.md`.
+
+# TypeScript patterns
+
+Typed API envelope (`success`, `data`, `error`, optional `meta`). Generic repository interface for persistence. Shared hooks (debounce, etc.) colocated under `hooks/`.

package/assets/techne/rules/typescript/security.md

@@ -0,0 +1,14 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+> Builds on the shared rules in `../common/security.md`.
+
+# TypeScript security
+
+Read secrets from `process.env`; throw at startup if missing. Never embed keys in source.
+
+Use **exo-security** / `security-review` for audits.

package/assets/techne/rules/typescript/testing.md

@@ -0,0 +1,12 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+> Builds on the shared rules in `../common/testing.md`.
+
+# TypeScript testing
+
+Playwright for critical E2E flows unless the repo standard differs. Component/unit via project runner (often Vitest/Jest).

package/assets/techne/rules/vue/coding-style.md

@@ -0,0 +1,19 @@
+---
+paths:
+  - "**/*.vue"
+---
+> Builds on the shared rules in `../common/coding-style.md`.
+
+# Vue coding style
+
+`<script setup lang="ts">` only for new work. Order: script, template, scoped style. PascalCase SFC names; `use*` composables.
+
+`ref` primary; `.value` in script; no destructuring reactive/Pinia without `toRefs`/`storeToRefs`.
+
+Pure `computed`; lazy `watch` with getters; `watchEffect` stops tracking after first `await`.
+
+Lifecycle registered synchronously in setup; cleanup on unmount; DOM reads after `nextTick`.
+
+Macros: typed props/emits; `defineModel` for v-model; stable `:key` on `v-for` (never index); never `v-if` + `v-for` same element.
+
+**techne:vue** skill for depth.

package/assets/techne/rules/vue/hooks.md

@@ -0,0 +1,13 @@
+---
+paths:
+  - "**/*.vue"
+  - "**/*.ts"
+  - "**/*.tsx"
+---
+> Builds on the shared rules in `../common/hooks.md`.
+
+# Vue harness hooks
+
+After edits: eslint (vue plugin) + Prettier per file; debounced project `vue-tsc --noEmit` (not plain `tsc` for SFCs).
+
+Optional boundary lint (FSD/steiger). `EXONOUS_HOOK_PROFILE`, `EXONOUS_DISABLED_HOOKS`.

package/assets/techne/rules/vue/patterns.md

@@ -0,0 +1,29 @@
+---
+paths:
+  - "**/*.vue"
+---
+> Builds on the shared rules in `../common/patterns.md`.
+
+# Vue patterns
+
+## Composables
+
+Export `useFeature()` accepting `MaybeRefOrGetter` inputs (`toValue` inside). Return `toRefs(reactiveState)` so callers can destructure safely.
+
+If the composable registers lifecycle hooks or `provide`, call it synchronously from `setup` only.
+
+## State split
+
+Pinia (client/domain) vs `@tanstack/vue-query` (server cache). Keep fetch functions + `queryOptions` factories in an `api/` layer.
+
+Query keys must include reactive refs/computed objects — **not** `.value` snapshots — or refetch breaks.
+
+## Router
+
+Lazy `import()` route components. Global guard checks `meta.requiresAuth`. Watch `() => route.params.id` instead of the whole route object.
+
+## Provide / inject
+
+Use `Symbol` keys typed with `InjectionKey<T>`. Expose readonly state + explicit mutators.
+
+**techne:vue** skill for FSD/Nuxt overlap.

package/assets/techne/rules/vue/security.md

@@ -0,0 +1,11 @@
+---
+paths:
+  - "**/*.vue"
+---
+> Builds on the shared rules in `../common/security.md`.
+
+# Vue security
+
+`{{ }}` and bound attrs escape; `v-html` and dynamic `:is` from users do not. Sanitize HTML; block `javascript:` in URLs; never bind user strings to `:style` objects or event attrs.
+
+`import.meta.env.VITE_*` is public. Sessions via httpOnly cookies.

package/assets/techne/rules/vue/testing.md

@@ -0,0 +1,11 @@
+---
+paths:
+  - "**/*.vue"
+---
+> Builds on the shared rules in `../common/testing.md`.
+
+# Vue testing
+
+Vitest + `@vue/test-utils`; `happy-dom`/`jsdom`. `mount` vs `shallowMount`; await `trigger`/`setValue`.
+
+Test props/emits/slots — not internals. Pinia: `createTestingPinia` or isolated store per test.