hatch3r 1.7.5 → 1.9.0

package/{rules → dist/content/rules}/hatch3r-agent-orchestration.mdc

@@ -1,6 +1,7 @@
 ---
 description: Mandatory agent delegation, skill loading, and subagent usage directives for ALL tasks in ALL contexts
 alwaysApply: true
+precedence: high
 ---
 # Agent Orchestration
 
@@ -98,6 +99,28 @@ Examples:
 
 A missing header on a tracked Tier >= 2 task is a self-detectable drift signal — the user may halt the turn and request re-grounding. The header also functions as a per-reply cache prime: rendering it forces the orchestrator to re-resolve which phase it is in before choosing tools. Tier 1 tasks, read-only answers, and chat-only iterations do NOT require the header.
 
+### End-of-Turn Delegation Attestation
+
+When the turn is on a tracked task at Tier >= 2 AND caused at least one file mutation, the orchestrator MUST emit a closing block immediately before the Iteration Summary. The block enumerates every file mutated this turn, the spawning sub-agent invocation, and the `delegation_proof_id` returned by that sub-agent.
+
+Format:
+
+```
+[hatch3r-delegation-attestation]
+files_mutated_this_turn:
+  - <relative path>: via <agent-name> (proof: <delegation_proof_id>)
+mutating_subagent_invocations: <integer>
+inline_edits_by_orchestrator: none | <carve-out: hatch3r-quick-change Tier-1 + queued re-delegation>
+```
+
+Rules:
+
+- Each `files_mutated_this_turn` row MUST cite the spawning sub-agent invocation and quote the `delegation_proof_id` returned by that sub-agent verbatim. Unattributable rows are self-declared P8 B2 violations and the orchestrator MUST queue re-delegation in the next turn.
+- `inline_edits_by_orchestrator: none` is the only acceptable value outside the `hatch3r-quick-change` Tier-1 carve-out declared in the "Inline implementation" definition above.
+- Tier 1 read-only and chat-only turns are exempt — same scope as the Per-Turn Pipeline-State Header.
+- Missing block on a Tier >= 2 mutating turn is a self-detectable drift signal — the user may halt the turn and re-ground per the same protocol as the missing-header signal.
+- The block is consumed by reviewers and the next orchestrator turn; it sits beside the Iteration Summary, not inside it, preserving the existing 5-field iteration-summary contract verbatim.
+
 ### Mandatory Delegation Directive (No Inline Implementation)
 
 Restating with maximum clarity for sub-agent prompt inclusion: the orchestrator MUST NOT call `Edit`, `Write`, `MultiEdit`, `NotebookEdit`, `replace_string_in_file`, `multi_replace_string_in_file`, `create_file`, `str_replace_based_edit_tool`, `apply_patch`, or any platform-equivalent code-writing tool from its own turn. The only path for code mutation is the Task tool spawning `hatch3r-implementer` (Phase 2) or `hatch3r-fixer` (Phase 3). Carve-out: `hatch3r-quick-change` Tier 1 trivial items per its declared scope. No other carve-out exists. Violations are bypass mode (see issue #73) — surface them by halting the turn and re-delegating.
@@ -127,14 +150,14 @@ For multi-sub-task implementations, the implementer performs a lightweight mini-
 
 1. Spawn `hatch3r-reviewer` with diff and acceptance criteria. Reviewer includes blast radius summary.
 2. Critical/Warning findings: spawn `hatch3r-fixer` with full reviewer output.
-3. Re-review after fixes. Repeat until 0 Critical + 0 Warning, or max 3 iterations.
+3. Re-review after fixes. Repeat until 0 Critical + 0 Warning, or max 4 iterations (matches `DEFAULT_MAX_REVIEW_ITERATIONS` in `src/pipeline/reviewLoop.ts`; raised from 3 to 4 in Cycle 7.5 W2B2 finding H26 so the oscillation detector becomes reachable in default config). The rule default and the code constant are kept in sync by `src/__tests__/pipeline/reviewLoop.test.ts` (CI-enforced).
 4. **Confirmation pass** after clean review: lightweight re-review for fix-driven regressions and acceptance criteria completeness. The confirmation pass checks only: (a) no new test failures compared to Phase 2 baseline, (b) no type errors introduced, (c) acceptance criteria from the issue are still met. It does not re-run the full review checklist.
 5. Max iterations reached: surface to user with a structured summary: iteration count, remaining Critical findings (with file:line), remaining Warning findings, and a recommendation (fix manually vs. accept risk). Never present raw reviewer output without summarization.
 6. **Review gate confidence signal:** When the review loop exits with a clean verdict, record the iteration count in `PipelineContext.reviewResult.iterations`. Clean-on-first-pass (iteration 1) signals higher confidence than clean-after-multiple-iterations (iteration 2-3). Phase 4 specialists and the orchestrator should factor this into their risk assessment.
 
 **Phase 4 — Final Quality** (after review loop is clean):
 
-Launch parallel subagents -- no artificial concurrency limit.
+Launch Phase 4 specialists in parallel, bounded by `max_phase4_parallel` (default `3`, override via `HATCH3R_MAX_PHASE4_PARALLEL` env var; valid range 1-16, values outside the range fall back to default with a logged warning). The bound exists to cap per-orchestrator concurrent context cost — it does not soften the P8 B2 directive that fan-out scales with task decomposition. When the number of applicable specialists exceeds `max_phase4_parallel`, batch them by severity-descending priority: `CRITICAL → HIGH → MEDIUM → LOW` (severity is the worst-case finding class the specialist is expected to surface, per the `hatch3r-test-writer` / `hatch3r-security-auditor` always-on baseline → CRITICAL, conditional UI/security/perf → HIGH, docs/lint → MEDIUM, low-impact specialists → LOW). Within the same severity bucket, dispatch order is the trigger-table order in the table above. Each batch runs to completion (all specialists return SUCCESS/PARTIAL/FAILED) before the next batch starts; the validation pass below runs once after the final batch.
 
 - **Always** (except when Phase Skip Criteria applies — see below)**:** `hatch3r-test-writer`, `hatch3r-security-auditor`
 - **Evaluate:** `hatch3r-docs-writer` (when APIs/architecture/UX affected)
@@ -343,6 +366,6 @@ All `scope: always` rules apply to every task including subagent work. Include r
 - `hatch3r-dependency-management` -- dependency-auditor
 
 **Tier 3 -- On-demand:**
-- `hatch3r-api-design`, `hatch3r-secrets-management`, `hatch3r-data-classification`, `hatch3r-performance-budgets`, `hatch3r-browser-verification`, `hatch3r-component-conventions`, `hatch3r-i18n`, `hatch3r-theming`, `hatch3r-migrations`, `hatch3r-feature-flags`, `hatch3r-observability-logging`, `hatch3r-observability-metrics`, `hatch3r-observability-tracing`, `hatch3r-observability-tracing-detail`
+- `hatch3r-api-design`, `hatch3r-secrets-management`, `hatch3r-data-classification`, `hatch3r-performance-budgets`, `hatch3r-browser-verification`, `hatch3r-component-conventions`, `hatch3r-i18n`, `hatch3r-theming`, `hatch3r-migrations`, `hatch3r-feature-flags`, `hatch3r-observability-logging`, `hatch3r-observability-metrics`, `hatch3r-observability-tracing`
 
 For limited context windows, Tier 1 is mandatory. Tier 2/3 included selectively by agent role and task scope.

package/{rules → dist/content/rules}/hatch3r-ai-evals.md

@@ -4,6 +4,7 @@ type: rule
 description: AI feature evaluation, prompt versioning, cost telemetry, prompt caching, model fallback, and hallucination-as-SLI for end-user projects shipping LLM features
 scope: "**/ai/**,**/llm/**,**/chat/**,**/assistant/**,**/agents/**,**/copilot/**,**/evals/**,**/prompts/**,**/rag/**"
 tags: [review, implementation, ai]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---
@@ -67,7 +68,7 @@ Match the metric to the task class:
 
 Every LLM call logs: `tokens_in`, `tokens_out`, `cache_hit` (boolean + cached_tokens count), `model`, `cost_usd`, `latency_ms`, `cost_center` (feature ID), `prompt_version`, `prompt_hash`, `user_id_hash`.
 
-Aggregate dashboards in the observability stack — cross-reference `rules/hatch3r-observability-metrics.md` and `rules/hatch3r-observability-tracing-detail.md` for the SLI/SLO vocabulary, and `skills/hatch3r-observability-verify` for the wiring checklist. Per-feature budget alerts fire at 50%, 75%, and 90% of monthly budget; abuse-detection alert at 10x user p99 cost over a 1-hour window.
+Aggregate dashboards in the observability stack — cross-reference `rules/hatch3r-observability-metrics.md` and `rules/hatch3r-observability-tracing.md` for the SLI/SLO vocabulary, and `skills/hatch3r-observability-verify` for the wiring checklist. Per-feature budget alerts fire at 50%, 75%, and 90% of monthly budget; abuse-detection alert at 10x user p99 cost over a 1-hour window.
 
 ## Prompt Caching (Anthropic)
 

package/{rules → dist/content/rules}/hatch3r-ai-evals.mdc

@@ -2,6 +2,7 @@
 description: AI feature evaluation, prompt versioning, cost telemetry, prompt caching, model fallback, and hallucination-as-SLI for end-user projects shipping LLM features
 globs: ["**/ai/**", "**/llm/**", "**/chat/**", "**/assistant/**", "**/agents/**", "**/copilot/**", "**/evals/**", "**/prompts/**", "**/rag/**"]
 alwaysApply: false
+precedence: high
 ---
 # AI Feature Evaluation and Cost Governance (2026)
 
@@ -63,7 +64,7 @@ Match the metric to the task class:
 
 Every LLM call logs: `tokens_in`, `tokens_out`, `cache_hit` (boolean + cached_tokens count), `model`, `cost_usd`, `latency_ms`, `cost_center` (feature ID), `prompt_version`, `prompt_hash`, `user_id_hash`.
 
-Aggregate dashboards in the observability stack — cross-reference `rules/hatch3r-observability-metrics.md` and `rules/hatch3r-observability-tracing-detail.md` for the SLI/SLO vocabulary, and `skills/hatch3r-observability-verify` for the wiring checklist. Per-feature budget alerts fire at 50%, 75%, and 90% of monthly budget; abuse-detection alert at 10x user p99 cost over a 1-hour window.
+Aggregate dashboards in the observability stack — cross-reference `rules/hatch3r-observability-metrics.md` and `rules/hatch3r-observability-tracing.md` for the SLI/SLO vocabulary, and `skills/hatch3r-observability-verify` for the wiring checklist. Per-feature budget alerts fire at 50%, 75%, and 90% of monthly budget; abuse-detection alert at 10x user p99 cost over a 1-hour window.
 
 ## Prompt Caching (Anthropic)
 

package/{rules → dist/content/rules}/hatch3r-ai-ux-patterns.md

@@ -3,7 +3,7 @@ id: hatch3r-ai-ux-patterns
 type: rule
 description: 2026 AI/agentic UX patterns for end-user projects shipping AI features — streaming, tool-call UI, human-approval gates, cancel/abort/undo, citations
 scope: "**/*.vue,**/*.jsx,**/*.tsx,**/*.svelte,**/ai/**,**/chat/**,**/assistant/**,**/agents/**,**/llm/**,**/copilot/**"
-tags: [ux, ai, frontend]
+tags: [implementation, floor:ui-ux, ux, ai, frontend]
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-api-versioning.md

@@ -4,6 +4,7 @@ type: rule
 description: API versioning, deprecation lifecycle, and idempotency — RFC 9457 errors, RFC 9745 Deprecation header, RFC 8594 Sunset, OAuth 2.1, Idempotency-Key, semver vs CalVer for APIs
 scope: "**/api/**,**/openapi*,**/asyncapi*,**/*.proto,**/routes/**,**/handlers/**,**/controllers/**"
 tags: [implementation, devops]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-api-versioning.mdc

@@ -2,6 +2,7 @@
 description: API versioning, deprecation lifecycle, and idempotency — RFC 9457 errors, RFC 9745 Deprecation header, RFC 8594 Sunset, OAuth 2.1, Idempotency-Key, semver vs CalVer for APIs
 globs: ["**/api/**", "**/openapi*", "**/asyncapi*", "**/*.proto", "**/routes/**", "**/handlers/**", "**/controllers/**"]
 alwaysApply: false
+precedence: high
 ---
 # API Versioning, Deprecation & Idempotency
 

package/{rules → dist/content/rules}/hatch3r-auth-patterns.md

@@ -3,7 +3,8 @@ id: hatch3r-auth-patterns
 type: rule
 description: Authentication and authorization patterns for end-user apps — OAuth 2.1, OIDC, DPoP, JWT rotation, cookie security, RBAC vs ABAC vs ReBAC rubric
 scope: "**/auth/**,**/login/**,**/session/**,**/oauth/**,**/oidc/**,**/jwt/**,**/permissions/**,**/policies/**,**/middleware/**"
-tags: [security, implementation]
+tags: [implementation, floor:security]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-auth-patterns.mdc

@@ -2,6 +2,7 @@
 description: Authentication and authorization patterns for end-user apps — OAuth 2.1, OIDC, DPoP, JWT rotation, cookie security, RBAC vs ABAC vs ReBAC rubric
 globs: ["**/auth/**", "**/login/**", "**/session/**", "**/oauth/**", "**/oidc/**", "**/jwt/**", "**/permissions/**", "**/policies/**", "**/middleware/**"]
 alwaysApply: false
+precedence: high
 ---
 # Authentication & Authorization Patterns
 

package/{rules → dist/content/rules}/hatch3r-browser-verification.md

@@ -48,16 +48,12 @@ Browser verification is opt-in per command session. The orchestrator follows a s
 | Supports Browser Verification | Does NOT Support |
 | ------------------------------ | ---------------- |
 | `hatch3r-workflow` | `hatch3r-board-fill` |
-| `hatch3r-board-pickup` | `hatch3r-board-groom` |
-| `hatch3r-quick-change` | `hatch3r-board-refresh` |
-| `hatch3r-revision` | `hatch3r-roadmap` |
-| `hatch3r-debug` | `hatch3r-release` |
-| | `hatch3r-refactor-plan` |
-| | `hatch3r-security-audit` |
-| | `hatch3r-rule-customize` |
-| | `hatch3r-skill-customize` |
-
-Commands in the "Does NOT Support" column are documentation-only, planning-only, or non-implementation commands. They MUST NOT prompt for browser verification.
+| `hatch3r-board-pickup` | `hatch3r-roadmap` |
+| `hatch3r-quick-change` | `hatch3r-refactor-plan` |
+| `hatch3r-revision` | `hatch3r-security-audit` |
+| `hatch3r-debug` | |
+
+Commands in the "Does NOT Support" column are documentation-only, planning-only, or non-implementation commands. They MUST NOT prompt for browser verification. Skills (including `hatch3r-board-groom`, `hatch3r-board-refresh`, `hatch3r-release`) are invoked outside the orchestrator command lifecycle and therefore do not prompt for browser verification.
 
 ---
 

package/{rules → dist/content/rules}/hatch3r-browser-verification.mdc

@@ -43,16 +43,12 @@ Browser verification is opt-in per command session. The orchestrator follows a s
 | Supports Browser Verification | Does NOT Support |
 | ------------------------------ | ---------------- |
 | `hatch3r-workflow` | `hatch3r-board-fill` |
-| `hatch3r-board-pickup` | `hatch3r-board-groom` |
-| `hatch3r-quick-change` | `hatch3r-board-refresh` |
-| `hatch3r-revision` | `hatch3r-roadmap` |
-| `hatch3r-debug` | `hatch3r-release` |
-| | `hatch3r-refactor-plan` |
-| | `hatch3r-security-audit` |
-| | `hatch3r-rule-customize` |
-| | `hatch3r-skill-customize` |
-
-Commands in the "Does NOT Support" column are documentation-only, planning-only, or non-implementation commands. They MUST NOT prompt for browser verification.
+| `hatch3r-board-pickup` | `hatch3r-roadmap` |
+| `hatch3r-quick-change` | `hatch3r-refactor-plan` |
+| `hatch3r-revision` | `hatch3r-security-audit` |
+| `hatch3r-debug` | |
+
+Commands in the "Does NOT Support" column are documentation-only, planning-only, or non-implementation commands. They MUST NOT prompt for browser verification. Skills (including `hatch3r-board-groom`, `hatch3r-board-refresh`, `hatch3r-release`) are invoked outside the orchestrator command lifecycle and therefore do not prompt for browser verification.
 
 ---
 

package/{rules → dist/content/rules}/hatch3r-ci-cd.md

@@ -4,6 +4,7 @@ type: rule
 description: CI/CD pipeline standards covering stage gates, deployment strategies, and rollback procedures
 scope: "**/.github/workflows/**,**/Dockerfile*,**/docker-compose*,**/.gitlab-ci*,**/Jenkinsfile,**/azure-pipelines*,**/.circleci/**,**/deploy/**,**/*pipeline*"
 tags: [devops]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-ci-cd.mdc

@@ -2,6 +2,7 @@
 description: CI/CD pipeline standards covering stage gates, deployment strategies, and rollback procedures
 globs: ["**/.github/workflows/**", "**/Dockerfile*", "**/docker-compose*", "**/.gitlab-ci*", "**/Jenkinsfile", "**/azure-pipelines*", "**/.circleci/**", "**/deploy/**", "**/*pipeline*"]
 alwaysApply: false
+precedence: high
 ---
 # CI/CD Standards
 

package/{rules → dist/content/rules}/hatch3r-code-standards.md

@@ -3,7 +3,7 @@ id: hatch3r-code-standards
 type: rule
 description: TypeScript typing discipline, naming, file size caps, Result types, barrel exports, import ordering, and monorepo boundary rules
 scope: always
-tags: [core, lang:typescript]
+tags: [implementation, lang:typescript]
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-component-conventions.md

@@ -4,7 +4,7 @@ type: rule
 description: Component structure, styling tokens, loading/error/empty states, form validation timing, and accessible label patterns for Vue, React, and JSX
 scope: conditional
 globs: "src/**/*.vue,src/**/*.tsx,src/**/*.jsx"
-tags: [implementation, lang:typescript]
+tags: [implementation, floor:ui-ux, lang:typescript]
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-container-hardening.md

@@ -3,7 +3,8 @@ id: hatch3r-container-hardening
 type: rule
 description: Container image hardening — digest pinning, distroless / Wolfi base, non-root user, SBOM-in-image, cosign signing + verification, multi-stage builds, CVE scanning
 scope: "**/Dockerfile*,**/docker-compose*,**/*.containerfile,**/charts/**,**/k8s/**,**/kubernetes/**,**/manifests/**"
-tags: [security, devops]
+tags: [devops, floor:security]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-container-hardening.mdc

@@ -2,6 +2,7 @@
 description: Container image hardening — digest pinning, distroless / Wolfi base, non-root user, SBOM-in-image, cosign signing + verification, multi-stage builds, CVE scanning
 globs: ["**/Dockerfile*", "**/docker-compose*", "**/*.containerfile", "**/charts/**", "**/k8s/**", "**/kubernetes/**", "**/manifests/**"]
 alwaysApply: false
+precedence: high
 ---
 # Container Hardening
 

package/{rules → dist/content/rules}/hatch3r-contract-testing.md

@@ -4,6 +4,7 @@ type: rule
 description: Consumer-driven and spec-driven contract testing between services — Pact, Schemathesis, Dredd, pact-broker can-i-deploy gate
 scope: "**/contracts/**,**/pacts/**,**/api/**,**/openapi*,**/asyncapi*,**/*.proto,**/__tests__/contract/**"
 tags: [review, implementation]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-contract-testing.mdc

@@ -2,6 +2,7 @@
 description: Consumer-driven and spec-driven contract testing between services — Pact, Schemathesis, Dredd, pact-broker can-i-deploy gate
 globs: ["**/contracts/**", "**/pacts/**", "**/api/**", "**/openapi*", "**/asyncapi*", "**/*.proto", "**/__tests__/contract/**"]
 alwaysApply: false
+precedence: high
 ---
 # Contract Testing
 

package/{rules → dist/content/rules}/hatch3r-data-classification.md

@@ -3,7 +3,8 @@ id: hatch3r-data-classification
 type: rule
 description: Data classification standards covering PII handling, encryption, retention policies, and regulatory compliance
 scope: "**/models/**,**/schemas/**,**/schema*,**/database/**,**/db/**,**/*model*,**/*entity*,**/prisma/**,**/drizzle/**,**/*migration*"
-tags: [security]
+tags: [floor:security]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-data-classification.mdc

@@ -2,6 +2,7 @@
 description: Data classification standards covering PII handling, encryption, retention policies, and regulatory compliance
 globs: ["**/models/**", "**/schemas/**", "**/schema*", "**/database/**", "**/db/**", "**/*model*", "**/*entity*", "**/prisma/**", "**/drizzle/**", "**/*migration*"]
 alwaysApply: false
+precedence: high
 ---
 # Data Classification Standards
 

package/{rules → dist/content/rules}/hatch3r-deep-context.md

@@ -3,7 +3,7 @@ id: hatch3r-deep-context
 type: rule
 description: Adaptive pre-implementation analysis — complexity scoring, requirements elicitation, similar implementation discovery, and transitive dependency tracing before coding
 scope: always
-tags: [core]
+tags: [orchestration, floor:protocol]
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-dependency-management.md

@@ -3,7 +3,8 @@ id: hatch3r-dependency-management
 type: rule
 description: Lockfile discipline, CVE scanning, transitive dependency audits, major version upgrade protocol, and bundle-size impact gates for package manifests
 scope: "**/package.json,**/package-lock.json,**/yarn.lock,**/pnpm-lock.yaml,**/Cargo.toml,**/Cargo.lock,**/requirements*.txt,**/pyproject.toml,**/go.mod,**/go.sum,**/Gemfile*"
-tags: [maintenance, security]
+tags: [maintenance, floor:security]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-dependency-management.mdc

@@ -2,6 +2,7 @@
 description: Lockfile discipline, CVE scanning, transitive dependency audits, major version upgrade protocol, and bundle-size impact gates for package manifests
 globs: ["**/package.json", "**/package-lock.json", "**/yarn.lock", "**/pnpm-lock.yaml", "**/Cargo.toml", "**/Cargo.lock", "**/requirements*.txt", "**/pyproject.toml", "**/go.mod", "**/go.sum", "**/Gemfile*"]
 alwaysApply: false
+precedence: high
 ---
 # Dependency Management
 

package/{rules → dist/content/rules}/hatch3r-design-system-detection.md

@@ -3,7 +3,8 @@ id: hatch3r-design-system-detection
 type: rule
 description: Mandatory detection of existing design tokens, theme primitives, and component library before AI agents author new UI components
 scope: "**/*.vue,**/*.jsx,**/*.tsx,**/*.svelte,**/*.css,**/*.scss,**/components/**,**/tokens*,**/theme*,**/design-system/**,**/tailwind*"
-tags: [ui, design-system, frontend]
+tags: [implementation, floor:ui-ux, ui, design-system, frontend]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-design-system-detection.mdc

@@ -2,6 +2,7 @@
 description: Mandatory detection of existing design tokens, theme primitives, and component library before AI agents author new UI components
 globs: ["**/*.vue", "**/*.jsx", "**/*.tsx", "**/*.svelte", "**/*.css", "**/*.scss", "**/components/**", "**/tokens*", "**/theme*", "**/design-system/**", "**/tailwind*"]
 alwaysApply: false
+precedence: high
 ---
 # Design System Detection
 

package/{rules → dist/content/rules}/hatch3r-event-schema-evolution.md

@@ -4,6 +4,7 @@ type: rule
 description: Event and message schema evolution patterns for Kafka / Kinesis / Pub-Sub / event store — backward + forward + full compatibility modes, schema registry, consumer-side defaults
 scope: "**/events/**,**/schemas/**,**/*.avsc,**/*.proto,**/messaging/**,**/kafka/**,**/pubsub/**"
 tags: [implementation, devops]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-event-schema-evolution.mdc

@@ -2,6 +2,7 @@
 description: Event and message schema evolution patterns for Kafka / Kinesis / Pub-Sub / event store — backward + forward + full compatibility modes, schema registry, consumer-side defaults
 globs: ["**/events/**", "**/schemas/**", "**/*.avsc", "**/*.proto", "**/messaging/**", "**/kafka/**", "**/pubsub/**"]
 alwaysApply: false
+precedence: high
 ---
 # Event Schema Evolution
 

package/{rules → dist/content/rules}/hatch3r-git-conventions.md

@@ -3,7 +3,7 @@ id: hatch3r-git-conventions
 type: rule
 description: Conventional Commits type list, subject line rules, breaking-change footer format, and branch naming template for type/short-description
 scope: "**/.git/**,**/.gitignore,**/.gitattributes,**/.gitmodules,**/COMMIT_EDITMSG"
-tags: [core]
+tags: [orchestration]
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-handoff-readiness.md

@@ -3,15 +3,15 @@ id: hatch3r-handoff-readiness
 type: rule
 description: Handoff readiness checklist — pre-write validation before persisting a canonical handoff document.
 scope: conditional
-globs: .agents/handoffs/active/**/*.md
+globs: .hatch3r/handoffs/active/**/*.md
 precedence: high
-tags: [core, maintenance]
+tags: [orchestration, maintenance]
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---
 # Handoff Readiness Checklist
 
-Before writing a handoff to `.agents/handoffs/active/`, verify each criterion. Refuse the write if any **Required** criterion fails; warn on **Recommended** failures.
+Before writing a handoff to `.hatch3r/handoffs/active/`, verify each criterion. Refuse the write if any **Required** criterion fails; warn on **Recommended** failures.
 
 ## Required (fail = refuse write)
 
@@ -39,7 +39,7 @@ The `hatch3r-handoff-preparer` agent applies this checklist before invoking `wri
 
 ## Cross-references
 
-- Body sections schema: `.agents/handoffs/README.md`
+- Body sections schema: `.hatch3r/handoffs/README.md`
 - Iteration Summary contract (populates Work Done / Work Remaining / Blockers): `rules/hatch3r-iteration-summary.md`
 - Injection-pattern catalog: `agents/shared/injection-patterns.md` Section B
 - Quality charter (confidence levels): `agents/shared/quality-charter.md`

package/{rules → dist/content/rules}/hatch3r-handoff-readiness.mdc

@@ -1,12 +1,12 @@
 ---
 description: Handoff readiness checklist — pre-write validation before persisting a canonical handoff document.
-globs: [".agents/handoffs/active/**/*.md"]
+globs: [".hatch3r/handoffs/active/**/*.md"]
 alwaysApply: false
 precedence: high
 ---
 # Handoff Readiness Checklist
 
-Before writing a handoff to `.agents/handoffs/active/`, verify each criterion. Refuse the write if any **Required** criterion fails; warn on **Recommended** failures.
+Before writing a handoff to `.hatch3r/handoffs/active/`, verify each criterion. Refuse the write if any **Required** criterion fails; warn on **Recommended** failures.
 
 ## Required (fail = refuse write)
 
@@ -34,7 +34,7 @@ The `hatch3r-handoff-preparer` agent applies this checklist before invoking `wri
 
 ## Cross-references
 
-- Body sections schema: `.agents/handoffs/README.md`
+- Body sections schema: `.hatch3r/handoffs/README.md`
 - Iteration Summary contract (populates Work Done / Work Remaining / Blockers): `rules/hatch3r-iteration-summary.md`
 - Injection-pattern catalog: `agents/shared/injection-patterns.md` Section B
 - Quality charter (confidence levels): `agents/shared/quality-charter.md`

package/{rules → dist/content/rules}/hatch3r-i18n.md

@@ -4,7 +4,7 @@ type: rule
 description: Internationalization, localization, and RTL support conventions for the project
 scope: conditional
 globs: "src/**/*.vue,src/**/*.tsx,src/**/*.jsx,src/**/*.ts,**/locales/**,**/i18n/**,**/*i18n*,**/*locale*"
-tags: [implementation, lang:typescript]
+tags: [implementation, floor:ui-ux, lang:typescript]
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-iteration-summary.md

@@ -3,7 +3,7 @@ id: hatch3r-iteration-summary
 type: rule
 description: Every user-facing iteration ends with the canonical Iteration Summary block — a 5-field contract exposing status, gaps, and confidence at a glance.
 scope: always
-tags: [core]
+tags: [orchestration, floor:protocol]
 quality_charter: agents/shared/quality-charter.md
 precedence: high
 cache_friendly: true
@@ -67,6 +67,8 @@ Append only when they carry information. Do not include empty headers.
 **Suggested Next Action:** {one line}
 ```
 
+The **End-of-Turn Delegation Attestation** (defined in `hatch3r-agent-orchestration` -> End-of-Turn Delegation Attestation) is conditionally required and appears immediately BEFORE this Iteration Summary block. It applies when the turn is on a Tier >= 2 tracked task AND caused at least one file mutation. The Iteration Summary's 5-field contract is unchanged — the Attestation lives in a separate block to preserve backward compatibility for the 15 adapter outputs.
+
 ## Field Semantics
 
 - **Outcome** is one sentence. The user should grasp what happened from this line alone.

package/{rules → dist/content/rules}/hatch3r-iteration-summary.mdc

@@ -62,6 +62,8 @@ Append only when they carry information. Do not include empty headers.
 **Suggested Next Action:** {one line}
 ```
 
+The **End-of-Turn Delegation Attestation** (defined in `hatch3r-agent-orchestration` -> End-of-Turn Delegation Attestation) is conditionally required and appears immediately BEFORE this Iteration Summary block. It applies when the turn is on a Tier >= 2 tracked task AND caused at least one file mutation. The Iteration Summary's 5-field contract is unchanged — the Attestation lives in a separate block to preserve backward compatibility for the 15 adapter outputs.
+
 ## Field Semantics
 
 - **Outcome** is one sentence. The user should grasp what happened from this line alone.

package/{rules → dist/content/rules}/hatch3r-learning-consult.md

@@ -1,19 +1,19 @@
 ---
 id: hatch3r-learning-consult
 type: rule
-description: Consult .agents/learnings/ for pitfalls, patterns, and past decisions before implementation with frontmatter-first scan and priority ordering
-scope: "**/.agents/learnings/**,**/learnings/**"
-tags: [core]
+description: Consult .hatch3r/learnings/ for pitfalls, patterns, and past decisions before implementation with frontmatter-first scan and priority ordering
+scope: "**/.hatch3r/learnings/**,**/learnings/**"
+tags: [orchestration]
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---
 # Learning Consultation
 
-Before implementing any task, check `.agents/learnings/` for relevant past learnings.
+Before implementing any task, check `.hatch3r/learnings/` for relevant past learnings.
 
 ## Consultation Process
 
-1. If `.agents/learnings/` exists and contains files:
+1. If `.hatch3r/learnings/` exists and contains files:
    - Scan learning file frontmatter for matching `tags` or `area` that overlap with the current task.
    - Read the `## Applies When` section of potential matches.
    - Surface relevant learnings to the developer/agent before implementation begins.
@@ -23,7 +23,7 @@ Before implementing any task, check `.agents/learnings/` for relevant past learn
 
 - During `hatch3r-board-pickup` Step 6: consult learnings before implementation delegation.
 - During `hatch3r-board-fill` Step 4: consult learnings when scoping and estimating issues.
-- During `hatch3r-board-groom` Step 4c: consult learnings when re-scoping or reclassifying existing issues.
+- During the `hatch3r-board-groom` skill (Step 4c): consult learnings when re-scoping or reclassifying existing issues.
 - During any skill execution: check for relevant pitfalls before coding.
 
 ## Learning Priority
@@ -39,4 +39,4 @@ To avoid excessive token usage during consultation:
 1. **Scan frontmatter first.** Read only the YAML frontmatter (`tags`, `area`, `category`) of each learning file to determine relevance. Only read the full body of learnings that match the current task.
 2. **Limit surfaced learnings.** Present at most 5 relevant learnings per consultation. If more are relevant, prioritize by confidence level (high > medium > low) and recency.
 3. **Cache consultation results.** If consultation was already performed for this task (e.g., during board-pickup), do not re-consult during skill execution. The orchestrator passes relevant learnings to subagents as part of prompt enrichment.
-4. **Skip when empty.** If `.agents/learnings/` has fewer than 3 files, consultation overhead exceeds value. Skip silently.
+4. **Skip when empty.** If `.hatch3r/learnings/` has fewer than 3 files, consultation overhead exceeds value. Skip silently.

package/{rules → dist/content/rules}/hatch3r-learning-consult.mdc

@@ -1,15 +1,15 @@
 ---
-description: Consult .agents/learnings/ for pitfalls, patterns, and past decisions before implementation with frontmatter-first scan and priority ordering
-globs: ["**/.agents/learnings/**", "**/learnings/**"]
+description: Consult .hatch3r/learnings/ for pitfalls, patterns, and past decisions before implementation with frontmatter-first scan and priority ordering
+globs: ["**/.hatch3r/learnings/**", "**/learnings/**"]
 alwaysApply: false
 ---
 # Learning Consultation
 
-Before implementing any task, check `.agents/learnings/` for relevant past learnings.
+Before implementing any task, check `.hatch3r/learnings/` for relevant past learnings.
 
 ## Consultation Process
 
-1. If `.agents/learnings/` exists and contains files:
+1. If `.hatch3r/learnings/` exists and contains files:
    - Scan learning file frontmatter for matching `tags` or `area` that overlap with the current task.
    - Read the `## Applies When` section of potential matches.
    - Surface relevant learnings to the developer/agent before implementation begins.
@@ -19,7 +19,7 @@ Before implementing any task, check `.agents/learnings/` for relevant past learn
 
 - During `hatch3r-board-pickup` Step 6: consult learnings before implementation delegation.
 - During `hatch3r-board-fill` Step 4: consult learnings when scoping and estimating issues.
-- During `hatch3r-board-groom` Step 4c: consult learnings when re-scoping or reclassifying existing issues.
+- During the `hatch3r-board-groom` skill (Step 4c): consult learnings when re-scoping or reclassifying existing issues.
 - During any skill execution: check for relevant pitfalls before coding.
 
 ## Learning Priority
@@ -35,4 +35,4 @@ To avoid excessive token usage during consultation:
 1. **Scan frontmatter first.** Read only the YAML frontmatter (`tags`, `area`, `category`) of each learning file to determine relevance. Only read the full body of learnings that match the current task.
 2. **Limit surfaced learnings.** Present at most 5 relevant learnings per consultation. If more are relevant, prioritize by confidence level (high > medium > low) and recency.
 3. **Cache consultation results.** If consultation was already performed for this task (e.g., during board-pickup), do not re-consult during skill execution. The orchestrator passes relevant learnings to subagents as part of prompt enrichment.
-4. **Skip when empty.** If `.agents/learnings/` has fewer than 3 files, consultation overhead exceeds value. Skip silently.
+4. **Skip when empty.** If `.hatch3r/learnings/` has fewer than 3 files, consultation overhead exceeds value. Skip silently.

package/{rules → dist/content/rules}/hatch3r-migrations.md

@@ -3,7 +3,8 @@ id: hatch3r-migrations
 type: rule
 description: Database migration and schema change patterns — expand-contract, online DDL, backfills, compatibility windows, reversibility, multi-region, tooling
 scope: "**/migrations/**,**/*migration*,**/migrate/**,**/seeds/**,**/seeders/**,**/prisma/migrations/**,**/drizzle/**,**/knex/**"
-tags: [implementation, brownfield]
+tags: [implementation, ctx:brownfield-only]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-migrations.mdc

@@ -2,6 +2,7 @@
 description: Database migration and schema change patterns — expand-contract, online DDL, backfills, compatibility windows, reversibility, multi-region, tooling
 globs: ["**/migrations/**", "**/*migration*", "**/migrate/**", "**/seeds/**", "**/seeders/**", "**/prisma/migrations/**", "**/drizzle/**", "**/knex/**"]
 alwaysApply: false
+precedence: high
 ---
 # Migrations
 

package/{rules → dist/content/rules}/hatch3r-observability-logging.md

@@ -5,6 +5,7 @@ description: Structured logging and error reporting conventions for the project
 scope: conditional
 globs: "**/*log*,**/*logger*,**/*logging*,**/*error*,**/observability/**,**/routes/**,**/handlers/**,**/services/**,**/api/**,**/middleware/**,**/controllers/**,**/lib/**"
 tags: [devops]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-observability-logging.mdc

@@ -2,6 +2,7 @@
 description: Structured logging and error reporting conventions for the project
 globs: ["**/*log*", "**/*logger*", "**/*logging*", "**/*error*", "**/observability/**", "**/routes/**", "**/handlers/**", "**/services/**", "**/api/**", "**/middleware/**", "**/controllers/**", "**/lib/**"]
 alwaysApply: false
+precedence: high
 ---
 # Observability -- Logging & Error Reporting
 

package/{rules → dist/content/rules}/hatch3r-observability-metrics.md

@@ -5,6 +5,7 @@ description: Metrics, SLO/SLI definitions, alerting, and dashboard conventions f
 scope: conditional
 globs: "**/*metric*,**/*slo*,**/*sli*,**/*alert*,**/*dashboard*,**/observability/**,**/routes/**,**/handlers/**,**/services/**,**/api/**,**/middleware/**,**/controllers/**,**/lib/**"
 tags: [devops]
+precedence: high
 quality_charter: agents/shared/quality-charter.md
 cache_friendly: true
 ---

package/{rules → dist/content/rules}/hatch3r-observability-metrics.mdc

@@ -2,6 +2,7 @@
 description: Metrics, SLO/SLI definitions, alerting, and dashboard conventions for the project
 globs: ["**/*metric*", "**/*slo*", "**/*sli*", "**/*alert*", "**/*dashboard*", "**/observability/**", "**/routes/**", "**/handlers/**", "**/services/**", "**/api/**", "**/middleware/**", "**/controllers/**", "**/lib/**"]
 alwaysApply: false
+precedence: high
 ---
 # Observability -- Metrics, SLOs & Alerting