data-boar 1.7.4__tar.gz

data_boar-1.7.4/.cursor/hooks/adr-protection.ps1

@@ -0,0 +1,14 @@
+# beforeShellExecution hook - ADR file protection
+# G0-S - agent safety hardening 2026-05-21
+# Platform: Windows 11 + PowerShell
+param([string]$Command = "")
+
+if ($Command -match "git\s+(add|commit|stage)") {
+    $staged = git diff --cached --name-only 2>$null | Where-Object { $_ -match "docs/adr/ADR-.*\.md" }
+    if ($staged) {
+        Write-Error "BLOCKED [G0-S]: commit includes ADR file: $($staged[0])"
+        Write-Error "ADR modification requires explicit operator authorization (ADR-0056)."
+        exit 1
+    }
+}
+exit 0

data_boar-1.7.4/.cursor/hooks/pre-commit

@@ -0,0 +1,10 @@
+#!/bin/sh
+# pre-commit hook — defense-in-depth (git level, Git Bash on Windows)
+# G0·S — agent safety hardening 2026-05-21
+STAGED_ADRS=$(git diff --cached --name-only | grep "docs/adr/ADR-.*\.md")
+if [ -n "$STAGED_ADRS" ]; then
+  echo "BLOCKED [G0·S]: commit includes ADR file(s): $STAGED_ADRS"
+  echo "ADR modification requires explicit operator authorization (ADR-0056)."
+  exit 1
+fi
+exit 0

data_boar-1.7.4/.cursor/hooks.json

@@ -0,0 +1,10 @@
+{
+  "version": 1,
+  "hooks": {
+    "beforeShellExecution": [
+      {
+        "command": "powershell.exe -NoProfile -ExecutionPolicy Bypass -File .cursor/hooks/adr-protection.ps1"
+      }
+    ]
+  }
+}

data_boar-1.7.4/.cursor/mcp.json

@@ -0,0 +1 @@
+{"mcpServers":{"MCP_DOCKER":{"command":"docker","args":["mcp","gateway","run"],"env":{"LOCALAPPDATA":"C:\\Users\\<username>\\AppData\\Local","ProgramData":"C:\\ProgramData","ProgramFiles":"C:\\Program Files"}}}}

data_boar-1.7.4/.cursor/rules/adr-inventory-ritual.mdc

@@ -0,0 +1,27 @@
+---
+description: After any docs/adr ADR-*.md change, regenerate INVENTORY.txt via inv-adr.ps1 in the same PR.
+globs:
+  - docs/adr/**
+alwaysApply: false
+---
+
+# ADR inventory ritual
+
+## When this applies
+
+Any edit under **`docs/adr/`** that adds, renames, or changes **`ADR-*.md`**.
+
+## Required steps
+
+1. Run **`.\scripts\inv-adr.ps1`** from repo root (or rely on **`new-adr.ps1`**, which invokes it after scaffold).
+2. Stage **`docs/adr/INVENTORY.txt`** in the **same commit/PR** as the ADR change.
+3. Optional operator attestation: **`ssh-keygen -Y sign -f <key> -n file docs/adr/INVENTORY.txt`** and commit **`INVENTORY.txt.sig`** when publishing evidence.
+
+## Agent guardrail
+
+- **Do not** merge a PR that changes **`ADR-*.md`** without an updated **`INVENTORY.txt`**.
+- If pytest **`test_adr_inventory_sync`** fails, regenerate inventory before push.
+
+## Canonical decision
+
+**[ADR-0056](../../docs/adr/ADR-0056-cryptographic-adr-inventory-inv-adr-ssh-attestation.md)**

data_boar-1.7.4/.cursor/rules/adr-trigger.mdc

@@ -0,0 +1,112 @@
+# ADR trigger — when to create an Architecture Decision Record
+
+## Rule (always-on)
+
+After **any** session where one or more of the triggers below occurs, **create or propose an ADR before closing the session**.
+Do not wait for the operator to ask. If unsure whether a decision qualifies, err on the side of creating a short ADR — a brief record is better than silence.
+
+Use `.\scripts\new-adr.ps1 -Title "short-kebab-title" -Summary "one-liner"` to scaffold.
+
+---
+
+## Trigger categories
+
+### 1. Tooling / runtime choice
+A specific tool, library, runtime, or vendor was chosen **over alternatives**:
+- Container runtime: Docker CE, Podman, k3s, docker.io, Colima...
+- Package manager: uv over pip/poetry/conda
+- Export format: pandoc over LibreOffice/Word
+- CI provider, branch strategy, release tool
+- Database engine for dev/lab (MariaDB vs PostgreSQL vs SQLite)
+- Monitoring agent (Wazuh vs Falco vs auditd)
+
+### 2. Architecture / structure
+A **structural pattern** was established or changed:
+- Where configuration lives (Ansible roles vs shell scripts vs manual)
+- How docs are segmented by audience (external vs internal vs secrets-only)
+- How private vs public information is separated (gitignored `docs/private/`)
+- Module boundaries, plugin interfaces, or connector patterns in Data Boar
+- Directory/repo layout decisions (ops/ vs scripts/ vs docs/)
+
+### 3. Security / compliance posture
+A security-relevant decision that must not be silently undone:
+- IP assignment protection (prior-art declarations before employment)
+- Key management patterns (Bitwarden, session env vars, never in commits)
+- Data sovereignty choices (no cloud APM to avoid LGPD surface)
+- Secure Boot + TPM stance, LUKS choices, Clevis TPM binding
+- Supply chain pins (GitHub Actions SHA pinning — already ADR 0005)
+
+### 4. Process / workflow lock-in
+A process was formalised in a way that future contributors must not circumvent:
+- "synthetic data corpus before real client data" (ADR 0007)
+- "external-tier docs must not link into plans/" (ADR 0004)
+- "Ansible roles win over manual steps" (ADR 0009)
+- Testing gates, pre-commit hooks added for a specific reason
+- PR merge policy or branch strategy
+
+### 5. Deferral with explicit reason
+A decision was **explicitly deferred** and should be documented so future sessions know:
+- "We chose X now; Y is deferred because of cost/complexity/dependency"
+- "Legal counsel on IP was deferred to post-revenue stage" (part of ADR 0010)
+- Plan sequencing choices (why one feature precedes another)
+
+---
+
+## What does NOT need an ADR
+
+- Routine bug fixes with no architectural implication
+- Adding a new file to an established pattern (e.g., new Ansible role for a tool already in the stack)
+- Docs-only updates that do not change structure or policy
+- Config value tweaks (e.g., changing a timeout from 30s to 60s)
+- Private/gitignored operational notes (go into `docs/private/`, not ADR)
+
+---
+
+## Format (MADR-style, English, one or two screens)
+
+```markdown
+# ADR NNNN: Short descriptive title
+
+**Status:** Accepted | Proposed | Deprecated | Superseded by ADRNNN
+**Date:** YYYY-MM-DD
+
+## Context
+[What situation forced this decision? What alternatives existed?]
+
+## Decision
+[What was chosen and why? Numbered list of specific choices made.]
+
+## Consequences
+[Positive, negative, and watch items.]
+
+## References
+[Docs, plans, rules, scripts that implement or document the decision.]
+```
+
+---
+
+## Numbering
+
+- Next ADR number: check `docs/adr/` — `ls docs/adr/*.md | sort` → take max + 1
+- Filename: `NNNN-short-kebab-title.md` (stable after merge — do not rename)
+- Language: **English only** (canonical); no pt-BR twin for numbered ADR files
+- After creating: update `docs/adr/README.md` index table
+
+---
+
+## Automation
+
+`.\scripts\new-adr.ps1 -Title "my-decision-title" -Summary "One-line summary"`:
+- Detects next number automatically
+- Creates the file from template with correct header
+- Prints the path for the operator to open and fill in
+
+---
+
+## Session habit (agent checklist)
+
+At the end of any session where a trigger fires:
+1. List candidate decisions in chat (one line each)
+2. For each: `new-adr.ps1 -Title ... -Summary ...` → fill Context/Decision/Consequences
+3. Update `docs/adr/README.md` index
+4. Commit as `docs(adr): add ADR NNNN — short title`

data_boar-1.7.4/.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc

@@ -0,0 +1,36 @@
+---
+description: When safe (CI green, mergeable, docs aligned), complete PR merge via scripts/ without asking permission; run LAB-OP SSH collection scripts from terminal; escalate on failures or regressions.
+alwaysApply: true
+---
+
+# Autonomous merge + LAB-OP (operator trust)
+
+## 1. GitHub PR merge (no permission ping when safe)
+
+When **all** hold:
+
+- `git fetch` + `gh pr view` show **OPEN**, **mergeable** (not CONFLICTING), and `gh pr checks` are **green** (or equivalent).
+- No **suspected regression** from the diff; **docs** relevant to the change are updated.
+- Operator has **not** asked for a **review pause** or **hold** on this PR.
+
+**Do:** run **`.\scripts\pr-merge-when-green.ps1 -PrNumber <N>`** from repo root (after `gh auth` works on the machine). Prefer **merge**; use **squash/rebase** only if repo convention or PR comment says so.
+
+**Do not** merge without checking **mergeable** + **checks**. **Do not** use `--admin` unless branch protection blocks merge and the operator explicitly authorizes.
+
+**Escalate (stop and ask)** when: checks fail/pending, conflicts, **mergeable UNKNOWN**, `gh` auth errors, or **any doubt** about regression / release impact.
+
+## 2. LAB-OP (SSH from the dev PC terminal — not “remote AI datacenter”)
+
+The assistant **does not** have a separate network to your LAN. It **does** have the same path as **`ssh`** in the **Cursor integrated terminal** on the **operator’s PC** (see **`homelab-ssh-via-terminal.mdc`**).
+
+When the task is **refresh inventory / homelab reports** and a manifest exists:
+
+**Do:** run **`.\scripts\lab-op-sync-and-collect.ps1`** (or **`.\scripts\collect-homelab-report-remote.ps1`** per host) after **`docs/private/homelab/lab-op-hosts.manifest.json`** is present (copy from **`lab-op-hosts.manifest.example.json`**). Then **`read_file`** the new log under **`docs/private/homelab/reports/`** and summarize deltas — **do not** paste raw LAN details into **tracked** files.
+
+**Escalate** when: SSH fails, `git pull` fails, manifest missing, or output suggests **host down** / **key** issues.
+
+**Lab completão (multi-host smoke):** When the operator asks for **completão** or session keyword **`completao`**, run **`.\scripts\lab-completao-orchestrate.ps1 -Privileged`** from repo root (unless they opt out), then read logs under **`docs/private/homelab/reports/`**. **May remediate** lab-op **deps**, **ports**, **firewall/VLAN/LSM** blockers with **least privilege** per **`lab-completao-workflow.mdc`**. Full contract: **`lab-completao-workflow.mdc`** and **`docs/ops/LAB_COMPLETAO_RUNBOOK.md`**. If **`sudo -n`** fails for privileged probes, **remind** the operator to align narrow sudoers / sessions and **re-run** — do not claim lack of LAN access.
+
+## 3. Truth vs wish
+
+If **`gh`**, **`ssh`**, or **`fping`** fails in-session, **report the error** — do not imply the merge or collection “completed” without a **zero exit code**.

data_boar-1.7.4/.cursor/rules/agent-docs-private-read-access.mdc

@@ -0,0 +1,29 @@
+---
+description: Agent must read docs/private/ when relevant; gitignore is not an access denial; never self-block.
+alwaysApply: true
+---
+
+# `docs/private/` — full agent read access
+
+## Policy
+
+- **`docs/private/`** is **gitignored from public Git** only. It is **operator workspace context** for the assistant on this machine.
+- The assistant **must** use **`read_file`** / list / search under **`docs/private/`** when the task involves homelab, security audits, hygiene audits, commercial notes, legal dossier, author info, **`social_drafts/`** (LinkedIn/X/FacColleague-Sok rascunhos em `.md`), or any other private subtree—**without** asking the operator to paste content or **`@`-mention** files to “unlock” them. Editing draft **text** in the workspace does **not** require a “warm” browser session; only **posting** to a third-party site is operator-side.
+- **Do not** claim that files are inaccessible **because** they are gitignored. If **`read_file`** fails, treat it as: wrong path, file not present in this worktree, or environment limitation—retry with absolute path or **`list_dir`**, then escalate only if still missing.
+
+## Never self-block
+
+- **Do not** refuse, skip, or defer work that depends on **`docs/private/`** out of “policy,” “privacy,” or “I cannot access gitignored files.” That is **incorrect** for this repo.
+- **Do not** substitute only generic advice when the answer requires private context—**read the private files first**, then answer; redact only when writing **back** to **tracked** public/collaborator-facing output.
+- **Audience:** follow **`.cursor/rules/audience-segmentation-docs.mdc`** and **`docs/PRIVATE_OPERATOR_NOTES.md`**: **public** GitHub docs stay free of PII/secrets; **collaborator** tier gets tracked repo only; **operator + assistant** sessions may use full **`docs/private/`** for decisions—never paste wholesale into issues/PRs/public Markdown.
+
+## Versioning (stacked private repo—not `origin`)
+
+- Private material is **never** pushed to the **GitHub** product remote; the operator may use **nested Git** (stacked private repo) under **`docs/private/`** for history, backup, and sync—see **`docs/ops/PRIVATE_LOCAL_VERSIONING.md`** and **`docs/PRIVATE_OPERATOR_NOTES.md`**. The assistant **reads** and **edits** there when asked; it does **not** replace the operator's private `git push` habits.
+
+## Still true
+
+- **Never** commit **`docs/private/`** contents to **`origin`** / **public GitHub**.
+- **Never** copy private specifics into **tracked** files, issues, or PRs without redaction.
+
+See **`AGENTS.md`** (first bullets) and **`docs/PRIVATE_OPERATOR_NOTES.md`** §1.

data_boar-1.7.4/.cursor/rules/agent-roles-executor-vs-auditor.mdc

@@ -0,0 +1,52 @@
+---
+description: AI executor vs auditor role contract (Cursor = executor, Claude Code = read-only auditor)
+alwaysApply: true
+---
+# Agent roles — executor vs auditor (AI axis)
+
+This rule adds the **AI executor x auditor** axis to the project governance model.
+It complements (does not replace) `.cursor/rules/collaboration-maintainer-contributor.mdc`,
+which covers the **human** maintainer x contributor axis.
+
+## Cursor — executor + cognitive support
+
+- **Role:** primary execution agent for this repo.
+- **Capabilities:** writes code, edits docs, runs scripts, stages files, commits, opens and
+  merges PRs, calls browser/homelab/MCP tools — under operator governance.
+- **Constraints:** all non-negotiable rules in `AGENTS.md` and `.cursor/rules/` apply:
+  PII policy, commercial confidentiality, ADR governance, cross-platform guard rails,
+  pre-commit hooks, CI gates. Writes and commits only inside these agreed patterns.
+
+## Claude Code (and any other read-only model the operator adds) — auditor
+
+- **Role:** read-only reasoning, review, and audit agent.
+- **Scope:** reads repo files, analyzes content, reasons about design, audits compliance.
+  **Does not write or commit to the repo.**
+- **Output path (how to deliver findings):**
+  - `gh issue create` — structured issues with context for the Cursor executor to implement.
+  - `gh issue comment` — commentary on existing issues.
+  - Prompts delivered to Cursor in the operator's chat for execution.
+- **Rationale:** a single write path (Cursor) keeps governance hooks intact — pre-commit,
+  ADR protection, PII guards, PII seed gate, audit trail, signed commits. A second write
+  agent would either bypass those hooks or replicate them inconsistently.
+- **Cross-vendor (ADR-0062, #991):** Auditors must span **different vendors** for gate/security
+  sign-off; same-vendor dual-audit is harness diversity only. Pin model IDs — never Auto.
+  Illustrative roster: **C** Claude Code, **A** claude.ai, **B** Sonnet/lab, **G** Gemini/NotebookLM;
+  **O** OpenAI slot is still a gap for full triangulation.
+
+## Anti-patterns to avoid
+
+- Claude Code must **not** `git commit`, `git push`, or write tracked files directly.
+- Cursor must **not** defer write work to Claude Code as if it were a co-executor.
+- Neither agent replaces the **human operator** for merge approvals, secret management,
+  or high-blast-radius decisions (history rewrite, live publish, destructive ops).
+- An auditor agent that encounters a security finding must create a **`[U0]`-tagged issue**
+  and alert the operator — it must not attempt a silent fix.
+
+## Canonical references
+
+- `CLAUDE.md` at the repo root — cold-start pointer for Claude Code sessions.
+- [ADR-0062](../../docs/adr/ADR-0062-agent-containment-triple-audit-offband-pingpong.md) — A.I.I.D.C.O.B.P.P.; cross-vendor mandate (#991)
+- `AGENTS.md` *Maintainer + contributor* bullet — human axis (maintainer x contributor).
+- `AGENTS.md` *Quick index* — maps this rule from the "Agent roles" row.
+- `.cursor/rules/collaboration-maintainer-contributor.mdc` — human axis contract.

data_boar-1.7.4/.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc

@@ -0,0 +1,45 @@
+---
+description: Start sessions with git fetch/status; pull main when behind; integrate origin/main on feature branches; private-git-sync after meaningful docs/private changes; next steps without redundant asks; sidequest exception; protect canonical primary dev clone.
+alwaysApply: true
+---
+
+# Agent session ritual — synced `main`, private stack, next steps
+
+## Calendar / “today” (operator workstation — not the model’s clock)
+
+When you need **which calendar day** matters (today-mode checklist path, dated drafts, “this morning”, release timing):
+
+1. **Do not** rely only on IDE **User** / chat **“Today’s date”** fields — they can be **wrong or stale** for the real session.
+2. On **Windows** (typical for this repo’s dev PC), run in the **integrated terminal**: **`Get-Date -Format "yyyy-MM-dd"`** (PowerShell) or **`date /t`** (cmd). Use that string to pick **`docs/ops/today-mode/OPERATOR_TODAY_MODE_YYYY-MM-DD.md`** unless the operator fixes the date in chat.
+3. On **Linux/macOS** shells, use **`date -I`** or **`date "+%Y-%m-%d"`** the same way.
+
+Canonical prose: **`AGENTS.md`** (*Workstation calendar clock*), **`docs/ops/today-mode/README.md`** (*For assistants*). **Condensed cold-start ladder (token-aware / fresh chat):** **[`docs/ops/OPERATOR_AGENT_COLD_START_LADDER.md`](../../docs/ops/OPERATOR_AGENT_COLD_START_LADDER.md)** ([pt-BR](../../docs/ops/OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md)) — read before re-loading the entire **`AGENTS.md`** table when context is empty.
+
+## Public repo (`origin`)
+
+1. Before **substantive** edits: run **`git fetch origin`** and **`git status -sb`** in the integrated terminal (or rely on fresh output from the same session).
+2. On **`main`**: if behind **`origin/main`**, **`git pull origin main`** before building on a stale base.
+3. On a **feature branch**: **`git fetch`**; integrate **`origin/main`** when the branch is stale or before opening/updating a PR (**merge** or **rebase** per repo habit).
+4. Do **not** give merge advice, PR numbers, or “what’s next” without this refresh—see **`git-pr-sync-before-advice.mdc`**.
+
+## Canonical workstation (primary dev PC — not a cloud hop)
+
+- Do **not** run destructive repo history ops on the canonical clone from routine sessions (**`primary-windows-workstation-protected-no-destructive-repo-ops.mdc`**, **`docs/ops/PRIMARY_WINDOWS_WORKSTATION_PROTECTION.md`**).
+
+## Sidequests
+
+- Exploratory **`sidequest`** branches may be abandoned if impractical; document **stop condition** and **resume pointer** (session keywords).
+
+## Stacked private Git (`docs/private/`)
+
+- After meaningful changes under **`docs/private/`**, run **`scripts/private-git-sync.ps1`** from repo root; use **`-Push`** when the operator’s policy or request includes **non-GitHub mirrors** (configured **`lab-*`** remotes **and**, on Windows, a **bare `notes-sync.git` on the VeraCrypt-mounted drive** when that path exists — the script probes **`Z:`** first (operator default), then **`Y:`** fallback). **Do not** stop after lab pushes if another mirror is mounted and still behind. See **`docs/ops/PRIVATE_STACK_SYNC_RITUAL.md`**, **`operator-evidence-backup-no-rhetorical-asks.mdc`**, **[ADR 0040](../../docs/adr/ADR-0040-assistant-private-stack-evidence-mirrors-default.md)**, keyword **`private-stack-sync`**.
+
+## PR / merge (when it makes sense — not every commit)
+
+- **Sync + local commits** preserve history on the canonical clone; **PR + merge** are for slices **worth** review/CI on GitHub.
+- **Do not** spiral: open PR → CI nit → merge → pull → another PR for the next typo in the same breath. **Batch** fixes; **one** PR per coherent slice when possible (**`execution-priority-and-pr-batching.mdc`**).
+- Merge when green per **`agent-autonomous-merge-and-lab-ops.mdc`** only when the PR is the right integration step—not a reflex.
+
+## Canonical prose
+
+- Root **`AGENTS.md`** — bullets *Assistant session ritual* and *Assistant session closure*.

data_boar-1.7.4/.cursor/rules/api-routes-plan-matrix-sync.mdc

@@ -0,0 +1,22 @@
+---
+description: When changing api/routes.py HTTP routes, update PLAN_DASHBOARD_REPORTS_ACCESS_CONTROL Phase 0 table and tests/test_api_route_matrix_plan_sync.py in the same PR.
+globs: ["api/routes.py", "docs/plans/PLAN_DASHBOARD_REPORTS_ACCESS_CONTROL.md", "tests/test_api_route_matrix_plan_sync.py"]
+alwaysApply: false
+---
+
+# API routes ↔ D-WEB plan matrix
+
+## Rule
+
+Any PR that **adds, removes, or renames** a FastAPI route in **`api/routes.py`** must **in the same PR**:
+
+1. Update the **§ Phase 0 deliverable — HTTP routes** table in **`docs/plans/PLAN_DASHBOARD_REPORTS_ACCESS_CONTROL.md`** (and middleware subsection if order changes).
+1. Update **`EXPECTED_HTTP_ROUTES`** in **`tests/test_api_route_matrix_plan_sync.py`** so CI stays green.
+
+## Optional micro-PR
+
+If a route change is already merged, a **follow-up PR** may only refresh the plan table + test tuple — no product code — to restore sync.
+
+## See also
+
+**`.cursor/rules/plans-status-pl-sync.mdc`** (plan header vs `PLANS_TODO.md`).

data_boar-1.7.4/.cursor/rules/ats-locale-aware-recommendations.mdc

@@ -0,0 +1,28 @@
+---
+description: Talent ATS / LinkedIn recommendations must match candidate target locale and jurisdiction (en_CA+PIPEDA for Canada, not default GDPR); verify certification pricing in local currency
+globs: ["**/*"]
+alwaysApply: true
+---
+
+# ATS / talent recommendations — locale and jurisdiction
+
+## When this applies
+
+Any **talent-ats** output, **LinkedIn/ATS recommendation** for pool candidates, or **ATS_SLI_RECOMMENDATIONS_*.md** draft for a **named geography**.
+
+## Rules
+
+1. **Anchor language** to the candidate’s **target job market** (e.g. **en_CA** for Canada — not generic `en`, **en_UK**, or **en_US** unless that is the stated target).
+2. **Privacy / data protection framing:**
+   - **Canada:** lead with **PIPEDA** and relevant **provincial** laws; note **Bill C-27** / CPPA trajectory where useful; treat **GDPR** as supplementary when the role involves **EU data** or explicit employer ask — **not** as the default Canadian market vocabulary.
+   - **EU/UK:** **GDPR** / **UK GDPR** as appropriate.
+   - **Brazil:** **LGPD** (pt-BR narrative).
+   - **US:** sectoral + **state** privacy laws when relevant.
+3. **Certifications:** If the issuer is **US-based** (e.g. **SCCE** for **CCEP**), **do not** assume one global price — direct the candidate to **official** pricing for **Canada** (**CAD**), **test centres**, **taxes**, and **chapter** discounts; mention **USD** only as a **separate** scenario (e.g. exam in the United States).
+4. **Uncertainty:** Say **verify on the issuer’s site** instead of inventing fees or eligibility.
+
+## Canonical references
+
+- **`docs/ops/LINKEDIN_ATS_PLAYBOOK.md`** section **8** (EN) / **`.pt_BR.md`** (pt-BR).
+- **`.cursor/skills/candidate-ats-evaluation/SKILL.md`** — Locale subsection.
+- Session keyword **`talent-ats`** in **`.cursor/rules/session-mode-keywords.mdc`**.

data_boar-1.7.4/.cursor/rules/audience-segmentation-docs.mdc

@@ -0,0 +1,47 @@
+---
+description: Audience segmentation for docs navigation and link boundaries (external vs internal vs private-secrets)
+alwaysApply: true
+---
+
+# Audience segmentation guardrail (docs and training materials)
+
+Use these audience buckets when editing docs, README sections, and training/disclosure material:
+
+1. **External audience**
+
+   Stakeholders, decision-makers, and enterprise teams (IT, cybersecurity, compliance, DPO, legal) evaluating or operating Data Boar.
+
+1. **Technical integrators**
+
+   Engineers deploying, configuring, and extending the product (USAGE, TECH_GUIDE, connectors, API) without maintainer PMO context.
+
+1. **Internal project audience**
+
+   Operator, assistant, maintainers, collaborators, and reviewers working on project internals.
+
+1. **Secrets-access audience**
+
+   Strictly operator + assistant; includes private operational notes and secret-bearing workflows.
+
+## Planning vs product documentation (segregation)
+
+- **Plans stay public in-tree** (`docs/plans/`, `docs/plans/completed/`, optional `.cursor/plans/`) for transparency and contributor access, but **must not be one-click navigation targets** from **external** or **integrator** documentation.
+- **Deliberate entry point:** The **Internal and reference** section of **[docs/README.md](../../docs/README.md)** (and **README.pt_BR.md**) lists plan files for maintainers and collaborators. **`docs/plans/PLANS_HUB.md`** is the in-tree **table of all plans** (summaries + related-plan hints); keep it in sync via **`scripts/plans_hub_sync.py`**. Prefer pointing there (or plain-text paths like `` `docs/plans/` ``) instead of deep-linking `PLAN_*.md` from compliance, legal, pitch, or primary product guides.
+- **Where plan links are OK:** **`docs/ops/`** runbooks, **`docs/plans/`** itself, **`docs/README.md`** / **README.pt_BR.md** internal tables, **CONTRIBUTING**, **AGENTS** when describing workflow, and **gitignored** `docs/private/` (never in tracked pages).
+- **Prefer instead of plan URLs:** **USAGE**, **TECH_GUIDE**, **COMPLIANCE_***, **SECURITY**, **releases/**, **SENSITIVITY_DETECTION**, **MINOR_DETECTION**, and **[README.md](../../docs/README.md)** index rows.
+- **Automation:** **`tests/test_docs_external_no_plan_links.py`** fails CI/pre-commit if a tracked **external-tier** Markdown file contains markdown links whose targets include `plans/` or `.cursor/plans`. Excluded from that scan: **`docs/ops/`**, **`docs/plans/`**, **`docs/adr/`**, **`docs/private/`**, **`docs/README*.md`** (hub), **`docs/COLLABORATION_TEAM*.md`**, **root `CONTRIBUTING*.md`**, **`AGENTS.md`**, and other **root policy** files listed in the test module.
+- **Architecture record:** **[ADR 0004](../../docs/adr/ADR-0004-external-docs-no-markdown-links-to-plans.md)** — information architecture decision (why external-tier surfaces stay separate from plan hyperlinks).
+
+## Link and visibility rules (summary)
+
+- Keep current protections for `docs/private/` and existing restricted paths unchanged.
+- External-facing sections (e.g. README pitch, compliance/legal overview) should prefer links to public product docs (USAGE, TECH_GUIDE, COMPLIANCE_*, TESTING, SECURITY, GLOSSARY).
+- Avoid adding links from external-facing sections to internal-operational planning/control material (for example: `docs/plans/` deep links, CI/pipeline control docs, internal review-tracking files) except via the **docs/README** hub or **ops** runbooks as above.
+- Internal docs may link to `docs/ops/`, `docs/plans/`, `docs/releases/`, `docs/private.example/`, and review-feedback folders when useful.
+- Secrets-only details remain in gitignored private docs and must never be exposed in tracked public pages.
+
+## Language and source-of-truth constraints
+
+- Product/user docs are authored from code truth in English first, then synced to pt-BR.
+- Respect lint/locale rules; avoid pt-PT forms in pt-BR docs.
+- Keep edits minimal and natural when removing boundary-crossing links.

data_boar-1.7.4/.cursor/rules/check-all-gate.mdc

@@ -0,0 +1,44 @@
+---
+description: Use repo automation scripts for lint/tests (token-aware)
+globs: ["**/*"]
+alwaysApply: true
+---
+
+# Automation scripts (token-aware)
+
+**Prefer existing scripts over ad-hoc commands** when it saves tokens or time.
+
+| When                                              | Script                                                                                                                                                                                                                             | Example                                                                                                                                                                                                                                                                                                                                                                             |
+| ------                                            | --------                                                                                                                                                                                                                           | --------                                                                                                                                                                                                                                                                                                                                                                            |
+| Full gate (lint + tests)                          | `.\scripts\check-all.ps1` (Windows) or `./scripts/check-all.sh` (Linux / macOS)                                                                                                                                                    | Before commit/PR                                                                                                                                                                                                                                                                                                                                                                    |
+| Quick iterations (tests only)                     | `.\scripts\check-all.ps1 -SkipPreCommit` or `./scripts/check-all.sh --skip-pre-commit`                                                                                                                                            | After code change                                                                                                                                                                                                                                                                                                                                                                   |
+| Lint/format only (no pytest)                      | `.\scripts\lint-only.ps1` or `./scripts/lint-only.sh`                                                                                                                                                                               | After docs/templates/style change — runs **`pre-commit run --all-files`** (Ruff, plans-stats, plans-hub, markdown, pt-BR, commercial guard, external plan links)                                                                                                                                                                                                                    |
+| Subset of tests                                   | `.\scripts\quick-test.ps1 -Path tests/test_foo.py` or `-Keyword "content_type"` · `./scripts/quick-test.sh --path …` / `--keyword …`                                                                                                  | When iterating on one area                                                                                                                                                                                                                                                                                                                                                          |
+| **`.github/workflows/` YAML edits**               | `.\scripts\quick-test.ps1 -Path tests/test_github_workflows.py` · `./scripts/quick-test.sh --path tests/test_github_workflows.py`                                                                                                   | Same module runs inside full **`check-all`** / **`ci.yml`** (`uv run pytest`); guards Slack webhook step pattern, Action SHA pins, `ci.yml` lint = **`pre-commit run --all-files`**. See **`docs/TESTING.md`**, **`docs/ops/OPERATOR_NOTIFICATION_CHANNELS.md`** §4.1.1, **ADR 0005**.                                                                                                 |
+| Pre-commit + full pytest (no gatekeeper)          | `.\scripts\pre-commit-and-tests.ps1` or `./scripts/pre-commit-and-tests.sh`                                                                                                                                                         | Same intent as inner step of **`check-all`**; see **`docs/ops/SCRIPTS_CROSS_PLATFORM_PAIRING.md`**                                                                                                                                                                                                                                                                                    |
+| Windows: filename search (Everything)             | `.\scripts\es-find.ps1 -Query "*.md" -MaxCount 40` (repo scope); add `-Global` for full index; `-Help` for usage                                                                                                                                      | **Default** = **`es-find.ps1`** / **`es.exe`**; if **`es`** fails, **notify operator** then **`-FallbackPowerShell`** or scoped **`Get-ChildItem`**. When **Glob** is heavy or paths are **outside** the repo; **not** for file **content** (use **`repo-grep`** / **`rg`**). **L-series** only — not **Linux lab-op**. **`docs/ops/EVERYTHING_ES_PRIMARY_WINDOWS_DEV_LAB.md`**; session **`es-find`**. **`.cursor/rules/everything-es-cli.mdc`**.                                                                                                                                                       |
+| Windows: content search (capped transcript)       | `.\scripts\repo-grep.ps1 -Pattern "TODO" -Path . -MaxOutputLines 200`                                                                                                                                                                                  | **Default** over long **`Select-String`** walks; prefers **`rg`**, optional **`baregrep`** (`-PreferBareGrep`, also **`Downloads`**). **`docs/ops/WINDOWS_FAST_CLI_WRAPPERS.md`**. **`.cursor/rules/repo-scripts-wrapper-ritual.mdc`**.                                                                                                                                                                                                                |
+| Windows: tail / preview                             | `.\scripts\repo-tail.ps1 -Path .\CHANGELOG.md -Lines 60` · `.\scripts\repo-view.ps1 -Path .\README.md -MaxLines 120`                                                                                                                                 | Git **`tail.exe`** / **`bat`** when installed; hints if **BareTail** portable exists. **`WINDOWS_FAST_CLI_WRAPPERS.md`**.                                                                                                                                                                                                                                                              |
+| Doc-bundle recovery (post-`cat` / copy mess)      | `.\scripts\recovery-doc-bundle-sanity.ps1` (optional `-BundlePath`, `-Headerless`); **loose files in `final_round_bucket`:** `uv run python scripts/build_final_round_bucket_concat.py` (`--map-names`, `--sweep`, `--quiet-gaps`) | Heuristic forensics only — **not** a substitute for `check-all`. Narrative: **`docs/ops/DOC_BUNDLE_RECOVERY_PLAYBOOK.md`**.                                                                                                                                                                                                                                                         |
+| Day boundary (**carryover-sweep** / **eod-sync**) | `.\scripts\operator-day-ritual.ps1 -Mode Morning` / `-Mode Eod`                                                                                                                                                                    | Session tokens in **`.cursor/rules/session-mode-keywords.mdc`**; git/gh path hints, not a substitute for `check-all`.                                                                                                                                                                                                                                                               |
+| PII fresh-clone self-audit (Windows)              | `.\scripts\pii-fresh-clone-audit.ps1` (optional `-IncludeTalentGuards`, `-KeepClone`)                                                                                                                                                | Not `check-all`; validates **public** clone + full-history guard; **temp-only** (primary-dev-workstation-safe). See **`docs/ops/PII_FRESH_CLONE_AUDIT.md`**, **`PRIMARY_WINDOWS_WORKSTATION_PROTECTION.md`**. Session **`pii-fresh-audit`**.                                                                                                                                                                       |
+| **Commit / PR**                                   | `.\scripts\commit-or-pr.ps1`                                                                                                                                                                                                       | When user asks to commit, push, or create a PR: use Preview first to see files and propose title/body, then `-Action Commit` or `-Action PR -RunTests`. Prefer `.\scripts\preview-commit.ps1` for preview-only; for PR with multi-line body use a one-off .ps1 that sets `$Title`/`$Body` and calls commit-or-pr.ps1, or `.\scripts\create-pr.ps1 -Title "..." -BodyFilePath path`. |
+
+**Full workflow (check → pre-commit → commit → describe → safe synced PR)** — use in this order to save tokens and keep one source of truth:
+
+1. **Check + pre-commit:** `.\scripts\check-all.ps1` or `./scripts/check-all.sh` (Ruff, format, markdown, pytest in one run).
+1. **Preview:** `.\scripts\preview-commit.ps1` to see files and diff; propose a short title and bullet body.
+1. **Commit + describe + PR:** `.\scripts\commit-or-pr.ps1 -Action PR -Title "..." -Body "..." -RunTests` (or `.\scripts\create-pr.ps1 -Title "..." -BodyFilePath path` / one-off .ps1 for long body). This commits, runs tests again, fetch+rebase if behind, push, open PR.
+
+**Merge-ready slice (operator expectation):** When work is clearly ready to land (tests/docs committed, no open blocker), **run `check-all`**, then merge to `main` and **`git push origin main`** (or open/update PR) **without** asking permission to run the standard gate — the gate is the default safety step, not a decision point.
+
+Avoid raw `pytest`/`ruff` invocations when a script covers the need; scripts keep behaviour consistent and reduce back-and-forth. For **commit, description, push, and PR**, prefer the commit-or-pr workflow (and helpers) over ad-hoc `git add`/`git commit`/`git push` so behaviour is consistent and tokens are saved. See `.cursor/skills/token-aware-automation/SKILL.md` for when to use which.
+
+## Proactive automation policy (regression + token savings)
+
+- If a bug/risk was fixed, ask: **can we encode this in a test or script gate?**
+- Prefer adding/updating:
+- a **targeted pytest** (fast, deterministic),
+- a **script wrapper** under `scripts/` for repeated operator flow,
+- or a **pre-commit/CI guard** for high-value checks.
+- Goal: avoid reintroducing solved issues and reduce repeated ad-hoc command sequences over time.

data_boar-1.7.4/.cursor/rules/clean-slate-pii-self-audit.mdc

@@ -0,0 +1,34 @@
+---
+description: Where clean-slate lives, how it fits PII self-audit vs filter-repo; assistants must not simulate runs — use real guards or point to PII guide H.9–H.10; primary Windows dev PC never runs destructive clean-slate / rewrite
+globs: ["**/*"]
+alwaysApply: true
+---
+
+# `clean-slate` + PII — memory hook (no simulation)
+
+## primary Windows dev PC (primary dev workstation)
+
+- **Never** run **`clean-slate.sh`**-class destructive reset or **`run-pii-history-rewrite.ps1`** on **L-series** — **`primary-windows-workstation-protected-no-destructive-repo-ops.mdc`**, **`docs/ops/PRIMARY_WINDOWS_WORKSTATION_PROTECTION.md`**.
+- Temp-only Windows audits (**`pii-fresh-clone-audit.ps1`**, **`new-b2-verify.ps1`**) are **not** clean-slate; they only use **`%TEMP%`**.
+
+## What exists (tracked vs private)
+
+- **Template (tracked):** `docs/private.example/scripts/clean-slate.sh.example` — copy to **`docs/private/scripts/clean-slate.sh`** (private git only). See **`docs/private.example/scripts/README.md`**.
+- **Canonical runbook:** **`docs/ops/PII_PUBLIC_TREE_OPERATOR_GUIDE.md`** — **H.9** (how to run on Linux lab), **H.10** (what assistants/operators should remember).
+
+## Purpose
+
+- **Self-audit / validation:** After a **destructive** re-clone, run **`uv run python scripts/pii_history_guard.py --full-history`** and **`uv run pytest tests/test_pii_guard.py`** (plus private seed greps per the guide) to see if policy matches a **fresh** tree.
+- **Windows:** **`scripts/pii-fresh-clone-audit.ps1`** automates **new empty folder** + full `git clone` + `uv sync` + same guards — see **`docs/ops/PII_FRESH_CLONE_AUDIT.md`**. Manual equivalent: empty folder + `git clone` + commands from the PII guide Section D.
+
+## What it is *not*
+
+- **Not** `git filter-repo` / history rewrite — see **`scripts/run-pii-history-rewrite.ps1`** and Part II of the same guide.
+- **Not** something to “simulate” in chat. Do **not** claim clean-slate ran without a real terminal clone/reset.
+
+## When the operator asks “did the improvements suffice?”
+
+1. Run **`pii_history_guard.py --full-history`** and **`pytest tests/test_pii_guard.py`** on the **real** workspace when possible.
+2. Remind that periodic **fresh clone** (or `~/clean-slate.sh` on Linux lab) is the stronger check for **long-lived** working trees — **H.10**.
+
+Repeat real guard runs / fresh clones as often as needed after changing guards, seeds, or replacement rules — that loop is valid; fake repetition in chat is not.

data_boar-1.7.4/.cursor/rules/cloud-agents-token-aware-safety.mdc

@@ -0,0 +1,71 @@
+# Cloud Agents / Cursor Web — token-aware + safety guardrails
+
+## Purpose
+
+Use Cloud Agents as a **toil offload** and **reproducible sandbox**, not as a replacement for:
+
+- LAB-OP (operator LAN via SSH),
+- `docs/private/` / `P:` workflows,
+- or secret-bearing operations.
+
+## Default stance (token-aware)
+
+- Prefer **light gates** by default:
+  - `uv sync`
+  - `uv run pre-commit run --all-files`
+  - a **targeted** `pytest` subset only when needed
+- Avoid running heavy gates on every refresh:
+  - `.\scripts\check-all.ps1` is for **pre-PR / pre-merge / pre-release** moments.
+
+## Environment limitations (avoid false positives/negatives)
+
+Cloud Agents may differ from the operator workstation:
+
+- OS (Linux vs Windows), shells (bash vs PowerShell), and available system packages
+- no access to operator LAN / homelab SSH targets (unless explicitly bridged)
+- no access to `docs/private/` values (gitignored) unless explicitly provided
+
+Treat failures as **signal to investigate**, not as proof of regression until reproduced in the right environment.
+
+## Secrets and sensitive data (hard rule)
+
+- Never put secrets in:
+  - update/setup scripts
+  - committed files
+  - PR descriptions
+- If a task requires secrets, use:
+  - CI secret store / environment variables
+  - or operator-controlled manual steps documented in `docs/private/`
+
+## Recommended “Update Script” (minimal)
+
+Use scripts as the repo’s “API” where possible.
+
+### Minimal refresh (default)
+
+```bash
+uv sync
+uv run pre-commit run --all-files
+```
+
+### Add tests (only when needed)
+
+```bash
+uv sync
+uv run pre-commit run --all-files
+uv run pytest -q
+```
+
+## What Cloud Agents are good for
+
+- docs refactors, link fixes, markdown lint
+- Python refactors guarded by unit tests
+- pre-commit and CI-like checks in a clean sandbox
+- draft PR descriptions / summaries
+
+## What Cloud Agents should NOT do
+
+- LAB-OP SSH actions (unless explicitly requested to run via the operator workstation terminal)
+- any action that depends on private inventory values
+- any destructive actions (mass deletes, force pushes, infra changes) without explicit operator intent
+