From 888b648935aa19488286f50ed869904e323d0f8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?FabioLeit=C3=A3o?= Date: Fri, 3 Jul 2026 14:25:49 -0300 Subject: [PATCH] chore(cursor): Tier B situationalization wave (#1154) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Situationalize 14 workflow/rare rules (alwaysApply:false + globs/tokens); merge operator-chat-language into operator-chat-language-pt-br and persona-rigor into linguistic-rigor-and-performance; reframe workstation rules (main dev box + secondary, same rigor). Update SITUATIONALIZATION doc, policy hubs, session-mode-keywords latch, RULES_AND_SKILLS_HUB, and ADR-0048 cross-ref. Always-on: 36 → 18. Rollback: git revert this commit. Closes #1154 Gate-Change-Approved-By: Fabio Tavares Leitão --- .../agent-autonomous-merge-and-lab-ops.mdc | 9 +++- ...ion-ritual-sync-main-and-private-stack.mdc | 8 +++- .../ats-locale-aware-recommendations.mdc | 9 ++-- .cursor/rules/audience-segmentation-docs.mdc | 8 +++- .cursor/rules/clean-slate-pii-self-audit.mdc | 9 ++-- .../collaboration-maintainer-contributor.mdc | 8 ++-- .../cursor-browser-social-sso-hygiene.mdc | 7 ++- .../cursor-markdown-preview-guardrail.mdc | 7 ++- .cursor/rules/git-pr-sync-before-advice.mdc | 11 +++-- .../linguistic-rigor-and-performance.mdc | 22 ++++++--- .../rules/operator-browser-warm-session.mdc | 6 ++- .../rules/operator-career-private-layout.mdc | 7 ++- .../rules/operator-chat-language-pt-br.mdc | 12 +++-- .cursor/rules/operator-chat-language.mdc | 16 ------- ...tor-evidence-backup-no-rhetorical-asks.mdc | 6 ++- .cursor/rules/persona-rigor.mdc | 18 -------- .cursor/rules/pre-commit-ruff.mdc | 2 +- ...tion-protected-no-destructive-repo-ops.mdc | 4 +- ...tion-protected-no-destructive-repo-ops.mdc | 4 +- .cursor/rules/repo-scripts-wrapper-ritual.mdc | 9 ++-- .cursor/rules/session-mode-keywords.mdc | 2 +- .../linguistic-rigor-active-voice/SKILL.md | 4 +- CHANGELOG.md | 2 + ...xonomy-and-naming-contract-preservation.md | 2 +- docs/adr/INVENTORY.txt | 6 +-- docs/hubs/RULES_AND_SKILLS_HUB.md | 46 +++++++++---------- docs/hubs/RULES_AND_SKILLS_HUB.pt_BR.md | 2 +- docs/ops/CURSOR_AGENT_POLICY_HUB.md | 2 +- docs/ops/CURSOR_AGENT_POLICY_HUB.pt_BR.md | 2 +- .../CURSOR_RULES_PHASE2_SITUATIONALIZATION.md | 38 ++++++++++++++- ...R_RULES_PHASE2_SITUATIONALIZATION.pt_BR.md | 6 ++- tests/test_no_legacy_cursorrules.py | 2 +- 32 files changed, 178 insertions(+), 118 deletions(-) delete mode 100644 .cursor/rules/operator-chat-language.mdc delete mode 100644 .cursor/rules/persona-rigor.mdc diff --git a/.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc b/.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc index 4d8fd0604..2c382f109 100644 --- a/.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc +++ b/.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc @@ -1,6 +1,11 @@ --- -description: When safe (CI green, mergeable, docs aligned), complete PR merge via scripts/ without asking permission; run LAB-OP SSH collection scripts from terminal; escalate on failures or regressions. -alwaysApply: true +description: Autonomous merge when green and LAB-OP SSH collection. Situational — `completao` / `homelab` tokens or @agent-autonomous-merge-and-lab-ops.mdc when globs miss. +globs: + - scripts/pr-merge-when-green.ps1 + - scripts/lab-op* + - scripts/lab-completao* + - docs/ops/LAB_COMPLETAO* +alwaysApply: false --- # Autonomous merge + LAB-OP (operator trust) diff --git a/.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc b/.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc index 4f2679182..93ac54fe1 100644 --- a/.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc +++ b/.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc @@ -1,6 +1,10 @@ --- -description: Start sessions with git fetch/status; pull main when behind; integrate origin/main on feature branches; private-git-sync after meaningful docs/private changes; next steps without redundant asks; sidequest exception; protect canonical primary dev clone. -alwaysApply: true +description: Session ritual — synced main, private stack, today-mode. Situational — `carryover-sweep` / `eod-sync` / `private-stack-sync` or globs below; @agent-session-ritual-sync-main-and-private-stack.mdc. +globs: + - docs/ops/today-mode/** + - docs/ops/PRIVATE_STACK_SYNC* + - AGENTS.md +alwaysApply: false --- # Agent session ritual — synced `main`, private stack, next steps diff --git a/.cursor/rules/ats-locale-aware-recommendations.mdc b/.cursor/rules/ats-locale-aware-recommendations.mdc index 1732ddd9e..6b29e890f 100644 --- a/.cursor/rules/ats-locale-aware-recommendations.mdc +++ b/.cursor/rules/ats-locale-aware-recommendations.mdc @@ -1,7 +1,10 @@ --- -description: Talent ATS / LinkedIn recommendations must match candidate target locale and jurisdiction (en_CA+PIPEDA for Canada, not default GDPR); verify certification pricing in local currency -globs: ["**/*"] -alwaysApply: true +description: Talent ATS / LinkedIn recommendations — locale-aware. Situational — `talent-ats` token or globs below; @ats-locale-aware-recommendations.mdc. +globs: + - docs/ops/LINKEDIN_ATS_PLAYBOOK* + - docs/private.example/commercial/** + - .cursor/skills/candidate-ats-evaluation/** +alwaysApply: false --- # ATS / talent recommendations — locale and jurisdiction diff --git a/.cursor/rules/audience-segmentation-docs.mdc b/.cursor/rules/audience-segmentation-docs.mdc index de199e25b..63be2e72c 100644 --- a/.cursor/rules/audience-segmentation-docs.mdc +++ b/.cursor/rules/audience-segmentation-docs.mdc @@ -1,6 +1,10 @@ --- -description: Audience segmentation for docs navigation and link boundaries (external vs internal vs private-secrets) -alwaysApply: true +description: Audience segmentation for docs. Situational — `docs` / `feature` tokens or docs/** globs; @audience-segmentation-docs.mdc when globs miss. +globs: + - docs/** + - README.md + - CONTRIBUTING.md +alwaysApply: false --- # Audience segmentation guardrail (docs and training materials) diff --git a/.cursor/rules/clean-slate-pii-self-audit.mdc b/.cursor/rules/clean-slate-pii-self-audit.mdc index 430c73d23..db71fa7ee 100644 --- a/.cursor/rules/clean-slate-pii-self-audit.mdc +++ b/.cursor/rules/clean-slate-pii-self-audit.mdc @@ -1,7 +1,10 @@ --- -description: Where clean-slate lives, how it fits PII self-audit vs filter-repo; assistants must not simulate runs — use real guards or point to PII guide H.9–H.10; primary Windows dev PC never runs destructive clean-slate / rewrite -globs: ["**/*"] -alwaysApply: true +description: clean-slate + PII self-audit memory hook. Situational — `pii-fresh-audit` token or globs below; @clean-slate-pii-self-audit.mdc. +globs: + - docs/ops/PII_FRESH_CLONE* + - docs/ops/PII_PUBLIC_TREE* + - scripts/pii-fresh-clone* +alwaysApply: false --- # `clean-slate` + PII — memory hook (no simulation) diff --git a/.cursor/rules/collaboration-maintainer-contributor.mdc b/.cursor/rules/collaboration-maintainer-contributor.mdc index a32b57b14..b4539965b 100644 --- a/.cursor/rules/collaboration-maintainer-contributor.mdc +++ b/.cursor/rules/collaboration-maintainer-contributor.mdc @@ -1,7 +1,9 @@ --- -description: Maintainer vs contributor collaboration — Git identity, no implicit "who is typing", follow AGENTS.md -globs: ["**/*"] -alwaysApply: true +description: Maintainer vs contributor collaboration. Situational — CONTRIBUTING / COLLABORATION_TEAM globs or @collaboration-maintainer-contributor.mdc. +globs: + - docs/COLLABORATION_TEAM* + - CONTRIBUTING.md +alwaysApply: false --- # Maintainer / contributor collaboration (Cursor) diff --git a/.cursor/rules/cursor-browser-social-sso-hygiene.mdc b/.cursor/rules/cursor-browser-social-sso-hygiene.mdc index 0129fc96b..7186ada10 100644 --- a/.cursor/rules/cursor-browser-social-sso-hygiene.mdc +++ b/.cursor/rules/cursor-browser-social-sso-hygiene.mdc @@ -1,6 +1,9 @@ --- -description: Cursor IDE browser — same workstation as SSH: all operator social + Gmail + dashboards; try MCP then Google SSO when cold; only escalate to operator after a real failed attempt -alwaysApply: true +description: Cursor IDE browser — SSO/social/Gmail. Situational — browser MCP tasks or @cursor-browser-social-sso-hygiene.mdc. +globs: + - .cursor/skills/cursor-browser-social-session/** + - docs/ops/OPERATOR_NOTIFICATION_CHANNELS* +alwaysApply: false --- # Cursor browser (redes, Patreon, pesquisa) diff --git a/.cursor/rules/cursor-markdown-preview-guardrail.mdc b/.cursor/rules/cursor-markdown-preview-guardrail.mdc index 726e14215..b60d59336 100644 --- a/.cursor/rules/cursor-markdown-preview-guardrail.mdc +++ b/.cursor/rules/cursor-markdown-preview-guardrail.mdc @@ -1,6 +1,9 @@ --- -description: Keep Markdown preview opening as a normal tab (not forced side-by-side split) in Cursor/VS Code on Windows. -alwaysApply: true +description: Markdown preview — avoid forced split. Situational — CURSOR_MARKDOWN_PREVIEW docs or @cursor-markdown-preview-guardrail.mdc. +globs: + - docs/ops/CURSOR_MARKDOWN_PREVIEW* + - scripts/check-cursor-markdown* +alwaysApply: false --- # Markdown preview: avoid forced GUI split (operator workstation) diff --git a/.cursor/rules/git-pr-sync-before-advice.mdc b/.cursor/rules/git-pr-sync-before-advice.mdc index ddd27c686..2104d45e1 100644 --- a/.cursor/rules/git-pr-sync-before-advice.mdc +++ b/.cursor/rules/git-pr-sync-before-advice.mdc @@ -1,7 +1,12 @@ --- -description: Refresh git/gh state before merge/PR advice or sharing PR URLs (avoid stale PR numbers) -globs: ["**/*"] -alwaysApply: true +description: Refresh git/gh before merge/PR advice. Situational — commit/PR scripts and COMMIT_AND_PR docs; @git-pr-sync-before-advice.mdc when globs miss. +globs: + - docs/ops/COMMIT_AND_PR* + - CONTRIBUTING.md + - scripts/commit-or-pr* + - scripts/create-pr* + - scripts/preview-commit* +alwaysApply: false --- # Git / GitHub PR state — sync before advice diff --git a/.cursor/rules/linguistic-rigor-and-performance.mdc b/.cursor/rules/linguistic-rigor-and-performance.mdc index f9f4b2f4c..e22b36a74 100644 --- a/.cursor/rules/linguistic-rigor-and-performance.mdc +++ b/.cursor/rules/linguistic-rigor-and-performance.mdc @@ -1,21 +1,31 @@ --- -description: Impoe o tom de voz NASA e o gate de performance de 0.574x. -alwaysApply: true +description: Persona Tech Lead + NASA voice + Rust perf gate (0.574x Safe-Hold). Situational — docs/cursor prose or @linguistic-rigor-and-performance.mdc; docs-locale-pt-br-contract stays always-on for pt-BR. +globs: + - docs/** + - .cursor/rules/** + - .cursor/skills/** +alwaysApply: false --- -# Rigor Linguistico e de Performance +# Persona, rigor linguistico e performance (Data Boar Protocol) -## 1. Voz Ativa e Comando (NASA Style) +## 1. Persona — Tech Lead de Trincheira + +- **Verbos de acao:** Proibido voz passiva em PT-BR. Use "O sistema executa", "O gate impede". +- **Fidelidade ao Rust:** O `boar_fast_filter` e o coracao. Se houver lentidao, a solucao e nativa (Rust), nao remendo em Python. +- **Rigor documental:** Documentacao desatualizada e BUG de severidade alta. + +## 2. Voz ativa e comando (NASA style) - **Proibido:** Voz passiva ("Os logs sao gerados", "E permitido"). - **Obrigatorio:** Verbos de acao direta ("O sistema gera logs", "O gate impede a execucao"). - **Abstracao (LCM):** Use descricoes concretas de funcoes de codigo, nao metaforas vagas. -## 2. Gate de Performance +## 3. Gate de performance - O motor Rust e a prioridade. NUNCA mascare lentidao com "ajustes de sintaxe" em Python. - Se a performance cair abaixo de **0.574x**, entre em **NASA Safe-Hold**: pare tudo e reporte o gargalo. -## 3. Taxonomia Sagrada +## 4. Taxonomia intocavel Mantenha os termos originais: Data Sniffing, Deep Boring, Safe-Hold, Audit Trail. diff --git a/.cursor/rules/operator-browser-warm-session.mdc b/.cursor/rules/operator-browser-warm-session.mdc index 81e712677..bb53a9ef1 100644 --- a/.cursor/rules/operator-browser-warm-session.mdc +++ b/.cursor/rules/operator-browser-warm-session.mdc @@ -1,6 +1,8 @@ --- -description: Warm browser + Google SSO — try MCP on social, Gmail/webmail, Docker Hub, and other operator dashboards before permission pings or paste-only handoffs -alwaysApply: true +description: Warm browser + Google SSO. Situational — browser/social tasks or @operator-browser-warm-session.mdc. +globs: + - .cursor/skills/cursor-browser-social-session/** +alwaysApply: false --- # Operator social / browser (Cursor IDE) diff --git a/.cursor/rules/operator-career-private-layout.mdc b/.cursor/rules/operator-career-private-layout.mdc index cbb8c870b..8db61de8d 100644 --- a/.cursor/rules/operator-career-private-layout.mdc +++ b/.cursor/rules/operator-career-private-layout.mdc @@ -1,6 +1,9 @@ --- -description: Where to place operator career, LinkedIn, ATS, and SLI private files (not talent-pool candidates). -alwaysApply: true +description: Operator career / LinkedIn / ATS private layout. Situational — career globs or @operator-career-private-layout.mdc. +globs: + - docs/private.example/author_info/** + - docs/ops/LINKEDIN_ATS* +alwaysApply: false --- # Operator career / LinkedIn / ATS / SLI — private layout diff --git a/.cursor/rules/operator-chat-language-pt-br.mdc b/.cursor/rules/operator-chat-language-pt-br.mdc index ded10549f..ed1404230 100644 --- a/.cursor/rules/operator-chat-language-pt-br.mdc +++ b/.cursor/rules/operator-chat-language-pt-br.mdc @@ -1,7 +1,9 @@ --- -description: Operator conversational language — Brazilian Portuguese (pt-BR) or English; never European Portuguese (pt-PT). +description: Operator chat language (pt-BR default, EN when asked). Situational — conversational turns; hard pt-BR contract is docs-locale-pt-br-contract.mdc (always-on). @operator-chat-language-pt-br.mdc when globs miss. globs: -alwaysApply: true + - docs/private.example/** + - AGENTS.md +alwaysApply: false --- # Operator chat language (this workspace) @@ -11,11 +13,15 @@ When talking **conversationally** with the project operator **in Portuguese**: 1. Use **Brazilian Portuguese (pt-BR)** only — **same lexical and style bar** as **`*.pt_BR.md`** and **`.cursor/rules/docs-pt-br-locale.mdc`** (e.g. **arquivo**, **compartilhar**, **seção**, **usuário**, **precisa/tem que** for obligation — not *ficheiro*, *partilhar*, *secção*, *utilizador*, *tem de*). Prefer **você** (or neutral phrasing) and Brazilian verb agreement (**você tem**, **você faz**, **está**). 1. **English in the same message is OK** where it helps: **commands**, **API paths**, **flags**, **product/brand names**, and **stable technical jargon** the repo already keeps in English — **code-switch** naturally; do not force awkward literal translations of terms that are idiomatically left in EN in this project. 1. **Do not** write in **European Portuguese (pt-PT)** — avoid **tu** + **tens/fazes/trazes**, PT-only vocabulary, or conjugations that read as Portugal unless the operator **explicitly** asks for pt-PT for a specific purpose. -1. If the operator’s message is in **English**, or Portuguese would be ambiguous, reply in **English** for that turn — acceptable and often clearer for technical work. +1. If the operator's message is in **English**, or Portuguese would be ambiguous, reply in **English** for that turn — acceptable and often clearer for technical work. +1. If the operator says they prefer **English** in this thread, use **English** for narrative until they switch back. 1. **Tracked documentation:** EN is canonical written source; **pt-BR** mirrors EN. When editing or suggesting pt-BR doc text, keep it **Brazilian**. Hard contract: **`.cursor/rules/docs-locale-pt-br-contract.mdc`** (always applied). CI-style guard: **`tests/test_docs_pt_br_locale.py`**. 1. **Private drafts and operator Markdown (`docs/private/`, including `social_drafts/`):** Any **Portuguese** prose should follow the **same pt-BR** lexical bar as **`docs-pt-br-locale.mdc`** (not pt-PT), even when the filename is not **`*.pt_BR.md`**. 1. **Explicitly English content:** When writing or revising **English-only** prose (not just inline jargon), prefer **`en-US`** spelling and conventions for narrative text. +1. **Unchanged in any language:** File paths, `code`, **Conventional Commits** types/scopes, CLI flags, API names, and **English-only** plan tokens (`deps`, `feature`, `homelab`, …) stay **English**. **Skill (optional reminder for the operator):** `.cursor/skills/operator-dialogue-pt-br/SKILL.md`. If unsure, **default to English** for the reply rather than mixing pt-PT habits into pt-BR. + +See **`AGENTS.md`** (chat language bullet) and **`docs/PRIVATE_OPERATOR_NOTES.md`** §5.1. diff --git a/.cursor/rules/operator-chat-language.mdc b/.cursor/rules/operator-chat-language.mdc deleted file mode 100644 index 00cba3b88..000000000 --- a/.cursor/rules/operator-chat-language.mdc +++ /dev/null @@ -1,16 +0,0 @@ ---- -description: Chat language for this operator — Brazilian Portuguese (pt-BR), not European Portuguese (pt-PT); English when they prefer; aligns with AGENTS.md and synced EN/pt-BR docs. -alwaysApply: true ---- - -# Operator chat language (this workspace) - -1. **Default:** Reply in **concise Brazilian Portuguese (pt-BR)** for explanations—same register as **pt-BR docs** in this repo (e.g. **arquivo**, **compartilhar**, **seção**, **padrão** for software defaults). **Do not** default to **European Portuguese (pt-PT)** (e.g. *ficheiro*, *partilhar*, *tu* + *tens/fazes* as the usual address). Non-negotiable scope and exceptions: **`.cursor/rules/docs-locale-pt-br-contract.mdc`**. - -1. **English:** If the operator says they prefer **English** in this thread (e.g. to avoid mixed Portuguese variants), use **English** for narrative in that conversation until they switch back. - -1. **Unchanged in any language:** File paths, `code`, **Conventional Commits** types/scopes, CLI flags, API names, and **English-only** plan tokens (`deps`, `feature`, `homelab`, …) stay **English**. - -1. **Docs sync:** When editing paired **EN + pt-BR** files, keep the same meaning; pt-BR should read like **Brazilian** technical writing, not a literal calque from pt-PT. - -See **`AGENTS.md`** (first bullet) and **`docs/PRIVATE_OPERATOR_NOTES.md`** §5.1. diff --git a/.cursor/rules/operator-evidence-backup-no-rhetorical-asks.mdc b/.cursor/rules/operator-evidence-backup-no-rhetorical-asks.mdc index 6921b4143..f72229e0b 100644 --- a/.cursor/rules/operator-evidence-backup-no-rhetorical-asks.mdc +++ b/.cursor/rules/operator-evidence-backup-no-rhetorical-asks.mdc @@ -1,7 +1,9 @@ --- -description: Private progress history and backups — update every configured mirror without asking obvious permission; hope is not a plan. +description: Private evidence mirrors — full mirror set on sync. Situational — `private-stack-sync` token or globs below; @operator-evidence-backup-no-rhetorical-asks.mdc. globs: -alwaysApply: true + - docs/ops/PRIVATE_STACK_SYNC* + - scripts/private-git-sync* +alwaysApply: false --- # Evidence, private Git history, and redundant mirrors diff --git a/.cursor/rules/persona-rigor.mdc b/.cursor/rules/persona-rigor.mdc deleted file mode 100644 index 2848b021e..000000000 --- a/.cursor/rules/persona-rigor.mdc +++ /dev/null @@ -1,18 +0,0 @@ ---- -description: Define a autoridade tecnica e o tom de voz do Agente. -alwaysApply: true ---- - -# Persona: Tech Lead de Trincheira (Data Boar Protocol) - -## 1. Principios de Comando - -- **Verbos de Acao:** Proibido o uso de voz passiva em PT-BR. Use "O sistema executa", "O gate impede". -- **Fidelidade ao Rust:** O `boar_fast_filter` e o coracao. Se houver lentidao, a solucao e nativa (Rust), nao um remendo em Python. -- **Rigor Documental:** Documentacao desatualizada e um BUG de severidade alta. - -## 2. Taxonomia Intocavel - -Mantenha os termos originais para preservar o contexto de engenharia: - -- Data Sniffing, Deep Boring, Safe-Hold, Audit Trail. diff --git a/.cursor/rules/pre-commit-ruff.mdc b/.cursor/rules/pre-commit-ruff.mdc index 08c0e86fe..5be1689cc 100644 --- a/.cursor/rules/pre-commit-ruff.mdc +++ b/.cursor/rules/pre-commit-ruff.mdc @@ -1,7 +1,7 @@ --- description: Recommend and enforce pre-commit (Ruff + plans-stats + doc guards) before commits and PRs; CI runs the same bundle. globs: ["**/*.py", ".pre-commit-config.yaml"] -alwaysApply: true +alwaysApply: false --- # Pre-commit and Ruff (recommended before every commit) diff --git a/.cursor/rules/primary-linux-workstation-protected-no-destructive-repo-ops.mdc b/.cursor/rules/primary-linux-workstation-protected-no-destructive-repo-ops.mdc index 19c56b3be..fcbd95737 100644 --- a/.cursor/rules/primary-linux-workstation-protected-no-destructive-repo-ops.mdc +++ b/.cursor/rules/primary-linux-workstation-protected-no-destructive-repo-ops.mdc @@ -1,5 +1,5 @@ --- -description: Primary Linux dev workstation — never run clean-slate, history rewrite, or destructive repo reset on the canonical clone; temporary while Windows primary is in Lenovo repair (E0482B2DMD) +description: Main dev box (canonical clone) — Linux role today (LMDE); same destructive-repo prohibitions whenever this machine holds the canonical tree; secondary Windows uses same rigor when role moves. globs: ["**/*"] alwaysApply: true --- @@ -8,7 +8,7 @@ alwaysApply: true ## Scope -- **primary Linux dev workstation** (LMDE 7) is the operator’s **primary dev workstation** **temporarily** (former Windows primary failed **2026-06-07**; Lenovo case **E0482B2DMD**) where the **canonical** `data-boar` working tree, **evidence**, and **long-lived Git history** must stay intact. Tracked docs use **role labels**, not hostnames to paste into commits. +- **Main dev box (Linux role today):** **primary Linux dev workstation** (LMDE 7) currently holds the **canonical** `data-boar` clone when the Windows primary is in repair. **Secondary** Windows (L-series) keeps the **same destructive-repo rigor** when it holds or regains the canonical clone — see **`primary-windows-workstation-protected-no-destructive-repo-ops.mdc`**. Tracked docs use **role labels**, not hostnames or hardware IDs in commits. - **`DATA_BOAR_ROOT`** (operator default **`~/Projects/dev/data-boar`**) is **intouchable** for **`rm -rf`**, **`clean-slate`**, **`git reset --hard`**, **`git clean -fdx`**, or history rewrite in routine sessions. - **lab-op** and other **manifest SSH hosts** are **not** this canonical tree: destructive align scripts **only** apply on those remote **`repoPaths`** — see **`docs/ops/LAB_COMPLETAO_RUNBOOK.md`** (*Blast radius*) and **`docs/ops/PRIMARY_LINUX_WORKSTATION_PROTECTION.md`**. - **Reversion:** When the **Windows primary dev workstation** returns from repair, the operator may move the canonical clone role back — see **ADR 0068** and **`docs/ops/PRIMARY_LINUX_WORKSTATION_PROTECTION.md`** (*Reversion when Windows primary returns*). Until then, apply **this** rule on the Linux primary dev workstation, not only the Windows rule. diff --git a/.cursor/rules/primary-windows-workstation-protected-no-destructive-repo-ops.mdc b/.cursor/rules/primary-windows-workstation-protected-no-destructive-repo-ops.mdc index 3173b0390..a4a53e5dc 100644 --- a/.cursor/rules/primary-windows-workstation-protected-no-destructive-repo-ops.mdc +++ b/.cursor/rules/primary-windows-workstation-protected-no-destructive-repo-ops.mdc @@ -1,5 +1,5 @@ --- -description: primary Windows dev PC primary dev workstation — never run clean-slate, history rewrite, or destructive repo reset here; assistants never simulate destructive outcomes against canonical clone +description: Windows dev workstation (L-series) — same destructive-repo prohibitions when this machine holds the canonical clone; secondary today, may become main dev box again. globs: ["**/*"] alwaysApply: true --- @@ -8,7 +8,7 @@ alwaysApply: true ## Scope -- **L-series** means the operator’s **primary Windows dev workstation** (hardware: typically ThinkPad **L-series**) where the **canonical** `data-boar` working tree, **evidence**, and **long-lived Git history** must stay intact. Tracked docs use **L-series** as a **role label** (not a hostname to paste into commits). +- **Windows dev workstation (L-series):** **Secondary** today while canonical clone lives on Linux; **same rigor** as main dev box when this machine holds the canonical tree (may become **main dev box** again after repair). Tracked docs use **role labels** (not hostnames in commits). - **lab-op** and other **manifest SSH hosts** are **not** the primary dev PC canonical tree: **`git reset --hard`**, **`lab-op-git-align-main`**, **`lab-op-git-ensure-ref -Mode Reset`**, and similar **only** apply to **`repoPaths`** on those remote hosts — **never** to the operator’s primary clone path opened in Cursor on Windows — see **`docs/ops/LAB_COMPLETAO_RUNBOOK.md`** (*Blast radius*) and **`docs/ops/PRIMARY_WINDOWS_WORKSTATION_PROTECTION.md`**. - **Container images** (Docker / Swarm / Podman / Kubernetes): re-pull from **Docker Hub** (or configured registry) is **normal** and **reversible** for lab work — not the same blast radius as rewriting Git history on the primary dev PC. diff --git a/.cursor/rules/repo-scripts-wrapper-ritual.mdc b/.cursor/rules/repo-scripts-wrapper-ritual.mdc index 11aa70db2..6aad903f3 100644 --- a/.cursor/rules/repo-scripts-wrapper-ritual.mdc +++ b/.cursor/rules/repo-scripts-wrapper-ritual.mdc @@ -1,7 +1,10 @@ --- -description: Before long ad-hoc shell or reinvention — use documented scripts/*.ps1 wrappers, TOKEN_AWARE_SCRIPTS_HUB, and check-all-gate; notify operator if agreed automation fails (misconfiguration). -globs: ["**/*"] -alwaysApply: true +description: Repo script wrappers before ad-hoc shell. Situational — scripts/** or TOKEN_AWARE_SCRIPTS_HUB globs; @repo-scripts-wrapper-ritual.mdc when globs miss. +globs: + - scripts/** + - docs/ops/TOKEN_AWARE_SCRIPTS* + - docs/ops/SCRIPTS_CROSS_PLATFORM* +alwaysApply: false --- # Repo scripts and wrapper ritual (token-aware, agreed automation) diff --git a/.cursor/rules/session-mode-keywords.mdc b/.cursor/rules/session-mode-keywords.mdc index c1777ca9b..8c09aafdb 100644 --- a/.cursor/rules/session-mode-keywords.mdc +++ b/.cursor/rules/session-mode-keywords.mdc @@ -1,5 +1,5 @@ --- -description: Operator shorthand — deps, feature, homelab, completao, lab-lessons, external-eval, docs, houseclean, backlog, pmo-view, release-ritual, safe-commit, pii-remediation-ritual, pii-fresh-audit, legal-dossier-update, es-find, x-pace-check, x-posted, social-today-check, operator-sli-check, sonar-mcp; scope the session (plans + scripts). homelab = HOMELAB_VALIDATION second environment + situational homelab-ssh-via-terminal.mdc (token homelab + HOMELAB* / lab-op / collect-homelab / homelab script globs). completao = LAB_COMPLETAO_RUNBOOK SSH orchestrate (lab-completao-orchestrate.ps1 -Privileged, wrappers, sudoers per LAB_OP_PRIVILEGED_COLLECTION; protect primary L-series dev PC per PRIMARY_WINDOWS_WORKSTATION_PROTECTION; no redundant permission pings per operator-direct-execution); doc+code capability matrix; automate repeat steps (TOKEN_AWARE_SCRIPTS_HUB); document timeouts, latency, FP/FN vs synthetic, real-path confidence in private session notes per lab-completao-workflow. lab-lessons = dated public LAB_LESSONS snapshots under docs/ops/lab_lessons_learned/ + hub LAB_LESSONS_LEARNED.md + PLANS_TODO bridges; situational lab-lessons-learned-archive.mdc; ADR 0042; pair with private COMPLETAO_SESSION*. external-eval = LAB_EXTERNAL_CONNECTIVITY_EVAL public APIs + optional read-only DBs + intentional failures; no secrets in git. pmo-view = list plan/PMO paths + Markdown preview shortcuts (agent cannot toggle Preview). safe-commit = read-only git snapshot + optional quick guard tests before Preview. block-close = work-block/lab-exit boundary (VC/carryover/private-stack; not full eod-sync). morning-readiness / carryover-sweep = operator-day-ritual.ps1 -Mode Morning + today-mode/README Morning readiness ladder (Tier A daily; -1/-1b/-1L cadence). pii-remediation-ritual = on-demand public-tree PII pass (PII_REMEDIATION_RITUAL.md; private seeds + HEAD order). pii-fresh-audit = Windows fresh-clone PII self-audit (pii-fresh-clone-audit.ps1). es-find = Windows Everything filename search (read situational everything-es-cli.mdc or @ first; es-find.ps1). x-pace-check / x-posted = X editorial pace + post validation (private SOCIAL_HUB + scripts/social-x-pace-remind.ps1). social-today-check = skim private SOCIAL_HUB + calendar for today/tomorrow planned posts (SOCIAL_PUBLISH_AND_TODAY_MODE.md). operator-sli-check = weekly LinkedIn SLI validation (private ATS/SLI + SOCIAL_HUB). private-stack-sync = stacked private repo close (read situational docs-private-workspace-context.mdc or @ first; private-git-sync.ps1 + PRIVATE_STACK_SYNC_RITUAL.md; agent-docs-private-read-access stays always-on for never self-block; no secrets in tracked files). release-ritual = public semver publish order (read situational release-publish-sequencing.mdc or @ first; docker-local-smoke-cleanup stays always-on): tag + GitHub + Docker smoke (lab) before Hub push + prune + Hub UI paste. Browser SSO anti-toil: for Hub/GitHub web UI, try cursor-ide-browser + Google SSO before any “may I access?” ping (operator-browser-warm-session, operator-direct-execution §5). legal-dossier-update = private legal/labour evidence intake per dossier-update-on-evidence.mdc (INDEX + SUMMARY + RETEACH + stacked private git); never name parties in tracked files. plans-status = situational plans-status-pl-sync (docs/feature/houseclean/backlog or plan globs or @). plans-archive = situational plans-archive-on-completion (plan/archive globs or @). sonar-mcp = situational sonarqube_mcp_instructions (sonar globs or @). study-cadence = situational study-cadence-reminders (study-check or @). +description: Operator shorthand — deps, feature, homelab, completao, lab-lessons, external-eval, docs, houseclean, backlog, pmo-view, release-ritual, safe-commit, pii-remediation-ritual, pii-fresh-audit, legal-dossier-update, es-find, x-pace-check, x-posted, social-today-check, operator-sli-check, sonar-mcp; scope the session (plans + scripts). homelab = HOMELAB_VALIDATION second environment + situational homelab-ssh-via-terminal.mdc (token homelab + HOMELAB* / lab-op / collect-homelab / homelab script globs). completao = LAB_COMPLETAO_RUNBOOK SSH orchestrate (lab-completao-orchestrate.ps1 -Privileged, wrappers, sudoers per LAB_OP_PRIVILEGED_COLLECTION; protect primary L-series dev PC per PRIMARY_WINDOWS_WORKSTATION_PROTECTION; no redundant permission pings per operator-direct-execution); doc+code capability matrix; automate repeat steps (TOKEN_AWARE_SCRIPTS_HUB); document timeouts, latency, FP/FN vs synthetic, real-path confidence in private session notes per lab-completao-workflow. lab-lessons = dated public LAB_LESSONS snapshots under docs/ops/lab_lessons_learned/ + hub LAB_LESSONS_LEARNED.md + PLANS_TODO bridges; situational lab-lessons-learned-archive.mdc; ADR 0042; pair with private COMPLETAO_SESSION*. external-eval = LAB_EXTERNAL_CONNECTIVITY_EVAL public APIs + optional read-only DBs + intentional failures; no secrets in git. pmo-view = list plan/PMO paths + Markdown preview shortcuts (agent cannot toggle Preview). safe-commit = read-only git snapshot + optional quick guard tests before Preview. block-close = work-block/lab-exit boundary (VC/carryover/private-stack; not full eod-sync). morning-readiness / carryover-sweep = operator-day-ritual.ps1 -Mode Morning + today-mode/README Morning readiness ladder (Tier A daily; -1/-1b/-1L cadence). pii-remediation-ritual = on-demand public-tree PII pass (PII_REMEDIATION_RITUAL.md; private seeds + HEAD order). pii-fresh-audit = Windows fresh-clone PII self-audit (pii-fresh-clone-audit.ps1). es-find = Windows Everything filename search (read situational everything-es-cli.mdc or @ first; es-find.ps1). x-pace-check / x-posted = X editorial pace + post validation (private SOCIAL_HUB + scripts/social-x-pace-remind.ps1). social-today-check = skim private SOCIAL_HUB + calendar for today/tomorrow planned posts (SOCIAL_PUBLISH_AND_TODAY_MODE.md). operator-sli-check = weekly LinkedIn SLI validation (private ATS/SLI + SOCIAL_HUB). private-stack-sync = stacked private repo close (read situational docs-private-workspace-context.mdc or @ first; private-git-sync.ps1 + PRIVATE_STACK_SYNC_RITUAL.md; agent-docs-private-read-access stays always-on for never self-block; no secrets in tracked files). release-ritual = public semver publish order (read situational release-publish-sequencing.mdc or @ first; docker-local-smoke-cleanup stays always-on): tag + GitHub + Docker smoke (lab) before Hub push + prune + Hub UI paste. Browser SSO anti-toil: for Hub/GitHub web UI, try cursor-ide-browser + Google SSO before any “may I access?” ping (operator-browser-warm-session, operator-direct-execution §5). legal-dossier-update = private legal/labour evidence intake per dossier-update-on-evidence.mdc (INDEX + SUMMARY + RETEACH + stacked private git); never name parties in tracked files. plans-status = situational plans-status-pl-sync (docs/feature/houseclean/backlog or plan globs or @). plans-archive = situational plans-archive-on-completion (plan/archive globs or @). sonar-mcp = situational sonarqube_mcp_instructions (sonar globs or @). study-cadence = situational study-cadence-reminders (study-check or @). Tier B (#1154) @ latches when globs miss: git-pr-sync=@git-pr-sync-before-advice.mdc; merge-autonomous=@agent-autonomous-merge-and-lab-ops.mdc; browser=@cursor-browser-social-sso-hygiene.mdc or @operator-browser-warm-session.mdc; scripts-wrapper=@repo-scripts-wrapper-ritual.mdc; session-ritual=@agent-session-ritual-sync-main-and-private-stack.mdc (carryover-sweep/eod-sync/private-stack-sync). globs: ["**/*"] alwaysApply: true --- diff --git a/.cursor/skills/linguistic-rigor-active-voice/SKILL.md b/.cursor/skills/linguistic-rigor-active-voice/SKILL.md index 9b22593b2..f8971e350 100644 --- a/.cursor/skills/linguistic-rigor-active-voice/SKILL.md +++ b/.cursor/skills/linguistic-rigor-active-voice/SKILL.md @@ -5,7 +5,7 @@ description: Checklist for enforcing NASA-style active voice, LCM Level 1/2 verb # Linguistic Rigor — Active Voice and Lexicon Stability -Policy source: `persona-rigor.mdc` + `linguistic-rigor-and-performance.mdc` (both `alwaysApply: true`). +Policy source: `linguistic-rigor-and-performance.mdc` (situational — `@linguistic-rigor-and-performance.mdc` or docs/cursor globs). This skill provides a **practical checklist** for use during writing and PR review. --- @@ -86,6 +86,6 @@ When reviewing a PR, docstring addition, or doc update, run through: ## References -- [`persona-rigor.mdc`](../../.cursor/rules/persona-rigor.mdc) +- [`linguistic-rigor-and-performance.mdc`](../../.cursor/rules/linguistic-rigor-and-performance.mdc) - [`linguistic-rigor-and-performance.mdc`](../../.cursor/rules/linguistic-rigor-and-performance.mdc) - [ADR-0048 — Operator-facing taxonomy and naming contract preservation](../../docs/adr/ADR-0048-operator-facing-taxonomy-and-naming-contract-preservation.md) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0cca0dc39..19f4b1902 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ Human-readable summary of user-facing changes. **Detailed release notes:** [docs ## Unreleased (`main`) +- **Cursor rules — Tier B situationalization (#1154):** 14 workflow rules → `alwaysApply: false` + globs/tokens; merged `operator-chat-language` + `persona-rigor` duplicates; workstation rules reframed (main dev box / secondary, same rigor). Rollback: `git revert` the Tier B commit. Inventory: `docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.md`. + **Targeting (next dev line):** **`1.8.0-beta`** (#772) — after operator **release-ritual** for **1.7.4** (PR **#1024**). --- diff --git a/docs/adr/ADR-0048-operator-facing-taxonomy-and-naming-contract-preservation.md b/docs/adr/ADR-0048-operator-facing-taxonomy-and-naming-contract-preservation.md index b1143c72c..3cedbd75f 100644 --- a/docs/adr/ADR-0048-operator-facing-taxonomy-and-naming-contract-preservation.md +++ b/docs/adr/ADR-0048-operator-facing-taxonomy-and-naming-contract-preservation.md @@ -97,7 +97,7 @@ meaning if the internal label silently changed to "Deep Scan" in a refactor. ## References -- [`persona-rigor.mdc`](../../.cursor/rules/persona-rigor.mdc) — frozen domain vocabulary contract +- [`linguistic-rigor-and-performance.mdc`](../../.cursor/rules/linguistic-rigor-and-performance.mdc) — frozen domain vocabulary + NASA voice + perf gate (situational) - [`operator-help-sync.mdc`](../../.cursor/rules/operator-help-sync.mdc) — CLI flag and help-text sync procedure - [`docs/GLOSSARY.md`](../GLOSSARY.md) — canonical product terminology - [`docs/OPERATOR_HELP_AUDIT.md`](../OPERATOR_HELP_AUDIT.md) — drift guard for CLI surface diff --git a/docs/adr/INVENTORY.txt b/docs/adr/INVENTORY.txt index 649de2940..3ffbba0a7 100644 --- a/docs/adr/INVENTORY.txt +++ b/docs/adr/INVENTORY.txt @@ -1,5 +1,5 @@ # ADR Inventory - generated by scripts/inv-adr.ps1 -# GeneratedUtc: 2026-07-01T09:34:57Z +# GeneratedUtc: 2026-07-03T17:22:15Z # Algorithm: SHA256 # Format: NUMBER | STATUS | FILE_HASH | FILENAME | TITLE | RATIFIED_BY # RATIFIED_BY: - = N/A; PENDING = ratification line with signature PENDING; @op = stamped @@ -52,7 +52,7 @@ 0045 | Accepted | 6226BB8F1184C1D5A1D3BF371C25C23ACAD78CCA4AABD19327012E282622F8C2 | ADR-0045-adr-metadata-and-format-standardization.md | ADR metadata and format standardization | - 0046 | Accepted | 07CA56EB399E5F06E6A2BB19C3940FB84A3F8B425036A6CE278A35E77564FFCC | ADR-0046-operator-intent-and-blameless-collaboration.md | Operator intent and blameless collaboration posture | - 0047 | Accepted | E4BF0EAE26EA9C357D6BB1AD79ADEC52B66011C509D620A7263D7FF2A8CB9037 | ADR-0047-rca-first-defect-investigation-and-fix-discipline.md | RCA-first defect investigation and fix discipline | - -0048 | Accepted | BB07A2FC540513470844DF8B4D1609154877777E5D75E2C217A4041892637727 | ADR-0048-operator-facing-taxonomy-and-naming-contract-preservation.md | Operator-facing taxonomy and naming contract preservation | - +0048 | Accepted | 018AC2337ECD324FDDA4C12593025D3F05FD04F88B1CB3486B40E2B142A2B98D | ADR-0048-operator-facing-taxonomy-and-naming-contract-preservation.md | Operator-facing taxonomy and naming contract preservation | - 0049 | Accepted | 04A634D892FE07A30560FDBC04F3CEACBD710491B94E3E9B5CEE346417A7B30A | ADR-0049-no-brittle-mitigations-robust-input-handling.md | No brittle mitigations — robust input handling over symptom suppression | - 0050 | Accepted | 902D694FAE7CDEF77B48BBA352502BA550F6EE651F265B96012F1FE216DE5401 | ADR-0050-plan-document-metadata-standard.md | Plan document metadata standard | - 0051 | Accepted | 28F5BCB170C515F028A747C286420FF2A099EE39B132B9C0D0223BDD2ADF57AB | ADR-0051-incremental-filesystem-scan-file-identity-fingerprint.md | Incremental filesystem scan: file-identity fingerprint contract | - @@ -82,4 +82,4 @@ 0078 | Proposed | 5FEF0DCAC3DA292E33519F24FE6387584C04A850771958FF78B19D3EEB856990 | ADR-0078-multi-pattern-regex-benchmark-gate-regexset-before-vectorscan.md | Multi-pattern regex acceleration gated by benchmark (RegexSet before Vectorscan) | - 0079 | Proposed | 158C68D90B9C6934F0FAAC392E86C6C889FA8F5A6E9AD8197168205946435F9D | ADR-0079-ecosystem-engineering-rigor-canon.md | Ecosystem engineering rigor canon (UMADR satellites) | - # -# InventoryHash: A4D38F67D132F63EA4E99EEDB6723FD37AE7B6D00CE2C17E97D29053D5B7013D +# InventoryHash: B78E69346A3195D38D493AB82DE996B3E41296C1EE0415199C436ECE3704A674 diff --git a/docs/hubs/RULES_AND_SKILLS_HUB.md b/docs/hubs/RULES_AND_SKILLS_HUB.md index a55a3e716..ab2253a5f 100644 --- a/docs/hubs/RULES_AND_SKILLS_HUB.md +++ b/docs/hubs/RULES_AND_SKILLS_HUB.md @@ -4,7 +4,7 @@ > **For agents:** consult this hub before duplicating behavior in chat. Rules with `alwaysApply: true` are already active — do not re-load them unless debugging. Situational rules attach via **globs** or **session keywords** (see [session-mode-keywords.mdc](../../.cursor/rules/session-mode-keywords.mdc)). Skills are invoked when the task matches the skill description or a session keyword. -_Generated by `scripts/build_rules_skills_hub.py` — 74 rules, 31 skills. Session keyword sample: `deps`, `feature`, `homelab`, `docs`, `houseclean`, `backlog`, `sidequest`._ +_Generated by `scripts/build_rules_skills_hub.py` — 72 rules, 31 skills. Session keyword sample: `deps`, `feature`, `homelab`, `docs`, `houseclean`, `backlog`, `sidequest`._ ## Rules (`.cursor/rules/*.mdc`) @@ -12,41 +12,23 @@ _Generated by `scripts/build_rules_skills_hub.py` — 74 rules, 31 skills. Sessi | Rule | What it does | | ---- | ------------ | -| `.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc` | When safe (CI green, mergeable, docs aligned), complete PR merge via scripts/ without asking permission; run LAB-OP SSH collection scripts from terminal; escalate on failures or regressions. | | `.cursor/rules/agent-docs-private-read-access.mdc` | Agent must read docs/private/ when relevant; gitignore is not an access denial; never self-block. | | `.cursor/rules/agent-roles-executor-vs-auditor.mdc` | AI executor vs auditor role contract (Cursor = executor, Claude Code = read-only auditor) | -| `.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc` | Start sessions with git fetch/status; pull main when behind; integrate origin/main on feature branches; private-git-sync after meaningful docs/private changes; next steps without redundant asks; sidequest exception; protect canonical primary dev clone. | -| `.cursor/rules/ats-locale-aware-recommendations.mdc` | Talent ATS / LinkedIn recommendations must match candidate target locale and jurisdiction (en_CA+PIPEDA for Canada, not default GDPR); verify certification pricing in local currency | -| `.cursor/rules/audience-segmentation-docs.mdc` | Audience segmentation for docs navigation and link boundaries (external vs internal vs private-secrets) | | `.cursor/rules/check-all-gate.mdc` | Use repo automation scripts for lint/tests (token-aware) | -| `.cursor/rules/clean-slate-pii-self-audit.mdc` | Where clean-slate lives, how it fits PII self-audit vs filter-repo; assistants must not simulate runs — use real guards or point to PII guide H.9–H.10; primary Windows dev PC never runs destructive clean-slate / rewrite | -| `.cursor/rules/collaboration-maintainer-contributor.mdc` | Maintainer vs contributor collaboration — Git identity, no implicit "who is typing", follow AGENTS.md | | `.cursor/rules/confidential-commercial-never-tracked.mdc` | Confidential commercial, client-specific, and pricing drafts never belong in tracked Git files | -| `.cursor/rules/cursor-browser-social-sso-hygiene.mdc` | Cursor IDE browser — same workstation as SSH: all operator social + Gmail + dashboards; try MCP then Google SSO when cold; only escalate to operator after a real failed attempt | -| `.cursor/rules/cursor-markdown-preview-guardrail.mdc` | Keep Markdown preview opening as a normal tab (not forced side-by-side split) in Cursor/VS Code on Windows. | | `.cursor/rules/docker-local-smoke-cleanup.mdc` | Keep at most one or two local Data Boar containers; reuse data_boar:lab for smoke; prune extra tags; disk-aware; paired with release-publish-sequencing for Hub pushes. | | `.cursor/rules/docs-locale-pt-br-contract.mdc` | Non-negotiable — all assistant-authored Portuguese in this workspace defaults to Brazilian Portuguese (pt-BR), never European Portuguese (pt-PT), unless an explicit exception applies. | | `.cursor/rules/execution-priority-and-pr-batching.mdc` | Critical-first execution, token-aware sequencing, and PR batching (avoid micro-PR chaos) | -| `.cursor/rules/git-pr-sync-before-advice.mdc` | Refresh git/gh state before merge/PR advice or sharing PR URLs (avoid stale PR numbers) | -| `.cursor/rules/linguistic-rigor-and-performance.mdc` | Impoe o tom de voz NASA e o gate de performance de 0.574x. | | `.cursor/rules/never-weaken-security-gates.mdc` | Hard rule — NEVER weaken, disable, or bypass a security gate (PII, secrets, history guard, CODEOWNERS, signed-commit checks) to pass a commit or CI. A triggered gate means STOP and escalate to the operator. The only response to a false positive is tighten-pattern + operator-approved allowlist — never loosen. | -| `.cursor/rules/operator-browser-warm-session.mdc` | Warm browser + Google SSO — try MCP on social, Gmail/webmail, Docker Hub, and other operator dashboards before permission pings or paste-only handoffs | -| `.cursor/rules/operator-career-private-layout.mdc` | Where to place operator career, LinkedIn, ATS, and SLI private files (not talent-pool candidates). | -| `.cursor/rules/operator-chat-language-pt-br.mdc` | Operator conversational language — Brazilian Portuguese (pt-BR) or English; never European Portuguese (pt-PT). | -| `.cursor/rules/operator-chat-language.mdc` | Chat language for this operator — Brazilian Portuguese (pt-BR), not European Portuguese (pt-PT); English when they prefer; aligns with AGENTS.md and synced EN/pt-BR docs. | | `.cursor/rules/operator-direct-execution.mdc` | Execute clear operator directives without redundant confirmation; honest lab/CI validation. | -| `.cursor/rules/operator-evidence-backup-no-rhetorical-asks.mdc` | Private progress history and backups — update every configured mirror without asking obvious permission; hope is not a plan. | | `.cursor/rules/operator-investigation-before-blocking.mdc` | SRE-style recovery — investigate on disk, private git, and tools before refusing or panicking | | `.cursor/rules/operator-mandate-vs-external-limits.mdc` | Operator mandates workspace work; distinguish policy (none blocking private) from technical limits (third-party login, browser SSO). | -| `.cursor/rules/persona-rigor.mdc` | Define a autoridade tecnica e o tom de voz do Agente. | -| `.cursor/rules/pre-commit-ruff.mdc` | Recommend and enforce pre-commit (Ruff + plans-stats + doc guards) before commits and PRs; CI runs the same bundle. | -| `.cursor/rules/primary-linux-workstation-protected-no-destructive-repo-ops.mdc` | Primary Linux dev workstation — never run clean-slate, history rewrite, or destructive repo reset on the canonical clone; temporary while Windows primary is in Lenovo repair (E0482B2DMD) | -| `.cursor/rules/primary-windows-workstation-protected-no-destructive-repo-ops.mdc` | primary Windows dev PC primary dev workstation — never run clean-slate, history rewrite, or destructive repo reset here; assistants never simulate destructive outcomes against canonical clone | +| `.cursor/rules/primary-linux-workstation-protected-no-destructive-repo-ops.mdc` | Main dev box (canonical clone) — Linux role today (LMDE); same destructive-repo prohibitions whenever this machine holds the canonical tree; secondary Windows uses same rigor when role moves. | +| `.cursor/rules/primary-windows-workstation-protected-no-destructive-repo-ops.mdc` | Windows dev workstation (L-series) — same destructive-repo prohibitions when this machine holds the canonical clone; secondary today, may become main dev box again. | | `.cursor/rules/private-pii-never-public.mdc` | "PII and personal sensitive content -- never in public Git or GitHub. alwaysApply guardrail." | | `.cursor/rules/public-tracked-pii-zero-tolerance.mdc` | Zero tolerance for third-party identifiers and sensitive breadcrumbs in public tracked files, commits, and PR text (LGPD/GDPR alignment). | | `.cursor/rules/publication-truthfulness-no-invented-facts.mdc` | "Never invent dates, metrics, URLs, or publication claims; always capture real permalinks when reachable. alwaysApply." | -| `.cursor/rules/repo-scripts-wrapper-ritual.mdc` | Before long ad-hoc shell or reinvention — use documented scripts/*.ps1 wrappers, TOKEN_AWARE_SCRIPTS_HUB, and check-all-gate; notify operator if agreed automation fails (misconfiguration). | -| `.cursor/rules/session-mode-keywords.mdc` | Operator shorthand — deps, feature, homelab, completao, lab-lessons, external-eval, docs, houseclean, backlog, pmo-view, release-ritual, safe-commit, pii-remediation-ritual, pii-fresh-audit, legal-dossier-update, es-find, x-pace-check, x-posted, social-today-check, operator-sli-check, sonar-mcp; scope the session (plans + scripts). homelab = HOMELAB_VALIDATION second environment + situational homelab-ssh-via-terminal.mdc (token homelab + HOMELAB* / lab-op / collect-homelab / homelab script globs). completao = LAB_COMPLETAO_RUNBOOK SSH orchestrate (lab-completao-orchestrate.ps1 -Privileged, wrappers, sudoers per LAB_OP_PRIVILEGED_COLLECTION; protect primary L-series dev PC per PRIMARY_WINDOWS_WORKSTATION_PROTECTION; no redundant permission pings per operator-direct-execution); doc+code capability matrix; automate repeat steps (TOKEN_AWARE_SCRIPTS_HUB); document timeouts, latency, FP/FN vs synthetic, real-path confidence in private session notes per lab-completao-workflow. lab-lessons = dated public LAB_LESSONS snapshots under docs/ops/lab_lessons_learned/ + hub LAB_LESSONS_LEARNED.md + PLANS_TODO bridges; situational lab-lessons-learned-archive.mdc; ADR 0042; pair with private COMPLETAO_SESSION*. external-eval = LAB_EXTERNAL_CONNECTIVITY_EVAL public APIs + optional read-only DBs + intentional failures; no secrets in git. pmo-view = list plan/PMO paths + Markdown preview shortcuts (agent cannot toggle Preview). safe-commit = read-only git snapshot + optional quick guard tests before Preview. block-close = work-block/lab-exit boundary (VC/carryover/private-stack; not full eod-sync). morning-readiness / carryover-sweep = operator-day-ritual.ps1 -Mode Morning + today-mode/README Morning readiness ladder (Tier A daily; -1/-1b/-1L cadence). pii-remediation-ritual = on-demand public-tree PII pass (PII_REMEDIATION_RITUAL.md; private seeds + HEAD order). pii-fresh-audit = Windows fresh-clone PII self-audit (pii-fresh-clone-audit.ps1). es-find = Windows Everything filename search (read situational everything-es-cli.mdc or @ first; es-find.ps1). x-pace-check / x-posted = X editorial pace + post validation (private SOCIAL_HUB + scripts/social-x-pace-remind.ps1). social-today-check = skim private SOCIAL_HUB + calendar for today/tomorrow planned posts (SOCIAL_PUBLISH_AND_TODAY_MODE.md). operator-sli-check = weekly LinkedIn SLI validation (private ATS/SLI + SOCIAL_HUB). private-stack-sync = stacked private repo close (read situational docs-private-workspace-context.mdc or @ first; private-git-sync.ps1 + PRIVATE_STACK_SYNC_RITUAL.md; agent-docs-private-read-access stays always-on for never self-block; no secrets in tracked files). release-ritual = public semver publish order (read situational release-publish-sequencing.mdc or @ first; docker-local-smoke-cleanup stays always-on): tag + GitHub + Docker smoke (lab) before Hub push + prune + Hub UI paste. Browser SSO anti-toil: for Hub/GitHub web UI, try cursor-ide-browser + Google SSO before any “may I access?” ping (operator-browser-warm-session, operator-direct-execution §5). legal-dossier-update = private legal/labour evidence intake per dossier-update-on-evidence.mdc (INDEX + SUMMARY + RETEACH + stacked private git); never name parties in tracked files. plans-status = situational plans-status-pl-sync (docs/feature/houseclean/backlog or plan globs or @). plans-archive = situational plans-archive-on-completion (plan/archive globs or @). sonar-mcp = situational sonarqube_mcp_instructions (sonar globs or @). study-cadence = situational study-cadence-reminders (study-check or @). | +| `.cursor/rules/session-mode-keywords.mdc` | Operator shorthand — deps, feature, homelab, completao, lab-lessons, external-eval, docs, houseclean, backlog, pmo-view, release-ritual, safe-commit, pii-remediation-ritual, pii-fresh-audit, legal-dossier-update, es-find, x-pace-check, x-posted, social-today-check, operator-sli-check, sonar-mcp; scope the session (plans + scripts). homelab = HOMELAB_VALIDATION second environment + situational homelab-ssh-via-terminal.mdc (token homelab + HOMELAB* / lab-op / collect-homelab / homelab script globs). completao = LAB_COMPLETAO_RUNBOOK SSH orchestrate (lab-completao-orchestrate.ps1 -Privileged, wrappers, sudoers per LAB_OP_PRIVILEGED_COLLECTION; protect primary L-series dev PC per PRIMARY_WINDOWS_WORKSTATION_PROTECTION; no redundant permission pings per operator-direct-execution); doc+code capability matrix; automate repeat steps (TOKEN_AWARE_SCRIPTS_HUB); document timeouts, latency, FP/FN vs synthetic, real-path confidence in private session notes per lab-completao-workflow. lab-lessons = dated public LAB_LESSONS snapshots under docs/ops/lab_lessons_learned/ + hub LAB_LESSONS_LEARNED.md + PLANS_TODO bridges; situational lab-lessons-learned-archive.mdc; ADR 0042; pair with private COMPLETAO_SESSION*. external-eval = LAB_EXTERNAL_CONNECTIVITY_EVAL public APIs + optional read-only DBs + intentional failures; no secrets in git. pmo-view = list plan/PMO paths + Markdown preview shortcuts (agent cannot toggle Preview). safe-commit = read-only git snapshot + optional quick guard tests before Preview. block-close = work-block/lab-exit boundary (VC/carryover/private-stack; not full eod-sync). morning-readiness / carryover-sweep = operator-day-ritual.ps1 -Mode Morning + today-mode/README Morning readiness ladder (Tier A daily; -1/-1b/-1L cadence). pii-remediation-ritual = on-demand public-tree PII pass (PII_REMEDIATION_RITUAL.md; private seeds + HEAD order). pii-fresh-audit = Windows fresh-clone PII self-audit (pii-fresh-clone-audit.ps1). es-find = Windows Everything filename search (read situational everything-es-cli.mdc or @ first; es-find.ps1). x-pace-check / x-posted = X editorial pace + post validation (private SOCIAL_HUB + scripts/social-x-pace-remind.ps1). social-today-check = skim private SOCIAL_HUB + calendar for today/tomorrow planned posts (SOCIAL_PUBLISH_AND_TODAY_MODE.md). operator-sli-check = weekly LinkedIn SLI validation (private ATS/SLI + SOCIAL_HUB). private-stack-sync = stacked private repo close (read situational docs-private-workspace-context.mdc or @ first; private-git-sync.ps1 + PRIVATE_STACK_SYNC_RITUAL.md; agent-docs-private-read-access stays always-on for never self-block; no secrets in tracked files). release-ritual = public semver publish order (read situational release-publish-sequencing.mdc or @ first; docker-local-smoke-cleanup stays always-on): tag + GitHub + Docker smoke (lab) before Hub push + prune + Hub UI paste. Browser SSO anti-toil: for Hub/GitHub web UI, try cursor-ide-browser + Google SSO before any “may I access?” ping (operator-browser-warm-session, operator-direct-execution §5). legal-dossier-update = private legal/labour evidence intake per dossier-update-on-evidence.mdc (INDEX + SUMMARY + RETEACH + stacked private git); never name parties in tracked files. plans-status = situational plans-status-pl-sync (docs/feature/houseclean/backlog or plan globs or @). plans-archive = situational plans-archive-on-completion (plan/archive globs or @). sonar-mcp = situational sonarqube_mcp_instructions (sonar globs or @). study-cadence = situational study-cadence-reminders (study-check or @). Tier B (#1154) @ latches when globs miss: git-pr-sync=@git-pr-sync-before-advice.mdc; merge-autonomous=@agent-autonomous-merge-and-lab-ops.mdc; browser=@cursor-browser-social-sso-hygiene.mdc or @operator-browser-warm-session.mdc; scripts-wrapper=@repo-scripts-wrapper-ritual.mdc; session-ritual=@agent-session-ritual-sync-main-and-private-stack.mdc (carryover-sweep/eod-sync/private-stack-sync). | | `.cursor/rules/windows-pcloud-drive-search-discipline.mdc` | Windows dev PC — pCloud on P: (often); default filename/path search on large trees = scripts/es-find.ps1 (es.exe); if es fails notify operator then native fallback (e.g. capped Get-ChildItem). Avoid opening with unbounded -Recurse on huge sync roots. | ### Situational (globs and/or session keywords) @@ -55,10 +37,18 @@ _Generated by `scripts/build_rules_skills_hub.py` — 74 rules, 31 skills. Sessi | ---- | ---------- | ------------ | | `.cursor/rules/adr-inventory-ritual.mdc` | keyword / `@rule` / plan globs | After any docs/adr ADR-*.md change, regenerate INVENTORY.txt via inv-adr.ps1 in the same PR. | | `.cursor/rules/adr-trigger.mdc` | keyword / `@rule` / plan globs | ADR trigger — when to create an Architecture Decision Record | +| `.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc` | keyword / `@rule` / plan globs | Autonomous merge when green and LAB-OP SSH collection. Situational — `completao` / `homelab` tokens or @agent-autonomous-merge-and-lab-ops.mdc when globs miss. | +| `.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc` | keyword / `@rule` / plan globs | Session ritual — synced main, private stack, today-mode. Situational — `carryover-sweep` / `eod-sync` / `private-stack-sync` or globs below; @agent-session-ritual-sync-main-and-private-stack.mdc. | | `.cursor/rules/api-routes-plan-matrix-sync.mdc` | ["api/routes.py", "docs/plans/PLAN_DASHBOARD_REPORTS_ACCESS_CONTROL.md", "tests/test_api_route_matrix_plan_sync.py"] | When changing api/routes.py HTTP routes, update PLAN_DASHBOARD_REPORTS_ACCESS_CONTROL Phase 0 table and tests/test_api_route_matrix_plan_sync.py in the same PR. | +| `.cursor/rules/ats-locale-aware-recommendations.mdc` | keyword / `@rule` / plan globs | Talent ATS / LinkedIn recommendations — locale-aware. Situational — `talent-ats` token or globs below; @ats-locale-aware-recommendations.mdc. | +| `.cursor/rules/audience-segmentation-docs.mdc` | keyword / `@rule` / plan globs | Audience segmentation for docs. Situational — `docs` / `feature` tokens or docs/** globs; @audience-segmentation-docs.mdc when globs miss. | +| `.cursor/rules/clean-slate-pii-self-audit.mdc` | keyword / `@rule` / plan globs | clean-slate + PII self-audit memory hook. Situational — `pii-fresh-audit` token or globs below; @clean-slate-pii-self-audit.mdc. | | `.cursor/rules/cloud-agents-token-aware-safety.mdc` | keyword / `@rule` / plan globs | Cloud Agents / Cursor Web — token-aware + safety guardrails | | `.cursor/rules/codeql-priority-matrix.mdc` | [".github/workflows/codeql.yml", "SECURITY.md", "SECURITY.pt_BR.md", "api/routes.py", "connectors/**/*.py", "core/licensing/**/*.py", "config/**/*.py", "database/**/*.py"] | Apply CodeQL P0/P1/P2 triage matrix on security/workflow/docs edits | +| `.cursor/rules/collaboration-maintainer-contributor.mdc` | keyword / `@rule` / plan globs | Maintainer vs contributor collaboration. Situational — CONTRIBUTING / COLLABORATION_TEAM globs or @collaboration-maintainer-contributor.mdc. | | `.cursor/rules/compliance-samples-language.mdc` | ["docs/compliance-samples/**/*.yaml", "docs/compliance-samples/**/README*.md", "docs/COMPLIANCE_FRAMEWORKS*.md"] | When adding or editing compliance samples, consider the target audience language(s) (e.g. LGPD → PT-BR + EN; PIPEDA → EN + FR) and document in the sample or COMPLIANCE_FRAMEWORKS. | +| `.cursor/rules/cursor-browser-social-sso-hygiene.mdc` | keyword / `@rule` / plan globs | Cursor IDE browser — SSO/social/Gmail. Situational — browser MCP tasks or @cursor-browser-social-sso-hygiene.mdc. | +| `.cursor/rules/cursor-markdown-preview-guardrail.mdc` | keyword / `@rule` / plan globs | Markdown preview — avoid forced split. Situational — CURSOR_MARKDOWN_PREVIEW docs or @cursor-markdown-preview-guardrail.mdc. | | `.cursor/rules/dependabot-hygiene.mdc` | ["pyproject.toml", "uv.lock", "requirements.txt", ".github/dependabot.yml", ".github/workflows/*.yml"] | When touching dependencies or opportunistically, check Dependabot recommendations; validate and apply only if safe, tests green, and consider adding a regression test. | | `.cursor/rules/doc-and-code-naming.mdc` | ["docs/**/*.md", "**/*.md", "**/*.yaml", "**/*.yml", ".cursor/**/*.mdc", ".cursor/**/SKILL.md"] | Documentation .md files use UPPERCASE subject names; code, config, rules, and skills use lowercase. Use when creating or renaming files under docs/, .cursor/, or repo root. | | `.cursor/rules/doc-hubs-sync-ritual.mdc` | keyword / `@rule` / plan globs | When editing MAP, docs README hub tables, adr README index, AGENTS ADR pointer, or plans sequencing—run plans_hub_sync/plans-stats and paired EN/pt-BR updates. Prevents silent drift vs PLANS_HUB and ADR truth. | @@ -67,6 +57,7 @@ _Generated by `scripts/build_rules_skills_hub.py` — 74 rules, 31 skills. Sessi | `.cursor/rules/docs-private-workspace-context.mdc` | keyword / `@rule` / plan globs | docs/private read cadence + .cursorignore opt-out; gitignore is not GitHub-only — pairs with always-on agent-docs-private-read-access. Situational (globs + private-stack-sync latch). | | `.cursor/rules/docs-pt-br-locale.mdc` | ["**/*.pt_BR.md", "README.pt_BR.md", "SECURITY.pt_BR.md", "CONTRIBUTING.pt_BR.md", "CODE_OF_CONDUCT.pt_BR.md"] | Brazilian Portuguese (pt-BR) docs must not read like European Portuguese (pt-PT). Use with *.pt_BR.md and when editing pt-BR prose; automated guard in tests/test_docs_pt_br_locale.py. | | `.cursor/rules/everything-es-cli.mdc` | keyword / `@rule` / plan globs | Windows primary dev PC — voidtools Everything (es.exe) via scripts/es-find.ps1 for token-aware filename/path search; not on Linux lab-op (use find/fd over SSH). Situational — session es-find or @everything-es-cli.mdc when globs miss. | +| `.cursor/rules/git-pr-sync-before-advice.mdc` | keyword / `@rule` / plan globs | Refresh git/gh before merge/PR advice. Situational — commit/PR scripts and COMMIT_AND_PR docs; @git-pr-sync-before-advice.mdc when globs miss. | | `.cursor/rules/gordon-docker-ai-token-aware.mdc` | keyword / `@rule` / plan globs | Gordon (Docker AI) — token-aware workflow and guardrails | | `.cursor/rules/homelab-ssh-via-terminal.mdc` | keyword / `@rule` / plan globs | Homelab reachability via operator dev PC terminal (ssh, scp, curl to LAN); specifics in gitignored docs/private/homelab/AGENT_LAB_ACCESS.md; never put real hosts in tracked files. Situational — session token homelab or @homelab-ssh-via-terminal.mdc when globs miss. | | `.cursor/rules/host-binding-security.mdc` | ["core/host_resolution.py", "Dockerfile", "docs/USAGE*.md"] | Keep API host binding safe-by-default (CLI loopback, Docker reachable) | @@ -75,7 +66,12 @@ _Generated by `scripts/build_rules_skills_hub.py` — 74 rules, 31 skills. Sessi | `.cursor/rules/lab-external-eval.mdc` | ["docs/ops/LAB_EXTERNAL_CONNECTIVITY_EVAL*.md", "scripts/lab-external-smoke.ps1", "deploy/lab-smoke-stack/docker-compose.mongo.yml"] | Lab external connectivity eval — public APIs and read-only DBs; no secrets in tracked files; pointer to LAB_EXTERNAL_CONNECTIVITY_EVAL.md and external-eval keyword. | | `.cursor/rules/lab-lessons-learned-archive.mdc` | keyword / `@rule` / plan globs | Dated public LAB_LESSONS snapshots under docs/ops/lab_lessons_learned/; hub LAB_LESSONS_LEARNED.md; pair with private COMPLETAO_SESSION; promote follow-ups to PLANS_TODO; session token lab-lessons. | | `.cursor/rules/lab-op-systems-context.mdc` | ["**/*"] | LAB-OP systems context — read before ANY homelab, energy, solar, Enel, HVAC, LAB-ROUTER-01, or hardware task. Token-aware index mapping topics to private files and scripts so the agent never re-discovers on every turn. | +| `.cursor/rules/linguistic-rigor-and-performance.mdc` | keyword / `@rule` / plan globs | Persona Tech Lead + NASA voice + Rust perf gate (0.574x Safe-Hold). Situational — docs/cursor prose or @linguistic-rigor-and-performance.mdc; docs-locale-pt-br-contract stays always-on for pt-BR. | | `.cursor/rules/markdown-lint.mdc` | ["**/*.md", ".cursor/**/*.mdc"] | When creating or editing any .md file, run the markdown lint test and apply the SonarQube fix script so MD060 (table style), MD009, MD012, and other rules pass. Use for changes to README, docs, or any markdown. | +| `.cursor/rules/operator-browser-warm-session.mdc` | keyword / `@rule` / plan globs | Warm browser + Google SSO. Situational — browser/social tasks or @operator-browser-warm-session.mdc. | +| `.cursor/rules/operator-career-private-layout.mdc` | keyword / `@rule` / plan globs | Operator career / LinkedIn / ATS private layout. Situational — career globs or @operator-career-private-layout.mdc. | +| `.cursor/rules/operator-chat-language-pt-br.mdc` | keyword / `@rule` / plan globs | Operator chat language (pt-BR default, EN when asked). Situational — conversational turns; hard pt-BR contract is docs-locale-pt-br-contract.mdc (always-on). @operator-chat-language-pt-br.mdc when globs miss. | +| `.cursor/rules/operator-evidence-backup-no-rhetorical-asks.mdc` | keyword / `@rule` / plan globs | Private evidence mirrors — full mirror set on sync. Situational — `private-stack-sync` token or globs below; @operator-evidence-backup-no-rhetorical-asks.mdc. | | `.cursor/rules/operator-feedback-inbox.mdc` | keyword / `@rule` / plan globs | WRB-style feedback drops — gitignored inbox first; never commit raw payloads; ask before attributing in tracked plans. | | `.cursor/rules/operator-help-sync.mdc` | keyword / `@rule` / plan globs | After changing CLI flags, dashboard scan options, or in-app help, sync operator surfaces and the help manifest (not full doc duplication). | | `.cursor/rules/operator-notification-channels.mdc` | .github/workflows/**,scripts/kpi-export.py,scripts/*notify*,docs/ops/OPERATOR_NOTIFICATION_CHANNELS.md | Prefer at least two operator paths (GitHub + Slack and/or Signal). Telegram is not used for Data Boar ops in this repo; never commit webhooks or Signal bridge secrets. | @@ -85,9 +81,11 @@ _Generated by `scripts/build_rules_skills_hub.py` — 74 rules, 31 skills. Sessi | `.cursor/rules/plan-milestone-and-identity-coherence.mdc` | keyword / `@rule` / plan globs | Single-source pointers for milestone bundles (M-*) and dashboard identity sequencing—do not paste duplicate tables; use when editing sprint/milestone docs, #86, PLANS_TODO, or today-mode production blocks. | | `.cursor/rules/plans-archive-on-completion.mdc` | keyword / `@rule` / plan globs | When a PLAN_*.md is truly done, archive under docs/plans/completed/. Situational — plan paths, plans_hub_sync / plans-stats scripts, or @. | | `.cursor/rules/plans-status-pl-sync.mdc` | keyword / `@rule` / plan globs | Keep PLAN_*.md header Status, body to-dos, and PLANS_TODO.md in sync—reduces silent drift. Situational — plan globs or session docs/feature/houseclean/backlog or @. | +| `.cursor/rules/pre-commit-ruff.mdc` | ["**/*.py", ".pre-commit-config.yaml"] | Recommend and enforce pre-commit (Ruff + plans-stats + doc guards) before commits and PRs; CI runs the same bundle. | | `.cursor/rules/quality-sonarqube-codeql.mdc` | ["**/*.py", "**/*.md", ".cursor/**/*.mdc"] | When editing Python or markdown, avoid SonarQube and CodeQL violations; run the project quality tests after changes so CI stays green. | | `.cursor/rules/release-publish-sequencing.mdc` | keyword / `@rule` / plan globs | Mandatory order for shipping a semver — tag vX.Y.Z, GitHub Release, Docker Desktop smoke before Hub push, prune, Hub UI + PUBLISHED_SYNC; only then pre-release bump on main. Situational — session release-ritual or @ when globs miss. | -| `.cursor/rules/release-versioning.mdc` | keyword / `@rule` / plan globs | Release/version guardrails — commit vs release gate, ADR-0073 side-channel, semver TBD, no 1.7.5. Situational — semver bumps, VERSIONING, pyproject version. | +| `.cursor/rules/release-versioning.mdc` | keyword / `@rule` / plan globs | Release/version guardrails — commit gate vs release gate, ADR-0073 side-channel, no 1.7.5, semver TBD. Situational — semver bumps, VERSIONING, pyproject version. | +| `.cursor/rules/repo-scripts-wrapper-ritual.mdc` | keyword / `@rule` / plan globs | Repo script wrappers before ad-hoc shell. Situational — scripts/** or TOKEN_AWARE_SCRIPTS_HUB globs; @repo-scripts-wrapper-ritual.mdc when globs miss. | | `.cursor/rules/sonarqube_mcp_instructions.mdc` | keyword / `@rule` / plan globs | SonarQube MCP Server usage guidelines in Cursor. Situational — sonar home-lab docs, sonar-project.properties, quality rule/skill, or session sonar-mcp / @. | | `.cursor/rules/study-cadence-reminders.mdc` | keyword / `@rule` / plan globs | Study cadence reminders — calendar vs deep code; nudge at natural stopping points. Situational — portfolio/sprints/operator manual docs or study-check / @. | | `.cursor/rules/yaml-regex-patterns.mdc` | ["**/compliance-sample-*.yaml", "**/regex_overrides*.yaml", "**/*.example.yaml"] | When editing YAML files that contain regex patterns (compliance samples, regex_overrides), use double-quoted strings with escaped backslashes to avoid linter errors and invalid escapes. | @@ -134,4 +132,4 @@ _Generated by `scripts/build_rules_skills_hub.py` — 74 rules, 31 skills. Sessi - Hub pattern: [ADR-0057](../adr/ADR-0057-lightweight-hub-index-co-located-links.md). - Cross-cutting map: [INDEX.md](INDEX.md). - + diff --git a/docs/hubs/RULES_AND_SKILLS_HUB.pt_BR.md b/docs/hubs/RULES_AND_SKILLS_HUB.pt_BR.md index 515364a11..901f7069e 100644 --- a/docs/hubs/RULES_AND_SKILLS_HUB.pt_BR.md +++ b/docs/hubs/RULES_AND_SKILLS_HUB.pt_BR.md @@ -6,7 +6,7 @@ ## Resumo -- **Regras:** 74 arquivos `.mdc` (36 always-on, 38 situacionais). +- **Regras:** 72 arquivos `.mdc` (18 always-on, 54 situacionais). - **Skills:** 31 pastas com `SKILL.md`. - **Keywords de sessão:** 7 tokens em `session-mode-keywords.mdc`. diff --git a/docs/ops/CURSOR_AGENT_POLICY_HUB.md b/docs/ops/CURSOR_AGENT_POLICY_HUB.md index 3e2200eac..5dacd0836 100644 --- a/docs/ops/CURSOR_AGENT_POLICY_HUB.md +++ b/docs/ops/CURSOR_AGENT_POLICY_HUB.md @@ -15,7 +15,7 @@ This page is **consolidation phase B**: the same **theme → first place to look | **Cold start (fresh agent, token-aware)** — ladder + task router | [OPERATOR_AGENT_COLD_START_LADDER.md](OPERATOR_AGENT_COLD_START_LADDER.md) ([pt-BR](OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md)) | | **`.cursor/` / `.vscode/` / `.github/` / caches** — what is tracked vs gitignored | [CURSOR_AND_EDITOR_ARTIFACTS.md](CURSOR_AND_EDITOR_ARTIFACTS.md) | | **`docs/private/`** read access / never self-block | [`.cursor/rules/agent-docs-private-read-access.mdc`](../../.cursor/rules/agent-docs-private-read-access.mdc) (**always-on**) · [`.cursor/rules/docs-private-workspace-context.mdc`](../../.cursor/rules/docs-private-workspace-context.mdc) (**situational** — **`private-stack-sync`** or **`@docs-private-workspace-context.mdc`**) · [First `AGENTS.md` bullet after the Quick index](../../AGENTS.md) · [`docs/PRIVATE_OPERATOR_NOTES.md`](../PRIVATE_OPERATOR_NOTES.md) · [OPERATOR_AGENT_COLD_START_LADDER.md](OPERATOR_AGENT_COLD_START_LADDER.md) § *Token → rule latch (`private-stack-sync`)* ([pt-BR](OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md)) | -| Chat **pt-BR** / locale (private `docs/private/` Portuguese = pt-BR; explicit EN prose → `en-US`) | [`.cursor/rules/docs-locale-pt-br-contract.mdc`](../../.cursor/rules/docs-locale-pt-br-contract.mdc) (always) · [`.cursor/rules/operator-chat-language.mdc`](../../.cursor/rules/operator-chat-language.mdc) · [`.cursor/rules/operator-chat-language-pt-br.mdc`](../../.cursor/rules/operator-chat-language-pt-br.mdc) · [`.cursor/rules/docs-pt-br-locale.mdc`](../../.cursor/rules/docs-pt-br-locale.mdc) · [`.cursor/skills/operator-dialogue-pt-br/SKILL.md`](../../.cursor/skills/operator-dialogue-pt-br/SKILL.md) · [`.cursor/skills/documentation-en-pt-br/SKILL.md`](../../.cursor/skills/documentation-en-pt-br/SKILL.md) | +| Chat **pt-BR** / locale (private `docs/private/` Portuguese = pt-BR; explicit EN prose → `en-US`) | [`.cursor/rules/docs-locale-pt-br-contract.mdc`](../../.cursor/rules/docs-locale-pt-br-contract.mdc) (always) · [`.cursor/rules/operator-chat-language-pt-br.mdc`](../../.cursor/rules/operator-chat-language-pt-br.mdc) (situational) · [`.cursor/rules/docs-pt-br-locale.mdc`](../../.cursor/rules/docs-pt-br-locale.mdc) · [`.cursor/skills/operator-dialogue-pt-br/SKILL.md`](../../.cursor/skills/operator-dialogue-pt-br/SKILL.md) · [`.cursor/skills/documentation-en-pt-br/SKILL.md`](../../.cursor/skills/documentation-en-pt-br/SKILL.md) | | **Session keywords** (deps, feature, `es-find`, …) | [`.cursor/rules/session-mode-keywords.mdc`](../../.cursor/rules/session-mode-keywords.mdc) | | **Rules and skills index** (all `.mdc` + skills) | [`docs/hubs/RULES_AND_SKILLS_HUB.md`](../hubs/RULES_AND_SKILLS_HUB.md) ([pt-BR](../hubs/RULES_AND_SKILLS_HUB.pt_BR.md)) · `scripts/build_rules_skills_hub.py` | | **Windows Everything / `es-find` (filename search)** | [`.cursor/rules/everything-es-cli.mdc`](../../.cursor/rules/everything-es-cli.mdc) (**situational** — session **`es-find`** or **`@everything-es-cli.mdc`**) · [`.cursor/rules/windows-pcloud-drive-search-discipline.mdc`](../../.cursor/rules/windows-pcloud-drive-search-discipline.mdc) (**always-on**) · [`EVERYTHING_ES_PRIMARY_WINDOWS_DEV_LAB.md`](EVERYTHING_ES_PRIMARY_WINDOWS_DEV_LAB.md) ([pt-BR](EVERYTHING_ES_PRIMARY_WINDOWS_DEV_LAB.pt_BR.md)) · [`.cursor/skills/everything-es-search/SKILL.md`](../../.cursor/skills/everything-es-search/SKILL.md) · [OPERATOR_AGENT_COLD_START_LADDER.md](OPERATOR_AGENT_COLD_START_LADDER.md) § *Token → rule latch (`es-find`)* ([pt-BR](OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md)) | diff --git a/docs/ops/CURSOR_AGENT_POLICY_HUB.pt_BR.md b/docs/ops/CURSOR_AGENT_POLICY_HUB.pt_BR.md index 367d8332b..64760a757 100644 --- a/docs/ops/CURSOR_AGENT_POLICY_HUB.pt_BR.md +++ b/docs/ops/CURSOR_AGENT_POLICY_HUB.pt_BR.md @@ -15,7 +15,7 @@ Esta página é a **fase B de consolidação**: o mesmo mapa **tema → primeiro | **Arranque a frio (agente novo, token-aware)** — escada + router de tarefas | [OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md](OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md) ([EN](OPERATOR_AGENT_COLD_START_LADDER.md)) | | **`.cursor/` / `.vscode/` / `.github/` / caches** — o que é versionado vs gitignore | [CURSOR_AND_EDITOR_ARTIFACTS.pt_BR.md](CURSOR_AND_EDITOR_ARTIFACTS.pt_BR.md) | | Leitura de **`docs/private/`** / nunca bloquear o agente | [`.cursor/rules/agent-docs-private-read-access.mdc`](../../.cursor/rules/agent-docs-private-read-access.mdc) (**sempre ligada**) · [`.cursor/rules/docs-private-workspace-context.mdc`](../../.cursor/rules/docs-private-workspace-context.mdc) (**situacional** — **`private-stack-sync`** ou **`@docs-private-workspace-context.mdc`**) · [Primeiro bullet do `AGENTS.md` depois do Quick index](../../AGENTS.md) · [`docs/PRIVATE_OPERATOR_NOTES.md`](../PRIVATE_OPERATOR_NOTES.md) · [OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md](OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md) § *Presilha token → regra (`private-stack-sync`)* ([EN](OPERATOR_AGENT_COLD_START_LADDER.md)) | -| Chat **pt-BR** / locale (PT em `docs/private/` = pt-BR; prosa só EN → `en-US`) | [`.cursor/rules/docs-locale-pt-br-contract.mdc`](../../.cursor/rules/docs-locale-pt-br-contract.mdc) (sempre) · [`.cursor/rules/operator-chat-language.mdc`](../../.cursor/rules/operator-chat-language.mdc) · [`.cursor/rules/operator-chat-language-pt-br.mdc`](../../.cursor/rules/operator-chat-language-pt-br.mdc) · [`.cursor/rules/docs-pt-br-locale.mdc`](../../.cursor/rules/docs-pt-br-locale.mdc) · [`.cursor/skills/operator-dialogue-pt-br/SKILL.md`](../../.cursor/skills/operator-dialogue-pt-br/SKILL.md) · [`.cursor/skills/documentation-en-pt-br/SKILL.md`](../../.cursor/skills/documentation-en-pt-br/SKILL.md) | +| Chat **pt-BR** / locale (PT em `docs/private/` = pt-BR; prosa só EN → `en-US`) | [`.cursor/rules/docs-locale-pt-br-contract.mdc`](../../.cursor/rules/docs-locale-pt-br-contract.mdc) (sempre) · [`.cursor/rules/operator-chat-language-pt-br.mdc`](../../.cursor/rules/operator-chat-language-pt-br.mdc) (situacional) · [`.cursor/rules/docs-pt-br-locale.mdc`](../../.cursor/rules/docs-pt-br-locale.mdc) · [`.cursor/skills/operator-dialogue-pt-br/SKILL.md`](../../.cursor/skills/operator-dialogue-pt-br/SKILL.md) · [`.cursor/skills/documentation-en-pt-br/SKILL.md`](../../.cursor/skills/documentation-en-pt-br/SKILL.md) | | **Palavras-chave de sessão** (deps, feature, `es-find`, …) | [`.cursor/rules/session-mode-keywords.mdc`](../../.cursor/rules/session-mode-keywords.mdc) | | **Everything no Windows / `es-find` (busca por nome)** | [`.cursor/rules/everything-es-cli.mdc`](../../.cursor/rules/everything-es-cli.mdc) (**situacional** — sessão **`es-find`** ou **`@everything-es-cli.mdc`**) · [`.cursor/rules/windows-pcloud-drive-search-discipline.mdc`](../../.cursor/rules/windows-pcloud-drive-search-discipline.mdc) (**sempre ligada**) · [`EVERYTHING_ES_PRIMARY_WINDOWS_DEV_LAB.pt_BR.md`](EVERYTHING_ES_PRIMARY_WINDOWS_DEV_LAB.pt_BR.md) ([EN](EVERYTHING_ES_PRIMARY_WINDOWS_DEV_LAB.md)) · [`.cursor/skills/everything-es-search/SKILL.md`](../../.cursor/skills/everything-es-search/SKILL.md) · [OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md](OPERATOR_AGENT_COLD_START_LADDER.pt_BR.md) § *Presilha token → regra (`es-find`)* ([EN](OPERATOR_AGENT_COLD_START_LADDER.md)) | | **Scripts acordados / ritual de wrappers** (hub + `scripts/*.ps1` antes de shell ad hoc longo) | [`.cursor/rules/repo-scripts-wrapper-ritual.mdc`](../../.cursor/rules/repo-scripts-wrapper-ritual.mdc) · [`TOKEN_AWARE_SCRIPTS_HUB.pt_BR.md`](TOKEN_AWARE_SCRIPTS_HUB.pt_BR.md) ([EN](TOKEN_AWARE_SCRIPTS_HUB.md)) · [`.cursor/rules/check-all-gate.mdc`](../../.cursor/rules/check-all-gate.mdc) · [`.cursor/skills/token-aware-automation/SKILL.md`](../../.cursor/skills/token-aware-automation/SKILL.md) | diff --git a/docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.md b/docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.md index 19d3548d8..20c95f860 100644 --- a/docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.md +++ b/docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.md @@ -88,9 +88,43 @@ So: **locale = strong forced contextual behaviour** in the sense of **non-negoti 2. **Release sequencing is already situational:** **`release-publish-sequencing.mdc`** binds on **`release-ritual`** / release **`globs`**. The **always-on** rule covers the **cross-cutting** “clean up after yourself” layer that also applies **outside** a full publish (local experiments, CI debugging). 3. **Failure mode:** If situationalized, assistants often **skip** prune/smoke cleanup in threads where only `main.py` is open—exactly when disk and tag hygiene still matter. -## Tier B — evaluation backlog (not committed) +## Tier B — situationalized (issue #1154, 2026-07) -Candidates are **always-on today** (or broad) and *might* be narrowed **later** after per-rule review. **Do not** batch-flip without checking blast radius. +**Meta:** reduce baseline noise; **not** a magic target of ~13 always-on rules. Rollback: `git revert` the Tier B commit. + +| Rule file | Latch (token / `@` / globs) | +| --------- | --------------------------- | +| **`agent-autonomous-merge-and-lab-ops.mdc`** | **`completao`**, **`homelab`**, `scripts/pr-merge-when-green*`, `scripts/lab-op*` | +| **`ats-locale-aware-recommendations.mdc`** | **`talent-ats`**, `docs/ops/LINKEDIN_ATS_PLAYBOOK*` | +| **`audience-segmentation-docs.mdc`** | **`docs`**, **`feature`**, `docs/**` | +| **`clean-slate-pii-self-audit.mdc`** | **`pii-fresh-audit`**, `docs/ops/PII_*` | +| **`collaboration-maintainer-contributor.mdc`** | `CONTRIBUTING.md`, `docs/COLLABORATION_TEAM*` | +| **`cursor-browser-social-sso-hygiene.mdc`** | browser MCP / social tokens; **`@cursor-browser-social-sso-hygiene.mdc`** | +| **`cursor-markdown-preview-guardrail.mdc`** | `docs/ops/CURSOR_MARKDOWN_PREVIEW*` | +| **`git-pr-sync-before-advice.mdc`** | `docs/ops/COMMIT_AND_PR*`, `scripts/commit-or-pr*` | +| **`operator-browser-warm-session.mdc`** | browser/social tasks; **`@operator-browser-warm-session.mdc`** | +| **`operator-career-private-layout.mdc`** | **`operator-sli-check`**, `docs/ops/LINKEDIN_ATS*` | +| **`operator-evidence-backup-no-rhetorical-asks.mdc`** | **`private-stack-sync`**, `scripts/private-git-sync*` | +| **`pre-commit-ruff.mdc`** | `**/*.py`, `.pre-commit-config.yaml` | +| **`repo-scripts-wrapper-ritual.mdc`** | `scripts/**`, `docs/ops/TOKEN_AWARE_SCRIPTS*` | +| **`agent-session-ritual-sync-main-and-private-stack.mdc`** | **`carryover-sweep`**, **`eod-sync`**, **`private-stack-sync`**, `docs/ops/today-mode/**` | + +### Merged (redundancy — not new always-on) + +- **`operator-chat-language.mdc`** → **`operator-chat-language-pt-br.mdc`** (situational; **`docs-locale-pt-br-contract.mdc`** stays always-on). +- **`persona-rigor.mdc`** → **`linguistic-rigor-and-performance.mdc`** (situational). + +### Workstation protection — reframed, still always-on + +- **`primary-linux-workstation-protected-no-destructive-repo-ops.mdc`** and **`primary-windows-workstation-protected-no-destructive-repo-ops.mdc`** — **main dev box** vs **secondary** (Linux / L-series) naming; **same destructive-repo rigor** on whichever machine holds the canonical clone. + +### Borderline — left always-on (judgment) + +- **`check-all-gate.mdc`**, **`execution-priority-and-pr-batching.mdc`**, **`operator-investigation-before-blocking.mdc`**, **`operator-mandate-vs-external-limits.mdc`** + +## Tier B — evaluation backlog (superseded by wave above) + +_The table below is **historical** pre-#1154; use the [Tier B situationalized](#tier-b--situationalized-issue-1154-2026-07) inventory for current state._ | Rule (examples) | Why it might be Tier B later | Why wait / caution | | --------------- | ---------------------------- | ------------------- | diff --git a/docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.pt_BR.md b/docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.pt_BR.md index d12bdb289..e24d88c41 100644 --- a/docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.pt_BR.md +++ b/docs/ops/CURSOR_RULES_PHASE2_SITUATIONALIZATION.pt_BR.md @@ -88,9 +88,11 @@ Em resumo: **locale = comportamento contextual forte** no sentido de **disciplin 2. **A sequência de release já é situacional:** **`release-publish-sequencing.mdc`** liga com **`release-ritual`** / **globs** de release. A regra **sempre ligada** cobre a camada transversal “limpar depois de si” que também vale **fora** de publicação completa (experiências locais, depuração de CI). 3. **Modo de falha:** Se fosse situacional, assistentes muitas vezes **saltam** prune/higiene de smoke em fios onde só `main.py` está aberto — precisamente quando disco e tags ainda importam. -## Tier B — backlog de avaliação (não comprometido) +## Tier B — situacionalizadas (issue #1154, 2026-07) -Candidatos estão **sempre ligados hoje** (ou amplos) e *podem* ser estreitados **mais tarde** após revisão por regra. **Não** fazer viragem em lote sem avaliar blast radius. +Inventário completo (EN): [Tier B situationalized](CURSOR_RULES_PHASE2_SITUATIONALIZATION.md#tier-b--situationalized-issue-1154-2026-07). **Meta:** reduzir ruído; rollback = `git revert`. **Always-on:** 36 → 18 (não meta mágica ~13). + +## Tier B — backlog de avaliação (histórico pré-#1154) | Regra (exemplos) | Por que poderia ser Tier B depois | Por que esperar / cuidado | | ---------------- | ----------------------------------- | -------------------------- | diff --git a/tests/test_no_legacy_cursorrules.py b/tests/test_no_legacy_cursorrules.py index 7d496e055..3cdf5cce2 100644 --- a/tests/test_no_legacy_cursorrules.py +++ b/tests/test_no_legacy_cursorrules.py @@ -9,7 +9,7 @@ version. Migration completed: 2026-05-12. Reference: commit 817cdf5. -See `.cursor/rules/persona-rigor.mdc`, `.cursor/rules/linguistic-rigor-and-performance.mdc`, +See `.cursor/rules/linguistic-rigor-and-performance.mdc`, `.cursor/rules/operator-notification-channels.mdc`, ADR-0047, ADR-0048, ADR-0049, and `.cursor/skills/linguistic-rigor-active-voice/SKILL.md`. """