DataBoar · FabioLeitao · Jul 3, 2026
diff --git a/.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc b/.cursor/rules/agent-autonomous-merge-and-lab-ops.mdc
@@ -1,6 +1,11 @@
 ---
-description: When safe (CI green, mergeable, docs aligned), complete PR merge via scripts/ without asking permission; run LAB-OP SSH collection scripts from terminal; escalate on failures or regressions.
-alwaysApply: true
+description: Autonomous merge when green and LAB-OP SSH collection. Situational — `completao` / `homelab` tokens or @agent-autonomous-merge-and-lab-ops.mdc when globs miss.
+globs:
+  - scripts/pr-merge-when-green.ps1
+  - scripts/lab-op*
+  - scripts/lab-completao*
+  - docs/ops/LAB_COMPLETAO*
+alwaysApply: false
 ---
 
 # Autonomous merge + LAB-OP (operator trust)

diff --git a/.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc b/.cursor/rules/agent-session-ritual-sync-main-and-private-stack.mdc
@@ -1,6 +1,10 @@
 ---
-description: Start sessions with git fetch/status; pull main when behind; integrate origin/main on feature branches; private-git-sync after meaningful docs/private changes; next steps without redundant asks; sidequest exception; protect canonical primary dev clone.
-alwaysApply: true
+description: Session ritual — synced main, private stack, today-mode. Situational — `carryover-sweep` / `eod-sync` / `private-stack-sync` or globs below; @agent-session-ritual-sync-main-and-private-stack.mdc.
+globs:
+  - docs/ops/today-mode/**
+  - docs/ops/PRIVATE_STACK_SYNC*
+  - AGENTS.md
+alwaysApply: false
 ---
 
 # Agent session ritual — synced `main`, private stack, next steps

diff --git a/.cursor/rules/ats-locale-aware-recommendations.mdc b/.cursor/rules/ats-locale-aware-recommendations.mdc
@@ -1,7 +1,10 @@
 ---
-description: Talent ATS / LinkedIn recommendations must match candidate target locale and jurisdiction (en_CA+PIPEDA for Canada, not default GDPR); verify certification pricing in local currency
-globs: ["**/*"]
-alwaysApply: true
+description: Talent ATS / LinkedIn recommendations — locale-aware. Situational — `talent-ats` token or globs below; @ats-locale-aware-recommendations.mdc.
+globs:
+  - docs/ops/LINKEDIN_ATS_PLAYBOOK*
+  - docs/private.example/commercial/**
+  - .cursor/skills/candidate-ats-evaluation/**
+alwaysApply: false
 ---
 
 # ATS / talent recommendations — locale and jurisdiction

diff --git a/.cursor/rules/audience-segmentation-docs.mdc b/.cursor/rules/audience-segmentation-docs.mdc
@@ -1,6 +1,10 @@
 ---
-description: Audience segmentation for docs navigation and link boundaries (external vs internal vs private-secrets)
-alwaysApply: true
+description: Audience segmentation for docs. Situational — `docs` / `feature` tokens or docs/** globs; @audience-segmentation-docs.mdc when globs miss.
+globs:
+  - docs/**
+  - README.md
+  - CONTRIBUTING.md
+alwaysApply: false
 ---
 
 # Audience segmentation guardrail (docs and training materials)

diff --git a/.cursor/rules/clean-slate-pii-self-audit.mdc b/.cursor/rules/clean-slate-pii-self-audit.mdc
@@ -1,7 +1,10 @@
 ---
-description: Where clean-slate lives, how it fits PII self-audit vs filter-repo; assistants must not simulate runs — use real guards or point to PII guide H.9–H.10; primary Windows dev PC never runs destructive clean-slate / rewrite
-globs: ["**/*"]
-alwaysApply: true
+description: clean-slate + PII self-audit memory hook. Situational — `pii-fresh-audit` token or globs below; @clean-slate-pii-self-audit.mdc.
+globs:
+  - docs/ops/PII_FRESH_CLONE*
+  - docs/ops/PII_PUBLIC_TREE*
+  - scripts/pii-fresh-clone*
+alwaysApply: false
 ---
 
 # `clean-slate` + PII — memory hook (no simulation)

diff --git a/.cursor/rules/collaboration-maintainer-contributor.mdc b/.cursor/rules/collaboration-maintainer-contributor.mdc
@@ -1,7 +1,9 @@
 ---
-description: Maintainer vs contributor collaboration — Git identity, no implicit "who is typing", follow AGENTS.md
-globs: ["**/*"]
-alwaysApply: true
+description: Maintainer vs contributor collaboration. Situational — CONTRIBUTING / COLLABORATION_TEAM globs or @collaboration-maintainer-contributor.mdc.
+globs:
+  - docs/COLLABORATION_TEAM*
+  - CONTRIBUTING.md
+alwaysApply: false
 ---
 
 # Maintainer / contributor collaboration (Cursor)

diff --git a/.cursor/rules/cursor-browser-social-sso-hygiene.mdc b/.cursor/rules/cursor-browser-social-sso-hygiene.mdc
@@ -1,6 +1,9 @@
 ---
-description: Cursor IDE browser — same workstation as SSH: all operator social + Gmail + dashboards; try MCP then Google SSO when cold; only escalate to operator after a real failed attempt
-alwaysApply: true
+description: Cursor IDE browser — SSO/social/Gmail. Situational — browser MCP tasks or @cursor-browser-social-sso-hygiene.mdc.
+globs:
+  - .cursor/skills/cursor-browser-social-session/**
+  - docs/ops/OPERATOR_NOTIFICATION_CHANNELS*
+alwaysApply: false
 ---
 
 # Cursor browser (redes, Patreon, pesquisa)

diff --git a/.cursor/rules/cursor-markdown-preview-guardrail.mdc b/.cursor/rules/cursor-markdown-preview-guardrail.mdc
@@ -1,6 +1,9 @@
 ---
-description: Keep Markdown preview opening as a normal tab (not forced side-by-side split) in Cursor/VS Code on Windows.
-alwaysApply: true
+description: Markdown preview — avoid forced split. Situational — CURSOR_MARKDOWN_PREVIEW docs or @cursor-markdown-preview-guardrail.mdc.
+globs:
+  - docs/ops/CURSOR_MARKDOWN_PREVIEW*
+  - scripts/check-cursor-markdown*
+alwaysApply: false
 ---
 
 # Markdown preview: avoid forced GUI split (operator workstation)

diff --git a/.cursor/rules/git-pr-sync-before-advice.mdc b/.cursor/rules/git-pr-sync-before-advice.mdc
@@ -1,7 +1,12 @@
 ---
-description: Refresh git/gh state before merge/PR advice or sharing PR URLs (avoid stale PR numbers)
-globs: ["**/*"]
-alwaysApply: true
+description: Refresh git/gh before merge/PR advice. Situational — commit/PR scripts and COMMIT_AND_PR docs; @git-pr-sync-before-advice.mdc when globs miss.
+globs:
+  - docs/ops/COMMIT_AND_PR*
+  - CONTRIBUTING.md
+  - scripts/commit-or-pr*
+  - scripts/create-pr*
+  - scripts/preview-commit*
+alwaysApply: false
 ---
 
 # Git / GitHub PR state — sync before advice

diff --git a/.cursor/rules/linguistic-rigor-and-performance.mdc b/.cursor/rules/linguistic-rigor-and-performance.mdc
@@ -1,21 +1,31 @@
 ---
-description: Impoe o tom de voz NASA e o gate de performance de 0.574x.
-alwaysApply: true
+description: Persona Tech Lead + NASA voice + Rust perf gate (0.574x Safe-Hold). Situational — docs/cursor prose or @linguistic-rigor-and-performance.mdc; docs-locale-pt-br-contract stays always-on for pt-BR.
+globs:
+  - docs/**
+  - .cursor/rules/**
+  - .cursor/skills/**
+alwaysApply: false
 ---
 
-# Rigor Linguistico e de Performance
+# Persona, rigor linguistico e performance (Data Boar Protocol)
 
-## 1. Voz Ativa e Comando (NASA Style)
+## 1. Persona — Tech Lead de Trincheira
+
+- **Verbos de acao:** Proibido voz passiva em PT-BR. Use "O sistema executa", "O gate impede".
+- **Fidelidade ao Rust:** O `boar_fast_filter` e o coracao. Se houver lentidao, a solucao e nativa (Rust), nao remendo em Python.
+- **Rigor documental:** Documentacao desatualizada e BUG de severidade alta.
+
+## 2. Voz ativa e comando (NASA style)
 
 - **Proibido:** Voz passiva ("Os logs sao gerados", "E permitido").
 - **Obrigatorio:** Verbos de acao direta ("O sistema gera logs", "O gate impede a execucao").
 - **Abstracao (LCM):** Use descricoes concretas de funcoes de codigo, nao metaforas vagas.
 
-## 2. Gate de Performance
+## 3. Gate de performance
 
 - O motor Rust e a prioridade. NUNCA mascare lentidao com "ajustes de sintaxe" em Python.
 - Se a performance cair abaixo de **0.574x**, entre em **NASA Safe-Hold**: pare tudo e reporte o gargalo.
 
-## 3. Taxonomia Sagrada
+## 4. Taxonomia intocavel
 
 Mantenha os termos originais: Data Sniffing, Deep Boring, Safe-Hold, Audit Trail.
diff --git a/.cursor/rules/operator-browser-warm-session.mdc b/.cursor/rules/operator-browser-warm-session.mdc
@@ -1,6 +1,8 @@
 ---
-description: Warm browser + Google SSO — try MCP on social, Gmail/webmail, Docker Hub, and other operator dashboards before permission pings or paste-only handoffs
-alwaysApply: true
+description: Warm browser + Google SSO. Situational — browser/social tasks or @operator-browser-warm-session.mdc.
+globs:
+  - .cursor/skills/cursor-browser-social-session/**
+alwaysApply: false
 ---
 
 # Operator social / browser (Cursor IDE)

diff --git a/.cursor/rules/operator-career-private-layout.mdc b/.cursor/rules/operator-career-private-layout.mdc
@@ -1,6 +1,9 @@
 ---
-description: Where to place operator career, LinkedIn, ATS, and SLI private files (not talent-pool candidates).
-alwaysApply: true
+description: Operator career / LinkedIn / ATS private layout. Situational — career globs or @operator-career-private-layout.mdc.
+globs:
+  - docs/private.example/author_info/**
+  - docs/ops/LINKEDIN_ATS*
+alwaysApply: false
 ---
 
 # Operator career / LinkedIn / ATS / SLI — private layout

diff --git a/.cursor/rules/operator-chat-language-pt-br.mdc b/.cursor/rules/operator-chat-language-pt-br.mdc
@@ -1,7 +1,9 @@
 ---
-description: Operator conversational language — Brazilian Portuguese (pt-BR) or English; never European Portuguese (pt-PT).
+description: Operator chat language (pt-BR default, EN when asked). Situational — conversational turns; hard pt-BR contract is docs-locale-pt-br-contract.mdc (always-on). @operator-chat-language-pt-br.mdc when globs miss.
 globs:
-alwaysApply: true
+  - docs/private.example/**
+  - AGENTS.md
+alwaysApply: false
 ---
 
 # Operator chat language (this workspace)
@@ -11,11 +13,15 @@ When talking **conversationally** with the project operator **in Portuguese**:
 1. Use **Brazilian Portuguese (pt-BR)** only — **same lexical and style bar** as **`*.pt_BR.md`** and **`.cursor/rules/docs-pt-br-locale.mdc`** (e.g. **arquivo**, **compartilhar**, **seção**, **usuário**, **precisa/tem que** for obligation — not *ficheiro*, *partilhar*, *secção*, *utilizador*, *tem de*). Prefer **você** (or neutral phrasing) and Brazilian verb agreement (**você tem**, **você faz**, **está**).
 1. **English in the same message is OK** where it helps: **commands**, **API paths**, **flags**, **product/brand names**, and **stable technical jargon** the repo already keeps in English — **code-switch** naturally; do not force awkward literal translations of terms that are idiomatically left in EN in this project.
 1. **Do not** write in **European Portuguese (pt-PT)** — avoid **tu** + **tens/fazes/trazes**, PT-only vocabulary, or conjugations that read as Portugal unless the operator **explicitly** asks for pt-PT for a specific purpose.
-1. If the operator’s message is in **English**, or Portuguese would be ambiguous, reply in **English** for that turn — acceptable and often clearer for technical work.
+1. If the operator's message is in **English**, or Portuguese would be ambiguous, reply in **English** for that turn — acceptable and often clearer for technical work.
+1. If the operator says they prefer **English** in this thread, use **English** for narrative until they switch back.
 1. **Tracked documentation:** EN is canonical written source; **pt-BR** mirrors EN. When editing or suggesting pt-BR doc text, keep it **Brazilian**. Hard contract: **`.cursor/rules/docs-locale-pt-br-contract.mdc`** (always applied). CI-style guard: **`tests/test_docs_pt_br_locale.py`**.
 1. **Private drafts and operator Markdown (`docs/private/`, including `social_drafts/`):** Any **Portuguese** prose should follow the **same pt-BR** lexical bar as **`docs-pt-br-locale.mdc`** (not pt-PT), even when the filename is not **`*.pt_BR.md`**.
 1. **Explicitly English content:** When writing or revising **English-only** prose (not just inline jargon), prefer **`en-US`** spelling and conventions for narrative text.
+1. **Unchanged in any language:** File paths, `code`, **Conventional Commits** types/scopes, CLI flags, API names, and **English-only** plan tokens (`deps`, `feature`, `homelab`, …) stay **English**.
 
 **Skill (optional reminder for the operator):** `.cursor/skills/operator-dialogue-pt-br/SKILL.md`.
 
 If unsure, **default to English** for the reply rather than mixing pt-PT habits into pt-BR.
+
+See **`AGENTS.md`** (chat language bullet) and **`docs/PRIVATE_OPERATOR_NOTES.md`** §5.1.
diff --git a/.cursor/rules/operator-chat-language.mdc b/.cursor/rules/operator-chat-language.mdc
diff --git a/.cursor/rules/operator-evidence-backup-no-rhetorical-asks.mdc b/.cursor/rules/operator-evidence-backup-no-rhetorical-asks.mdc
@@ -1,7 +1,9 @@
 ---
-description: Private progress history and backups — update every configured mirror without asking obvious permission; hope is not a plan.
+description: Private evidence mirrors — full mirror set on sync. Situational — `private-stack-sync` token or globs below; @operator-evidence-backup-no-rhetorical-asks.mdc.
 globs:
-alwaysApply: true
+  - docs/ops/PRIVATE_STACK_SYNC*
+  - scripts/private-git-sync*
+alwaysApply: false
 ---
 
 # Evidence, private Git history, and redundant mirrors

diff --git a/.cursor/rules/persona-rigor.mdc b/.cursor/rules/persona-rigor.mdc
diff --git a/.cursor/rules/pre-commit-ruff.mdc b/.cursor/rules/pre-commit-ruff.mdc
@@ -1,7 +1,7 @@
 ---
 description: Recommend and enforce pre-commit (Ruff + plans-stats + doc guards) before commits and PRs; CI runs the same bundle.
 globs: ["**/*.py", ".pre-commit-config.yaml"]
-alwaysApply: true
+alwaysApply: false
 ---
 
 # Pre-commit and Ruff (recommended before every commit)

diff --git a/.cursor/rules/primary-linux-workstation-protected-no-destructive-repo-ops.mdc b/.cursor/rules/primary-linux-workstation-protected-no-destructive-repo-ops.mdc
@@ -1,5 +1,5 @@
 ---
-description: Primary Linux dev workstation — never run clean-slate, history rewrite, or destructive repo reset on the canonical clone; temporary while Windows primary is in Lenovo repair (E0482B2DMD)
+description: Main dev box (canonical clone) — Linux role today (LMDE); same destructive-repo prohibitions whenever this machine holds the canonical tree; secondary Windows uses same rigor when role moves.
 globs: ["**/*"]
 alwaysApply: true
 ---
@@ -8,7 +8,7 @@ alwaysApply: true
 
 ## Scope
 
-- **primary Linux dev workstation** (LMDE 7) is the operator’s **primary dev workstation** **temporarily** (former Windows primary failed **2026-06-07**; Lenovo case **E0482B2DMD**) where the **canonical** `data-boar` working tree, **evidence**, and **long-lived Git history** must stay intact. Tracked docs use **role labels**, not hostnames to paste into commits.
+- **Main dev box (Linux role today):** **primary Linux dev workstation** (LMDE 7) currently holds the **canonical** `data-boar` clone when the Windows primary is in repair. **Secondary** Windows (L-series) keeps the **same destructive-repo rigor** when it holds or regains the canonical clone — see **`primary-windows-workstation-protected-no-destructive-repo-ops.mdc`**. Tracked docs use **role labels**, not hostnames or hardware IDs in commits.
 - **`DATA_BOAR_ROOT`** (operator default **`~/Projects/dev/data-boar`**) is **intouchable** for **`rm -rf`**, **`clean-slate`**, **`git reset --hard`**, **`git clean -fdx`**, or history rewrite in routine sessions.
 - **lab-op** and other **manifest SSH hosts** are **not** this canonical tree: destructive align scripts **only** apply on those remote **`repoPaths`** — see **`docs/ops/LAB_COMPLETAO_RUNBOOK.md`** (*Blast radius*) and **`docs/ops/PRIMARY_LINUX_WORKSTATION_PROTECTION.md`**.
 - **Reversion:** When the **Windows primary dev workstation** returns from repair, the operator may move the canonical clone role back — see **ADR 0068** and **`docs/ops/PRIMARY_LINUX_WORKSTATION_PROTECTION.md`** (*Reversion when Windows primary returns*). Until then, apply **this** rule on the Linux primary dev workstation, not only the Windows rule.

diff --git a/.cursor/rules/primary-windows-workstation-protected-no-destructive-repo-ops.mdc b/.cursor/rules/primary-windows-workstation-protected-no-destructive-repo-ops.mdc
@@ -1,5 +1,5 @@
 ---
-description: primary Windows dev PC primary dev workstation — never run clean-slate, history rewrite, or destructive repo reset here; assistants never simulate destructive outcomes against canonical clone
+description: Windows dev workstation (L-series) — same destructive-repo prohibitions when this machine holds the canonical clone; secondary today, may become main dev box again.
 globs: ["**/*"]
 alwaysApply: true
 ---
@@ -8,7 +8,7 @@ alwaysApply: true
 
 ## Scope
 
-- **L-series** means the operator’s **primary Windows dev workstation** (hardware: typically ThinkPad **L-series**) where the **canonical** `data-boar` working tree, **evidence**, and **long-lived Git history** must stay intact. Tracked docs use **L-series** as a **role label** (not a hostname to paste into commits).
+- **Windows dev workstation (L-series):** **Secondary** today while canonical clone lives on Linux; **same rigor** as main dev box when this machine holds the canonical tree (may become **main dev box** again after repair). Tracked docs use **role labels** (not hostnames in commits).
 - **lab-op** and other **manifest SSH hosts** are **not** the primary dev PC canonical tree: **`git reset --hard`**, **`lab-op-git-align-main`**, **`lab-op-git-ensure-ref -Mode Reset`**, and similar **only** apply to **`repoPaths`** on those remote hosts — **never** to the operator’s primary clone path opened in Cursor on Windows — see **`docs/ops/LAB_COMPLETAO_RUNBOOK.md`** (*Blast radius*) and **`docs/ops/PRIMARY_WINDOWS_WORKSTATION_PROTECTION.md`**.
 - **Container images** (Docker / Swarm / Podman / Kubernetes): re-pull from **Docker Hub** (or configured registry) is **normal** and **reversible** for lab work — not the same blast radius as rewriting Git history on the primary dev PC.
 

diff --git a/.cursor/rules/repo-scripts-wrapper-ritual.mdc b/.cursor/rules/repo-scripts-wrapper-ritual.mdc
@@ -1,7 +1,10 @@
 ---
-description: Before long ad-hoc shell or reinvention — use documented scripts/*.ps1 wrappers, TOKEN_AWARE_SCRIPTS_HUB, and check-all-gate; notify operator if agreed automation fails (misconfiguration).
-globs: ["**/*"]
-alwaysApply: true
+description: Repo script wrappers before ad-hoc shell. Situational — scripts/** or TOKEN_AWARE_SCRIPTS_HUB globs; @repo-scripts-wrapper-ritual.mdc when globs miss.
+globs:
+  - scripts/**
+  - docs/ops/TOKEN_AWARE_SCRIPTS*
+  - docs/ops/SCRIPTS_CROSS_PLATFORM*
+alwaysApply: false
 ---
 
 # Repo scripts and wrapper ritual (token-aware, agreed automation)