cursor-rules

Use when reviewing HTTP API design in a PR or change set — endpoints, routes, HTTP methods, status codes, idempotency, and input validation. Treats the API as a consumer-facing contract and flags resource-orientation, method-semantics, status-code, and trust-boundary violations. Read-only.

Use when checking that the pull request implementation actually fulfills the business requirements stated in the linked issue or task. Returns a plain-language markdown block that is the Functional review half of the two-part CR output (`@rules/code-review/general.mdc` Two-part CR output — Technical & Functional review): a full checklist of every extracted acceptance criterion with its status (Met / Not met / Partial / Divergent) and an explicit Goal met: Yes/No verdict, rendered on every run that has a linked tracker — including the fully affirmative report when every requirement is satisfied. No local file is created and the block is not embedded in the GitHub PR comment.

Use when run code review for a Bugsnag error and publish results to the linked GitHub PR and the Bugsnag error

Use when perform code review for GitHub pull requests and post findings as PR comments plus a non-technical summary to every linked issue

Use when run code review for JIRA issues and publish results to GitHub PR and JIRA

Use when senior PHP code review focused on architecture, business logic, and risk detection. Read-only.

Use when summarizing current PR changes for the development and product team. Analyzes all commits in the current branch, explains the purpose of changes, and produces a clear human-readable report that can be posted either as a GitHub PR comment (Markdown) or as a JIRA comment (Wiki Markup).

Use when a single objective is too large for one pull request and must span multiple sessions or PRs. Turns the objective into a sequenced construction plan of 3-12 one-PR steps, each with a cold-start context brief, dependency edges, and exit criteria, then reviews it adversarially and registers it as Markdown.

Use when create a single issue from provided text without modifying its content

Use when break down assignment into multiple structured issues

Use when a PRD or product intent is clear but the implementation constraints are not — turns a vague capability ask into an engineering-ready plan that exposes invariants, interfaces, and unresolved decisions before any code is written.

Use when refactor PHP classes to improve structure, readability, and maintainability while preserving behavior

Use when structured problem analysis for debugging, root cause identification, and breaking down complex issues before proposing solutions

Use when resolving an issue from any supported tracker (GitHub, JIRA, Bugsnag). Detects the source automatically from the provided link or ID, implements a safe fix or feature, validates with tests, and creates a pull request.

Use when reviewing authorization / access control in a Laravel project — find IDOR / broken object-level authorization (BOLA), audit which routes are unprotected, check policy / gate coverage, or sanity-check a new endpoint in a PR. Walks the authorization chain of every HTTP route (middleware → authorize/policy/gate → query scoping → API Resource output), anchors every finding to real `php artisan route:list --json` output plus a cited `file:line`, classifies by confidence, and produces a per-route coverage map. Read-only / advise-only — never edits code.

Use when performing a focused security review for Laravel/PHP projects. Prioritize real exploitability, business logic flaws, and high-risk vulnerabilities.

Use when processing pull request code review feedback. Finds the latest PR for a task, resolves review comments, updates review status, and triggers the next review cycle.

Use when autonomously resolving the oldest open GitHub issue end-to-end. Picks the oldest open issue (optionally filtered by label, default `Resolve_by_AI`), delegates resolution to `resolve-issue`, then runs `code-review-github`, `process-code-review`, and `merge-github-pr` on the resulting pull request. Stops and reports any blocker (merge conflict, failing CI, unresolved Critical/Moderate findings) instead of force-merging.

Use when safely merge GitHub pull requests that are ready

Use when building, configuring, or hardening security-sensitive Laravel features — authentication, authorization, Eloquent safety, CSRF/XSS, API security, file uploads, secrets, and production configuration. Provides condensed, copy-ready secure defaults for Laravel 11 / PHP 8.3.

Use when preparing data and context before /resolve-issue, TDD, or CR runs. Loads the assignment, extracts every concrete user scenario from the task description and acceptance criteria, maps each scenario to the codebase, seeds the development database with the records needed to reproduce the bug or feature end-to-end, and reports any gap that would force the implementing agent to hallucinate.

Use when a task has converged (end of resolve-issue, process-code-review, or the final orchestrator report) and a durable, reusable lesson was learned. Distils only the lessons that clear a strict promotion bar and appends them — after a dedup/supersede/prune curation pass — to the per-project compound memory file, never recording trivia, secrets, or PII.

Use when you need to send messages to a Slack channel or read recent messages from a channel via the Slack Web API

Use when testing a pull request from a real user perspective. Follow PR testing instructions, simulate realistic scenarios, and produce a human-readable report.

Use when a repository needs a maintainer-ready README.md (or sibling root docs like CONTRIBUTING / SECURITY) built from the project's actual code, manifests, scripts, and tests — a zero-hallucination scan that extracts real commands, setup steps, and configuration, with git commit/push only when the user explicitly asks. Adapted from the VoltAgent readme-generator subagent.

Use when creating a new Agent skill in this repository. Generates a SKILL.md that follows project conventions, passes skill-check validation, and updates the changelog and readme.

Use when you want exactly one high-impact, concrete proposal for the next project addition.

Use when following a strict problem-solving loop: understand, propose, implement, verify.

Use when choosing how to run Claude Code autonomously on this project — from a single sequential pipeline to multi-agent DAG orchestration. A reference catalog of loop patterns anchored to this repo's real tooling (resolve-issue, autoresolve-oldest-github-issue, code-review-github, process-code-review, merge-github-pr, /loop), with composer build / composer skill-check as the quality gate between iterations.

Use when auditing, planning, or implementing SEO in a Laravel app — crawlability, indexability, JSON-LD structured data in Blade, Core Web Vitals, on-page tags, keyword mapping, competitor gap analysis, E-E-A-T content quality, and measurement.

Use when the user explicitly requests a penetration test (pentest, ethical hacking, active exploitation, red-team assessment) against an authorized in-scope target — and only then. Runs a methodology-driven offensive assessment that validates exploitability with safe proofs of concept and delivers a risk-rated remediation report. Does not run on a normal code-review, security-review, or resolve-issue pass.

Use when refactoring controller, job, command, listener, or Livewire entry-point logic into a dedicated Action class while preserving behavior and response contracts.

Use when preparing a concise QA report for an internal tester from a JIRA task and its linked pull requests — focused on what the tester should report back to the dev team — and posting it as a JIRA comment.

Use when choosing a Git branching strategy or handling merge vs rebase, conflicts, stashing, undoing mistakes, and release tagging — complementing the commit/PR conventions in the git rules.

Use when analyzing Laravel Telescope requests from URL and DB. Loads Telescope entries, matches the same request in database tables, and proposes practical optimizations.

Use when designing MySQL schema features or applying advanced MySQL patterns in Laravel — upserts, JSON columns, full-text search, partitioning, replication/read-write splitting, and deadlock handling — beyond the query tuning already in the SQL rules.

Use when analyze real MySQL query and schema problems using code inspection, schema review, and EXPLAIN when available

Use when you need an evidence-first, read-only inventory of every automation in this repo (GitHub Actions, Claude Code hooks/settings, MCP servers, composer scripts, the bundled CLI installer, the skills catalog, scheduler/cron) before changing any of them, classifying each as live, broken, or redundant and recommending keep/merge/cut/fix.

Use when a goal is vague speed ("make it faster", "reduce p95", "cut query time") and you need a bounded, measured loop that promotes only verified, correctness-preserving wins instead of guessed micro-tweaks.

Use when measuring performance baselines or detecting regressions before and after a change in a Laravel app — page Core Web Vitals, API latency percentiles, build/test velocity, and DB query timing, stored as git-tracked baselines for team comparison.