fix(agent): close canonical guidance routing gaps

Author: qnbs

.cursor/rules/001-core-security.mdc

@@ -1,6 +1,6 @@
 ---
 description: Protect secrets, logging, CSP, and privacy boundaries on executable and security-sensitive paths
-globs: app/**/*.ts,app/**/*.tsx,components/**/*.ts,components/**/*.tsx,config/**/*,features/**/*.ts,features/**/*.tsx,hooks/useLanguageToolCheck.ts,hooks/useWorldScriptAI.ts,hooks/useFactoryReset.ts,hooks/useIdbUnlockStartupGuard.ts,hooks/useSettingsView.ts,App.tsx,index.tsx,register-sw.ts,index.html,package.json,packages/**/*.ts,packages/**/*.tsx,public/sw.js,scripts/**/*.mjs,scripts/**/*.ts,services/**/*.ts,services/**/*.tsx,vercel.json,vite.config.ts,workers/**/*,wrangler.toml,.github/**/*,src-tauri/**/*,crates/**/*
+globs: app/**/*.ts,app/**/*.tsx,components/**/*.ts,components/**/*.tsx,config/**/*,features/**/*.ts,features/**/*.tsx,hooks/useLanguageToolCheck.ts,hooks/useWorldScriptAI.ts,hooks/useFactoryReset.ts,hooks/useIdbUnlockStartupGuard.ts,hooks/useSettingsView.ts,App.tsx,index.tsx,register-sw.ts,index.html,nginx.conf,package.json,packages/**/*.ts,packages/**/*.tsx,public/_headers,public/sw.js,scripts/**/*.mjs,scripts/**/*.ts,services/**/*.ts,services/**/*.tsx,vercel.json,vite.config.ts,workers/**/*,wrangler.toml,.github/**/*,src-tauri/**/*,crates/**/*
 alwaysApply: false
 ---
 
@@ -16,6 +16,7 @@ alwaysApply: false
 ## Tauri / CSP / Integrationen
 
 - Neue externe Endpunkte (KI, LanguageTool, Signaling): `src-tauri` **CSP** `connect-src` prüfen/erweitern — nicht nur Web-`fetch`.
+- CSP-Surfaces werden durch `scripts/sync-csp.mjs` synchronisiert; Änderungen müssen alle von diesem Script definierten Deployment-Flächen konsistent halten.
 - LanguageTool und ähnliche Dienste: nur **nutzerkonfigurierte URL** + Privacy-Gating (`integrations.languageTool*`).
 - Community-Templates: Zod + `pnpm run content:guard` — keine eingebetteten Secrets oder `eval`-ähnliche Payloads.
 

.cursor/rules/100-ai-providers-and-storage.mdc

@@ -1,6 +1,6 @@
 ---
 description: Apply hybrid AI, persistence, and privacy patterns on AI and storage boundaries
-globs: app/listenerMiddleware.ts,app/persistenceCoordinator.ts,app/persistedStateFlush.ts,components/ApiKeySection.tsx,components/BinderPanel.tsx,components/CharacterView.tsx,components/ManuscriptResearchSplit.tsx,components/WelcomePortal.tsx,components/WorldView.tsx,components/dashboard/BackupQuickActionsCard.tsx,components/settings/AiProviderCard.tsx,components/settings/GeneralSections.tsx,components/settings/OpenRouterSection.tsx,features/lora/loraThunks.ts,features/project/projectSchemaVersion.ts,features/project/projectSchemaVersionShadow.ts,features/project/thunks/**/*.ts,features/settings/settingsSlice.ts,hooks/useCharacterInterviewsView.ts,hooks/useCharacterView.ts,hooks/useFactoryReset.ts,hooks/useIdbUnlockStartupGuard.ts,hooks/useSettingsView.ts,hooks/useWorldView.ts,hooks/useWorldScriptAI.ts,App.tsx,index.tsx,services/ai/**/*.ts,services/aiProviderService.ts,services/appBootstrap.ts,services/cloudSync/cloudSyncBackend.ts,services/codexService.ts,services/crossProjectIndexService.ts,services/crossProjectSearchService.ts,services/dbMigration.ts,services/dbService.ts,services/diagnostics/logSinks.ts,services/factoryResetService.ts,services/fs/**/*.ts,services/geminiService.ts,services/keyboard/shortcutActions.ts,services/libraryBackupService.ts,services/localAiFacade.ts,services/localFirst/docPersistence.ts,services/localRag*.ts,services/lora/**/*.ts,services/loraAdapterService.ts,services/pluginRegistry.ts,services/projectDocument.ts,services/projectImportSchema.ts,services/proForge/adapters/nodeProForgeCapability.ts,services/proForge/proForgeHistoryStore.ts,services/proForge/proForgeMemoryBank.ts,services/proForge/proForgeOrchestrator.ts,services/rag*.ts,services/sceneRevisionService.ts,services/settingsExchange.ts,services/startupRecovery.tsx,services/startupRecoveryPolicy.ts,services/storage/**/*.ts,services/storageBackend.ts,services/storageService.ts,services/duckdb/**/*.ts,services/logger.ts,packages/ai-core/**/*.ts
+globs: app/listenerMiddleware.ts,app/persistenceCoordinator.ts,app/persistedStateFlush.ts,components/ApiKeySection.tsx,components/BinderPanel.tsx,components/CharacterView.tsx,components/ManuscriptResearchSplit.tsx,components/WelcomePortal.tsx,components/WorldView.tsx,components/dashboard/BackupQuickActionsCard.tsx,components/settings/AiProviderCard.tsx,components/settings/GeneralSections.tsx,components/settings/OpenRouterSection.tsx,features/lora/loraThunks.ts,features/project/projectSchemaVersion.ts,features/project/projectSchemaVersionShadow.ts,features/project/thunks/**/*.ts,features/settings/settingsSlice.ts,hooks/useCharacterInterviewsView.ts,hooks/useCharacterView.ts,hooks/useFactoryReset.ts,hooks/useIdbUnlockStartupGuard.ts,hooks/useSettingsView.ts,hooks/useWorldView.ts,hooks/useWorldScriptAI.ts,App.tsx,index.tsx,services/ai/**/*.ts,services/aiProviderService.ts,services/appBootstrap.ts,services/cloudSync/cloudSyncBackend.ts,services/codexService.ts,services/crossProjectIndexService.ts,services/crossProjectSearchService.ts,services/dbInitialization.ts,services/dbMigration.ts,services/dbService.ts,services/diagnostics/logSinks.ts,services/factoryResetService.ts,services/fs/**/*.ts,services/geminiService.ts,services/keyboard/shortcutActions.ts,services/libraryBackupService.ts,services/localAiFacade.ts,services/localFirst/docPersistence.ts,services/localRag*.ts,services/lora/**/*.ts,services/loraAdapterService.ts,services/pluginRegistry.ts,services/projectDocument.ts,services/projectImportSchema.ts,services/proForge/adapters/nodeProForgeCapability.ts,services/proForge/proForgeHistoryStore.ts,services/proForge/proForgeMemoryBank.ts,services/proForge/proForgeOrchestrator.ts,services/rag*.ts,services/sceneRevisionService.ts,services/settingsExchange.ts,services/startupRecovery.tsx,services/startupRecoveryPolicy.ts,services/storage/**/*.ts,services/storageBackend.ts,services/storageService.ts,services/duckdb/**/*.ts,services/logger.ts,services/collaborationService.ts,packages/ai-core/**/*.ts,packages/collab-transport/**/*
 alwaysApply: false
 ---
 
@@ -29,7 +29,7 @@ alwaysApply: false
 - Zugriff über `dbService.ts`, `storageService.ts`, **`storageBackend.ts`** (`saveEnvelopeFromProjectData` — kein roher Cast im Listener).
 - Record-Keys/Migrationen nicht willkürlich umbenennen; Scene-Revisions → `sceneRevisionService.ts` (eigener Store).
 - `checkStorageHealth()` in `services/dbInitialization.ts` — liefert `StorageHealth`; wird beim App-Start ausgeführt (Low-Storage-Toast).
-- Kollaboration: nur **eine** CRDT-Schicht (`collaborationService.ts` + Yjs). RTCDataChannel-Verschlüsselung läuft über den y-webrtc-Patch (`patches/y-webrtc@10.3.0.patch`) — nicht erneut implementieren.
+- Kollaboration: nur **eine** CRDT-Schicht (`collaborationService.ts` + Yjs). RTCDataChannel-Verschlüsselung lebt in `packages/collab-transport`; Änderungen folgen `VENDOR-FORKS.md` und `pnpm run verify:vendor` — keine parallele Schicht implementieren.
 
 ## Privacy
 

.cursor/rules/200-architecture-limits.mdc

@@ -1,6 +1,6 @@
 ---
 description: Keep files small and reuse logic via services,hooks,and feature slices
-globs: App.tsx,app/**/*.ts,components/**/*.tsx,contexts/**/*.ts,contexts/**/*.tsx,features/**/*.ts,hooks/**/*.ts,services/**/*.ts,packages/**/*.ts,packages/**/*.tsx
+globs: App.tsx,app/**/*.ts,components/**/*.tsx,contexts/**/*.ts,contexts/**/*.tsx,features/**/*.ts,hooks/**/*.ts,services/**/*.ts,packages/**/*.ts,packages/**/*.tsx,vite.config.ts
 alwaysApply: false
 ---
 
@@ -17,6 +17,7 @@ alwaysApply: false
 - **Redux** für persistierten App-State; **Zustand** nur transient (`app/transientUiStore.ts`).
 - **Undo:** `redux-undo` am Projekt-Slice; Plot-Board-**Viewport** lokal — Verbindungen/Subplots im `projectSlice` wenn undo-relevant.
 - Schwere Views: `React.lazy` in `App.tsx`; Plot-Board-Subchunks, ForceGraph, Collaboration lazy; `listenerMiddleware` + `aiApi` dynamic import für DuckDB/RAG/Provider.
+- Neue schwere optionale Chunks müssen in `vite.config.ts` gemeinsam in `manualChunks` und PWA-`globIgnores` gepflegt werden; siehe ADR 0002, damit sie nicht service-worker-vorinstalliert werden.
 - ProForge orchestration stays behind `hooks/useProForgeOrchestrator.ts`; do not instantiate it in components.
 - Voice uses the existing engine abstractions and `VoiceCommandService`; honor its feature/settings gates.
 

AGENTS.md

@@ -45,8 +45,9 @@ needs their detail. Dynamic facts belong in `package.json`, `.nvmrc`, scripts, o
 - User-visible copy uses the i18n system. Add keys to canonical `locales/*` sources and run
   the repository i18n generator/check; do not hardcode UI strings or stale locale counts.
 - Do not use Tailwind `dark:` classes. Themes are body-class and semantic CSS-token driven.
-- `components/ui/**` must remain platform-neutral: do not import `@tauri-apps/api` there;
-  use the existing service/platform abstractions.
+- First-party TS/TSX must not import `@tauri-apps/*` directly. Route desktop capabilities through
+  `desktopPlatform` / `@domain/desktop-contracts`; the approved boundary and exceptions are
+  defined by `scripts/check-tauri-import-boundary.mjs`. `components/ui/**` remains platform-neutral.
 - New feature flags need the repository’s relevant E2E coverage, but heavy E2E execution is
   CI-only on this machine. Do not invent scattered `if (true)` feature gates.
 - For non-trivial TypeScript/TSX/CSS changes, add one short physical-line `QNBS-v3:` rationale
@@ -67,6 +68,9 @@ For persistence, AI, filesystem, or encryption work, inspect the relevant source
 path-scoped Cursor/nested Claude rule first. Deep references include `docs/CI.md`,
 `docs/BEST-PRACTICES.md`, `docs/IDB-ENCRYPTION.md`, and the native ledger.
 
+Vendor-fork edits under `packages/collab-transport` follow `VENDOR-FORKS.md` and
+`pnpm run verify:vendor`; do not recreate the removed upstream patch or a parallel fork.
+
 ## PR, review, signing, and merge work
 
 When a task enters commit/push/PR/CI/review/merge work, read and follow

CLAUDE.md

@@ -12,3 +12,14 @@ verified specialist mappings:
 - `hooks/useVoice.ts` → `services/voice/CLAUDE.md`
 - `hooks/useGlobalCopilot.ts` → `services/copilot/CLAUDE.md`
 - `features/project/thunks/plotBoardAiThunks.ts` → `features/plotBoard/CLAUDE.md`
+- Plot Board external callers: `services/plotBoardService.ts`, `hooks/usePlotBoardAi.ts`,
+  `components/scene-board/PlotMinimap.tsx` → `features/plotBoard/CLAUDE.md`
+- Voice external callers: `hooks/usePushToTalk.ts`, `hooks/useVoiceDictation.ts`,
+  `hooks/useVoiceAccessibility.ts` → `services/voice/CLAUDE.md`
+- Copilot external callers: `features/copilot/copilotSlice.ts`, `components/copilot/**/*`,
+  `App.tsx` → `services/copilot/CLAUDE.md`
+- ProForge external callers: `features/proForge/proForgeSlice.ts`, `features/proForge/types.ts`,
+  `hooks/useProForgeOrchestrator.ts`, `app/storeRef.ts` → `services/proForge/CLAUDE.md`
+- Service integration callers: `features/sceneComments/sceneCommentsSlice.ts`,
+  `features/progressTracker/progressTrackerSlice.ts`, `hooks/useLanguageToolCheck.ts`,
+  `config/csp-connect-src.json` → `services/CLAUDE.md`

docs/CI.md

@@ -56,7 +56,7 @@ coverage ratchet remains informational.
 1. Push the commit → CI starts automatically.
 2. `gh run watch $(gh run list --limit 1 --json databaseId -q '.[0].databaseId')` — stream the live run.
 3. When `quality` job completes, read the coverage summary from the CI logs or Codecov badge.
-4. Update `README.md` badges (`Tests-NNN_%2F_NNN_files`) and the `AUDIT.md` quality-gate line if the test count changed significantly; do not put dynamic metrics in agent adapters.
+4. Whenever the test-case or test-file count changes, run `node scripts/sync-readme-metrics.mjs` to update README metrics and update the `AUDIT.md` quality-gate line separately when its documented count changes; do not put dynamic metrics in agent adapters.
 5. Commit the doc update: `chore(docs): update metrics from CI vX.Y.Z`.
 
 ---