Sync .cursor from suite (autodev orchestrator + monorepo skills)

.cursor/skills/code-review/SKILL.md

@@ -50,6 +50,18 @@ For each task, verify implementation satisfies every acceptance criterion:
 - Flag any AC that is not demonstrably satisfied as a **Spec-Gap** finding (severity: High)
 - Flag any scope creep (implementation beyond what the spec asked for) as a **Scope** finding (severity: Low)
 
+**Contract verification** (for shared-models / shared-API tasks — any task with a `## Contract` section):
+
+- Verify the referenced contract file exists at the stated path under `_docs/02_document/contracts/`.
+- Verify the implementation's public signatures (types, method shapes, endpoint paths, error variants) match the contract's **Shape** section.
+- Verify invariants from the contract's **Invariants** section are enforced in code (either structurally via types or via runtime checks with tests).
+- If the implementation and the contract disagree, emit a **Spec-Gap** finding (High severity) and note which side is drifting.
+
+**Consumer-side contract verification** (for tasks whose Dependencies list a contract file):
+
+- Verify the consumer's imports and call sites match the contract's Shape.
+- If they diverge, emit a **Spec-Gap** finding (High severity) with a hint that the consumer, the contract, or the producer is drifting.
+
 ## Phase 3: Code Quality Review
 
 Check implemented code against quality standards:
@@ -92,6 +104,53 @@ When multiple tasks were implemented in the same batch:
 - Shared code is not duplicated across task implementations
 - Dependencies declared in task specs are properly wired
 
+## Phase 7: Architecture Compliance
+
+Verify the implemented code respects the architecture documented in `_docs/02_document/architecture.md` and the component boundaries declared in `_docs/02_document/module-layout.md`.
+
+**Inputs**:
+- `_docs/02_document/architecture.md` — layering, allowed dependencies, patterns
+- `_docs/02_document/module-layout.md` — per-component directories, Public API surface, `Imports from` lists, Allowed Dependencies table
+- The cumulative list of changed files (for per-batch invocation) or the full codebase (for baseline invocation)
+
+**Checks**:
+
+1. **Layer direction**: for each import in a changed file, resolve the importer's layer (from the Allowed Dependencies table) and the importee's layer. Flag any import where the importee's layer is strictly higher than the importer's. Severity: High. Category: Architecture.
+
+2. **Public API respect**: for each cross-component import, verify the imported symbol lives in the target component's Public API file list (from `module-layout.md`). Importing an internal file of another component is an Architecture finding. Severity: High.
+
+3. **No new cyclic module dependencies**: build a module-level import graph of the changed files plus their direct dependencies. Flag any new cycle introduced by this batch. Severity: Critical (cycles are structurally hard to undo once wired). Category: Architecture.
+
+4. **Duplicate symbols across components**: scan changed files for class, function, or constant names that also appear in another component's code AND do not share an interface. If a shared abstraction was expected (via cross-cutting epic or shared/*), flag it. Severity: High. Category: Architecture.
+
+5. **Cross-cutting concerns not locally re-implemented**: if a file under a component directory contains logic that should live in `shared/<concern>/` (e.g., custom logging setup, config loader, error envelope), flag it. Severity: Medium. Category: Architecture.
+
+**Detection approach (per language)**:
+
+- Python: parse `import` / `from ... import` statements; optionally AST with `ast` module for reliable symbol resolution.
+- TypeScript / JavaScript: parse `import ... from '...'` and `require('...')`; resolve via `tsconfig.json` paths.
+- C#: parse `using` directives and fully-qualified type references; respect `.csproj` ProjectReference layering.
+- Rust: parse `use <crate>::` and `mod` declarations; respect `Cargo.toml` workspace members.
+- Go: parse `import` blocks; respect module path ownership.
+
+If a static analyzer tool is available on the project (ArchUnit, NsDepCop, tach, eslint-plugin-boundaries, etc.), prefer invoking it and parsing its output over hand-rolled analysis.
+
+**Invocation modes**:
+
+- **Full mode** (default when invoked by the implement skill per batch): all 7 phases run.
+- **Baseline mode**: Phase 1 + Phase 7 only. Used for one-time architecture scan of an existing codebase (see existing-code flow Step 2 — Architecture Baseline Scan). Produces `_docs/02_document/architecture_compliance_baseline.md` instead of a batch review report.
+- **Cumulative mode**: all 7 phases on the union of changed files since the last cumulative review. Used mid-implementation (see implement skill Step 14.5).
+
+**Baseline delta** (cumulative mode + full mode, when `_docs/02_document/architecture_compliance_baseline.md` exists):
+
+After the seven phases produce the current Architecture findings list, partition those findings against the baseline:
+
+- **Carried over**: a finding whose `(file, category, rule)` triple matches an entry in the baseline. Not new; still present.
+- **Resolved**: a baseline entry whose `(file, category, rule)` triple is NOT in the current findings AND whose target file is in scope of this review. The team fixed it.
+- **Newly introduced**: a current finding that was not in the baseline. The review cycle created this.
+
+Emit a `## Baseline Delta` section in the report with three tables (Carried over, Resolved, Newly introduced) and per-category counts. The verdict logic does not change — Critical / High still drive FAIL. The delta is additional signal for the user and feeds the retrospective's structural metrics.
+
 ## Output Format
 
 Produce a structured report with findings deduplicated and sorted by severity:
@@ -136,7 +195,9 @@ Produce a structured report with findings deduplicated and sorted by severity:
 
 ## Category Values
 
-Bug, Spec-Gap, Security, Performance, Maintainability, Style, Scope
+Bug, Spec-Gap, Security, Performance, Maintainability, Style, Scope, Architecture
+
+`Architecture` findings come from Phase 7. They indicate layering violations, Public API bypasses, new cyclic dependencies, duplicate symbols, or cross-cutting concerns re-implemented locally.
 
 ## Verdict Logic