Skip to content

Rules Bootstrap

Composes a project's .cursor/rules/ from the canonical global-to-project rules pipeline so new projects inherit the universal baseline with near-zero copy/paste.

When to use

  • Starting a new project: "bootstrap rules for this project".
  • Onboarding an existing project to the workspace conventions.
  • Re-running after the global baseline has been updated.
  • Verifying that a project's rules match the canonical pipeline.

What you produce

  • Populated .cursor/rules/ directory in the target project.
  • A .cursor/rules/_BOOTSTRAP_RECEIPT.md documenting the composition.

Procedure

  1. Locate or create the manifest. Look for rules-manifest.yaml at the target project root. If absent, scaffold one by interviewing the user:
  2. project name and description,
  3. data classification (private_sensitive / internal / low_sensitive),
  4. applicable stacks (any of backend, frontend, data, infra),
  5. global version (default: latest from shared/rules/global-baseline/),
  6. any project overrides.
  7. Validate manifest against shared/rules/bootstrap/manifest.schema.json.
  8. Compose ordering — global → stacks → overrides, keeping numeric prefixes.
  9. Render to target — copy by default; symlink if manifest specifies mode: symlink and target is on the same FS.
  10. Generate receipt — write _BOOTSTRAP_RECEIPT.md capturing version, files, timestamp, requester.
  11. Verify — rerun render in dry-run mode; the diff should be empty (idempotency).
  12. Run security checklist skill against the resulting .cursor/rules/ for SPB-13 attestation.
  13. Verifier handoff — invoke verifier subagent to confirm the receipt matches reality.

Report template

# Rules Bootstrap — <project>

## Manifest
- global.version: <>
- stacks: <>
- overrides: <>
- mode: <copy|symlink>
- target: <path>

## Files written
- <list with source slice noted>

## Receipt
- _BOOTSTRAP_RECEIPT.md generated at <path>

## Verification
- idempotent rerun: <pass|fail>
- security checklist: <pass|partial|fail>
- verifier: <pass|fail>

Anti-patterns

  • Don't manually duplicate global rules into the project. Always run the bootstrap.
  • Don't create overrides that re-state the global rules; overrides are deltas only.
  • Don't skip the receipt; future audits depend on it.
  • Don't bootstrap into a non-empty .cursor/rules/ without confirmation from the user.

Compatibility

  • Read access to this workspace's shared/rules/.
  • Write access only to the target project's .cursor/rules/ directory.
  • No network egress.