Cursor Notepads: Living Architecture Constraints Agents Must Obey

# notepad: payments-bounded-context (v14)
## Owns
- packages/@acme/payments/**
- events: PaymentAuthorized, PaymentCaptured, PaymentRefunded

## May depend on
- @acme/identity (read-only userId)
- @acme/ledger (write via LedgerClient only)

## Forbidden
- direct import from @acme/marketing/**
- raw Stripe SDK outside adapters/stripe/
- DynamoDB DocumentClient outside infra/

## Event schema freeze
- PaymentAuthorized.v2: { paymentId, amountMinor, currency, userId }
- ❌ Do not invent PaymentSuccess — use PaymentCaptured

// scripts/assert-notepad-cited.ts — gate agent plans
export type AgentPlan = {
  notepadIds: string[];
  files: string[];
  newEvents?: string[];
};

const REQUIRED = ["payments-bounded-context", "platform-forbidden-libs"];

export function assertNotepads(plan: AgentPlan) {
  for (const id of REQUIRED) {
    if (!plan.notepadIds.includes(id)) {
      throw new Error(`missing_notepad:${id}`);
    }
  }
  // ❌ Never: agent invents PaymentSuccess
  const banned = (plan.newEvents ?? []).filter((e) =>
    /Success|Failed|Done$/i.test(e) && !/^Payment(Authorized|Captured|Refunded)$/.test(e)
  );
  if (banned.length) throw new Error(`undeclared_events:${banned.join(",")}`);
}

# ✅ Session bootstrap (illustrative)
cursor-agent --attach-notepad .cursor/notepads/payments.md \
             --attach-notepad .cursor/notepads/forbidden-libs.md \
             --rule .cursor/rules/bounded-contexts.mdc

# ❌ “The agent already knows our architecture from yesterday”

# .github/workflows/notepad-drift.yml
name: notepad-drift
on: [pull_request]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Notepad ↔ package graph
        run: node scripts/check-notepad-deps.mjs
      - name: Forbidden import lint
        run: node scripts/lint-forbidden-from-notepads.mjs

// scripts/check-notepad-deps.mjs — excerpt
import { readFileSync } from "node:fs";
import { parseNotepad } from "./notepad-parse.js";

const np = parseNotepad(readFileSync(".cursor/notepads/payments.md", "utf8"));
for (const edge of np.mayDependOn) {
  // ✅ every edge must map to a real package
  if (!existsPackage(edge)) throw new Error(`ghost_dep:${edge}`);
}
for (const ban of np.forbidden) {
  // ❌ agents proposing imports matching ban → CI fail
  assertNoImportsMatching(ban);
}