docs(rules): point agent runbooks at the real workspace layout

.claude/rules/auditor.md

@@ -1,14 +1,13 @@
 ---
 globs:
-  - "gateway/src/policy.rs"
-  - "gateway/policies.cedar"
+  - "lib/policy/src/cedar.rs"
   - "policies.cedar"
   - "SECURITY.md"
   - "lib/policy/**/*"
   - "lib/storage/**/*"
 ---
 
 # Persona: SecurityAuditorAgent
-# Active Scope: /gateway/src/policy.rs, /gateway/policies.cedar, /policy-templates, /skills
+# Active Scope: /lib/policy/src/cedar.rs, /policies.cedar, /policy-templates, /skills
 # Key Tasks: Verify SQL query parameterization, audit multi-tenant isolation, write Cedar policies.
 # Loaded Skills: security_scan.md, cedar_policy_authoring.md, tdd_workflow.md, token_budget_advisor.md

.claude/rules/axum_patterns.md

@@ -1,6 +1,6 @@
 ---
 globs:
-  - "gateway/src/**/*.rs"
+  - "src/src/**/*.rs"
   - "src/**/*.rs"
 ---
 

.claude/rules/cedar_policy_authoring.md

@@ -114,7 +114,7 @@ In AWS Cedar, policy evaluations natively return a binary `Allow` or `Deny` deci
 
 ## 5. Testing Policy Evaluation in Rust
 
-Policies should be verified via unit tests inside the Rust gateway (`gateway/src/policy.rs`).
+Policies should be verified via unit tests inside the Rust gateway (`lib/policy/src/cedar.rs`).
 
 ### Example Integration Test:
 
@@ -145,9 +145,9 @@ mod tests {
 ---
 
 ## 6. Runbook for Modifying Policies
-1. **Edit `gateway/policies.cedar`:** Add or adjust rules according to authorization needs.
-2. **Add matching unit test cases:** Write target assertions in `gateway/src/policy.rs` to verify correct evaluations.
+1. **Edit `policies.cedar`:** Add or adjust rules according to authorization needs.
+2. **Add matching unit test cases:** Write target assertions in `lib/policy/src/cedar.rs` to verify correct evaluations.
 3. **Execute test suite:** Run tests to verify rules compile and evaluate correctly:
    ```bash
-   cargo test --manifest-path gateway/Cargo.toml
+   cargo test --workspace -- --test-threads=1
    ```

.claude/rules/database_migration.md

@@ -1,8 +1,8 @@
 ---
 globs:
-  - "gateway/src/db.rs"
+  - "lib/storage/**/*"
   - "lib/storage/**/*.rs"
-  - "gateway/migrations/**/*"
+  - "lib/storage/migrations/**/*"
 ---
 
 # AI Skill: SQLite Database Migration & Management (`skills/database_migration.md`)

.claude/rules/developer.md

@@ -1,6 +1,6 @@
 ---
 globs:
-  - "gateway/**/*"
+  - "src/**/*"
   - "src/**/*"
   - "lib/**/*"
   - "sdk-python/**/*"
@@ -10,6 +10,6 @@ globs:
 ---
 
 # Persona: DeveloperAgent
-# Active Scope: /gateway, /sdk-python, /sdk-typescript, /mcp-gateway-lite, /examples
+# Active Scope: /src, /lib, /sdk-python, /sdk-typescript, /mcp-gateway-lite, /examples
 # Key Tasks: Implement gateway Axum endpoints, configure SQLx queries, test @protect_tool decorator.
 # Loaded Skills: database_migration.md, sdk_testing.md, tdd_workflow.md, token_budget_advisor.md

.claude/rules/project_flow_ops.md

@@ -24,7 +24,7 @@ Before making changes, the agent must run the local development stack to establi
    ```
 2. **Launch Database & Server:** Initialize compile checks:
    ```bash
-   cargo check --manifest-path gateway/Cargo.toml
+   cargo check --workspace
    ```
 
 ---
@@ -36,7 +36,7 @@ Every modification must pass our automated verification suite.
 ### Steps:
 1. **Run Rust Gateway Tests:**
    ```bash
-   cargo test --manifest-path gateway/Cargo.toml
+   cargo test --workspace -- --test-threads=1
    ```
 2. **Run Python SDK Tests:**
    ```bash
@@ -63,12 +63,12 @@ Before files are staged or merged into the main branch, they must pass security
    ```
 2. **Verify Formatting:**
    ```bash
-   cargo fmt --manifest-path gateway/Cargo.toml -- --check
+   cargo fmt --all -- --check
    black --check sdk-python/
    ```
 3. **Build the Production Release Artifact:**
    ```bash
-   cargo build --release --manifest-path gateway/Cargo.toml
+   cargo build --release -p gateway
    ```
 
 ---
@@ -79,5 +79,5 @@ When deploying releases using Helm or Docker:
 - Verify that the container configurations bind endpoints to loopbacks or private subnets unless exposing public entry points.
 - Ensure all Helm charts lint successfully:
   ```bash
-  helm lint helm/aegisagent
+  helm lint helm/aegis-gateway
   ```

.claude/rules/sdk_testing.md

@@ -107,7 +107,7 @@ For end-to-end checks, we use a loopback integration server.
 ### Runbook Steps:
 1. Ensure the gateway server is compiling and running:
    ```bash
-   cargo run --manifest-path gateway/Cargo.toml
+   cargo run -p gateway
    ```
 2. In a separate shell, run the integration harness script:
    ```bash

.claude/rules/security_scan.md

@@ -1,6 +1,6 @@
 ---
 globs:
-  - "gateway/src/**/*.rs"
+  - "src/src/**/*.rs"
   - "src/**/*.rs"
   - "lib/storage/**/*.rs"
   - "lib/policy/**/*.rs"
@@ -84,9 +84,9 @@ To prevent unauthorized access to local services during testing.
 
 ### Runbook Steps:
 1. **Localhost Binding:** Verify that the gateway's server listener config binds strictly to the loopback interface (`127.0.0.1`) for testing and local development, avoiding wildcard bindings (`0.0.0.0`).
-2. **Verification Command:** Inspect `gateway/src/config.rs` and `gateway/src/main.rs`. Search for bind targets:
+2. **Verification Command:** Inspect `src/src/main.rs`. Search for bind targets:
    ```bash
-   grep -ri "0.0.0.0" gateway/
+   grep -ri "0.0.0.0" src/
    ```
    If any matches are found outside production deployment scripts (like Helm/Docker), flag them as policy violations.
 
@@ -101,7 +101,7 @@ Detect common software vulnerabilities in source code before merging.
 1. **Run the Scanner:** Proactively run the security scanner (such as `cargo-clippy`, `bandit` for Python, or integrated MCP scanners) on all modified files.
 2. **Scan Command Example:**
    ```bash
-   cargo clippy --manifest-path gateway/Cargo.toml -- -D warnings
+   cargo clippy --workspace --all-targets -- -D warnings
    # And for python
    bandit -r sdk-python/
    ```

.claude/rules/skill_comply.md

@@ -27,7 +27,7 @@ To ensure the integrity, security, and quality of the AegisAgent codebase, the a
 - [ ] **Local Interface Binding:** Ensure all TCP listener configurations in tests or dev code bind strictly to `127.0.0.1`.
 
 ### Code Quality & Standards
-- [ ] **Rust gateway formatting:** Run `cargo fmt --manifest-path gateway/Cargo.toml -- --check` and verify it passes.
+- [ ] **Rust gateway formatting:** Run `cargo fmt --all -- --check` and verify it passes.
 - [ ] **Python SDK formatting:** Run `black --check sdk-python/` and verify it passes.
 - [ ] **Linter check:** Run `cargo clippy` and verify there are no compile-time warnings or clippy errors.
 

.claude/rules/sqlite_usage.md

@@ -1,8 +1,8 @@
 ---
 globs:
-  - "gateway/src/db.rs"
+  - "lib/storage/**/*"
   - "lib/storage/**/*.rs"
-  - "gateway/migrations/**/*"
+  - "lib/storage/migrations/**/*"
 ---
 
 # AI Skill: SQLite Database Usage & SQLx (`skills/sqlite_usage.md`)

.claude/rules/tdd_workflow.md

@@ -44,11 +44,11 @@ When operating in this workflow, execute the relevant framework commands to veri
 ### Rust Gateway Tests
 - **Run all gateway tests:**
   ```bash
-  cargo test --manifest-path gateway/Cargo.toml
+  cargo test --workspace -- --test-threads=1
   ```
 - **Run a specific test module or test name:**
   ```bash
-  cargo test --manifest-path gateway/Cargo.toml -- <test_name_or_module>
+  cargo test --workspace -- --test-threads=1 <test_name_or_module>
   ```
 
 ### Python SDK Tests