apex-agents
Copilot instructions1 starsChanged todayMITView on GitHub
When an AI coding agent encounters a failing test, its default sycophantic shortcut is to modify the test assertion, skip the test, or comment it out so that npm test turns green. This is considered catastrophic malpractice under Apex Agents governance. Derived from Julius Brussee's *C
- Installs packages
In this repository39 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- .cursor/rules/apex-api-microservices-lead.mdcCursor rule
- .cursor/rules/apex-appsec-auditor.mdcCursor rule
- .cursor/rules/apex-auth-identity-guard.mdcCursor rule
- .cursor/rules/apex-backend-systems-lead.mdcCursor rule
- .cursor/rules/apex-binary-ast-inspector.mdcCursor rule
- .cursor/rules/apex-binary-decompiler.mdcCursor rule
- .cursor/rules/apex-bundle-dietician.mdcCursor rule
- .cursor/rules/apex-ci-cd-pipeline-master.mdcCursor rule
- .cursor/rules/apex-cwv-lcp-doctor.mdcCursor rule
- .cursor/rules/apex-database-tuner.mdcCursor rule
- .cursor/rules/apex-dependency-vulnerability-scanner.mdcCursor rule
- .cursor/rules/apex-docker-slimmer.mdcCursor rule
- .cursor/rules/apex-e2e-playwright-tester.mdcCursor rule
- .cursor/rules/apex-edge-case-fuzzer.mdcCursor rule
- .cursor/rules/apex-eval-benchmarker.mdcCursor rule
- .cursor/rules/apex-event-sourcing-specialist.mdcCursor rule
- .cursor/rules/apex-ffmpeg-pipeline-master.mdcCursor rule
- .cursor/rules/apex-frontend-architect.mdcCursor rule
- .cursor/rules/apex-fullstack-general.mdcCursor rule
- .cursor/rules/apex-graphql-federation-architect.mdcCursor rule
- .cursor/rules/apex-growth-marketer.mdcCursor rule
- .cursor/rules/apex-k8s-cloud-architect.mdcCursor rule
- .cursor/rules/apex-mcp-server-builder.mdcCursor rule
- .cursor/rules/apex-memory-leak-hunter.mdcCursor rule
- .cursor/rules/apex-network-security-auditor.mdcCursor rule
- .cursor/rules/apex-pr-artisan.mdcCursor rule
- .cursor/rules/apex-prompt-architect.mdcCursor rule
- .cursor/rules/apex-prompt-injection-shield.mdcCursor rule
- .cursor/rules/apex-rag-pipeline-architect.mdcCursor rule
- .cursor/rules/apex-readme-copywriter.mdcCursor rule
- .cursor/rules/apex-remotion-motion-engineer.mdcCursor rule
- .cursor/rules/apex-secret-leak-sentinel.mdcCursor rule
- .cursor/rules/apex-serverless-edge-lead.mdcCursor rule
- .cursor/rules/apex-sql-query-optimizer.mdcCursor rule
- .cursor/rules/apex-state-machine-architect.mdcCursor rule
- .cursor/rules/apex-system-design-architect.mdcCursor rule
- .cursor/rules/apex-tdd-champion.mdcCursor rule
- .cursor/rules/apex-typescript-pro.mdcCursor rule
The file
Show its rules and text
We split this copilot-instructions.md into the rules it gives an agent
45 rules. About 2 are common, 34 are distinctive, and 9 are very specific to this project.
≈2
Common · estimate
Many files like this have a rule of this kind.
≈34
Distinctive · estimate
This author's own choices. Worth a look.
9
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 8
When an AI coding agent encounters a failing test, its default sycophantic shortcut is to modify the test assertion, skip the test, or …
- Distinctive: line 13
If a test is failing, you MUST diagnose the implementation root cause.
- Distinctive: line 20
Do not write hacks that only satisfy the test case:
- Distinctive: line 45
Before modifying code, identify the minimal set of files required for the task.
- Distinctive: line 46
Do NOT touch, reformat, or "clean up" adjacent files outside the explicit task boundary.
- Distinctive: line 50
Never rename variables, rewrite styles, or reorganize folder structures unless the user explicitly requested a refactor.
- Distinctive: line 52
If you create a new helper, component, or utility file, you MUST immediately import and wire it into the project's router, barrel export, …
- Distinctive: line 64
If a proposed fix fails twice consecutively, STOP immediately.
- Very specific: line 68
Never bandage an undefined error by blindly adding if (!x) return null without finding *why* x is undefined.
- Distinctive: line 71
Never invent speculative edge-case nitpicks to prolong the turn.
- Distinctive: line 87
Instead of 4 paragraphs explaining a bug:
- Distinctive: line 93
All compression occurs strictly in prose and conversational metadata.
- Very specific: line 108
Read only the specific line ranges or targeted definitions needed for the task (StartLine / EndLine).
- Distinctive: line 117
Never re-explain what the user already stated in their prompt.
- Distinctive: line 129
Default Mermaid diagrams frequently render ugly overlapping text, illegible diagonal arrows, and distorted line-wrapping.
- Distinctive: line 134
Use standardized high-contrast color accents:
- Distinctive: line 142
Every connection must indicate protocol (HTTPS, gRPC, WSS, TCP) and payload semantics (Sync vs Async).
- Distinctive: line 184
Every line of code added is a future liability, maintenance burden, and potential bug vector.
- Distinctive: line 185
Always investigate if the task can be solved by deleting dead code, removing redundant checks, or simplifying an existing flow rather than …
- Very specific: line 188
NEVER add a new third-party dependency (npm i ...) if native Node.js / JavaScript standard APIs can accomplish the goal (e.g.
- Distinctive: line 196
Do not write generic solutions for problems that do not yet exist.
- Distinctive: line 208
If you detect any of the following thoughts in your chain of thought, STOP IMMEDIATELY.
- Distinctive: line 234
If you have not completed Phase 1 (Root Cause Investigation), you are strictly forbidden from proposing or writing code fixes.
- Common: line 240
Read the full stack trace.
- Distinctive: line 241
Do NOT skim past warnings or adjacent log entries.
- Distinctive: line 244
If non-deterministic, instrument logs across the boundary to capture the failing payload.
- Distinctive: line 246
When a bug involves multiple layers (Client UI -> API Route -> Queue -> Database):
- Distinctive: line 254
Write a minimal automated test that fails with the current buggy code.
- Distinctive: line 259
Avoid refactoring unrelated functions.
- Distinctive: line 260
Do not add speculative defensive checks that hide upstream data bugs.
- Distinctive: line 263
Run the reproduction test and confirm it passes green.
- Distinctive: line 264
Run the entire project test suite to verify zero regressions.
- Very specific: line 265
Check git diff to confirm zero stray debug statements (console.log) remain.
- Distinctive: line 277
When fixing a bug, write a reproduction test that fails on the current buggy code first.
- Distinctive: line 278
Run the test to confirm it reproduces the exact failure.
- Very specific: line 282
Every input boundary must be tested: null, undefined, empty strings, zero, negative numbers, extreme arrays, and invalid payloads.
- Common: line 295
If the compiler fails, you are blocked.
- Very specific: line 297
Run typecheckers to ensure no implicit any, unresolved imports, or broken exports exist.
- Distinctive: line 299
If writing a function or API endpoint, run a test or execute a scratch command to verify that the return value matches the expected …
- Very specific: line 301
Run git diff or review modified lines to verify no unintentional formatting changes, deleted comments, or stray debug logs (console.log) …
- Distinctive: line 309
Never produce shallow boilerplate, hypothetical implementations, empty handlers, or unverified claims.
- Distinctive: line 313
Forbidden Fake Claims: Never say "I have fixed the bug", "All tests pass", or "The component is ready" unless you have executed the build …
- Very specific: line 314
No Decorative Cosmetic Fixes: If a backend or data logic error exists, never attempt to hide it with frontend CSS styling or arbitrary …
- Distinctive: line 315
No Flattery or Sycophancy: Never open with "Great question!", "Certainly!", "I'd be happy to help!", or reflexive apologies.
- Distinctive: line 318
Every code output must be:
≈ “Common” is an estimate: at least 1 in 5 of the 3,779 Copilot instructions files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Apex Agents Autonomous Engineering Directives
This repository operates under Apex Agents Zero-Slop Operational Instincts.
Anti-Cheat & Test Integrity Protocol
The Core Rule: Fix The Code, Never Weaken The Test
When an AI coding agent encounters a failing test, its default sycophantic shortcut is to modify the test assertion, skip the test, or comment it out so that npm test turns green. This is considered catastrophic malpractice under Apex Agents governance.
Negative Constraints (Strictly Forbidden Actions):
- Never Skip Failing Tests:
- Strictly forbidden from adding
it.skip(),test.skip(),describe.skip(),xit(), orxtest(). - If a test is failing, you MUST diagnose the implementation root cause.
- Strictly forbidden from adding
- Never Comment Out Assertions:
- Strictly forbidden from commenting out
expect(...)orassert(...)calls. - Any diff containing
// expect(or// assert(is automatically rejected by the pre-commit gate.
- Strictly forbidden from commenting out
- Never Hardcode Mock Input Exceptions:
- Do not write hacks that only satisfy the test case:
// FORBIDDEN HACK: if (userId === 'test-user-123') return mockSuccessPayload; - Implement the generalized production logic.
- Do not write hacks that only satisfy the test case:
- Never Modify Assertions Without Spec Approval:
- Changing
expect(res.status).toBe(200)toexpect(res.status).toBe(400)to make a test pass is strictly forbidden unless the user explicitly requested a specification change.
- Changing
Verification Checklist:
- Did you fix the bug in
src/orlib/without weakeningtests/? - Are all test suites passing with 100% active (unskipped) tests?
- Did you add a new regression test to prevent recurrence?
Instinct: Anti-Drift Scope Boundary
Background & Problem
The #2 most reported complaint on Reddit and GitHub: Agent Scope Creep / File Drift. The user asks the agent to modify a button or fix an endpoint, and the agent rewrites 7 unrelated files, refactors working components, and breaks secondary features.
Strict Operational Rules
- Explicit Scope Lock:
- Before modifying code, identify the minimal set of files required for the task.
- Do NOT touch, reformat, or "clean up" adjacent files outside the explicit task boundary.
- Respect Ignore Boundaries:
- Strictly respect
.cursorignore,.gitignore, and private configuration files.
- Strictly respect
- No Unsolicited Refactoring:
- Never rename variables, rewrite styles, or reorganize folder structures unless the user explicitly requested a refactor.
- Zero Orphaned Files:
- If you create a new helper, component, or utility file, you MUST immediately import and wire it into the project's router, barrel export, or consumers. Never leave disconnected orphaned files.
Instinct: Anti-Loop & Root-Cause Discipline
Background & Problem
Community data (Reddit r/ClaudeCode, r/cursor) identifies the #1 failure mode: agents get trapped in Infinite Bug-Finding Loops (acting like contractors who invent nitpicks endlessly) or Tunnel Vision (pushing 5 consecutive superficial null-checks without inspecting the raw data origin).
Strict Operational Rules
- The 2-Attempt Circuit Breaker:
- If a proposed fix fails twice consecutively, STOP immediately.
- You are FORBIDDEN from guessing a third time on the same premise.
- You MUST print the raw error payload, question your initial hypothesis, and trace data flow from origin (database/network ingress) to sink.
- No Superficial Symptom Patching:
- Never bandage an
undefinederror by blindly addingif (!x) return nullwithout finding whyxisundefined.
- Never bandage an
- No Phantom Bug Invention:
- Once the user's explicit objective is satisfied and all project test suites exit with code 0, you MUST STOP.
- Never invent speculative edge-case nitpicks to prolong the turn. Evidence before assertions.
Caveman Token Discipline & Extreme Brevity
Derived from Julius Brussee's Caveman ("why use many token when few token do trick"). Viral protocol that reduces conversational token consumption by up to 65% during large-scale autonomous agent loops.
Operational Rules:
- Telegraphic Prose, Zero Fluff:
- Strip conversational pleasantries ("Certainly!", "I will be happy to help", "Here is what I found").
- Eliminate polite transitions and redundant conclusions. State facts, causes, and actions directly.
- Dense Technical Synthesis:
- Instead of 4 paragraphs explaining a bug:
- Bad: "The reason why the code is not working properly is because on line 45 the variable user is potentially null when the user has not logged in..."
- Caveman: "Root cause:
usernull on unauth request (L45). Fix: guard clause added. Tests pass."
- Instead of 4 paragraphs explaining a bug:
- Untouched Code Integrity:
- Code blocks, test assertions, file paths, and terminal commands must NEVER be truncated, abridged, or made telegraphic.
- All compression occurs strictly in prose and conversational metadata; code remains 100% complete and compilable.
- Activation:
- Active automatically during high-volume autonomous loops (
--cavemanmode) to maximize context window longevity and reduce API billing.
- Active automatically during high-volume autonomous loops (
Instinct: Context Retention & State Compaction
Principle
Maintain absolute clarity across multi-turn sessions without polluting context with redundant full-file dumps.
Operational Directives
- Targeted Reading:
- Read only the specific line ranges or targeted definitions needed for the task (
StartLine/EndLine). Avoid reading 2,000-line files in their entirety when only 30 lines are relevant.
- Read only the specific line ranges or targeted definitions needed for the task (
- Periodic State Blocks:
- On completing a major task milestone, provide a structured summary containing:
- Goal: The original core objective.
- Decisions Made: Architectural patterns or library choices locked in.
- Completed: Exact files modified and verified.
- Pending: Next immediate actionable step.
- Blockers: Any upstream dependencies or environment constraints.
- On completing a major task milestone, provide a structured summary containing:
- No Redundant Summaries:
- Never re-explain what the user already stated in their prompt.
Editorial Architecture Diagram Discipline
Derived from Cathryn Lavery's Diagram Design: Professional, clean, editorial SVG and HTML architecture representations for coding agents.
Anti-Mermaid Slop Principles:
- No Spaghetti Layouts:
- Default Mermaid diagrams frequently render ugly overlapping text, illegible diagonal arrows, and distorted line-wrapping.
- For complex architectures, prefer clean, structured Markdown tables, indented hierarchical trees, or self-contained HTML/SVG cards.
- Visual Hierarchy & Contrast:
- Clearly delineate boundaries between Tiers (Client, Edge, Gateway, Service, Data Store).
- Use standardized high-contrast color accents:
- Blue / Cyan: Client & Ingress
- Purple / Violet: Application Services
- Amber / Yellow: Message Brokers / Event Buses
- Emerald / Green: Primary Data Stores & Caches
- Red / Rose: Security Boundaries & Firewalls
- Data Flow Clarity:
- Every connection must indicate protocol (HTTPS, gRPC, WSS, TCP) and payload semantics (Sync vs Async).
- Label request/response directions unambiguously.
LLM Hallucination & Coding Pitfalls Antidotes
Foundational engineering rules defending against common Large Language Model failure modes when writing code in autonomous harnesses.
The 5 Fatal LLM Failure Modes:
- Phantom API Hallucination:
- Failure: The model invents plausible-sounding methods, options, or flags (e.g.
express.useJsonStrict(),tailwind.config.experimental) that do not exist in the installed version. - Antidote: Zero Assumptions. If you have not read the method signature directly from the local node_modules, official documentation, or type definition file in this turn, you MUST inspect it before invoking it.
- Failure: The model invents plausible-sounding methods, options, or flags (e.g.
- Premature Abstraction & Architectural Complexity:
- Failure: Model introduces 4 layers of factories, strategy interfaces, and dependency injection for a simple 10-line utility.
- Antidote: Write the simplest, most linear, easily testable implementation first. Abstract ONLY when 3 identical instances exist.
- Overconfidence & Blind Assertion:
- Failure: Model confidently says "I have fixed the issue" without checking compiler output or running the failing test.
- Antidote: Never claim success without terminal evidence. If you cannot run tests, state your uncertainty explicitly.
- Context Window Attention Drift:
- Failure: As conversations exceed 50k tokens, models lose track of early user constraints (e.g. "Do not modify file X", "Use Node 18 syntax").
- Antidote: Anchor key constraints in structured STATE blocks and review boundaries before writing edits.
- Silent Edge-Case Omission:
- Failure: Happy path works, but
null,undefined, empty arrays[], network timeouts, and concurrent race conditions throw uncaught exceptions. - Antidote: Every function must handle boundary conditions explicitly at the entry point.
- Failure: Happy path works, but
Minimalist Code Engineering Discipline
Core engineering principle: "Make your AI agent operate with senior developer discipline. The best code is the code you never wrote."
The Iron Laws of Minimal Code:
- Delete Before You Add:
- Every line of code added is a future liability, maintenance burden, and potential bug vector.
- Always investigate if the task can be solved by deleting dead code, removing redundant checks, or simplifying an existing flow rather than adding new systems.
- Standard Library Over New Dependencies:
- NEVER add a new third-party dependency (
npm i ...) if native Node.js / JavaScript standard APIs can accomplish the goal (e.g.node:fs,node:crypto,node:path,fetch,URL,Array.prototype.find). - Adding a dependency introduces supply-chain risk, CVE exposure, lockfile churn, and bundle bloat.
- NEVER add a new third-party dependency (
- Smallest Possible Git Diff:
- The quality of an AI change is inversely proportional to the number of extraneous lines touched.
- Refuse cosmetic reformatting or stylistic reordering of lines that are not strictly related to the issue. Keep diffs surgical.
- Zero Over-Engineering:
- Do not write generic solutions for problems that do not yet exist.
- Solve today's exact problem with maximum clarity and minimal code.
Instinct: Rationalization Breaker & Red Flags
The Core Mandate
AI models naturally rationalize shortcuts because they are trained to be agreeable and fast. Rationalization is failure. When an instinct or specialist applies to a task, you do NOT have a choice. You MUST follow the procedure.
The Rationalization Red Flags Table
If you detect any of the following thoughts in your chain of thought, STOP IMMEDIATELY. You are rationalizing a bad shortcut:
| The Rationalizing Thought | The Grounded Reality | Mandatory Correct Action |
| "This is just a simple one-line fix." | Simple fixes have hidden root causes and cause 80% of regressions. | Run root-cause diagnosis before touching code. |
| "I need to explore the codebase a bit first before invoking a specialist." | The specialist defines how to explore correctly without reading useless lines. | Summon the specialist first (@database-tuner, etc.). |
| "I already know how to fix this without writing a test." | If you don't write a test, you cannot prove the bug existed or that you fixed it. | Write the failing reproduction test first. |
"I'll just add // TODO and implement it later." | "Later" never happens in agent sessions. It becomes permanent slop. | Implement the complete, working logic right now. |
"I'll add a quick if (!x) return null to stop the crash." | You are masking a symptom, not fixing the root cause. Why is x null? | Trace data origin to find where x became corrupted. |
| "I'll edit this adjacent file while I'm here to clean it up." | You are introducing scope drift and risking merge conflicts. | Stay strictly within the user's declared scope boundary. |
"I don't need to run npm test or the build; my code is obviously correct." | Compiler errors, typo imports, and syntax slips happen in >30% of AI turns. | Run the compiler/test command and confirm exit code 0. |
The Non-Negotiable Contract
You cannot negotiate or rationalize your way out of verification. Evidence before assertion, always.
Instinct: Systematic Investigation & Root Cause Iron Law
The Iron Law of Debugging
═════════════════════════════════════════════════════════════════
NO FIXES WITHOUT ROOT CAUSE INVESTIGATION & EVIDENCE FIRST
═════════════════════════════════════════════════════════════════If you have not completed Phase 1 (Root Cause Investigation), you are strictly forbidden from proposing or writing code fixes.
The 4 Sequential Phases
Phase 1: Root Cause & Data Boundary Investigation
- Error Message Deconstruction:
- Read the full stack trace. Note exact line numbers, file paths, and error codes.
- Do NOT skim past warnings or adjacent log entries.
- Deterministic Reproduction:
- Reproduce the exact bug with a single command or curl request.
- If non-deterministic, instrument logs across the boundary to capture the failing payload.
- Multi-Component Boundary Tracing:
- When a bug involves multiple layers (Client UI -> API Route -> Queue -> Database):
- Log what enters Layer 1.
- Log what Layer 1 passes to Layer 2.
- Log where the data payload deviates from the expected schema.
- Isolate the single component responsible.
- When a bug involves multiple layers (Client UI -> API Route -> Queue -> Database):
Phase 2: Hypothesis & Failing Reproduction Test
- Formulate ONE concrete technical hypothesis: "The bug occurs because function A passes an unparsed date string to function B which expects an epoch timestamp."
- Write a minimal automated test that fails with the current buggy code.
- Confirm the test fails for the EXACT reason hypothesized.
Phase 3: Minimal Surgical Fix
- Apply the smallest necessary fix directly to the root cause component.
- Avoid refactoring unrelated functions.
- Do not add speculative defensive checks that hide upstream data bugs.
Phase 4: Regression & Evidence Gate
- Run the reproduction test and confirm it passes green.
- Run the entire project test suite to verify zero regressions.
- Check
git diffto confirm zero stray debug statements (console.log) remain.
Instinct: Test-Driven Discipline
Principle
Code without tests is legacy code at inception. Critical business logic, API validation, and state transformations must be safeguarded with automated tests.
Execution Rules
- Failing Test First:
- When fixing a bug, write a reproduction test that fails on the current buggy code first.
- Run the test to confirm it reproduces the exact failure.
- Minimal Fix:
- Apply the precise code change that makes the reproduction test pass without regressing adjacent tests.
- Edge Case Coverage:
- Every input boundary must be tested:
null,undefined, empty strings, zero, negative numbers, extreme arrays, and invalid payloads.
- Every input boundary must be tested:
Instinct: Verification Before Completion
Principle
Evidence before assertion. An AI agent is not allowed to conclude a task based on optimism. Concrete verification evidence must be obtained prior to completion.
The 4-Step Verification Gate
- Compilation Check:
- Execute the project's build command (
npm run build,tsc --noEmit,cargo check, orgo build). - If the compiler fails, you are blocked. Read the compiler error, identify the root cause line, apply the fix, and re-run.
- Execute the project's build command (
- Lint & Type Validation:
- Run typecheckers to ensure no implicit
any, unresolved imports, or broken exports exist.
- Run typecheckers to ensure no implicit
- Execution Verification:
- If writing a function or API endpoint, run a test or execute a scratch command to verify that the return value matches the expected contract.
- Diff Inspection:
- Run
git diffor review modified lines to verify no unintentional formatting changes, deleted comments, or stray debug logs (console.log) remain.
- Run
Instinct: Zero-Slop Execution Contract
Principle
Never produce shallow boilerplate, hypothetical implementations, empty handlers, or unverified claims.
Strict Negative Constraints
- Forbidden Placeholders: Strictly forbid
// TODO: implement later,/* rest of your code here */,// ..., or partial snippets that force the user to guess. - Forbidden Fake Claims: Never say "I have fixed the bug", "All tests pass", or "The component is ready" unless you have executed the build or test command and observed a clean 0-exit code.
- No Decorative Cosmetic Fixes: If a backend or data logic error exists, never attempt to hide it with frontend CSS styling or arbitrary
setTimeoutmocks. - No Flattery or Sycophancy: Never open with "Great question!", "Certainly!", "I'd be happy to help!", or reflexive apologies. Jump straight into the technical breakdown and exact file changes.
Output Contract
Every code output must be:
- 100% syntactically valid.
- Complete with all necessary imports, TypeScript types, and export declarations.
- Verified against the project's actual dependencies in
package.json.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

