3.6 KiB
Global Instructions
For credentials, run the child command through ~/.my-ai-configuration/bin/with-credential.__SHELL__ with the client and credential key. Never expose credentials in commands, output, logs, or files.
Loading rules
Load rules just in time. First identify the changed area, languages, frameworks, tools, and security or workflow concerns from the task and nearby files. Then load the mandatory baseline and only rules whose triggers match; never preload or recursively read the complete rules tree.
For Codex, read the listed rule path directly. For Claude, invoke the matching rules-* skill by its exact name. When a technology directory applies, load its index skill/file first, then load only the topic skills/files that match the work. An index is a small routing map, not a request to load every linked topic. Load cross-cutting rules independently when their stated trigger applies. If a needed rule is not listed or installed, continue with applicable rules and repository conventions.
Every code, configuration, infrastructure, review, test, script, hook, or integration task: rules/security/index.md / rules-security.
Focused security: authentication, authorization, sessions, tokens, permissions, tenants => rules/security/references/auth.md / rules-security-auth; HTTP, requests, serialization, endpoints => api.md / rules-security-api; browser, cookies, redirects, XSS, CSRF => web.md / rules-security-web; databases, queries, persistence, sensitive data => data.md / rules-security-data; files, uploads, archives, paths, processes, IPC, deserialization => files.md / rules-security-files; network, URLs, proxies, TLS, SSRF => network.md / rules-security-network; cryptography, secrets, keys, credentials => crypto.md / rules-security-crypto; dependencies, packages, plugins, builds, deployment, CI => supply-chain.md / rules-security-supply-chain; active security testing => testing.md / rules-security-testing.
Technology indexes: Angular => rules/angular/index.md / rules-angular; C#/.NET => rules/csharp/index.md / rules-csharp; Java/JVM => rules/java/index.md / rules-java; TypeScript/ECMAScript => rules/typescript/index.md / rules-typescript; UI/UX => rules/ui-ux/index.md / rules-ui-ux; WPF/XAML/MVVM => rules/wpf/index.md / rules-wpf.
Cross-cutting: unclear requirements or significant choices => rules/decision-rule.md / rules-decision-rule; completion or review readiness => rules/definition-of-done.md / rules-definition-of-done; Git operations => rules/git.md / rules-git; Microsoft 365, Azure DevOps, Teams => rules/microsoft.md / rules-microsoft; delegation or long-running work => rules/orchestration.md / rules-orchestration; behavior-preserving refactors => rules/refactoring.md / rules-refactoring.
Tools and delegation
Use the mcporter CLI for MCP servers this configuration registers there, especially when the same server must work across Claude and Codex. Use a selected native plugin's MCP tools directly even when MCPorter is active; do not route them through an extra CLI hop or register the same server through both paths. Prefer native Codex plugin packaging when it provides the needed MCP server and skills together. Keep MCPorter where it provides a concrete shared benefit such as credential handling, discovery, or cross-client portability. If the selected route is unavailable, report the limitation instead of silently switching routes.
The main agent owns state and decisions. Delegate only independent work when it saves effort; use one implementer for contained work. Subagents do not spawn agents; pass minimal context and verify handoffs.