fraujulian
d5c2ca556b
CI / Capabilities and shell quality (push) Failing after 11s
CI / Python tests and compilation (push) Failing after 8s
CI / Build and inspect generated packages (push) Skipped
CI / Bash integration and installation guards (push) Skipped
CI / Installed client configuration smoke tests (push) Skipped
CI / Qwen retrieval integration (push) Skipped
CI / PowerShell tests on Ubuntu (push) Failing after 15s
CI / CI configuration security checks (push) Successful in 4s
26 lines
3.5 KiB
Markdown
26 lines
3.5 KiB
Markdown
# Global Instructions
|
|
|
|
Read `~/.my-ai-configuration/instructions/__CLIENT__.md` first when present; it is the user's direct instruction. System and developer requirements still apply.
|
|
|
|
For credentials, run the child command through `~/.my-ai-configuration/bin/with-credential.__SHELL__` with the client and credential key. Never expose credentials in commands, output, logs, or files.
|
|
|
|
## Loading rules
|
|
|
|
Load rules just in time. First identify the changed area, languages, frameworks, tools, and security or workflow concerns from the task and nearby files. Then load the mandatory baseline and only rules whose triggers match; never preload or recursively read the complete rules tree.
|
|
|
|
For Codex, read the listed rule path directly. For Claude, invoke the matching `rules-*` skill by its exact name. When a technology directory applies, load its index skill/file first, then load only the topic skills/files that match the work. An index is a small routing map, not a request to load every linked topic. Load cross-cutting rules independently when their stated trigger applies. If a needed rule is not listed or installed, continue with applicable rules and repository conventions.
|
|
|
|
Every code, configuration, infrastructure, review, test, script, hook, or integration task: `rules/security/index.md` / `rules-security`.
|
|
|
|
Focused security: authentication, authorization, sessions, tokens, permissions, tenants => `rules/security/references/auth.md` / `rules-security-auth`; HTTP, requests, serialization, endpoints => `api.md` / `rules-security-api`; browser, cookies, redirects, XSS, CSRF => `web.md` / `rules-security-web`; databases, queries, persistence, sensitive data => `data.md` / `rules-security-data`; files, uploads, archives, paths, processes, IPC, deserialization => `files.md` / `rules-security-files`; network, URLs, proxies, TLS, SSRF => `network.md` / `rules-security-network`; cryptography, secrets, keys, credentials => `crypto.md` / `rules-security-crypto`; dependencies, packages, plugins, builds, deployment, CI => `supply-chain.md` / `rules-security-supply-chain` (remaining paths under `rules/security/references/`).
|
|
|
|
Technology indexes: Angular => `rules/angular/index.md` / `rules-angular`; C#/.NET => `rules/csharp/index.md` / `rules-csharp`; Java/JVM => `rules/java/index.md` / `rules-java`; TypeScript/ECMAScript => `rules/typescript/index.md` / `rules-typescript`; UI/UX => `rules/ui-ux/index.md` / `rules-ui-ux`; WPF/XAML/MVVM => `rules/wpf/index.md` / `rules-wpf`.
|
|
|
|
Cross-cutting: unclear requirements or significant choices => `rules/decision-rule.md` / `rules-decision-rule`; completion or review readiness => `rules/definition-of-done.md` / `rules-definition-of-done`; Git operations => `rules/git.md` / `rules-git`; Microsoft 365, Azure DevOps, Teams => `rules/microsoft.md` / `rules-microsoft`; delegation or long-running work => `rules/orchestration.md` / `rules-orchestration`; behavior-preserving refactors => `rules/refactoring.md` / `rules-refactoring`.
|
|
|
|
## Tools and delegation
|
|
|
|
Use the `mcporter` CLI for MCP services by default. Use a native MCP connection when MCPorter is not active, or when the user explicitly requests it or selects a native MCP plugin in this configuration. If the requested route is unavailable, report the limitation instead of silently switching routes.
|
|
|
|
The main agent owns state and decisions. Delegate only independent work when it saves effort; use one implementer for contained work. Subagents do not spawn agents; pass minimal context and verify handoffs.
|