agent-context-kit copilot-instructions.md

Project instructions for an AI coding assistant working on the Cynrath/agent-context-kit repository. They define how changes, documentation, branches, releases, and commits must be handled.

In plain words
What is it for?
Use them when planning, implementing, documenting, testing, committing, or releasing changes in that repository.
Why use it?
They reduce mistakes such as changing files without a task record, publishing without permission, or leaving new work uncommitted.

Instructions file for GitHub Copilot

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/cynrath/agent-context-kit/copilot-instructions
Clone the repo
git clone --depth 1 https://github.com/Cynrath/agent-context-kit

Made for: GitHub Copilot.

Per session 758 This file is loaded in full into every session.
When invoked 758 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00758 $0.00758
Opus 5 $0.00379 $0.00379
Sonnet 5 $0.00152 $0.00152
Haiku 4.5 $0.00076 $0.00076

Measured 2d ago against content hash 8d411ec36b1c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

agent-context-kit copilot-instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/copilot-instructions.md · 48 lines

How it starts

The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Copilot Instructions

Prefer minimal, tested, secure changes that follow the project docs and task files.

Maintenance Note

This file is hand-maintained. ackit generate does not regenerate it. Update it through a regular docs/tasks/ task and a normal commit, never through the generator.

Governance

  • Authoritative agent policy: AGENTS.md — controlled-release governance.
  • Release actions (master push/merge, npm publish, tags, GitHub Releases) are user-authorized only; they require explicit authorization inside the active task. Always prohibited: force-push, history rewrite, tag movement/deletion, workflow dispatch, deployments.
  • Canonical development branch is master; rebuild/ackit-vnext is retired (historical evidence only, do not push).

Workflow

  • Task-first workflow is mandatory. Every implementation change starts from a task record under docs/tasks/active/, created with node dist/cli/index.js task "<title>".

Commit Completeness Hard Rule

  • Before any push, run git status and confirm the working tree is clean.
  • Never leave a newly created .md task file, plan, queue row, or test file uncommitted. New files must be added and committed in the same logical commit that creates them, or in an immediately following commit, before any push.

Repository Health

  • README: yes
  • LICENSE: yes
  • SECURITY: yes
  • Tests: yes
  • CI: yes
  • Agent instructions: yes

Stack & Validation

  • Main stack: TypeScript (strict ESM) + Node.js >= 22, pnpm, Vitest, Biome.
  • All validation uses the repository-built CLI: node dist/cli/index.js <command>. The old global .NET ackit tool and dotnet run invocations are not valid validation tools on this branch.

Release Status

  • Current line: AgentContextKit, package @cynrath/agent-context-kit, version 0.2.0 on master (tag v0.2.0, npm latest → 0.2.0, GitHub Release v0.2.0); 0.1.1/0.1.0 remain as historical releases.
  • npm publish, tag creation, GitHub Releases, and other master mutations require explicit user authorization. Automated publishing runs only through the tag-triggered .github/workflows/release.yml after that authorization; master pushes never publish.
  • Legacy .NET line is frozen and immutable: NuGet AgentContextKit 1.0.0-rc.1 (exact tag/release/assets/attestations at repository commit 258918b33c3d1359aac967604ee524e8b66ddf02) and earlier prereleases remain untouchable; do not republish, reuse, move, replace, or delete them. Historical failed recovery evidence remains preserved.

Read the full file on GitHub · 48 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 48 lines · 758 tokens per session scan A 8d411ec36b1c

Subscribe to this mod's changes

agent-context-kit copilot-instructions.md is an instructions file published in the GitHub repository Cynrath/agent-context-kit (14 stars, last pushed 3d ago), licensed MIT. It adds 758 tokens to every session, about $0.0038 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.