Borrowing it
Nothing to install: this file belongs to joslat/maf-doctor. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/joslat/maf-doctor/main/.github/copilot-instructions.mdgit clone --depth 1 https://github.com/joslat/maf-doctorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/joslat/maf-doctor/copilot-instructions)<a href="https://agentmods.dev/instructions/joslat/maf-doctor/copilot-instructions"><img src="https://agentmods.dev/badge/instructions/joslat/maf-doctor/copilot-instructions.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01604 | $0.01604 |
| Opus 5 | $0.00802 | $0.00802 |
| Sonnet 5 | $0.00321 | $0.00321 |
| Haiku 4.5 | $0.00160 | $0.00160 |
Grade A, and why
maf-doctor copilot-instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MAF 1.3.0 Migration — Auto-Loaded Constraints
Auto-generated by
maf-doctor init. Do not hand-edit. Regenerate: delete this file and re-runmaf-doctor init. Authoritative version: readmaf://constraintsin Copilot Chat.
MAF 1.3.0 — Constraints & Breaking Changes Reference
Hard Constraints (Never Violate)
- NEVER introduce patterns not present in MAF 1.3.0
- NEVER store session-specific state in
AIContextProviderorChatHistoryProviderinstance fields — always useProviderSessionState<T> - NEVER add
[StreamsMessage]or[YieldsMessage]attributes — removed in 1.3.0, causesCS0246 - NEVER use
DefaultAzureCredentialin production code — preferManagedIdentityCredential - NEVER enable
EnableSensitiveData = truein non-development environments - ALWAYS pin
dotnet-inspectto exact v0.9.1. For ground-truth on what your project actually triggers, runcs0618-hunter(compiler-based) — it catches transitive obsoletions, overload-resolution surprises, and project-local[Obsolete]attributes that static inspection cannot see. - ALWAYS update
src/docs/migration-plan.mdtracking table after each task is completed and build-verified
Fan-out / Fan-in Rules (Silent Failure Risk)
Fan-out executor handlers MUST return ValueTask<T> where T is the message type.
A void or non-generic ValueTask return produces NO output message.
The fan-in barrier then starves silently — the workflow exits cleanly but incompletely.
This is NOT a build error. The only detection is runtime or maf-fan-out-validator skill.
AddFanInBarrierEdge argument order:
CORRECT: AddFanInBarrierEdge(IEnumerable<ExecutorBinding> sources, ExecutorBinding target)
OBSOLETE: AddFanInBarrierEdge(ExecutorBinding target, IEnumerable<ExecutorBinding> sources)
The obsolete overload compiles and runs but triggers CS0618.
Key Breaking Changes
| Area | Old (broken) | New (correct) |
|---|---|---|
| Executors | ReflectingExecutor<T> |
sealed partial class : Executor + [MessageHandler] |
| Executors | IMessageHandler<TIn,TOut> |
[MessageHandler] on handler methods |
| Executors | [StreamsMessage], [YieldsMessage] |
Removed — delete these attributes |
| Source gen | (missing package) | Add Microsoft.Agents.AI.Workflows.Generators 1.3.0 |
| Sessions | AgentThread |
AgentSession via await agent.CreateSessionAsync() |
| Sessions | GetNewThread() |
await agent.CreateSessionAsync(ct) |
| Sessions | agent.SerializeSession(session) |
await agent.SerializeSessionAsync(session) |
| Response | AgentResponse.Deserialize<T>() |
RunAsync<T>() + .Result |
| Streaming | InProcessExecution.StreamAsync() |
RunStreamingAsync() |
| Events | AgentRunUpdateEvent |
AgentResponseUpdateEvent |
| A2A DI | AIAgentExtensions |
services.AddA2AServer(agent, new A2AServerRegistrationOptions { AgentCard = ... }) |
| A2A endpoint | app.MapA2A(...) |
app.MapA2AHttpJson(path) or app.MapA2AJsonRpc(path) |
| Agent options | Instructions / Tools at top-level |
Must be inside ChatClientAgentOptions.ChatOptions |
| DevUI/Hosting | Microsoft.Agents.AI.DevUI / .Hosting |
No 1.3.0 equivalent — guard with #if DEVUI_ENABLED |
| Fan-in | AddFanInBarrierEdge(target, sources) |
AddFanInBarrierEdge(sources, target) — sources first |
| Fan-out | async ValueTask HandleAsync(...) returning void |
async ValueTask<T> HandleAsync(...) returning the message |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 85 lines · 1,604 tokens per session scan A d7498b29783b
maf-doctor copilot-instructions.md is an instructions file published in the GitHub repository joslat/maf-doctor (14 stars, last pushed 20d ago), licensed MIT. It adds 1,604 tokens to every session, about $0.0080 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
plan-forge api-patterns.instructions.md
API patterns for .NET — REST conventions, ProblemDetails, pagination, versioning, error responses.
plan-forge errorhandling.instructions.md
Error handling patterns — Exception hierarchy, ProblemDetails responses, error boundaries, global exception middleware.
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).