Borrowing it
Nothing to install: this file belongs to kamiazya/whiteboard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/kamiazya/whiteboard/main/AGENTS.mdgit clone --depth 1 https://github.com/kamiazya/whiteboardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/kamiazya/whiteboard/agents-md)<a href="https://agentmods.dev/instructions/kamiazya/whiteboard/agents-md"><img src="https://agentmods.dev/badge/instructions/kamiazya/whiteboard/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/kamiazya/whiteboard/agents-md"><img src="https://agentmods.dev/badge/instructions/kamiazya/whiteboard/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.03759 | $0.03759 |
| Opus 5.5 | $0.01504 | $0.01504 |
| Sonnet 5.5 | $0.00752 | $0.00752 |
| Haiku 4.5 | $0.00376 | $0.00376 |
Grade A, and why
whiteboard AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 259 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Instructions
Use this repo's standard development loop for every feature, bug fix, or refactor:
- Start with the smallest failing test at the nearest layer.
- Make the smallest patch that turns it green.
- Manually verify the real behavior in a running app or browser.
- Lock the verified user flow into
canvas-viewer-browser/web-browseror a broader E2E test when browser-mode is not enough.
Test Layer Selection
Start with the smallest failing test at the nearest layer, and do not jump to broad E2E when a smaller failing test can isolate the bug. Reach for a property or model-based test (fast-check) over an example-only one when the change touches a parser/serializer, a state machine with time/TTL/revocation semantics, a concurrent store, a CRDT or other mergeable structure, or a rounding/normalization transform with an algebraic invariant. Prefer example and browser tests for UI wiring, one-off integrations, and anything with no clean invariant to state.
Everything that follows from that choice is the test-layer-selection skill: which project
serves which layer and the command for each, the per-layer numRuns budget, and the property
disciplines — mutation-check every new property, answer a vacuous one with a denser generator
rather than more runs, never pin a seed, and never build an oracle out of the code it is judging.
Coverage ledgers are .claude/rules/coverage-ledger.md, which is path-scoped and loads itself.
Required Workflow
1. Write the red test first
- Reproduce the bug or target behavior before changing production code.
- Keep the first failing case as small and local as possible.
2. Turn it green locally
Run the narrowest project first:
pnpm test --project mcp-node
pnpm test --project canvas-viewer-jsdom
pnpm test --project canvas-viewer-browser
After the targeted test passes, run the broader suite that covers the touched area.
3. Manually verify the real behavior
- For UI work, open the real screen and confirm the behavior directly.
- Prefer Chrome DevTools MCP or Playwright MCP when available to inspect DOM, console, network, and visible behavior.
- If the changed flow is represented by a project skill under
./skills/*, read the relevantSKILL.mdand dogfood the real MCP/skill flow instead of verifying only through mocks. - While dogfooding, collect friction, awkward prompts, missing affordances, and ideas for follow-up improvements.
- Record every still-open dogfooding finding as a whiteboard document issue (see the
ticketingskill). When it is fixed, change it totype: notewith aRESOLVED —name and say what fixed it — do not delete it. What the document accumulated is the measurements, and those are what stop it being investigated again. - If runtime behavior disagrees with the test, treat runtime as the source of truth and fix the test or implementation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed · +1 lines · -2 tokens per session 0bffe16a1456
- 16d ago Changed 94c19b0d7baa
- 17d ago Changed · +7 tokens per session e8f692708ed5
- 24d ago Changed · +1 lines · +26 tokens per session dc458165c15f
- 25d ago Changed · +26 tokens per session 612a79d6240c
- 26d ago Changed · +1 lines · +35 tokens per session 55dcee57a746
- 27d ago Changed · -35 lines · -556 tokens per session c21f528f3cc8
- 28d ago Changed · +10 tokens per session 228e613fb6d4
- 1mo ago Changed · +16 tokens per session 785a865da6f5
- 1mo ago First seen · 291 lines · 4,197 tokens per session scan A 07065d84dce3
whiteboard AGENTS.md is an instructions file published in the GitHub repository kamiazya/whiteboard (10 stars, last pushed 3d ago), licensed Apache-2.0. It adds 3,759 tokens to every session, about $0.0150 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.