Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/micheltlutz/dev-challenge/copilot-instructionsgit clone --depth 1 https://github.com/micheltlutz/dev-challengeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00690 | $0.00690 |
| Opus 5 | $0.00345 | $0.00345 |
| Sonnet 5 | $0.00138 | $0.00138 |
| Haiku 4.5 | $0.00069 | $0.00069 |
Grade A, and why
dev-challenge copilot-instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Copilot instructions
Mirror of AGENTS.md. Read that file for the full picture; this
is the short version Copilot loads automatically.
Which job are you doing?
Helping someone do a challenge — they are learning. Default to mentoring: plan with them, review their code, explain which acceptance criterion fails and why. Do not write the implementation unless they ask. If they ask, do it properly and without fuss. Scaffolding, config and boilerplate are always fine to write outright.
Improving the lab itself — normal engineering work. See
CONTRIBUTING.md.
The spec layer is the source of truth
specs/ — not the code, not readme_files/ (those are redirect stubs).
Before answering what a challenge requires, read
specs/challenges/<id>/spec.md and its acceptance.md. The old briefs
disagreed with the running API for a long time; this layer exists so that
cannot recur, and CI enforces it.
If you change API behaviour, update the spec and the harness test in the same commit.
Layout
app/— reference FastAPI APIspecs/— challenges, acceptance criteria, OpenAPI contract, design tokensharness/— black-box verifier, reports per acceptance criterionscripts/—seed.py,export_openapi.py,build_tokens.py,validate_specs.py
Commands
ruff check app scripts tests harness
pytest --cov=app
python scripts/export_openapi.py --check
python scripts/build_tokens.py --check
python scripts/validate_specs.py
python harness/cli.py --base-url http://localhost:3000 --challenge backend-05-balance
Fixture
[email protected] (5 statements, balance 15491.00) and [email protected]
(1 statement, balance 4200.00). Password Challenge@123 for both. Plus 40 rows
belonging to neither, which is what makes the scoping criteria bite.
Easy things to get wrong
- Primary buttons are near-black
#19191C, not purple. Purple is brand surfaces only. Importspecs/design/tokens.css; do not hard-code hex. - Credit
#0CB97B, debit#E02244, and colour is never the only signal — keep the sign and the arrow. - Web and mobile specs declare
testids. The harness drives the UI through them; omitting them makes the work unverifiable. - Balances and statement lists are per user. A statement is yours when your
full name is
from_userorto_user. Returning the global ledger is the commonest back-end mistake. - Mobile tokens go in Keychain/Keystore, never
AsyncStorageorUserDefaults. - Never commit a secret.
app/.envis git-ignored; useapp/.env.example.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 71 lines · 690 tokens per session scan A a6a24ffa3187
dev-challenge copilot-instructions.md is an instructions file published in the GitHub repository micheltlutz/dev-challenge (32 stars, last pushed 16d ago), licensed MIT. It adds 690 tokens to every session, about $0.0034 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
open-dictionary AGENTS.md
Instructions for ahpxex/open-dictionary, covering open dictionary rewrite charter, product framing, core workflow, technical framework and 1. raw ingestion layer.
designing-real-world-ai-agents-workshop CLAUDE.md
Instructions for iusztinpaul/designing-real-world-ai-agents-workshop, covering project, project structure, tech stack, access documentation and running qa.
canvas-lms-mcp AGENTS.md
Instructions for bruchris/canvas-lms-mcp, covering agents.md — canvas lms mcp server, quick start, run with npx (no install needed), or install globally and architecture.
Axon security-auditor.instructions.md
Instructions for jyunming/Axon, covering role: security auditor, known risk areas in this codebase, 1. bm25 serialization — src/axon/retrievers.py, 2. path traversal — src/axon/api.py /ingest endpoint and 3. dependency cves.
paper-pilot CLAUDE.md
Instructions for aytzey/paper-pilot, covering claude.md, best fit, setup, first workflow to try and claude prompt patterns.
foggy-data-mcp-bridge-python CLAUDE.md
Instructions for foggy-projects/foggy-data-mcp-bridge-python, covering foggy data mcp bridge — python, 快速启动, 安装依赖, 运行测试 and 启动 mcp 服务（连接 docker mysql）.