vox python.instructions.md

A set of review and construction rules for Python code, covering object creation, data hiding, type annotations, interfaces, and errors.

In plain words
What is it for?
It is for reviewing or writing Python according to rules such as frozen slotted data classes, private instance state, complete type annotations, and narrow exception handling.
Why use it?
It gives reviewers a consistent checklist for spotting design, typing, encapsulation, and error-handling problems in Python code.

Instructions file for GitHub Copilot

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/punt-labs/vox/python
Clone the repo
git clone --depth 1 https://github.com/punt-labs/vox

Made for: GitHub Copilot.

Per session 375 This file is loaded in full into every session.
When invoked 375 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00375 $0.00375
Opus 5 $0.00187 $0.00187
Sonnet 5 $0.00075 $0.00075
Haiku 4.5 $0.00038 $0.00038

Measured 2d ago against content hash 3c44863ec1a7, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

vox python.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to quarry python.instructions.md — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.github/instructions/python.instructions.md · 42 lines

What it actually says

Python Review Rules

Construction

  • __new__ is the constructor, not __init__. Flag any __init__ definition outside of @dataclass classes.
  • Constructors must establish all invariants before returning. No partially-constructed objects.
  • @dataclass must use frozen=True, slots=True.

Encapsulation

  • All instance attributes must start with _ (protected) or __ (private). Flag self.name = without underscore.
  • Expose state via @property, not public attributes.

Types

  • from __future__ import annotations must be the first import in every file.
  • Full type annotations on all function signatures and return types.
  • Use Protocol for structural interfaces, ABC for shared implementation. Never hasattr().
  • Return NotImplemented from binary operators, never raise NotImplementedError.
  • cast() must use string form: cast("Type", val).
  • Import abstract types from collections.abc, not typing.

Error handling

  • Validate at boundaries, trust internally. No defensive try/except in internal code.
  • Never catch broad Exception except at CLI entry points or MCP tool handlers.
  • ValueError for domain violations, TypeError for construction bypass.

Style

  • ruff format is the formatter (not black).
  • Double quotes, 88-char line length.
  • No backwards-compatibility shims, no # removed tombstones.

Tools directory

  • tools/oo_score.py is intentionally complex (subprocess calls to git, large check/update methods). Do not flag C901, S603, or S607 on files in tools/.
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 42 lines · 375 tokens per session scan A 3c44863ec1a7

Subscribe to this mod's changes

vox python.instructions.md is an instructions file published in the GitHub repository punt-labs/vox (3 stars, last pushed 2d ago), licensed MIT. It adds 375 tokens to every session, about $0.0019 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to quarry python.instructions.md, differing in 0 lines, and is treated as a copy.