engineer-flow AGENTS.md

A set of instructions for soden46/engineer-flow, an engineering workflow that routes tasks among general and specialist agent capabilities and performs a security check after development work.

In plain words
What is it for?
Use it to guide engineering-task routing, load project-specific instructions and memory when appropriate, coordinate up to two development specialists, and trigger post-development security verification.
Why use it?
It gives the agent rules for choosing relevant capabilities, managing project memory, and applying security review without relying on unrelated framework-specific instructions.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/soden46/engineer-flow/agents-md
Clone the repo
git clone --depth 1 https://github.com/soden46/engineer-flow

Made for: Codex, OpenCode.

Per session 587 This file is loaded in full into every session.
When invoked 587 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00587 $0.00587
Opus 5 $0.00293 $0.00293
Sonnet 5 $0.00117 $0.00117
Haiku 4.5 $0.00059 $0.00059

Measured 2d ago against content hash feb3295fa4ad, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

engineer-flow AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 108 lines

How it starts

The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Engineer Flow Agent Instructions

Use skills/engineer-flow/SKILL.md as the canonical entrypoint for engineering tasks.

Runtime Model

Engineer Flow consists of:

  • one public engineer-flow Agent Skill
  • 16 generalized internal engineering capabilities under skills/engineer-flow/core/
  • conditional persistent project memory under skills/engineer-flow/infrastructure/memory-management/
  • compatible user-installed external Agent Skills
  • sparse specialist routing with at most 2 development specialists
  • mandatory post-development security verification

Framework-specific and technology-specific expertise should come from project evidence, native stack mechanisms, or relevant external Agent Skills.

Do not add built-in framework adapters.

Routing Rules

  • Start from the engineering concern, not the framework.
  • Select at most 2 development specialists:
    • primary
    • optional support
  • Prefer generalized internal capabilities for generic engineering tasks.
  • Activate external skills only when task or project evidence specifically supports them.
  • Do not activate unrelated external skills because of generic keyword overlap.
  • Current project code and configuration take precedence over assumptions.
  • Prefer the smallest correct change.
  • Preserve existing project conventions where reasonable.
  • Avoid unnecessary repository-wide exploration.

Memory Contract

Memory is conditional infrastructure and never consumes a primary or support specialist slot.

Use memory preflight only when prior project/session/workflow context could materially affect correctness.

Prefer a host-provided MCP memory tool when available. Otherwise use:

skills/engineer-flow/infrastructure/memory-management/scripts/memory.mjs

Current code and configuration override stale memory.

Checkpoint only durable reusable project knowledge and never store secrets, credentials, .env values, raw tokens, or personal data.

Security Contract

After development, run the mandatory security verification stage.

Read the full file on GitHub · 108 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 108 lines · 587 tokens per session scan A feb3295fa4ad

Subscribe to this mod's changes

engineer-flow AGENTS.md is an instructions file published in the GitHub repository soden46/engineer-flow (3 stars, last pushed 5d ago), licensed MIT. It adds 587 tokens to every session, about $0.0029 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other instructions, from other repositories

claude-code-mastery CLAUDE.md

Instructions for ShipWithAI/claude-code-mastery, covering claude.md — claude code mastery course, project overview, course structure, directory layout and teaching methodology: progressive hands-on hybrid.

ShipWithAI/claude-code-mastery · 3,996 tokens

claude-code-recipes CLAUDE.md

Instructions for halflength-ampleness75/claude-code-recipes, covering claude code recipes — project config, project, structure, conventions and writing style.

halflength-ampleness75/claude-code-recipes · 417 tokens

claude-bridge AGENTS.md

Instructions for kadaba/claude-bridge, covering agents.md — using claude-bridge from any ai coding cli, two independent channels, 1. coordination (the conversation), 2. file transfer (the bytes) — same for every tool and workflows.

kadaba/claude-bridge · 1,505 tokens

claude-code-second-brain AGENTS.md

Instructions for shofer-dev/claude-code-second-brain, covering agents.md, read first, invariants and working here.

shofer-dev/claude-code-second-brain · 513 tokens

Warden-AI CLAUDE.md

Claude Code instructions for rynald0cst0ltziam/Warden-AI, covering warden — context governance and verification layer, session start (important — do this first), layer 1: before starting work — context selection, layer 2: during work — tool output pruning and enforcement hooks (automatic).

rynald0cst0ltziam/Warden-AI · 4,292 tokens

Warden-AI GEMINI.md

Gemini CLI instructions for rynald0cst0ltziam/Warden-AI, covering warden — context governance and verification layer, session start (important — do this first), layer 1: before starting work — context selection, layer 2: during work — tool output pruning and enforcement hooks (automatic).

rynald0cst0ltziam/Warden-AI · 4,292 tokens