loadout go.instructions.md

Engineering guidance for building Go command-line tools and web or gRPC services. It covers different Go frameworks and deployment environments.

In plain words
What is it for?
Use it when creating or changing Go CLIs, HTTP APIs, gRPC services, or serverless APIs.
Why use it?
It gives an AI coding agent consistent rules for structure, quality, and decisions when working on Go projects.

Instructions file for GitHub Copilot

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/stefaniuk/loadout/go
Clone the repo
git clone --depth 1 https://github.com/stefaniuk/loadout

Made for: GitHub Copilot.

Per session 10,675 This file is loaded in full into every session.
When invoked 10,675 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.10675 $0.10675
Opus 5 $0.05338 $0.05338
Sonnet 5 $0.02135 $0.02135
Haiku 4.5 $0.01068 $0.01068

Measured yesterday against content hash 322223d6c4f7, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

loadout go.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/instructions/go.instructions.md · 854 lines

How it starts

The opening of the file, as written. The whole thing — 854 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Go Engineering Instructions (CLI + API, framework-agnostic) 🐹

These instructions define the expert engineering approach for building modern, production-grade Go CLIs and APIs.

They must remain applicable to:

  • Minimal CLIs (standard library flag)
  • Command frameworks (for example Cobra, urfave/cli)
  • HTTP APIs (standard library net/http, Chi, Echo, Gin)
  • gRPC services
  • AWS Lambda–hosted APIs (for example API Gateway + Lambda)

They are non-negotiable unless an exception is explicitly documented (with rationale and expiry) in an ADR/decision record.

Identifier scheme. Every normative rule carries a unique tag in the form [GO-<prefix>-NNN], where the prefix maps to the containing section (for example OP for Operating Principles, LCL for Local-first developer experience, QG for Quality Gates, continuing through AI for AI-assisted expectations). Use these identifiers when referencing, planning, or validating requirements.


0. Quick reference (apply first) 🧠

This section exists so humans and AI assistants can reliably apply the most important rules even when context is tight.

  • [GO-QR-001] Specification first: treat the specification as the source of truth for behaviour ([GO-OP-001]).
  • [GO-QR-002] Small, safe changes: prefer small, explicit, testable changes ([GO-OP-002], [GO-OP-006]).
  • [GO-QR-003] Fast feedback: local development and tests must be quick and confidence-building ([GO-OP-007], [GO-LCL-001]–[GO-LCL-008]).
  • [GO-QR-004] Run the quality gates after any code/test change and iterate to clean ([GO-QG-001]–[GO-QG-005]).
  • [GO-QR-005] Accept interfaces, return structs: define interfaces at the consumer side, not the producer ([GO-INT-001]–[GO-INT-003]).
  • [GO-QR-006] Deterministic outputs: stable ordering, stable field naming, no hidden randomness ([GO-OP-003], [GO-CTR-007]).
  • [GO-QR-007] Correct CLI streams: stdout for primary output, stderr for diagnostics ([GO-BEH-008]–[GO-BEH-011]).
  • [GO-QR-008] No secrets in args or logs: use env vars or secure prompts; never print secrets ([GO-SEC-001]–[GO-SEC-004], [GO-OBS-013]).
  • [GO-QR-009] Local by default: no real cloud/network by default; use fakes/emulators; explicit integration mode switches ([GO-EXT-001]–[GO-EXT-007]).
  • [GO-QR-010] Operational visibility: correlation IDs and structured logs for APIs; controlled diagnostics only ([GO-OBS-004]–[GO-OBS-010]).
  • [GO-QR-011] Handle errors explicitly: never ignore returned errors; wrap with context using %w ([GO-ERR-001]–[GO-ERR-012]).
  • [GO-QR-012] Avoid common anti-patterns: naked goroutines, nil channel operations, interface pollution, init() abuse, global mutable state (§21).

Read the full file on GitHub · 854 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 854 lines · 10,675 tokens per session scan A 322223d6c4f7

Subscribe to this mod's changes

loadout go.instructions.md is an instructions file published in the GitHub repository stefaniuk/loadout (1 stars, last pushed 3d ago), licensed MIT. It adds 10,675 tokens to every session, about $0.0534 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.