workflow

workflow is a cursor rule for Cursor from coddy-project/coddy-agent. It costs 6,502 tokens per session, scanned A, original, MIT.

Development workflow rules based on BDD, or behavior-driven development, where expected behavior is written as readable scenarios. They use Gherkin feature files, automated checks, unit tests, and required final verification.

In plain words
What is it for?
Use them when adding features or fixing bugs: write the correct-behavior scenario, implement it, cover boundaries with unit tests, update related schemas, and complete the required checks.
Why use it?
They make new behavior and bug fixes reproducible before implementation and keep edge cases in focused unit tests. They also require related API and configuration changes to stay synchronized.

Cursor rule for Cursor

Written for Cursor: installed under .cursor/. Also seen: mentions CLAUDE.md; mentions Claude Code; mentions AGENTS.md.

Good fit Use them when adding features or fixing bugs: write the correct-behavior scenario, implement it, cover boundaries with unit tests, update related schemas, and complete the required checks.

Compare 6 cursor rules from other repositories ↓
Install with agentmods
npx agentmods add rules/coddy-project/coddy-agent/workflow
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/coddy-project/coddy-agent

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for workflow

README.md
[![agentmods](https://agentmods.dev/badge/rules/coddy-project/coddy-agent/workflow/github.svg)](https://agentmods.dev/rules/coddy-project/coddy-agent/workflow)
Your own site
<a href="https://agentmods.dev/rules/coddy-project/coddy-agent/workflow"><img src="https://agentmods.dev/badge/rules/coddy-project/coddy-agent/workflow/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for workflow

Your own site · 80×15
<a href="https://agentmods.dev/rules/coddy-project/coddy-agent/workflow"><img src="https://agentmods.dev/badge/rules/coddy-project/coddy-agent/workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 6,502 This file is loaded in full into every session.
When invoked 6,502 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.06502 $0.06502
Opus 5.5 $0.02601 $0.02601
Sonnet 5.5 $0.01300 $0.01300
Haiku 4.5 $0.00650 $0.00650

Measured today against content hash bd057536e000, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/workflow.mdc · 265 lines

How it starts

The opening of the file, as written. The whole thing — 265 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Workflow (features, bugs, finish)

Specifications live in features/ (BDD)

Executable specifications for feature behavior and the happy path of a bug fix are Gherkin .feature files in the repository-root features/ directory, run by a godog harness (step definitions in the package that owns the behavior, e.g. external/httpserver/bdd_*_test.go, pointing Options.Paths at ../../features/<name>.feature).

  • New feature → add or extend the feature's .feature spec in features/ describing the scenario as it works when correct (the happy path), so the behavior is reproducible.
  • Bug fix → add a scenario (or feature) in features/ that reproduces the problem as a happy-path expectation, then make it pass.
  • Boundary / edge / error cases → do not put these in features/; cover them with ordinary unit tests next to the code. Keep .feature files focused on the correct-behavior story.
  • Keep specs deterministic and LLM-free where possible (use a stub runner, as the existing harnesses do). Step definitions may live near the code; the .feature specs stay in features/.

New behavior (TDD / BDD)

When adding or changing behavior (including words like feature, add, implement, фича, добавить):

  1. Add or extend the happy-path .feature spec in features/ (and/or a failing unit test) that asserts the observable outcome (red). Edge cases go in unit tests, not the spec.
  2. Run the narrowest test scope that proves the failure is real.
  3. Implement the smallest change that makes the test pass (green).
  4. Run make test - the express run: test-agent-rules, ui-build, ui-test, then one go test over the whole tree with every optional module compiled in (http,ui,scheduler,memory,cli,gateway,swarm,metrics). Everything must pass. Do not walk the tag combinations locally: that matrix (make test-matrix) runs on GitHub Actions for every pull request, one job per combination. When the change moved a build-tag boundary (a _stub.go, an Available const, a //go:build line), run that one combination by hand - go test -tags=<set> ./... - and leave the rest to CI.
  5. UI screenshots in the PR - if the change touches the SPA (external/ui/**: .tsx, styles.css, rendered markup), attach screenshots of every changed surface to the PR description. Per edit, not one image per PR.
    • Screenshot the running build you already verified per the UI verification rule (npx vite in external/ui, browser tools). Never a mockup, a hand-drawn approximation, or a re-used older image.
    • One image per affected view and state - a new dialog needs open and the surface it returns to; a changed row needs the row in each state the edit reaches.
    • Post before/after pairs for surfaces that already existed, so the visual diff is readable without checking out the branch.
    • Add narrow (390px) and wide (1280px) when layout differs between them, and light plus dark when the change adds or edits colors (the repo ships 7 themes; cover any whose tokens the change touches).
    • If a surface genuinely cannot be captured (no browser available, backend-gated screen), say so explicitly in the PR and state what was verified instead - do not silently omit it.
  6. HTTP OpenAPI narrative - If you changed the optional OpenAI-compatible HTTP API (routes, methods, headers, request or response bodies, status codes, or anything reflected in the served spec), update external/httpserver/openapi.go (openAPISpec) so it matches external/httpserver/server.go handlers and tests. Align docs/reference/http-api.md (and README.md HTTP bullets) when user-facing descriptions change.
  7. Config schema sync - If you changed the YAML config surface (internal/config structs: added, renamed, retyped, or removed a yaml-tagged field, enum value, or default), update internal/config/config.schema.json (embedded into the binary: it is what coddy -t validates against and what the site publishes) and run make docs: the field tables of docs/reference/config.md are generated from the schema's description strings and the loader's defaults, so a key without a description ships an empty row. TestDocsConfigSchemaMatchesStructs (internal/config/docs_schema_test.go) catches key/type drift; the prose in the Notes section of that page and the guide docs/getting-started/configuration.md are kept by hand. Mirror user-facing fields in config.example.yaml and UISchemaMap() (internal/config/ui_schema.go) as well. The same change must also update the bundled self-configuration skill internal/skills/bundled/configure-coddy/SKILL.md (its "Configuration areas" catalog and command examples are the agent-facing view of the schema) - schema edits that skip the skill ship an agent that configures against a stale surface.

Read the full file on GitHub · 265 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +2 tokens per session bd057536e000
  2. 2d ago Changed · +6 lines · +129 tokens per session c5b1ddc91f36
  3. 3d ago Changed · +2 lines · +147 tokens per session 701e8b32b07d
  4. 7d ago Changed · +11 lines · +316 tokens per session 29600b198bd7
  5. 11d ago Changed · +13 lines · +329 tokens per session 6417af5d4347
  6. 13d ago Changed · +30 lines · +424 tokens per session f45b8a51c8af
  7. 19d ago Changed · +37 lines · +678 tokens per session de0d6e8b9108
  8. 1mo ago Changed · +37 tokens per session a2fe03fad75f
  9. 1mo ago Changed · +50 lines · +1,396 tokens per session 605298dd3793
  10. 1mo ago First seen · 116 lines · 3,044 tokens per session scan A f238078b1753

Subscribe to this mod's changes

workflow is a cursor rule published in the GitHub repository coddy-project/coddy-agent (175 stars, last pushed today), licensed MIT. It adds 6,502 tokens to every session, about $0.0260 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.