repo-dev-workflow-constraints

A set of development rules for the Flow2Spec repository, including where shared templates belong and how configuration files are distributed to different coding agents.

In plain words
What is it for?
Use it when editing Flow2Spec templates, synchronising Claude, Cursor, and Codex configuration, or checking the repository’s ownership and release rules.
Why use it?
It prevents changes from being made in generated files or the wrong part of the repository, which could be overwritten or break consistency.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/double-coding-lab/flow2spec/repo-dev-workflow-constraints
Clone the repo
git clone --depth 1 https://github.com/double-coding-lab/Flow2Spec

Made for: Cursor.

Per session 33 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,340 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00033 $0.01340
Opus 5 $0.00016 $0.00670
Sonnet 5 $0.00007 $0.00268
Haiku 4.5 $0.00003 $0.00134

Measured 2d ago against content hash e8f45e8d2e9d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

repo-dev-workflow-constraints scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/repo-dev-workflow-constraints.mdc · 90 lines

How it starts

The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Flow2Spec 项目开发纪律(Dev Workflow Constraints)

仅适用于 Flow2Spec 本仓自身开发,不下发给普通业务仓。

三端同源手写镜像:

  • Claude:.claude/rules/repo-dev-workflow-constraints.md
  • Cursor:.cursor/rules/repo-dev-workflow-constraints.mdc
  • Codex:.codex/topics/repo-dev-workflow-constraints.md
  • 路由摘要:.Knowledge/topics/f2s-dev-workflow-constraints.md

所有权边界

位置 角色 写入方式
packages/core/templates/{zh-CN,en-US}/ 下游 Rule、Skill、Hook、知识模板的唯一真源;随 Core tarball 发布 人或 Agent 直接维护并提交 Git
.claude/ / .cursor/ / .codex/ / 根 AGENTS.md 本仓消费模板后的配置根产物 用户明确要求后由 flow2spec init / npm run sync:agents 分发
.Knowledge/ 本仓共享知识库 按 topic/skill 写权直接维护
本仓专属 repo-* Rule/Skill 只服务本仓,不进入 Core templates 三端配置根手写镜像

templates/ 与根 lib/ 均不再存在:模板和核心实现分别由 packages/core/templates/packages/core/lib/ 单独持有。packages/core/templates/ 受 Git 管理,不依赖复制脚本、.gitignore 例外或 prepack 同步。

硬约束

  1. 下游会使用的 Rule、Skill、Hook、AGENTS、配置与知识模板,只改 packages/core/templates/zh-CN/packages/core/templates/en-US/;双语版本保持语义一致。
  2. 不直接编辑配置根中由 Core templates 派生的文件。它们会在后续 init 中被覆盖。
  3. 本规则、repo-dev-check 等本仓专属内容不进 Core templates,直接同步三端手写镜像与本仓知识库。
  4. Agent 不主动执行 flow2spec init / npm run sync:agents;只有用户明确要求分发时才执行。
  5. lib/ 不作为兼容入口。CLI 通过 createFlow2Spec() 等 Core 公共 API 工作;Core 内部测试可按需引用 packages/core/lib/

修改判断

  • 通用能力:改 packages/core/templates/{locale}/...,必要时同步 Core 实现与公开文档。
  • 本仓知识:改 .Knowledge/topics/、matcher、manifest/index;触达 topic 时先读 f2s-topic-authoring
  • 本仓专属纪律:改三端 repo-dev-workflow-constraints 镜像,不写入 Core templates。
  • 配置根派生产物:不手改,也不为预览主动执行 init。

版本模型

CLI Version       packages/cli/package.json
Core Version      packages/core/package.json
Template Version  packages/core/package.json.templateVersion
Protocol Version  packages/core/capabilities.json.protocolVersion
  • CLI 对 Core 使用运行时依赖 caret range(当前为 ^3.5.0);Core 必须落在该范围内。
  • Core 兼容修复/新增 API 可只升 Core;Template Version 不变,不触发知识库升级。
  • Rule、Skill、Hook、知识模板变化时升 Core,并显式执行 version:set:template
  • CLI 开始调用新版 Core API 时,升 CLI 并显式提高最低 Core range。
  • Protocol Version 只在公共协议不兼容时调整。
  • 根 private workspace version 不参与 npm 发布匹配。

Read the full file on GitHub · 90 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 90 lines · 33 tokens per session scan A e8f45e8d2e9d

Subscribe to this mod's changes

repo-dev-workflow-constraints is a cursor rule published in the GitHub repository double-coding-lab/Flow2Spec (47 stars, last pushed 5d ago), licensed MIT. It adds 33 tokens to every session and 1,340 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.