Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/kensaurus/cursor-kenjiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/kensaurus/cursor-kenji/approved-plan-execution)<a href="https://agentmods.dev/rules/kensaurus/cursor-kenji/approved-plan-execution"><img src="https://agentmods.dev/badge/rules/kensaurus/cursor-kenji/approved-plan-execution/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/kensaurus/cursor-kenji/approved-plan-execution"><img src="https://agentmods.dev/badge/rules/kensaurus/cursor-kenji/approved-plan-execution.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.01290 |
| Opus 5.5 | $0.00023 | $0.00516 |
| Sonnet 5.5 | $0.00011 | $0.00258 |
| Haiku 4.5 | $0.00006 | $0.00129 |
Grade A, and why
approved-plan-execution scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Approved-Plan Execution Adapter
You are executing an already-approved plan (a plan-*.md audit/burndown authored and reviewed at high effort). Your job is faithful, verifiable implementation — not re-planning or inventing unrelated scope. When complete-everything is explicitly active, its connected closure set (planned + previously parked + discovered blast-radius work) is part of the approved scope. When burndown-full is active, repo-wide search determines mechanical scope. These rules guard the failure modes of plan execution — passing the check instead of the intent, quietly widening or narrowing scope, deleting behavior to get green — and bind every change at every effort level.
1. Anti-reward-hacking (highest priority)
Satisfy the intent, never just the check. Forbidden:
- Hardcoding expected outputs, asserting trivialities, or narrowing a test so it cannot fail.
- Deleting, skipping, or
.only-ing a failing test to get green. - Silencing errors with
@ts-ignore,eslint-disable, broadtry/catch, oranyinstead of fixing the cause. - Stubbing/mocking the very thing under test.
- Reconstructing or faking data from caches, snapshots, fixtures, or bytecode to appear correct.
A green suite is necessary, not sufficient. In your trace, state why the change is correct — not just that checks pass.
2. Anti-feature-deletion
- Never delete or "simplify away" working code, features, routes, props, handlers, or states to pass checks or reduce scope. If something seems removable, leave it and note it for review.
- When replacing an implementation, preserve the existing public API, behavior, and output unless the approved plan explicitly says otherwise.
3. Small, checkpointed units
- Implement one burndown item (or one tight group) at a time. Do not execute the whole plan in a single unattended rollout.
- After each unit: run the relevant tests / typecheck / lint and confirm green.
- Default mode: stop at the plan's phase boundaries for review; do not auto-advance.
- Explicit closure mode: when the user invokes
complete-everythingorburndown-full, a phase boundary is an audit checkpoint, not a permission stop. Persist state, report meaningful progress, and auto-advance until the closure set is empty or a real human gate below is reached. - How a closure-mode turn ends: when the closure set is empty or a STOP condition below is met — not with a progress report while items remain open, not with a question the plan or repo already answers, not with an offer to continue ("want me to keep going?"), and not at a phase boundary. Before ending your turn, re-read your last paragraph: if it promises, offers, or asks, the turn is not over.
- If a tool call fails or a step dead-ends, fix that step before continuing — never paper over it and push on.
- Edit surgically: change the lines the item needs; do not rewrite files wholesale.
- Pre-existing bugs outside the approved scope go in the trace as follow-ups, not into the diff. Add tests only where the plan asks for them or the repo already keeps tests for that surface; scratch checks stay out of the repo.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 22d ago First seen · 66 lines · 57 tokens per session scan A 87b39fb48ca5
approved-plan-execution is a cursor rule published in the GitHub repository kensaurus/cursor-kenji (9 stars, last pushed 17d ago), licensed MIT. It adds 57 tokens to every session and 1,290 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-24.
Other cursor rules, from other repositories
propose-test-cases
Propose comprehensive test cases for PR changes.
300-testing-standards
WHEN implementing or validating BIG BRAIN components APPLY systematic testing and verification.
testing
Testing: test design, mocking strategy, coverage philosophy.
jest
Jest: describe/it, matchers, mocking, async testing.
playwright
Playwright: e2e testing, page objects, fixtures, assertions.
vitest
Vitest: unit testing, mocking, coverage, snapshot testing.