full-stack-ship-discipline

full-stack-ship-discipline is a cursor rule for Cursor from kensaurus/cursor-kenji. It costs 53 tokens per session (543 once invoked), scanned A, original, MIT.

A set of rules for shipping frontend features together with the database, API, permissions, storage, and secrets they depend on. It requires checking the real remote backend, not only compiling the interface.

In plain words
What is it for?
It guides end-to-end changes that read or write backend data, including migrations, database policies, server functions, deployment, and remote verification.
Why use it?
It prevents a feature from appearing complete when its live backend schema or API was never deployed or does not work for actual users.

Cursor rule for Cursor

Written for Cursor: a Cursor rule (.mdc).

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/kensaurus/cursor-kenji/full-stack-ship-discipline
Clone the repo
git clone --depth 1 https://github.com/kensaurus/cursor-kenji

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for full-stack-ship-discipline

README.md
[![agentmods](https://agentmods.dev/badge/rules/kensaurus/cursor-kenji/full-stack-ship-discipline.svg)](https://agentmods.dev/rules/kensaurus/cursor-kenji/full-stack-ship-discipline)
Your own site
<a href="https://agentmods.dev/rules/kensaurus/cursor-kenji/full-stack-ship-discipline"><img src="https://agentmods.dev/badge/rules/kensaurus/cursor-kenji/full-stack-ship-discipline.svg" alt="Measured on agentmods" height="20"></a>
Per session 53 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 543 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00053 $0.00543
Opus 5 $0.00026 $0.00271
Sonnet 5 $0.00011 $0.00109
Haiku 4.5 $0.00005 $0.00054

Measured 2d ago against content hash 4827fa758b34, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

full-stack-ship-discipline scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

rules/full-stack-ship-discipline.mdc · 38 lines

What it actually says

Full-Stack Ship Discipline

A feature is not done when the UI compiles — it is done when the flow works end-to-end against the remote backend the user actually hits. The recurring failure this prevents: a migration file authored beside a feature is never deployed, the live API 404s, and the bug masquerades as a UI issue.

  1. Inventory backend dependencies first. Before editing components ask: does this read/write data, call an RPC, or depend on a table / column / function / policy / bucket / secret? Fix those in the same turn.
  2. Deploy schema, don't just author it. Supabase: apply_migration / execute_sql on the confirmed project_id, then verify in the same turn — re-query information_schema / pg_proc / pg_policies, exercise the surface as anon / authenticated, check get_logs and get_advisors. Other stacks: run the real deploy command (prisma migrate deploy, drizzle-kit push, rails db:migrate, …) against the confirmed environment before the turn ends.
  3. Keep file and deploy in sync. SQL applied via MCP also gets a matching versioned file in the repo's migrations folder. Do not git push unless the user asked in this turn.
  4. Edge functions, secrets, RLS, buckets, and cron jobs count as schema — deploy and configure them with the UI change (verify_jwt, CORS, keys).
  5. Never re-ask before deploying schema the user asked to ship; always ask before mutating production data (DELETE / TRUNCATE / UPDATE on real rows).
  6. Do not attach during a present-then-stop pass. If the active skill is plan-* or a read-only audit-*, emit findings/plan only — do not apply_migration or deploy until the user approves a phase.

Done means: remote objects verified to exist, anon + authenticated paths exercised, migration file on disk, and the frontend observed hitting a 200 — not a stale 404.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 38 lines · 53 tokens per session scan A 4827fa758b34

Subscribe to this mod's changes

full-stack-ship-discipline is a cursor rule published in the GitHub repository kensaurus/cursor-kenji (9 stars, last pushed 8d ago), licensed MIT. It adds 53 tokens to every session and 543 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.