dev-process

A development workflow for an AI-built, multi-agent project where people make product and release decisions. It explains how to start a new task, choose supporting documents, decide when to pause for approval, and avoid risky patchwork fixes.

In plain words
What is it for?
Use it at the start of a task, when investigating seams or rendering issues, when making design or architecture changes, and when a fix might require new fallback or special-case logic.
Why use it?
It gives developers a consistent way to navigate the repository, gather the right evidence, and know which decisions require a person.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/lawofall/agentcore/dev-process
Clone the repo
git clone --depth 1 https://github.com/Lawofall/AgentCore

Made for: Cursor.

Per session 1,004 This file is loaded in full into every session.
When invoked 1,004 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01004 $0.01004
Opus 5 $0.00502 $0.00502
Sonnet 5 $0.00201 $0.00201
Haiku 4.5 $0.00100 $0.00100

Measured 2d ago against content hash 401a5c98e9d8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dev-process scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/dev-process.mdc · 62 lines

What it actually says

开发工作流

项目采用「AI 全程开发、人做决策」模式,多 Agent 并行开发。

新会话冷启动

定位任务 → docs/索引.md「任务路由」;跑通 → docs/02-架构/本地开发.md;接缝 → seam-audit.mdc;桌面渲染自检 → frontend-preview.mdc;本地产品 AI / eval / probe → local-llm-dogfood.mdcdev OpenCode Zen,禁默认踩 PLATFORM_API_KEY);沉淀 → memory.mdc。产品介绍与仓地图 → AGENTS.md

决策权限

AI 自主决定 AI 提案 → 人确认 人直接决定
实现细节、Bug 修复(不改契约)、测试/重构 架构选型、新依赖、设计文档修改 功能范围、需求变更、发布决策

遇需人决策的节点,立即暂停并清晰描述问题和备选方案。

设计纪律

  • 正向推导:用户需求 → 产品设计 → 技术实现;动手前答三问:谁用 / 解决什么真实问题 / 产品上如何呈现。为复用旧实现而裁剪需求 → 停。
  • 证据按问题选(禁止「生产实测 > …」单一高低档;生产日志是个案观测,不是产品规格):
在问什么 主证据 生产日志
产品该怎样 / 架构取舍 用户意图 + 设计文档 + 人确认 默认不打开
代码现在怎么跑 HEAD + 单测 / conformance 不打开
这次事故怎么发生的 用户点名的 cid/trace + HEAD 只核这一次;没 ID 不 sync、不 --recent
线上是否还有同类 仅用户明说巡检 / reviews 存在性;禁占比/趋势外推
质量回归 dogfood 金标 / eval 不当金标

打开后禁止用一窗推断「通常如此」,禁止用日志压过 HEAD 或已确认设计。禁止编造观测值与生产 ID;用户对话正文不进仓,只留 ID + 脱敏摘述。查法 → conversation-logs.mdc

补丁绊线

修复满足任一,先停、提根因重设计提案:1. 需新增兜底/对账/自愈/特例逻辑;2. 同一根因改 ≥2 层;3. 同一接缝第 3 次打补丁。拦截提案 → intercept-discipline.mdc

开发准则

生产级代码(错误处理、类型、日志);先 Protocol/ABC/Pydantic 再实现;共享类型放 shared/core/types/;核心逻辑有单测;委派 → multitask.mdc

验证范围

三档定义见 AGENTS.md;窄化命令、门禁分段、反空转、真跑核证据 → verify-scope.mdc

文件编辑安全

禁止用脚本批量改源码;用 StrReplace + replace_all 逐文件改;改完用 Read 自检。

并行开发 Git 约束

git status / git diff 不代表本会话改动:1. 用 Read 校验自己的改动;2. git 对不上是并行噪音,接受并继续;3. 禁止排查 git 内部;4. 仅用户明确要求才跑 git,非请勿 commit。

产品 AI 日志查询

未贴 ID、未明说查失败/巡检 → 不打开。用户给出 32 位 hex ID / UUID → 只读 conversation-logs.mdc 再动手(勿整篇读分析指南、勿为单次查询派探子),禁止在文件系统(含 agent-transcripts/)搜索这类 ID。

文档治理 → doc-governance.mdc

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 62 lines · 1,004 tokens per session scan A 401a5c98e9d8

Subscribe to this mod's changes

dev-process is a cursor rule published in the GitHub repository Lawofall/AgentCore (78 stars, last pushed 2d ago), licensed MIT. It adds 1,004 tokens to every session, about $0.0050 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.