Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/lawofall/agentcore/verify-scopegit clone --depth 1 https://github.com/Lawofall/AgentCoreWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00090 | $0.01564 |
| Opus 5 | $0.00045 | $0.00782 |
| Sonnet 5 | $0.00018 | $0.00313 |
| Haiku 4.5 | $0.00009 | $0.00156 |
Grade A, and why
verify-scope scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
验证范围与窄化配方
全量很贵（本机实测）：一次干净 pnpm release:gate 15–25 min，其中桌面 shoot 约 4 min（默认 4 个 Chromium worker；SHOOT_WORKERS=1 串行约 13 min。数百张图；张数 = turn 向量数 × 帧切数，随向量增长，别写死具体张数；CI frontend-shoot 同 SHOOT_FRAMES=3 + SHOOT_WORKERS=4）、后端全量 pytest ~5 min、桌面全量 vitest 数分钟。反过来，单包 pnpm --filter <包> typecheck 只要数秒——别为它收窄，力气花错地方。
根上没有 typecheck / lint / 前端 test 脚本（根 package.json 只有契约生成、发布门禁、依赖审计、后端 pytest、部署）。三档第 2 档的前端命令都挂在各 app 上，用 --filter 取；别在根上找。
三档阶梯（默认档 1）见 AGENTS.md；跳档要有具体理由（改了配置 / 依赖 / 契约），写在回复里。
窄化命令
后端 pytest（cd apps/server）：点名用例 uv run pytest tests/test_x.py::test_y -q；只重跑上次失败 uv run pytest --lf -q；按名过滤 -k "关键词"。包级 pnpm test:server:unit（~5 min，已开 xdist）只在收尾跑。
前端 vitest（3.2.6）：点名文件 pnpm --filter agentcore-desktop exec vitest run <路径>；点名用例追加 -t "<用例名>"；按改动文件反查相关测试 pnpm --filter <包> exec vitest related --run <改动文件...>（related 是子命令不是 flag，且必须带 --run，否则进 watch 挂住）。包级 pnpm --filter <包> test -- --run 只在收尾跑。
桌面截图：pnpm -C apps/desktop shoot <场景名过滤> —— 默认带场景过滤，无过滤的全量（数百张）只在发布门禁跑。
类型 / lint：改动落在单包就 pnpm --filter <包> typecheck|lint。
release:gate 分段
段序固定 backend → contracts → desktop → mobile → admin。--only <段> 只跑一段，--from <段> 从该段跑到底（互斥）；release:gate:lite 跳过 shoot + smoke，省约 4 min。
非发布语境禁止裸跑全量 pnpm release:gate——要跑就 --only 或 :lite。
失败后怎么续：修完哪段就 --from <该段> 续跑到底（下游段吃上游产物，故用 --from 而非 --only）。
发布依据默认是一次不中断的完整全绿；但改动范围可证与已绿段无关时，允许用 --from <失败段> 的绿拼接上一轮结果，不必重拍与改动无关的全量截图。三条同时满足才算「可证」：1. 两次运行之间的改动只落在失败段及其下游所属的包；2. 未碰契约 / 生成物（packages/contract-*、OpenAPI、gen:types 产物）、根配置、依赖清单、跨包共享代码——碰到任一项则上游段结论作废，必须完整重跑；3. 交付说明写明哪几段来自哪次运行、两次之间改了哪些文件。判不准就重跑全量：这条是给「证据明确无关」用的，不是给「感觉应该没事」用的。
反空转
- 上次验证之后没有编辑过任何文件 → 不得重跑同一命令。要重跑须有具体理由（改了配置、装了依赖、确证 flaky）并说明。
- 失败 → 只重跑失败面（
--lf/ 点名文件 /-t/--from <段>），不从头再来。 lint → typecheck → conformance这串只在收尾做一次，不在每次小改后串一遍；同一命令连跑数次 = 空转。- 长命令（全量 pytest / gate / shoot）直接后台化 +
notify_on_output，别前台反复AwaitShell轮询。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 51 lines · 90 tokens per session scan A b2ead4bd80b6
verify-scope is a cursor rule published in the GitHub repository Lawofall/AgentCore (78 stars, last pushed 2d ago), licensed MIT. It adds 90 tokens to every session and 1,564 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
code-patterns
Python code style and recurring patterns (config, logging, errors, paths).
project-overview
Core project architecture, patterns, and conventions for the AI Documentation Generator.
cursorrules
You are an AI agent building the module: {{MODULENAME}} This module is part of the Mnemosyne Neural OS ecosystem by XPACEGEMS LLC.
backend-python
Python and FastAPI standards for the backend.
core-project-context
Canonical project context and ownership rules.
dashboard-typescript
React and TypeScript standards for the operator dashboard.