Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/mhenke/john-ousterhout-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/mhenke/john-ousterhout-skills/aposd-guidelines)<a href="https://agentmods.dev/rules/mhenke/john-ousterhout-skills/aposd-guidelines"><img src="https://agentmods.dev/badge/rules/mhenke/john-ousterhout-skills/aposd-guidelines/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/mhenke/john-ousterhout-skills/aposd-guidelines"><img src="https://agentmods.dev/badge/rules/mhenke/john-ousterhout-skills/aposd-guidelines.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01802 | $0.01802 |
| Opus 5 | $0.00901 | $0.00901 |
| Sonnet 5 | $0.00360 | $0.00360 |
| Haiku 4.5 | $0.00180 | $0.00180 |
Grade A, and why
aposd-guidelines scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Content source: This file mirrors
CLAUDE.md.CLAUDE.mdis the single source of truth — make changes there first, then copy here.
APOSD behavioral guidelines
APOSD behavioral guidelines for AI coding agents. Merge with project-specific instructions as needed.
Tradeoff: These guidelines bias toward strategic design over tactical speed. For trivial tasks, use judgment.
1. Strategic Over Tactical
Working code isn't enough. Invest in design.
- Every task gets a small design investment: at least one improvement in the surrounding code.
- Watch for the "tactical tornado" — churning out code quickly while accumulating design debt.
- Strategic thinking costs no extra time — it's about how you think, not how long you spend.
- BEFORE implementing any fix, explicitly state the strategic alternative: "Here's the tactical path: [quick fix]. The strategic alternative: [redesign that reduces complexity]. I recommend the strategic approach unless time constraints require otherwise."
- Red flag: If you find yourself using APOSD vocabulary ("deep module," "define errors out of existence") to justify a tactical patch, you're still being tactical. Language doesn't make it strategic — design investment does.
2. Design Deep Modules
Simple interface, powerful implementation.
- Module depth = benefit provided / interface complexity. The ratio should be high.
- If the interface is as complex as the implementation, it's shallow — merge or redesign.
- Diagnostic questions: "How many use cases will this serve?" (if one, too special-purpose). "Is this easy to use for my current need?" (if not, redesign).
3. Information Hiding
Expose only what callers need.
- If implementation details leak into the interface, stop and redesign.
- If the same design decision appears in multiple modules, that's information leakage — consolidate.
- Don't expose internal state unless callers genuinely need it.
4. Design General-Purpose Modules
Serve multiple use cases through a stable interface.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 151 lines · 1,802 tokens per session scan A e53abf28ce3c
aposd-guidelines is a cursor rule published in the GitHub repository mhenke/john-ousterhout-skills (6 stars, last pushed 2mo ago), licensed MIT. It adds 1,802 tokens to every session, about $0.0090 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
006-anti-overengineering
006: Anti-overengineering rules to prevent overcomplicated solutions.
204-anti-overengineering-detailed
Detailed project rules for avoiding unnecessary design and keeping complexity under control, with evidence used to guide decisions.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.