Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/prisma/orm/ci-failure-classificationgit clone --depth 1 https://github.com/prisma/ormWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00542 |
| Opus 5 | $0.00000 | $0.00271 |
| Sonnet 5 | $0.00000 | $0.00108 |
| Haiku 4.5 | $0.00000 | $0.00054 |
Grade A, and why
ci-failure-classification scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI failure classification
Classify every CI failure from evidence before re-running, "fixing", or blaming it: (a) caused by this PR — fix the code; (b) infra/flake — retry and record the fingerprint; (c) already broken on the base — prove it, route to its own fix.
Before classifying anything
pnpm install --frozen-lockfilefirst. Stale install state fakes both reds and greens: staledist/(TS2307 on@internal/*), stale deps (a pin moved on the base is invisible until reinstall), stale fixtures. Install after a rebase, not before.- Read the actual job log; save it to a file once and grep the file (
running-tests.mdc). - Find the first failure. One dead shared connection fails dozens of tests at 0ms — count one event, not N failures.
- Check the diff can reach the failing package at all.
Control experiments
- A control proves a failure pre-existing only if it ran the same steps. CI skips heavy steps on inert (docs-only) diffs and still reports green — use a non-inert control diff.
- When the base never runs the failing workflow (pull_request-triggered), a concurrent trivial PR (e.g. dependabot bump) with the identical signature is the equivalent evidence.
- Reproduce with the real test file at the real commit; an approximate harness produces the right symptom for the wrong cause.
Known flake fingerprints
- Different assertions across retry attempts of one test — impossible for a deterministic defect; only the raw log shows it.
ECONNRESET/Connection terminated unexpectedlyat setup, or one connection error then siblings failing at 0ms — the shared dev database died mid-run.- All tests green, run exits 1 on an unhandled rejection — teardown race; classify from the rejection's stack.
A fingerprint match is a hypothesis, not a verdict — and a "flake" recurring on consecutive runs of the same tree is a real defect in a timing costume.
When a gate (not a test) fails
Read the gate's own output. If satisfying it would mean describing changes the PR does not contain, or contorting tense to avoid falsehoods, suspect the gate's comparison base — fix the gate, don't contort.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 37 lines · 0 tokens per session scan A 4a31b8afc456
ci-failure-classification is a cursor rule published in the GitHub repository prisma/orm (47,579 stars, last pushed today), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 542 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
config-validation-and-normalization
Patterns for config validation and normalization using Arktype.
contract-space-package-layout
On-disk layout for packages that expose a contract space (extensions, internal monorepo packages, aggregate-root apps).
cli-package-exports
CLI package export patterns and import conventions.
resolving-cyclic-dependencies
How to resolve cyclic dependencies when moving types or refactoring packages.
no-family-vocabulary-in-framework
The framework domain (packages/1-framework) carries no family- or target-specific vocabulary — types, fields, hooks, or strategy values. Enforced by lint:framework-vocabulary.
review-scope-overrides
Honor explicitly provided base branches in review artifacts.