Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/romkey/i2c-directory/deployment-rulesgit clone --depth 1 https://github.com/romkey/I2C-DirectoryWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00869 | $0.00869 |
| Opus 5 | $0.00434 | $0.00434 |
| Sonnet 5 | $0.00174 | $0.00174 |
| Haiku 4.5 | $0.00087 | $0.00087 |
Grade A, and why
deployment-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deployment Rules
These rules govern how code is reviewed, merged, and deployed in this repository. They apply to all contributors, including AI coding assistants.
Branch Model
| Branch | Purpose | Protected |
|---|---|---|
main |
Production — deployed automatically on merge | Yes — no direct push |
staging |
Integration target — deployed automatically on merge | Yes — PRs required |
feature/* / fix/* |
Developer working branches — deleted after merge | No |
The Rules
1. No direct pushes to main or staging
All changes must arrive via pull request. Branch protection enforces this.
2. All work branches target staging
Open PRs from your feature or fix branch into staging, not main.
3. PRs require at least one approval
A reviewer other than the author must approve before merging. For small teams: if no review is possible within 48 hours and the change is low-risk, the author may self-merge with a note explaining why.
4. Staging is always deployable
Do not merge broken or half-finished work into staging.
Use a Draft PR to share work-in-progress without triggering a review or merge.
5. Production is promoted from staging, not deployed directly
To release to production, open a PR from staging → main.
Get one approval. Merge. GitHub Actions handles the rest.
6. Hotfixes are the only exception
If production is broken and urgent:
- Branch from
main(e.g.hotfix/brief-description) - PR directly into
main— bypass staging if necessary - After merging, open a follow-up PR from
main→stagingto re-sync
7. Never commit secrets
No passwords, API keys, tokens, or credentials belong in the repository. Use GitHub Actions Secrets for CI/CD credentials. Use server-side environment variables for runtime secrets.
8. Delete branches after merging
Keep the branch list clean. GitHub can be configured to do this automatically.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 105 lines · 869 tokens per session scan A 22aa0f3ace30
deployment-rules is a cursor rule published in the GitHub repository romkey/I2C-Directory (11 stars, last pushed 21d ago), licensed MIT. It adds 869 tokens to every session, about $0.0043 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
cursorrules
🚨 ABSOLUTELY FORBIDDEN: Direct python/python3 execution.
cursorrules
This is an embedded systems project for the ESP32-S3-Touch-LCD-1.85C device. All development must strictly follow the project constitution located at .cursor/rules.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.
coolify-ai-docs
Master reference to all Coolify AI documentation in .ai/ directory.