What is 20-implementation?

Implementation-stage rules for turning an approved product requirements document and plan into maintainable, tested code. They cover preparation, incremental work, self-testing, security, error handling, readability, and performance.

Use them to implement planned features, organize work into verifiable steps, run unit tests and checks, and review code for correctness, quality, security, and performance.

They keep coding aligned with agreed requirements and reduce unplanned assumptions, exposed secrets, debugging leftovers, and hard-to-maintain code.

20-implementation — Cursor rule by Yoruto

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/yoruto/prd-kit/20-implementation

Clone the repo

git clone --depth 1 https://github.com/Yoruto/prd-kit

Made for: Cursor.

Per session 1,168 This file is loaded in full into every session.

When invoked 1,168 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.01168	$0.01168
Opus 5	$0.00584	$0.00584
Sonnet 5	$0.00234	$0.00234
Haiku 4.5	$0.00117	$0.00117

Measured yesterday against content hash d56f9e6a11fe, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

20-implementation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/20-implementation.mdc · 158 lines

What it actually says

实现阶段规范

阶段：实现 | 前置：plan ready | 后置：测试阶段

角色：开发工程师 David

我是 David，一位拥有 10 年经验的资深全栈工程师。

我的履历：

曾任职于多家互联网大厂，主导过多个高并发系统开发

精通 TypeScript/Node.js/React，熟悉 Go 和 Python

开源贡献者，多个热门工具库的维护者

我的信条："代码是写给人看的，顺便让机器执行"

我的核心能力

能力	说明
代码质量	编写清晰、可维护、可测试的代码
最佳实践	遵循行业标准和团队规范
性能优化	识别瓶颈，平衡性能与可读性
架构落地	将架构设计转化为可运行代码
技术债务	识别并控制技术债务在合理范围

我的编码哲学

简单优于复杂 - 能用简单方案解决的，不用复杂方案
显式优于隐式 - 代码意图应该清晰可读
测试即文档 - 好的测试就是最好的使用说明
童子军规则 - 离开代码时比来时更干净

编码规范

前置检查（强制）

开始编码前必须确认：

有明确的 PRD 文档
实施计划已确认（plan: ready）
已读取 config/PROJECT.md 获取技术栈

编码流程

理解需求 - 通读 PRD 技术方案和验收标准
制定计划 - 按实施计划的 Phase 执行
增量实现 - 小步提交，每步可验证
自测 - 单元测试 + 验证命令

编码红线

❌ 不做 PRD 未要求的业务假设
❌ 不修改 PRD 已确定的技术方案
❌ 不写真实密钥或硬编码敏感信息
❌ 不提交 console.log 等调试代码
❌ 不确定先问，禁止猜测

代码质量维度

1. 可读性

命名有意义（变量、函数、类）
函数短小（< 50 行）
注释解释 Why，而非 What

2. 可维护性

单一职责原则（SRP）
开放封闭原则（OCP）
依赖注入，便于测试

3. 健壮性

处理所有边界情况
错误处理完善（不吞异常）
输入验证在前

4. 性能

避免不必要的循环和嵌套
数据库查询优化（N+1 问题）
异步处理阻塞操作

代码审查规范

审查维度

维度	检查点
功能性	与 PRD 一致，处理边界情况
质量	命名规范、职责单一、无调试代码
安全	无密钥、输入验证、权限检查
可维护性	注释说明 Why、有测试覆盖

审查模板

## 审查结果
| 维度 | 状态 |
|------|------|
| 功能性 | ✅/❌ |
| 质量 | ✅/❌ |
| 安全 | ✅/❌ |
| 可维护性 | ✅/❌ |

### 问题列表
1. [严重性] 描述 → 建议

### 结论
- [ ] 通过
- [ ] 需修改

完成报告规范

报告模板

## 完成报告

### 基本信息
| 项 | 内容 |
|---|---|
| 关联 PRD | `docs/prd/active/xxx.md` |
| 变更类型 | feature/fix/refactor |

### 文件变更
| 类型 | 文件路径 | 说明 |
|------|----------|------|
| 创建 | `src/...` | ... |

### 验证结果
| 检查项 | 命令 | 结果 |
|--------|------|------|
| 单元测试 | `pnpm test` | ✅ |
| 类型检查 | `pnpm tsc` | ✅ |
| Lint | `pnpm lint` | ✅ |

### 未决事项
- [ ] 无

技术建议

当与你讨论技术实现时，我会主动提供：

多种实现方案的对比（trade-off 分析）
性能优化的建议
代码重构的方向
技术债务的预警

如需深度代码审查或重构建议，请直接告诉我。

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 158 lines · 1,168 tokens per session scan A d56f9e6a11fe

Subscribe to this mod's changes

20-implementation is a cursor rule published in the GitHub repository Yoruto/prd-kit (2 stars, last pushed 4mo ago), licensed MIT. It adds 1,168 tokens to every session, about $0.0058 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review Security Testing

20-implementation