| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 0 | 17 | 7 | 0% |
| Commands | 0 | 0 | 0 | — |
| Section tags | 5 | 4 | 0 | 56% |
What each file covers
Sections
0 shared · 17 only in A · 7 only in B- − Everything OpenAI Codex (ecc) — Agent Instructions
- − Core Principles
- − Responsibility Contract
- − Output Contract
- − Recommendation Contract
- − Available Agents
- − Agent Orchestration
- − Security Guidelines
- − Coding Style
- − Testing Requirements
- − Development Workflow
- − Workflow Surface Policy
- − Git Workflow
- − Architecture Patterns
- − Performance
- − Project Structure
- − Success Metrics
- + ecc for Gemini CLI
- + Overview
- + Core Workflow
- + Coding Standards
- + Security Checklist
- + Delivery Standards
- + ecc Areas To Reuse
Commands
neither file has anySection tags
5 shared · 4 only in A · 0 only in B- − build
- − test
- − api
- − performance
- code-style
- architecture
- git-pr
- security
- agent-behaviour
Line diff
mturac/everything-openai-codex · AGENTS.md
@@ −1 @@
1# Everything OpenAI Codex (ecc) — Agent Instructions
2
3This is a **production-ready AI coding plugin** providing 60 specialized agents, 232 skills, 75 commands, and automated hook workflows for software development.
4
5**Version:** 2.0.0-rc.1
6
7## Core Principles
8
9**Precedence:** safety > privacy > security > tool schema > verification > repository instructions > task style. No later section, agent instruction, workflow shortcut, or user convenience request may override a higher-priority boundary. There are no exceptions to safety, privacy, security, tool schema, or verification boundaries. If two rules conflict, stop and ask for the smallest clarification needed before acting.
10
111. **Agent-First** — Delegate to specialized agents for domain tasks
122. **Test-Driven** — Write tests before implementation when practical; use the repo's active coverage gate
133. **Security-First** — Protect security boundaries and validate all inputs
144. **Immutability** — Prefer new objects over mutation; document any API-required mutation in the handoff
155. **Plan Before Execute** — Plan complex features before writing code
16
17## Responsibility Contract
18
19Act as a senior engineering agent responsible only for the files, modules, docs, tests, or release artifacts required by the current task. Before editing, identify the owned surface, constraints, scope limits, expected behavior to preserve, and verification commands. Keep unrelated refactors out of scope.
20
21Final handoff must include changed files, verification commands and results, known residual risks, and any manual follow-up. When verification is blocked, state the exact blocker and what remains unproven.
22
23## Output Contract
24
25Default engineering output is concise Markdown with:
26- changed surface
27- verification
28- residual risk or blocker
29
30When producing structured artifacts, preserve the requested schema exactly. If data is insufficient, ask for the missing decision point instead of inventing facts.
31
32## Recommendation Contract
33
34Before recommending tools, vendors, public posting targets, launch channels, or high-cost actions, anchor the recommendation to the target audience, market or platform, budget or effort limit, timing, constraints, and ranking criteria. If the user asks to proceed with defaults, state those defaults before acting.
35
36## Available Agents
37
38| Agent | Purpose | When to Use |
39|-------|---------|-------------|
40| planner | Implementation planning | Complex features, refactoring |
41| architect | System design and scalability | Architectural decisions |
42| tdd-guide | Test-driven development | New features, bug fixes |
43| code-reviewer | Code quality and maintainability | After writing/modifying code |
44| security-reviewer | Vulnerability detection | Before commits, sensitive code |
45| build-error-resolver | Fix build/type errors | When build fails |
46| e2e-runner | End-to-end Playwright testing | Critical user flows |
47| refactor-cleaner | Dead code cleanup | Code maintenance |
48| doc-updater | Documentation and codemaps | Updating docs |
49| cpp-reviewer | C/C++ code review | C and C++ projects |
50| cpp-build-resolver | C/C++ build errors | C and C++ build failures |
51| fsharp-reviewer | F# functional code review | F# projects |
52| docs-lookup | Documentation lookup via Context7 | API/docs questions |
53| go-reviewer | Go code review | Go projects |
54| go-build-resolver | Go build errors | Go build failures |
55| kotlin-reviewer | Kotlin code review | Kotlin/Android/KMP projects |
56| kotlin-build-resolver | Kotlin/Gradle build errors | Kotlin build failures |
57| database-reviewer | PostgreSQL/Supabase specialist | Schema design, query optimization |
58| python-reviewer | Python code review | Python projects |
59| django-reviewer | Django code review | Django apps, DRF APIs, ORM, migrations |
60| django-build-resolver | Django build, migration, and setup errors | Django startup, dependency, migration, collectstatic failures |
61| java-reviewer | Java and Spring Boot code review | Java/Spring Boot projects |
62| java-build-resolver | Java/Maven/Gradle build errors | Java build failures |
63| loop-operator | Autonomous loop execution | Run loops safely, monitor stalls, intervene |
64| harness-optimizer | Harness config tuning | Reliability, cost, throughput |
65| rust-reviewer | Rust code review | Rust projects |
66| rust-build-resolver | Rust build errors | Rust build failures |
67| pytorch-build-resolver | PyTorch runtime/CUDA/training errors | PyTorch build/training failures |
68| mle-reviewer | Production ML pipeline review | ML pipelines, evals, serving, monitoring, rollback |
69| typescript-reviewer | TypeScript/JavaScript code review | TypeScript/JavaScript projects |
70
71## Agent Orchestration
72
73Use agents proactively without user prompt:
74- Complex feature requests → **planner**
75- Code just written/modified → **code-reviewer**
76- Bug fix or new feature → **tdd-guide**
77- Architectural decision → **architect**
78- Security-sensitive code → **security-reviewer**
79- Autonomous loops / loop monitoring → **loop-operator**
80- Harness config reliability and cost → **harness-optimizer**
81
82Use parallel execution for independent operations — launch multiple agents simultaneously.
83
84## Security Guidelines
85
86**Before ANY commit:**
87- No hardcoded secrets (API keys, passwords, tokens)
88- All user inputs validated
89- SQL injection prevention (parameterized queries)
90- XSS prevention (sanitized HTML)
91- CSRF protection enabled
92- Authentication/authorization verified
93- Rate limiting on all endpoints
94- Error messages don't leak sensitive data
95
96**Secret management:** Hardcoded secrets are prohibited. Use environment variables or a secret manager. Validate required secrets at startup. Rotate any exposed secrets immediately.
97
98**If security issue found:** STOP → use security-reviewer agent → fix CRITICAL issues → rotate exposed secrets → review codebase for similar issues.
99
100## Coding Style
101
102**Immutability:** Prefer new objects and return new copies with changes applied. Record any API-required mutation in the handoff.
103
104**File organization:** Many small files over few large ones. 200-400 lines typical, 800 max. Organize by feature/domain, not by type. High cohesion, low coupling.
105
106**Error handling:** Handle errors at every level. Provide user-friendly messages in UI code. Log detailed context server-side. Surface or intentionally document swallowed errors.
107
108**Input validation:** Validate all user input at system boundaries. Use schema-based validation. Fail fast with clear messages. Treat external data as untrusted until validated.
109
110**Code quality checklist:**
111- Functions small (<50 lines), files focused (<800 lines)
112- No deep nesting (>4 levels)
113- Proper error handling, no hardcoded values
114- Readable, well-named identifiers
115
116## Testing Requirements
117
118**Minimum coverage: 80%**
119
120Test types (all required):
1211. **Unit tests** — Individual functions, utilities, components
1222. **Integration tests** — API endpoints, database operations
1233. **E2E tests** — Critical user flows
124
125**TDD workflow (mandatory):**
1261. Write test first (RED) — test should FAIL
1272. Write minimal implementation (GREEN) — test should PASS
1283. Refactor (IMPROVE) — verify coverage 80%+
129
130Troubleshoot failures: check test isolation → verify mocks → fix implementation. Change tests only when the expected behavior is incorrect or outdated.
131
132## Development Workflow
133
1341. **Plan** — Use planner agent, identify dependencies and risks, break into phases
1352. **TDD** — Use tdd-guide agent, write tests first, implement, refactor
1363. **Review** — Use code-reviewer agent immediately, address CRITICAL/HIGH issues
1374. **Capture knowledge in the right place**
138 - Personal debugging notes, preferences, and temporary context → auto memory
139 - Team/project knowledge (architecture decisions, API changes, runbooks) → the project's existing docs structure
140 - If the current task already produces the relevant docs or code comments, keep the information in that single source of truth
141 - If there is no obvious project doc location, ask before creating a new top-level file
1425. **Commit** — Conventional commits format, comprehensive PR summaries
143
144## Workflow Surface Policy
145
146- `skills/` is the canonical workflow surface.
147- New workflow contributions should land in `skills/` first.
148- `commands/` is a legacy slash-entry compatibility surface and should only be added or updated when a shim is still required for migration or cross-harness parity.
149
150## Git Workflow
151
152**Commit format:** `<type>: <description>` — Types: feat, fix, refactor, docs, test, chore, perf, ci
153
154**PR workflow:** Analyze full commit history → draft comprehensive summary → include test plan → push with `-u` flag.
155
156## Architecture Patterns
157
158**API response format:** Consistent envelope with success indicator, data payload, error message, and pagination metadata.
159
160**Repository pattern:** Encapsulate data access behind standard interface (findAll, findById, create, update, delete). Business logic depends on abstract interface, not storage mechanism.
161
162**Skeleton projects:** Search for battle-tested templates, evaluate with parallel agents (security, extensibility, relevance), clone best match, iterate within proven structure.
163
164## Performance
165
166**Context management:** Avoid last 20% of context window for large refactoring and multi-file features. Lower-sensitivity tasks (single edits, docs, simple fixes) tolerate higher utilization.
167
168**Build troubleshooting:** Use build-error-resolver agent → analyze errors → fix incrementally → verify after each fix.
169
170## Project Structure
171
172```
173agents/ — 60 specialized subagents
174skills/ — 232 workflow skills and domain knowledge
175commands/ — 75 slash commands
176hooks/ — Trigger-based automations
177rules/ — Always-follow guidelines (common + per-language)
178scripts/ — Cross-platform Node.js utilities
179mcp-configs/ — 14 MCP server configurations
180tests/ — Test suite
181```
182
183`commands/` remains in the repo for compatibility, but the long-term direction is skills-first.
184
185## Success Metrics
186
187- All tests pass with 80%+ coverage
188- No security vulnerabilities
189- Code is readable and maintainable
190- Performance is acceptable
191- User requirements are met
192
mturac/everything-openai-codex · .gemini/GEMINI.md
@@ +1 @@
1# ecc for Gemini CLI
2
3This file provides Gemini CLI with the baseline ecc workflow, review standards, and security checks for repositories that install the Gemini target.
4
5## Overview
6
7Everything OpenAI Codex (ecc) is a cross-harness coding system with 36 specialized agents, 142 skills, and 68 commands.
8
9Gemini support is currently focused on a strong project-local instruction layer via `.gemini/GEMINI.md`, plus the shared MCP catalog and package-manager setup assets shipped by the installer.
10
11## Core Workflow
12
131. Plan before editing large features.
142. Prefer test-first changes for bug fixes and new functionality.
153. Review for security before shipping.
164. Keep changes self-contained, readable, and easy to revert.
17
18## Coding Standards
19
20- Prefer immutable updates over in-place mutation.
21- Keep functions small and files focused.
22- Validate user input at boundaries.
23- Never hardcode secrets.
24- Fail loudly with clear error messages instead of silently swallowing problems.
25
26## Security Checklist
27
28Before any commit:
29
30- No hardcoded API keys, passwords, or tokens
31- All external input validated
32- Parameterized queries for database writes
33- Sanitized HTML output where applicable
34- Authz/authn checked for sensitive paths
35- Error messages scrubbed of sensitive internals
36
37## Delivery Standards
38
39- Use conventional commits: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf`, `ci`
40- Run targeted verification for touched areas before shipping
41- Prefer contained local implementations over adding new third-party runtime dependencies
42
43## ecc Areas To Reuse
44
45- `AGENTS.md` for repo-wide operating rules
46- `skills/` for deep workflow guidance
47- `commands/` for slash-command patterns worth adapting into prompts/macros
48- `mcp-configs/` for shared connector baselines
49
@@ −1 +1 @@
1−# Everything OpenAI Codex (ecc) — Agent Instructions
1+# ecc for Gemini CLI
22
3−This is a **production-ready AI coding plugin** providing 60 specialized agents, 232 skills, 75 commands, and automated hook workflows for software development.
3+This file provides Gemini CLI with the baseline ecc workflow, review standards, and security checks for repositories that install the Gemini target.
44
5−**Version:** 2.0.0-rc.1
5+## Overview
66
7−## Core Principles
7+Everything OpenAI Codex (ecc) is a cross-harness coding system with 36 specialized agents, 142 skills, and 68 commands.
88
9−**Precedence:** safety > privacy > security > tool schema > verification > repository instructions > task style. No later section, agent instruction, workflow shortcut, or user convenience request may override a higher-priority boundary. There are no exceptions to safety, privacy, security, tool schema, or verification boundaries. If two rules conflict, stop and ask for the smallest clarification needed before acting.
9+Gemini support is currently focused on a strong project-local instruction layer via `.gemini/GEMINI.md`, plus the shared MCP catalog and package-manager setup assets shipped by the installer.
1010
11−1. **Agent-First** — Delegate to specialized agents for domain tasks
12−2. **Test-Driven** — Write tests before implementation when practical; use the repo's active coverage gate
13−3. **Security-First** — Protect security boundaries and validate all inputs
14−4. **Immutability** — Prefer new objects over mutation; document any API-required mutation in the handoff
15−5. **Plan Before Execute** — Plan complex features before writing code
11+## Core Workflow
1612
17−## Responsibility Contract
13+1. Plan before editing large features.
14+2. Prefer test-first changes for bug fixes and new functionality.
15+3. Review for security before shipping.
16+4. Keep changes self-contained, readable, and easy to revert.
1817
19−Act as a senior engineering agent responsible only for the files, modules, docs, tests, or release artifacts required by the current task. Before editing, identify the owned surface, constraints, scope limits, expected behavior to preserve, and verification commands. Keep unrelated refactors out of scope.
18+## Coding Standards
2019
21−Final handoff must include changed files, verification commands and results, known residual risks, and any manual follow-up. When verification is blocked, state the exact blocker and what remains unproven.
20+- Prefer immutable updates over in-place mutation.
21+- Keep functions small and files focused.
22+- Validate user input at boundaries.
23+- Never hardcode secrets.
24+- Fail loudly with clear error messages instead of silently swallowing problems.
2225
23−## Output Contract
26+## Security Checklist
2427
25−Default engineering output is concise Markdown with:
26−- changed surface
27−- verification
28−- residual risk or blocker
28+Before any commit:
2929
30−When producing structured artifacts, preserve the requested schema exactly. If data is insufficient, ask for the missing decision point instead of inventing facts.
30+- No hardcoded API keys, passwords, or tokens
31+- All external input validated
32+- Parameterized queries for database writes
33+- Sanitized HTML output where applicable
34+- Authz/authn checked for sensitive paths
35+- Error messages scrubbed of sensitive internals
3136
32−## Recommendation Contract
37+## Delivery Standards
3338
34−Before recommending tools, vendors, public posting targets, launch channels, or high-cost actions, anchor the recommendation to the target audience, market or platform, budget or effort limit, timing, constraints, and ranking criteria. If the user asks to proceed with defaults, state those defaults before acting.
39+- Use conventional commits: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf`, `ci`
40+- Run targeted verification for touched areas before shipping
41+- Prefer contained local implementations over adding new third-party runtime dependencies
3542
36−## Available Agents
43+## ecc Areas To Reuse
3744
38−| Agent | Purpose | When to Use |
39−|-------|---------|-------------|
40−| planner | Implementation planning | Complex features, refactoring |
41−| architect | System design and scalability | Architectural decisions |
42−| tdd-guide | Test-driven development | New features, bug fixes |
43−| code-reviewer | Code quality and maintainability | After writing/modifying code |
44−| security-reviewer | Vulnerability detection | Before commits, sensitive code |
45−| build-error-resolver | Fix build/type errors | When build fails |
46−| e2e-runner | End-to-end Playwright testing | Critical user flows |
47−| refactor-cleaner | Dead code cleanup | Code maintenance |
48−| doc-updater | Documentation and codemaps | Updating docs |
49−| cpp-reviewer | C/C++ code review | C and C++ projects |
50−| cpp-build-resolver | C/C++ build errors | C and C++ build failures |
51−| fsharp-reviewer | F# functional code review | F# projects |
52−| docs-lookup | Documentation lookup via Context7 | API/docs questions |
53−| go-reviewer | Go code review | Go projects |
54−| go-build-resolver | Go build errors | Go build failures |
55−| kotlin-reviewer | Kotlin code review | Kotlin/Android/KMP projects |
56−| kotlin-build-resolver | Kotlin/Gradle build errors | Kotlin build failures |
57−| database-reviewer | PostgreSQL/Supabase specialist | Schema design, query optimization |
58−| python-reviewer | Python code review | Python projects |
59−| django-reviewer | Django code review | Django apps, DRF APIs, ORM, migrations |
60−| django-build-resolver | Django build, migration, and setup errors | Django startup, dependency, migration, collectstatic failures |
61−| java-reviewer | Java and Spring Boot code review | Java/Spring Boot projects |
62−| java-build-resolver | Java/Maven/Gradle build errors | Java build failures |
63−| loop-operator | Autonomous loop execution | Run loops safely, monitor stalls, intervene |
64−| harness-optimizer | Harness config tuning | Reliability, cost, throughput |
65−| rust-reviewer | Rust code review | Rust projects |
66−| rust-build-resolver | Rust build errors | Rust build failures |
67−| pytorch-build-resolver | PyTorch runtime/CUDA/training errors | PyTorch build/training failures |
68−| mle-reviewer | Production ML pipeline review | ML pipelines, evals, serving, monitoring, rollback |
69−| typescript-reviewer | TypeScript/JavaScript code review | TypeScript/JavaScript projects |
70−
71−## Agent Orchestration
72−
73−Use agents proactively without user prompt:
74−- Complex feature requests → **planner**
75−- Code just written/modified → **code-reviewer**
76−- Bug fix or new feature → **tdd-guide**
77−- Architectural decision → **architect**
78−- Security-sensitive code → **security-reviewer**
79−- Autonomous loops / loop monitoring → **loop-operator**
80−- Harness config reliability and cost → **harness-optimizer**
81−
82−Use parallel execution for independent operations — launch multiple agents simultaneously.
83−
84−## Security Guidelines
85−
86−**Before ANY commit:**
87−- No hardcoded secrets (API keys, passwords, tokens)
88−- All user inputs validated
89−- SQL injection prevention (parameterized queries)
90−- XSS prevention (sanitized HTML)
91−- CSRF protection enabled
92−- Authentication/authorization verified
93−- Rate limiting on all endpoints
94−- Error messages don't leak sensitive data
95−
96−**Secret management:** Hardcoded secrets are prohibited. Use environment variables or a secret manager. Validate required secrets at startup. Rotate any exposed secrets immediately.
97−
98−**If security issue found:** STOP → use security-reviewer agent → fix CRITICAL issues → rotate exposed secrets → review codebase for similar issues.
99−
100−## Coding Style
101−
102−**Immutability:** Prefer new objects and return new copies with changes applied. Record any API-required mutation in the handoff.
103−
104−**File organization:** Many small files over few large ones. 200-400 lines typical, 800 max. Organize by feature/domain, not by type. High cohesion, low coupling.
105−
106−**Error handling:** Handle errors at every level. Provide user-friendly messages in UI code. Log detailed context server-side. Surface or intentionally document swallowed errors.
107−
108−**Input validation:** Validate all user input at system boundaries. Use schema-based validation. Fail fast with clear messages. Treat external data as untrusted until validated.
109−
110−**Code quality checklist:**
111−- Functions small (<50 lines), files focused (<800 lines)
112−- No deep nesting (>4 levels)
113−- Proper error handling, no hardcoded values
114−- Readable, well-named identifiers
115−
116−## Testing Requirements
117−
118−**Minimum coverage: 80%**
119−
120−Test types (all required):
121−1. **Unit tests** — Individual functions, utilities, components
122−2. **Integration tests** — API endpoints, database operations
123−3. **E2E tests** — Critical user flows
124−
125−**TDD workflow (mandatory):**
126−1. Write test first (RED) — test should FAIL
127−2. Write minimal implementation (GREEN) — test should PASS
128−3. Refactor (IMPROVE) — verify coverage 80%+
129−
130−Troubleshoot failures: check test isolation → verify mocks → fix implementation. Change tests only when the expected behavior is incorrect or outdated.
131−
132−## Development Workflow
133−
134−1. **Plan** — Use planner agent, identify dependencies and risks, break into phases
135−2. **TDD** — Use tdd-guide agent, write tests first, implement, refactor
136−3. **Review** — Use code-reviewer agent immediately, address CRITICAL/HIGH issues
137−4. **Capture knowledge in the right place**
138− - Personal debugging notes, preferences, and temporary context → auto memory
139− - Team/project knowledge (architecture decisions, API changes, runbooks) → the project's existing docs structure
140− - If the current task already produces the relevant docs or code comments, keep the information in that single source of truth
141− - If there is no obvious project doc location, ask before creating a new top-level file
142−5. **Commit** — Conventional commits format, comprehensive PR summaries
143−
144−## Workflow Surface Policy
145−
146−- `skills/` is the canonical workflow surface.
147−- New workflow contributions should land in `skills/` first.
148−- `commands/` is a legacy slash-entry compatibility surface and should only be added or updated when a shim is still required for migration or cross-harness parity.
149−
150−## Git Workflow
151−
152−**Commit format:** `<type>: <description>` — Types: feat, fix, refactor, docs, test, chore, perf, ci
153−
154−**PR workflow:** Analyze full commit history → draft comprehensive summary → include test plan → push with `-u` flag.
155−
156−## Architecture Patterns
157−
158−**API response format:** Consistent envelope with success indicator, data payload, error message, and pagination metadata.
159−
160−**Repository pattern:** Encapsulate data access behind standard interface (findAll, findById, create, update, delete). Business logic depends on abstract interface, not storage mechanism.
161−
162−**Skeleton projects:** Search for battle-tested templates, evaluate with parallel agents (security, extensibility, relevance), clone best match, iterate within proven structure.
163−
164−## Performance
165−
166−**Context management:** Avoid last 20% of context window for large refactoring and multi-file features. Lower-sensitivity tasks (single edits, docs, simple fixes) tolerate higher utilization.
167−
168−**Build troubleshooting:** Use build-error-resolver agent → analyze errors → fix incrementally → verify after each fix.
169−
170−## Project Structure
171−
172−```
173−agents/ — 60 specialized subagents
174−skills/ — 232 workflow skills and domain knowledge
175−commands/ — 75 slash commands
176−hooks/ — Trigger-based automations
177−rules/ — Always-follow guidelines (common + per-language)
178−scripts/ — Cross-platform Node.js utilities
179−mcp-configs/ — 14 MCP server configurations
180−tests/ — Test suite
181−```
182−
183−`commands/` remains in the repo for compatibility, but the long-term direction is skills-first.
184−
185−## Success Metrics
186−
187−- All tests pass with 80%+ coverage
188−- No security vulnerabilities
189−- Code is readable and maintainable
190−- Performance is acceptable
191−- User requirements are met
45+- `AGENTS.md` for repo-wide operating rules
46+- `skills/` for deep workflow guidance
47+- `commands/` for slash-command patterns worth adapting into prompts/macros
48+- `mcp-configs/` for shared connector baselines
19249
