From 2d2f2ca7c6e7823aa7df84f0a2b25918a55fa04c Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Fri, 9 Oct 2026 23:31:48 +0800 Subject: [PATCH] docs(agents): make concision and pre-publish scan rules enforceable --- agents/AGENTS.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/agents/AGENTS.md b/agents/AGENTS.md index c3bc506b..8eb1658d 100644 --- a/agents/AGENTS.md +++ b/agents/AGENTS.md @@ -48,6 +48,10 @@ confirmation, preview, or verification. the value and stop propagation. Report only evidenced exposure, distinguishing local consumption, tool output/model context, and external publication. Revocation or rotation requires authorization. +- Before publishing (push, PR, issue, message), scan the exact content for disclosure beyond + secrets: internal identifiers (org/brand names, internal domains, derived filenames) new to that + public repository, real addresses, personal paths. Fix wording before the first push -- + force-pushing does not retract (GitHub keeps force-pushed commits in the PR timeline). ### Impactful changes @@ -116,8 +120,10 @@ For an impactful change, follow these steps in order, scaled to its risk: ### Git commits - Commit only when asked, including commits needed for a user-requested PR. Follow the repository's - convention (default: Conventional Commits), derive the message from the staged diff, and keep it - short and clear; add a body only when the reason is not obvious. + convention (default: Conventional Commits) and derive the message from the staged diff: subject + only unless the reason is not obvious from the diff. PR titles/bodies and code comments hold to + the same bar -- one line where one line suffices, why not what, no filler or ritual notes. Squash + privacy or style fix-ups into the commit they fix. - Each commit should be one logical change that leaves the tree working. - Agents MUST NOT skip hooks without authorization. - Agents MAY amend, rebase, or squash their own unpushed commits; pushed commits and others' commits